Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 09:26
General
- Target jaffacakes118_5376af36d5e2104a5fbd106c6c0cad062d16cfdc8d58dd905db08c650ec43457.exe
- Size 228KB
- Sample261002-legqpsshqc
- SHA256 5376af36d5e2104a5fbd106c6c0cad062d16cfdc8d58dd905db08c650ec43457
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5376af36d5e2104a5fbd106c6c0cad062d16cfdc8d58dd905db08c650ec43457.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5376af36d5e2104a5fbd106c6c0cad062d16cfdc8d58dd905db08c650ec43457.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe6⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe7⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe9⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe10⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe12⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe16⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe19⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe24⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe26⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe27⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe28⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe29⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe31⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe35⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe40⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe43⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe45⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe48⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe53⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe55⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe64⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe66⤵
- Enumerates connected drives
- Drops file in System32 directory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe67⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe68⤵
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe69⤵
- Enumerates connected drives
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe70⤵
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe71⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe72⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe73⤵
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe74⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe75⤵
- Enumerates connected drives
- Drops file in System32 directory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe76⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe77⤵
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe78⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe79⤵
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe80⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe81⤵
- Enumerates connected drives
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe82⤵
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe83⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe84⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe85⤵
- Enumerates connected drives
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe86⤵
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe87⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe88⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe89⤵
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe90⤵
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe91⤵
- Enumerates connected drives
- Drops file in System32 directory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe92⤵
- Enumerates connected drives
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe93⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe94⤵
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe95⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe96⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe97⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe98⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe99⤵
- Enumerates connected drives
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe100⤵
- Enumerates connected drives
- Drops file in System32 directory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe101⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe102⤵
- Enumerates connected drives
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe103⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe104⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe105⤵
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe106⤵
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe107⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe108⤵
- Enumerates connected drives
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe109⤵
- Enumerates connected drives
- Drops file in System32 directory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe110⤵
- Enumerates connected drives
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe111⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe112⤵
- Enumerates connected drives
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe113⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe114⤵
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe115⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe116⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe117⤵
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe118⤵
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe119⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe120⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-