Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 21:57
Static task
static1
Behavioral task
behavioral1
Sample
01c07d09ff212f857e96c20e57e4b4fc_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
01c07d09ff212f857e96c20e57e4b4fc_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
01c07d09ff212f857e96c20e57e4b4fc_JaffaCakes118.exe
-
Size
208KB
-
MD5
01c07d09ff212f857e96c20e57e4b4fc
-
SHA1
641f73b9004808f62c308c634993ed4137cee914
-
SHA256
21579b6c8c0f5588ab7c20813f1fb0ba52e9a1647733456a39529327c45af8ed
-
SHA512
8ddc52aa7fc4e31f335ae03d7caca969961efe66cd4253eb02ba495e737d0b59854ba8db123bc3b316cde8f00b3de185120a22d259d3484f3e100a4ea67066d1
-
SSDEEP
6144:arYTgEMnRNL+I3YHBC/vMYRbbdfHKpkEj1:OBrI6U8IpkC
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation DVEZPN.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation LXFBJU.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation LHLZ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation RPLAQB.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ICVHP.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation BNAIW.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation UWQ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ORHXD.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation HRKODK.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation BZMX.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation RVTWXUL.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SZXSYU.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SYZLKA.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation PMIPKOO.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ILL.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation QACTN.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation KYGNRJ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ZPDLR.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation XVHF.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation FGEAZ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation QKIS.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation MLDHOYU.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation OWFWYMN.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation NCKMOHW.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation WOOTB.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation BCGY.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation RILXZP.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation VRJGAQE.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation EPYHZUD.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation DLSH.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ZAOFS.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation LDK.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation QXYUQ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation VFS.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SEPGAHO.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation DOD.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation IOLCBK.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation STN.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation PYYFTCI.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation EQCESH.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation OPR.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ZZVZYT.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation XZPZ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation QONCWG.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ARZHJD.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SRKHU.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation BVIEW.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation MPRPJFS.