7dcba99f083b62841fb1b73e3697bc096e32cc19a6d2a9be2bd92960a630e5da

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_7dcba99f083b62841fb1b73e3697bc096e32cc19a6d2a9be2bd92960a630e5da.exe
Size 122KB
Sample260924-2la5haytct
SHA256 7dcba99f083b62841fb1b73e3697bc096e32cc19a6d2a9be2bd92960a630e5da
MD5 7761a05e2b3a5e6e6145a50c83ba91a4
SHA1 90808e6c2ad67c1f98b4ee74eb2484b1ec6020f5
SHA512 6d53e646bed3893e8d698a2ebff9243f64888be91399433826b16fa9e8a172cf452332ea6faa936135b84d0d7a5901abd66d52a13c16eb0822cfddde9123a9fc
SSDEEP 3072:3mqOW8BHQKxPysFPVr59HqTM8Fg0GkcNanc/FSs:2qDaRxZFPt5V2M8FgnNanc/F
TLSH
T168C3D01E76E0C531E48480F00B7D4F73EB7E652C0652436B5B98A469AFB4253FA0A37B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1516	uorzniyiq.exe
5712	MsSvc32.exe
760	MsSvc32.exe
6120	MsSvc32.exe
1820	MsSvc32.exe
4168	MsSvc32.exe
1396	MsSvc32.exe
1108	MsSvc32.exe
4024	MsSvc32.exe
936	MsSvc32.exe
3364	MsSvc32.exe
3500	MsSvc32.exe
5636	MsSvc32.exe
2672	MsSvc32.exe
1940	MsSvc32.exe
3300	MsSvc32.exe
1448	MsSvc32.exe
5468	MsSvc32.exe
3888	MsSvc32.exe
1652	MsSvc32.exe
5652	MsSvc32.exe
3016	MsSvc32.exe
5916	MsSvc32.exe
5052	MsSvc32.exe
2720	MsSvc32.exe
708	MsSvc32.exe
5912	MsSvc32.exe
3140	MsSvc32.exe
1996	MsSvc32.exe
5788	MsSvc32.exe
2876	MsSvc32.exe
1816	MsSvc32.exe
6084	MsSvc32.exe
5088	MsSvc32.exe
1092	MsSvc32.exe
5596	MsSvc32.exe
2576	MsSvc32.exe
5800	MsSvc32.exe
3580	MsSvc32.exe
4596	MsSvc32.exe
3396	MsSvc32.exe
4424	MsSvc32.exe
5564	MsSvc32.exe
4960	MsSvc32.exe
6044	MsSvc32.exe
2040	MsSvc32.exe
2396	MsSvc32.exe
1792	MsSvc32.exe
5176	MsSvc32.exe
4344	MsSvc32.exe
4724	MsSvc32.exe
2192	MsSvc32.exe
2324	MsSvc32.exe
5500	MsSvc32.exe
4048	MsSvc32.exe
4572	MsSvc32.exe
4964	MsSvc32.exe
5944	MsSvc32.exe
2072	MsSvc32.exe
4032	MsSvc32.exe
5820	MsSvc32.exe
5284	MsSvc32.exe
2052	MsSvc32.exe
4056	MsSvc32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uorzniyiq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_7dcba99f083b62841fb1b73e3697bc096e32cc19a6d2a9be2bd92960a630e5da.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1516	uorzniyiq.exe
1516	uorzniyiq.exe
5712	MsSvc32.exe
5712	MsSvc32.exe
760	MsSvc32.exe
760	MsSvc32.exe
6120	MsSvc32.exe
6120	MsSvc32.exe
1820	MsSvc32.exe
1820	MsSvc32.exe
4168	MsSvc32.exe
