aa3fe9f7858be55f5d87bf8cf90915872fa05cb054dfa20d6649864c00afd8c6

Analysis

max time kernel
143s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_aa3fe9f7858be55f5d87bf8cf90915872fa05cb054dfa20d6649864c00afd8c6.exe
Size 20KB
Sample261002-jt6l9sys7m
SHA256 aa3fe9f7858be55f5d87bf8cf90915872fa05cb054dfa20d6649864c00afd8c6
MD5 2c8544f6b2be0bd41cd713fdcbb72dc7
SHA1 ecfb0f6bb5d3d07e73b48b958a2ee552f922b6c3
SHA512 8d11455d3e45c703ef09574d78d069ce91264b7f1decc915040a7d52db52e6dedef7d4a8862fe4b863d8fe7a2b95aaaaeeefa9c1fbe775dbbad10f6bb5adc2ba
SSDEEP 192:KMKQxeqwSm1D5G2fghn8zq9njhcKaKusqDg9deL:KMFezSm1lFghUPKkk9d
TLSH
T1F492C78F6E48D57FC7404176096C84EDEFB67A3667D26E42D740C61E78A44CBD86830B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
992	ccPrxy.exe
4468	ccPrxy.exe
6036	ccPrxy.exe
1364	ccPrxy.exe
3388	ccPrxy.exe
620	ccPrxy.exe
4136	ccPrxy.exe
2976	ccPrxy.exe
2684	ccPrxy.exe
3000	ccPrxy.exe
5596	ccPrxy.exe
5868	ccPrxy.exe
5368	ccPrxy.exe
2616	ccPrxy.exe
908	ccPrxy.exe
6088	ccPrxy.exe
4244	ccPrxy.exe
5348	ccPrxy.exe
4364	ccPrxy.exe
4700	ccPrxy.exe
1628	ccPrxy.exe
2880	ccPrxy.exe
4592	ccPrxy.exe
2808	ccPrxy.exe
1684	ccPrxy.exe
5072	ccPrxy.exe
2584	ccPrxy.exe
808	ccPrxy.exe
5012	ccPrxy.exe
3760	ccPrxy.exe
1556	ccPrxy.exe
1408	ccPrxy.exe
1468	ccPrxy.exe
2700	ccPrxy.exe
5128	ccPrxy.exe
4560	ccPrxy.exe
5524	ccPrxy.exe
1608	ccPrxy.exe
1204	ccPrxy.exe
2588	ccPrxy.exe
2080	ccPrxy.exe
3744	ccPrxy.exe
4056	ccPrxy.exe
596	ccPrxy.exe
4300	ccPrxy.exe
832	ccPrxy.exe
2744	ccPrxy.exe
4204	ccPrxy.exe
5548	ccPrxy.exe
1544	ccPrxy.exe
1776	ccPrxy.exe
3288	ccPrxy.exe
3264	ccPrxy.exe
784	ccPrxy.exe
5200	ccPrxy.exe
5100	ccPrxy.exe
5492	ccPrxy.exe
5912	ccPrxy.exe
5212	ccPrxy.exe
6008	ccPrxy.exe
1524	ccPrxy.exe
4728	ccPrxy.exe
4080	ccPrxy.exe
3832	ccPrxy.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	jaffacakes118_aa3fe9f7858be55f5d87bf8cf90915872fa05cb054dfa20d6649864c00afd8c6.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe
\??\F:\	ccPrxy.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File created	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe
File opened for modification	C:\Windows\SysWOW64\ccPrxy.exe	ccPrxy.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccPrxy.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 992	1948	jaffacakes118_aa3fe9f7858be55f5d87bf8cf90915872fa05cb054dfa20d6649864c00afd8c6.exe	90
PID 992 wrote to memory of 4468	992	ccPrxy.exe	91
PID 4468 wrote to memory of 6036	4468	ccPrxy.exe	92
PID 6036 wrote to memory of 1364	6036	ccPrxy.exe	93
PID 1364 wrote to memory of 3388	1364	ccPrxy.exe	94
PID 3388 wrote to memory of 620	3388	ccPrxy.exe	95
PID 620 wrote to memory of 4136	620	ccPrxy.exe	96
PID 4136 wrote to memory of 2976	4136	ccPrxy.exe	97
PID 2976 wrote to memory of 2684	2976	ccPrxy.exe	98
PID 2684 wrote to memory of 3000	2684	ccPrxy.exe	99
PID 3000 wrote to memory of 5596	3000	ccPrxy.exe	100
PID 5596 wrote to memory of 5868	5596	ccPrxy.exe	101
PID 5868 wrote to memory of 5368	5868	ccPrxy.exe	102
PID 5368 wrote to memory of 2616	5368	ccPrxy.exe	103
PID 2616 wrote to memory of 908	2616	ccPrxy.exe	104
PID 908 wrote to memory of 6088	908	ccPrxy.exe	105
PID 6088 wrote to memory of 4244	6088	ccPrxy.exe	106
PID 4244 wrote to memory of 5348	4244	ccPrxy.exe	107
PID 5348 wrote to memory of 4364	5348	ccPrxy.exe	108
PID 4364 wrote to memory of 4700	4364	ccPrxy.exe	109
PID 4700 wrote to memory of 1628	4700	ccPrxy.exe	110
PID 1628 wrote to memory of 2880	1628	ccPrxy.exe	111
PID 2880 wrote to memory of 4592	2880	ccPrxy.exe	112
PID 4592 wrote to memory of 2808	4592	ccPrxy.exe	113
PID 2808 wrote to memory of 1684	2808	ccPrxy.exe	114
PID 1684 wrote to memory of 5072	1684	ccPrxy.exe	116
PID 5072 wrote to memory of 2584	5072	ccPrxy.exe	117
PID 2584 wrote to memory of 808	2584	ccPrxy.exe	118
PID 808 wrote to memory of 5012	808	ccPrxy.exe	119
PID 5012 wrote to memory of 3760	5012	ccPrxy.exe	120
PID 3760 wrote to memory of 1556	3760	ccPrxy.exe	121
PID 1556 wrote to memory of 1408	1556	ccPrxy.exe	122
PID 1408 wrote to memory of 1468	1408	ccPrxy.exe	123
PID 1468 wrote to memory of 2700	1468	ccPrxy.exe	124
PID 2700 wrote to memory of 5128	2700	ccPrxy.exe	125
PID 5128 wrote to memory of 4560	5128	ccPrxy.exe	126
PID 4560 wrote to memory of 5524	4560	ccPrxy.exe	127
PID 5524 wrote to memory of 1608	5524	ccPrxy.exe	128
PID 1608 wrote to memory of 1204	1608	ccPrxy.exe	129
PID 1204 wrote to memory of 2588	1204	ccPrxy.exe	130
PID 2588 wrote to memory of 2080	2588	ccPrxy.exe	131
PID 2080 wrote to memory of 3744	2080	ccPrxy.exe	132
PID 3744 wrote to memory of 4056	3744	ccPrxy.exe	133
PID 4056 wrote to memory of 596	4056	ccPrxy.exe	134
PID 596 wrote to memory of 4300	596	ccPrxy.exe	135
PID 4300 wrote to memory of 832	4300	ccPrxy.exe	136
PID 832 wrote to memory of 2744	832	ccPrxy.exe	137
PID 2744 wrote to memory of 4204	2744	ccPrxy.exe	138
PID 4204 wrote to memory of 5548	4204	ccPrxy.exe	139
PID 5548 wrote to memory of 1544	5548	ccPrxy.exe	140
PID 1544 wrote to memory of 1776	1544	ccPrxy.exe	141
PID 1776 wrote to memory of 3288	1776	ccPrxy.exe	142
PID 3288 wrote to memory of 3264	3288	ccPrxy.exe	143
PID 3264 wrote to memory of 784	3264	ccPrxy.exe	144
PID 784 wrote to memory of 5200	784	ccPrxy.exe	145
PID 5200 wrote to memory of 5100	5200	ccPrxy.exe	146
PID 5100 wrote to memory of 5492	5100	ccPrxy.exe	147
PID 5492 wrote to memory of 5912	5492	ccPrxy.exe	148
PID 5912 wrote to memory of 5212	5912	ccPrxy.exe	149
PID 5212 wrote to memory of 6008	5212	ccPrxy.exe	150
PID 6008 wrote to memory of 1524	6008	ccPrxy.exe	151
PID 1524 wrote to memory of 4728	1524	ccPrxy.exe	152
PID 4728 wrote to memory of 4080	4728	ccPrxy.exe	153
PID 4080 wrote to memory of 3832	4080	ccPrxy.exe	154