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation AIJ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation GCXAB.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation HTW.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation YVXZNTZ.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ZAJXL.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation RKYMS.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ONSJPUA.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation OUQXF.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation XNUEKV.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation RWAD.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation PJIWL.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation QJVGE.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation ZKXX.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation HBD.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation KAEQXHG.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 01c07d09ff212f857e96c20e57e4b4fc_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3792 FGEAZ.exe 1840 VBO.exe 2948 XZPZ.exe 5032 CZXN.exe 3972 XNUEKV.exe 1580 BVIEW.exe 4548 SOZCW.exe 4032 QDKX.exe 4272 QJKLS.exe 2612 FETQDNA.exe 4280 EPS.exe 840 ZKXX.exe 5052 KIADZ.exe 3512 VADVIV.exe 2516 ZIKV.exe 1900 KBNOC.exe 4996 CJPTGA.exe 3772 NCKMOHW.exe 3360 RKYMS.exe 528 WVUT.exe 5000 TAAQM.exe 1304 PYYFTCI.exe 972 PQHGHPX.exe 3252 RDLQ.exe 4340 LBNSQ.exe 4932 DCHXTJ.exe 4884 MPRPJFS.exe 4356 ONSJPUA.exe 1360 KSYG.exe 4048 FGDPHE.exe 1636 ATA.exe 2352 UGEQ.exe 2868 XCJADD.exe 5056 RPO.exe 2032 RZX.exe 5072 SCBGH.exe 4996 DVEZPN.exe 912 OOZ.exe 4076 HRKODK.exe 3876 WMUSOFC.exe 4472 RZZJ.exe 1312 VHTRB.exe 1168 ZXZROWA.exe 2284 DFUZR.exe 1072 IQYFWMY.exe 4704 QBYHKQN.exe 376 BTB.exe 1840 PZH.exe 4988 SMMY.exe 3128 NZRILH.exe 3844 HVW.exe 1524 SNRK.exe 4544 SYZLKA.exe 2440 EQCESH.exe 4352 JRK.exe 3416 BZMX.exe 4600 RPLAQB.exe 1884 OUQXF.exe 1148 AIJ.exe 4848 VVOXJ.exe 4460 QISHTQU.exe 2568 XBTI.exe 1968 ZRU.exe 2248 LJPV.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\YQYBVG.exe.bat DCTS.exe File created C:\windows\SysWOW64\BVIEW.exe.bat XNUEKV.exe File created C:\windows\SysWOW64\LJPV.exe.bat ZRU.exe File opened for modification C:\windows\SysWOW64\NGDBEL.exe BNAIW.exe File created C:\windows\SysWOW64\FGEAZ.exe.bat 01c07d09ff212f857e96c20e57e4b4fc_JaffaCakes118.exe File opened for modification C:\windows\SysWOW64\NZRILH.exe SMMY.exe File opened for modification C:\windows\SysWOW64\KKAE.exe UZCO.exe File opened for modification C:\windows\SysWOW64\PMIPKOO.exe RWJ.exe File created C:\windows\SysWOW64\TAAQM.exe.bat WVUT.exe File created C:\windows\SysWOW64\IAMX.exe KKFU.exe File created C:\windows\SysWOW64\KKAE.exe.bat UZCO.exe File created C:\windows\SysWOW64\IOLCBK.exe.bat NBGS.exe File opened for modification C:\windows\SysWOW64\EDGD.exe JIBMEOL.exe File created C:\windows\SysWOW64\AJQWU.exe.bat LDK.exe File created C:\windows\SysWOW64\XIWBX.exe.bat MPTI.exe File created C:\windows\SysWOW64\NCKMOHW.exe CJPTGA.exe File created C:\windows\SysWOW64\HRKODK.exe.bat OOZ.exe File created C:\windows\SysWOW64\QBYHKQN.exe.bat IQYFWMY.exe File created C:\windows\SysWOW64\QISHTQU.exe.bat VVOXJ.exe File opened for modification C:\windows\SysWOW64\FOIA.exe KAEQXHG.exe File opened for modification C:\windows\SysWOW64\CZXN.exe XZPZ.exe File created C:\windows\SysWOW64\BVIEW.exe XNUEKV.exe File created C:\windows\SysWOW64\ZXZROWA.exe VHTRB.exe File created C:\windows\SysWOW64\OYABT.exe TDV.exe File opened for modification C:\windows\SysWOW64\RTAAQNR.exe PVHGSY.exe File created C:\windows\SysWOW64\SUQL.exe IMO.exe File created C:\windows\SysWOW64\JENCAD.exe.bat HBD.exe File opened for modification C:\windows\SysWOW64\IOLCBK.exe