4168	MsSvc32.exe
1396	MsSvc32.exe
1396	MsSvc32.exe
1108	MsSvc32.exe
1108	MsSvc32.exe
4024	MsSvc32.exe
4024	MsSvc32.exe
936	MsSvc32.exe
936	MsSvc32.exe
3364	MsSvc32.exe
3364	MsSvc32.exe
3500	MsSvc32.exe
3500	MsSvc32.exe
5636	MsSvc32.exe
5636	MsSvc32.exe
2672	MsSvc32.exe
2672	MsSvc32.exe
1940	MsSvc32.exe
1940	MsSvc32.exe
3300	MsSvc32.exe
3300	MsSvc32.exe
1448	MsSvc32.exe
1448	MsSvc32.exe
5468	MsSvc32.exe
5468	MsSvc32.exe
3888	MsSvc32.exe
3888	MsSvc32.exe
1652	MsSvc32.exe
1652	MsSvc32.exe
5652	MsSvc32.exe
5652	MsSvc32.exe
3016	MsSvc32.exe
3016	MsSvc32.exe
5916	MsSvc32.exe
5916	MsSvc32.exe
5052	MsSvc32.exe
5052	MsSvc32.exe
2720	MsSvc32.exe
2720	MsSvc32.exe
708	MsSvc32.exe
708	MsSvc32.exe
5912	MsSvc32.exe
5912	MsSvc32.exe
3140	MsSvc32.exe
3140	MsSvc32.exe
1996	MsSvc32.exe
1996	MsSvc32.exe
5788	MsSvc32.exe
5788	MsSvc32.exe
2876	MsSvc32.exe
2876	MsSvc32.exe
1816	MsSvc32.exe
1816	MsSvc32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5244 wrote to memory of 1516	5244	jaffacakes118_7dcba99f083b62841fb1b73e3697bc096e32cc19a6d2a9be2bd92960a630e5da.exe	89
PID 1516 wrote to memory of 5712	1516	uorzniyiq.exe	90
PID 5712 wrote to memory of 760	5712	MsSvc32.exe	91
PID 760 wrote to memory of 6120	760	MsSvc32.exe	92
PID 6120 wrote to memory of 1820	6120	MsSvc32.exe	93
PID 1820 wrote to memory of 4168	1820	MsSvc32.exe	94
PID 4168 wrote to memory of 1396	4168	MsSvc32.exe	95
PID 1396 wrote to memory of 1108	1396	MsSvc32.exe	96
PID 1108 wrote to memory of 4024	1108	MsSvc32.exe	97
PID 4024 wrote to memory of 936	4024	MsSvc32.exe	98
PID 936 wrote to memory of 3364	936	MsSvc32.exe	99
PID 3364 wrote to memory of 3500	3364	MsSvc32.exe	100
PID 3500 wrote to memory of 5636	3500	MsSvc32.exe	101
PID 5636 wrote to memory of 2672	5636	MsSvc32.exe	102
PID 2672 wrote to memory of 1940	2672	MsSvc32.exe	103
PID 1940 wrote to memory of 3300	1940	MsSvc32.exe	104
PID 3300 wrote to memory of 1448	3300	MsSvc32.exe	105
PID 1448 wrote to memory of 5468	1448	MsSvc32.exe	106
PID 5468 wrote to memory of 3888	5468	MsSvc32.exe	107
PID 3888 wrote to memory of 1652	3888	MsSvc32.exe	108
PID 1652 wrote to memory of 5652	1652	MsSvc32.exe	109
PID 5652 wrote to memory of 3016	5652	MsSvc32.exe	110
PID 3016 wrote to memory of 5916	3016	MsSvc32.exe	111