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_aa3fe9f7858be55f5d87bf8cf90915872fa05cb054dfa20d6649864c00afd8c6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_aa3fe9f7858be55f5d87bf8cf90915872fa05cb054dfa20d6649864c00afd8c6.exe"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\ccPrxy.exe
  C:\Windows\system32\ccPrxy.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\SysWOW64\ccPrxy.exe
    C:\Windows\system32\ccPrxy.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\SysWOW64\ccPrxy.exe
      C:\Windows\system32\ccPrxy.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:6036
    - - C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1364
      - C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:620
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        11⤵
        Executes dropped EXE
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5596
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5868
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5368
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:908
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6088
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5348
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        27⤵
        Executes dropped EXE
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:808
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3760
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        36⤵
        Executes dropped EXE
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:5128
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        37⤵
        Executes dropped EXE
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        38⤵
        Executes dropped EXE
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:5524
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        39⤵
        Executes dropped EXE
        Enumerates connected drives
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2588
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        42⤵
        Executes dropped EXE
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        44⤵
        Executes dropped EXE
        Enumerates connected drives
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:596
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:832
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        49⤵
        Executes dropped EXE
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        50⤵
        Executes dropped EXE
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5548
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        52⤵
        Executes dropped EXE
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        53⤵
        Executes dropped EXE
        Enumerates connected drives
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:784
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5200
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5492
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        59⤵
        Executes dropped EXE
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:5912
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5212
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6008
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        62⤵
        Executes dropped EXE
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        63⤵
        Executes dropped EXE
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4080
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3832
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        66⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        67⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        68⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        69⤵
        Enumerates connected drives
        