NBGS.exe File created C:\windows\SysWOW64\BTB.exe QBYHKQN.exe File opened for modification C:\windows\SysWOW64\BTB.exe QBYHKQN.exe File opened for modification C:\windows\SysWOW64\OYABT.exe TDV.exe File created C:\windows\SysWOW64\BCGY.exe TWG.exe File opened for modification C:\windows\SysWOW64\UWQ.exe RILXZP.exe File created C:\windows\SysWOW64\CBRO.exe MLSD.exe File created C:\windows\SysWOW64\ZIKV.exe.bat VADVIV.exe File created C:\windows\SysWOW64\XBTI.exe QISHTQU.exe File opened for modification C:\windows\SysWOW64\XBTI.exe QISHTQU.exe File created C:\windows\SysWOW64\NBGS.exe.bat RWAD.exe File created C:\windows\SysWOW64\NYGXXW.exe.bat RTAAQNR.exe File created C:\windows\SysWOW64\SUQL.exe.bat IMO.exe File opened for modification C:\windows\SysWOW64\NCKMOHW.exe CJPTGA.exe File opened for modification C:\windows\SysWOW64\QBYHKQN.exe IQYFWMY.exe File created C:\windows\SysWOW64\EQCESH.exe.bat SYZLKA.exe File opened for modification C:\windows\SysWOW64\YQYBVG.exe DCTS.exe File created C:\windows\SysWOW64\PMIPKOO.exe RWJ.exe File opened for modification C:\windows\SysWOW64\WHOYERB.exe OWFWYMN.exe File opened for modification C:\windows\SysWOW64\PKFBJVK.exe WHOYERB.exe File created C:\windows\SysWOW64\HDL.exe LXFBJU.exe File created C:\windows\SysWOW64\UWQ.exe RILXZP.exe File created C:\windows\SysWOW64\SRKHU.exe.bat EMEK.exe File opened for modification C:\windows\SysWOW64\JENCAD.exe HBD.exe File opened for modification C:\windows\SysWOW64\NBGS.exe RWAD.exe File created C:\windows\SysWOW64\BSAOOR.exe PAXVG.exe File created C:\windows\SysWOW64\QCOS.exe OPR.exe File created C:\windows\SysWOW64\UXT.exe.bat NUJRR.exe File created C:\windows\SysWOW64\PKFBJVK.exe.bat WHOYERB.exe File opened for modification C:\windows\SysWOW64\ZXZROWA.exe VHTRB.exe File created C:\windows\SysWOW64\XBTI.exe.bat QISHTQU.exe File created C:\windows\SysWOW64\JENCAD.exe HBD.exe File created C:\windows\SysWOW64\CZXN.exe XZPZ.exe File opened for modification C:\windows\SysWOW64\BVIEW.exe XNUEKV.exe File created C:\windows\SysWOW64\OLYDLQ.exe.bat CTVK.exe File created C:\windows\SysWOW64\NZPE.exe.bat HYIQ.exe File created C:\windows\SysWOW64\HVW.exe.bat NZRILH.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\LHLZ.exe PKFBJVK.exe File created C:\windows\system\VBO.exe.bat FGEAZ.exe File created C:\windows\RVTWXUL.exe GCQDON.exe File created C:\windows\system\RUR.exe.bat WHNBUH.exe File created C:\windows\system\EWH.exe YVZKGH.exe File opened for modification C:\windows\system\DCTS.exe YCLWCEF.exe File created C:\windows\system\XNUEKV.exe.bat CZXN.exe File opened for modification C:\windows\system\ZKXX.exe EPS.exe File created C:\windows\LDK.exe PXFB.exe File opened for modification C:\windows\system\HBD.exe IMEKDVT.exe File opened for modification C:\windows\system\YFNLNK.exe UXT.exe File created C:\windows\WAYSTXE.exe CMTAJX.exe File created C:\windows\system\RILXZP.exe.bat XVHF.exe File opened for modification C:\windows\system\PQHGHPX.exe PYYFTCI.exe File opened for modification C:\windows\system\FGS.exe IAMX.exe File created C:\windows\VRJGAQE.exe KYGNRJ.exe File created C:\windows\EMEK.exe ORHXD.exe File opened for modification C:\windows\PZH.exe BTB.exe File created C:\windows\SNRK.exe HVW.exe File opened for modification C:\windows\system\RUR.exe WHNBUH.exe File opened for modification C:\windows\system\KYGNRJ.exe PLBE.exe File created C:\windows\SCBGH.exe.bat RZX.exe File created C:\windows\QXYUQ.exe.bat HPWPNKN.exe File created C:\windows\system\BZMX.exe.bat JRK.exe File created C:\windows\system\TDV.exe CSE.exe File created C:\windows\system\CTVK.exe CFVW.exe File opened for modification C:\windows\VFS.exe QCWN.exe File created C:\windows\HTW.exe BTOPOI.exe File opened for modification C:\windows\SNRK.exe HVW.exe File created