PID 5916 wrote to memory of 5052	5916	MsSvc32.exe	112
PID 5052 wrote to memory of 2720	5052	MsSvc32.exe	113
PID 2720 wrote to memory of 708	2720	MsSvc32.exe	114
PID 708 wrote to memory of 5912	708	MsSvc32.exe	115
PID 5912 wrote to memory of 3140	5912	MsSvc32.exe	117
PID 3140 wrote to memory of 1996	3140	MsSvc32.exe	118
PID 1996 wrote to memory of 5788	1996	MsSvc32.exe	119
PID 5788 wrote to memory of 2876	5788	MsSvc32.exe	120
PID 2876 wrote to memory of 1816	2876	MsSvc32.exe	121
PID 1816 wrote to memory of 6084	1816	MsSvc32.exe	122
PID 6084 wrote to memory of 5088	6084	MsSvc32.exe	123
PID 5088 wrote to memory of 1092	5088	MsSvc32.exe	124
PID 1092 wrote to memory of 5596	1092	MsSvc32.exe	125
PID 5596 wrote to memory of 2576	5596	MsSvc32.exe	126
PID 2576 wrote to memory of 5800	2576	MsSvc32.exe	127
PID 5800 wrote to memory of 3580	5800	MsSvc32.exe	128
PID 3580 wrote to memory of 4596	3580	MsSvc32.exe	129
PID 4596 wrote to memory of 3396	4596	MsSvc32.exe	130
PID 3396 wrote to memory of 4424	3396	MsSvc32.exe	131
PID 4424 wrote to memory of 5564	4424	MsSvc32.exe	132
PID 5564 wrote to memory of 4960	5564	MsSvc32.exe	133
PID 4960 wrote to memory of 6044	4960	MsSvc32.exe	134
PID 6044 wrote to memory of 2040	6044	MsSvc32.exe	135
PID 2040 wrote to memory of 2396	2040	MsSvc32.exe	136
PID 2396 wrote to memory of 1792	2396	MsSvc32.exe	137
PID 1792 wrote to memory of 5176	1792	MsSvc32.exe	138
PID 5176 wrote to memory of 4344	5176	MsSvc32.exe	139
PID 4344 wrote to memory of 4724	4344	MsSvc32.exe	140
PID 4724 wrote to memory of 2192	4724	MsSvc32.exe	141
PID 2192 wrote to memory of 2324	2192	MsSvc32.exe	142
PID 2324 wrote to memory of 5500	2324	MsSvc32.exe	143
PID 5500 wrote to memory of 4048	5500	MsSvc32.exe	144
PID 4048 wrote to memory of 4572	4048	MsSvc32.exe	145
PID 4572 wrote to memory of 4964	4572	MsSvc32.exe	146
PID 4964 wrote to memory of 5944	4964	MsSvc32.exe	147
PID 5944 wrote to memory of 2072	5944	MsSvc32.exe	148
PID 2072 wrote to memory of 4032	2072	MsSvc32.exe	149
PID 4032 wrote to memory of 5820	4032	MsSvc32.exe	150
PID 5820 wrote to memory of 5284	5820	MsSvc32.exe	151
PID 5284 wrote to memory of 2052	5284	MsSvc32.exe	152
PID 2052 wrote to memory of 4056	2052	MsSvc32.exe	153