        PID:2296
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        70⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        72⤵
        Drops file in System32 directory
        
        PID:3828
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        74⤵
        Enumerates connected drives
        
        PID:2092
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        75⤵
        Enumerates connected drives
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        76⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        
        PID:3424
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:1236
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        78⤵
        Enumerates connected drives
        Drops file in System32 directory
        
        PID:3244
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        79⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        80⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        81⤵
        Enumerates connected drives
        Drops file in System32 directory
        
        PID:5692
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        82⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        83⤵
        Enumerates connected drives
        
        PID:3272
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        84⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        85⤵
        Enumerates connected drives
        
        PID:5104
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        86⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        87⤵
        Enumerates connected drives
        
        PID:3336
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        88⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:5600
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        90⤵
        Enumerates connected drives
        
        PID:4200
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        91⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        92⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        93⤵
        Enumerates connected drives
        
        PID:2172
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        94⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:4260
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        96⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        97⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        98⤵
        Enumerates connected drives
        Drops file in System32 directory
        
        PID:5736
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        99⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        
        PID:2952
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        100⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        101⤵
        Drops file in System32 directory
        
        PID:1220
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        102⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        103⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        104⤵
        Drops file in System32 directory
        
        PID:4576
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        105⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        106⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        107⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        108⤵
        Enumerates connected drives
        
        PID:4944
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        110⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        111⤵
        Drops file in System32 directory
        
        PID:5332
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        112⤵
        Enumerates connected drives
        
        PID:4448
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        114⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:460
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        115⤵
        
        PID:200
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        116⤵
        Enumerates connected drives
        
        PID:952
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        117⤵
        Enumerates connected drives
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5800
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        118⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        119⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:1336
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        121⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        123⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        124⤵
        Enumerates connected drives
        
        PID:3496
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        125⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        126⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        127⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        128⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        129⤵
        Enumerates connected drives
        
        PID:3736
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        130⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        131⤵
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        132⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        
        PID:3012
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        133⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        135⤵
        Enumerates connected drives
        
        PID:1768
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        136⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        
        PID:4664
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        137⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        
        PID:4328
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        138⤵
        Enumerates connected drives
        
        PID:2624
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        139⤵
        Drops file in System32 directory
        
        PID:1736
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        140⤵
        Drops file in System32 directory
        
        PID:2000
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:3384
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        142⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        143⤵
        Drops file in System32 directory
        
        PID:480
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        144⤵
        
        PID:240
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        145⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        146⤵
        Enumerates connected drives
        Drops file in System32 directory
        
        PID:5228
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        147⤵
        
        PID:980
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        148⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5792
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        149⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:1296
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        151⤵
        Enumerates connected drives
        
        PID:1764
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        152⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        153⤵
        
        PID:864
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        154⤵
        Enumerates connected drives
        
        PID:3180
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        155⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        157⤵
        Enumerates connected drives
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:3884
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        159⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        160⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        161⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:2264
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        163⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        164⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        165⤵
        Enumerates connected drives
        
        PID:2772
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        166⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        167⤵
        Enumerates connected drives
        