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7dcba99f083b62841fb1b73e3697bc096e32cc19a6d2a9be2bd92960a630e5da.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7dcba99f083b62841fb1b73e3697bc096e32cc19a6d2a9be2bd92960a630e5da.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5244
- C:\Users\Admin\AppData\Local\Temp\uorzniyiq.exe
  "C:\Users\Admin\AppData\Local\Temp\uorzniyiq.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
    C:\Windows\system32\WinSvc32\MsSvc32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5712
  - - C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
      C:\Windows\system32\WinSvc32\MsSvc32.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:760
    - - C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:6120
      - C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1820
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4168
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5636
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5468
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5652
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5916
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:708
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        28⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5912
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5788
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6084
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5596
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5800
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3580
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3396
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5564
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6044
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5176
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4344
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5500
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4048
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5944
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4032
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5820
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5284
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4056
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        66⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        67⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:4984
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        70⤵
        Drops file in System32 directory
        
        PID:2708
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        71⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        72⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        73⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        74⤵
        Drops file in System32 directory
        
        PID:4232
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        75⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:1308
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        77⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1532
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        78⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        79⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        80⤵
        Drops file in System32 directory
        
        PID:4748
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        82⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        83⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        84⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:4524
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        86⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        87⤵
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        88⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        89⤵
        Drops file in System32 directory
        
        PID:1392
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        91⤵
        
        PID:880
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:5444
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        95⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        96⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        97⤵
        Drops file in System32 directory
        
        PID:2792
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:1344
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        100⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        101⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3040
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:920
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5992
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        104⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        105⤵
        Drops file in System32 directory
        
        PID:5812
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:6048
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:5408
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        108⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        109⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:4600
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        112⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5984
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:1764
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        114⤵
        Drops file in System32 directory
        
        PID:3392
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        115⤵
        Drops file in System32 directory
        
        PID:5920
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        116⤵
        Drops file in System32 directory
        
        PID:4212
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        117⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        118⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4860
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        119⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3820
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        120⤵
        Drops file in System32 directory
        
        PID:4716
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        121⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1664
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        122⤵
        Drops file in System32 directory
        
        PID:488
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:1972
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        124⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        125⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        128⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5840
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        129⤵
        Drops file in System32 directory
        
        PID:1204
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:2600
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        132⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        133⤵
        
        PID:984
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        134⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        135⤵
        
        PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uorzniyiq.exe

Path C:\Users\Admin\AppData\Local\Temp\uorzniyiq.exe
Size 74KB
SHA256 cfca891ba7752f123f580adf886629ae42bac40fd9f4c26a0dc6d1e019b7fcf3
MD5 064ec0e02aff819c09e1ac120b3fb1ab
SHA1 e9d814871d1e174fd4a19fcd238fd0e4444c6a37
SHA512 72d360ad501724e2275fe758dfb0108cd5e58fea32f76f4252c1d5417aa32f4244e81c1a82d3c6fe207b41017f293dc3345a17aad2a08e8496e7859f420b960e
SSDEEP 1536:s3iBemo5PK+dTGq5X0u8iQHp1b48weg0GwMzQrzoN7xcncFlFSH:bsFPVr59HqTM8Fg0GkcNanc/FSH
TLSH
T1B873018D03A10A94D8D8817603AA8FD5D7AAB43D5D4A0B2B5D14406E7B3C347BB86F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/708-84-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/760-18-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/880-238-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/920-260-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/936-37-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1092-110-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1108-31-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1116-271-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1204-309-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1308-211-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1344-254-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1392-234-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1396-28-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1448-58-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1516-12-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1516-8-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1532-212-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1652-67-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1684-236-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1692-210-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1716-223-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1764-279-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1792-148-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1816-101-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1820-23-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1940-52-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1996-92-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2040-142-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2052-189-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2072-178-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2192-158-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2276-269-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2300-192-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2324-161-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2392-242-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2396-145-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2512-216-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2544-263-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2576-115-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2672-49-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2708-200-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2720-81-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2792-250-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2876-98-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2972-202-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3016-72-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3028-194-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3040-258-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3128-232-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3140-90-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3300-55-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3364-40-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3396-127-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3500-43-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3512-286-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3580-121-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3888-64-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4024-34-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4032-181-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4048-167-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4056-191-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4112-244-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4124-198-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4168-25-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4232-208-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4344-153-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4376-214-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4384-225-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4424-130-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4476-230-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4524-227-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4572-170-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4596-124-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4600-273-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4616-220-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4724-156-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4748-218-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4836-204-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4960-136-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4964-172-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4984-196-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5052-78-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5088-107-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5132-248-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5176-150-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5224-256-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5244-29-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5284-187-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5384-206-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5408-267-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5444-240-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5468-61-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5476-252-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5500-164-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5564-133-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5596-112-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5636-46-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5652-69-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5672-228-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5712-15-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5788-95-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5800-118-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5812-264-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5820-184-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5912-87-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5916-75-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5932-246-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5944-175-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5984-277-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5992-261-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/6044-139-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/6048-266-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/6072-221-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/6084-104-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/6088-275-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/6120-21-0x0000000000400000-0x0000000000447000-memory.dmp

Download