        PID:4784
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        168⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        169⤵
        Enumerates connected drives
        
        PID:2704
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        170⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        171⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        172⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        173⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:1460
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        176⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        177⤵
        Drops file in System32 directory
        
        PID:4708
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:1412
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        179⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        180⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        181⤵
        Drops file in System32 directory
        
        PID:2176
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        182⤵
        Enumerates connected drives
        
        PID:4616
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        183⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        184⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        185⤵
        Enumerates connected drives
        
        PID:4164
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        186⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        187⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        188⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        189⤵
        Drops file in System32 directory
        
        PID:2844
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        190⤵
        Drops file in System32 directory
        
        PID:4856
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        191⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:5192
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        193⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        194⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        195⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        196⤵
        Drops file in System32 directory
        
        PID:4332
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        197⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:2604
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        199⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        200⤵
        Enumerates connected drives
        Drops file in System32 directory
        
        PID:3772
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        201⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        202⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        203⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        204⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        205⤵
        Enumerates connected drives
        
        PID:4752
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        206⤵
        Enumerates connected drives
        
        PID:1132
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        207⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        208⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        209⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        210⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        211⤵
        Enumerates connected drives
        
        PID:3048
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        212⤵
        Drops file in System32 directory
        
        PID:2560
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        213⤵
        Enumerates connected drives
        
        PID:4276
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        214⤵
        Enumerates connected drives
        
        PID:4528
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        217⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        218⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        219⤵
        Drops file in System32 directory
        
        PID:4500
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        220⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        221⤵
        Drops file in System32 directory
        
        PID:4976
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        222⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        223⤵
        System Location Discovery: System Language Discovery
        
        PID:1960
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        224⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        225⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        226⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:6056
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        228⤵
        Drops file in System32 directory
        
        PID:5404
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        229⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        230⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        231⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        
        PID:1616
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        232⤵
        Drops file in System32 directory
        
        PID:4812
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        233⤵
        Enumerates connected drives
        Drops file in System32 directory
        
        PID:2116
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        234⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        
        PID:1148
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        235⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        236⤵
        Drops file in System32 directory
        
        PID:6080
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        237⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        238⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        239⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        240⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        241⤵
        Enumerates connected drives
        Drops file in System32 directory
        
        PID:4516
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        242⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        243⤵
        System Location Discovery: System Language Discovery
        
        PID:2564
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        244⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        245⤵
        Enumerates connected drives
        
        PID:4824
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        246⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:2944
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        248⤵
        Drops file in System32 directory
        
        PID:3696
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        249⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        
        PID:1340
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        250⤵
        Enumerates connected drives
        Drops file in System32 directory
        
        PID:1136
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        251⤵
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        252⤵
        Enumerates connected drives
        
        PID:2620
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        253⤵
        Enumerates connected drives
        
        PID:4992
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        254⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        255⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        256⤵
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        257⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        258⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        259⤵
        Drops file in System32 directory
        
        PID:3448
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        260⤵
        Drops file in System32 directory
        
        PID:3120
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        261⤵
        
        PID:948
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        262⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        263⤵
        
        PID:852
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        264⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        265⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        266⤵
        
        PID:264
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        267⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        268⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        269⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        270⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        271⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        272⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        273⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        274⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        275⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        276⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        277⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        278⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        279⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        280⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        281⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        282⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        283⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        284⤵
        
        PID:920
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        285⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        286⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        287⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        288⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        289⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        290⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        291⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        292⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\ccPrxy.exe
        
        C:\Windows\system32\ccPrxy.exe
        293⤵
        
        PID:2576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ccPrxy.exe

Path C:\Windows\SysWOW64\ccPrxy.exe
Size 20KB
SHA256 aa3fe9f7858be55f5d87bf8cf90915872fa05cb054dfa20d6649864c00afd8c6
MD5 2c8544f6b2be0bd41cd713fdcbb72dc7
SHA1 ecfb0f6bb5d3d07e73b48b958a2ee552f922b6c3
SHA512 8d11455d3e45c703ef09574d78d069ce91264b7f1decc915040a7d52db52e6dedef7d4a8862fe4b863d8fe7a2b95aaaaeeefa9c1fbe775dbbad10f6bb5adc2ba
SSDEEP 192:KMKQxeqwSm1D5G2fghn8zq9njhcKaKusqDg9deL:KMFezSm1lFghUPKkk9d
TLSH
T1F492C78F6E48D57FC7404176096C84EDEFB67A3667D26E42D740C61E78A44CBD86830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download