C:\windows\system\LLOM.exe.bat SDOW.exe File opened for modification C:\windows\system\VSUP.exe SEPGAHO.exe File created C:\windows\system\ILL.exe NYGXXW.exe File created C:\windows\QJKLS.exe QDKX.exe File created C:\windows\WHNBUH.exe.bat PMIPKOO.exe File created C:\windows\RKYMS.exe NCKMOHW.exe File created C:\windows\system\KYGNRJ.exe PLBE.exe File created C:\windows\system\DOD.exe.bat XOV.exe File opened for modification C:\windows\JRK.exe EQCESH.exe File created C:\windows\system\STN.exe.bat EWH.exe File created C:\windows\TENWUF.exe.bat NIVWQ.exe File opened for modification C:\windows\system\RZX.exe RPO.exe File opened for modification C:\windows\system\ZRU.exe XBTI.exe File created C:\windows\LHLZ.exe.bat PKFBJVK.exe File opened for modification C:\windows\system\ATA.exe FGDPHE.exe File created C:\windows\system\STN.exe EWH.exe File created C:\windows\EMEK.exe.bat ORHXD.exe File opened for modification C:\windows\EPS.exe FETQDNA.exe File opened for modification C:\windows\RKYMS.exe NCKMOHW.exe File created C:\windows\CSE.exe RVTWXUL.exe File created C:\windows\CSE.exe.bat RVTWXUL.exe File opened for modification C:\windows\system\LLOM.exe SDOW.exe File opened for modification C:\windows\system\ZZVZYT.exe ILL.exe File created C:\windows\JIBMEOL.exe.bat YQYBVG.exe File created C:\windows\system\YFNLNK.exe.bat UXT.exe File created C:\windows\system\LLOM.exe SDOW.exe File created C:\windows\system\CMTAJX.exe RUQQ.exe File created C:\windows\NIVWQ.exe SVR.exe File opened for modification C:\windows\IQYFWMY.exe DFUZR.exe File created C:\windows\system\YPOFGIT.exe RUR.exe File opened for modification C:\windows\system\TWG.exe XRIVBN.exe File created C:\windows\KSYG.exe.bat ONSJPUA.exe File created C:\windows\TFEHAZG.exe.bat WAYSTXE.exe File created C:\windows\system\RZZJ.exe.bat WMUSOFC.exe File created C:\windows\system\VHTRB.exe.bat RZZJ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
pid pid_target Process procid_target 2008 912 WerFault.exe 79 2116 3792 WerFault.exe 87 2860 1840 WerFault.exe 93 5052 2948 WerFault.exe 98 2520 5032 WerFault.exe 103 5116 3972 WerFault.exe 108 1900 1580 WerFault.exe 113 216 4548 WerFault.exe 118 3716 4032 WerFault.exe 123 3640 4272 WerFault.exe 128 1960 2612 WerFault.exe 133 4644 4280 WerFault.exe 138 456 840 WerFault.exe 143 1176 5052 WerFault.exe 148 1528 3512 WerFault.exe 153 4916 2516 WerFault.exe 158 3496 1900 WerFault.exe 163 2736 4996 WerFault.exe 168 4708 3772 WerFault.exe 173 2628 3360 WerFault.exe 178 1392 528 WerFault.exe 183 1400 5000 WerFault.exe 188 1176 1304 WerFault.exe 193 5116 972 WerFault.exe 197 1168 3252 WerFault.exe 203 744 4340 WerFault.exe 208 2200 4932 WerFault.exe 213 4528 4884 WerFault.exe 218 1260 4356 WerFault.exe 222 3500 1360 WerFault.exe 228 380 4048 WerFault.exe 233 1656 1636 WerFault.exe 238 3844 2352 WerFault.exe 243 3272 2868 WerFault.exe 248 532 5056 WerFault.exe 253 2256 2032 WerFault.exe 258 1660 5072 WerFault.exe 262 1276 4996 WerFault.exe 268 3816 912 WerFault.exe 273 4212 4076 WerFault.exe 278 3204 3876 WerFault.exe 283 2352 4472 WerFault.exe 289 1904 1312 WerFault.exe 295 4992 1168 WerFault.exe 300 4200 2284 WerFault.exe 304 5072 1072 WerFault.exe 310 2620 4704 WerFault.exe 315 4488 376 WerFault.exe 320 3292 1840 WerFault.exe 325 2364 4988 WerFault.exe 330 2520 3128 WerFault.exe 335 4480 3844 WerFault.exe 340 4552 1524 WerFault.exe 345 1168 4544 WerFault.exe 350 2284 2440 WerFault.exe 355 3884 4352 WerFault.exe 360 4272 3416 WerFault.exe 365 2920 4600 WerFault.exe 370 1516 1884 WerFault.exe 375 4988 1148 WerFault.exe 380 5032 4848 WerFault.exe 385 3512 4460 WerFault.exe 390 688 2568 WerFault.exe 395 400 1968 WerFault.exe 400 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 912 01c07d09ff212f857e96c20e57e4b4fc_JaffaCakes118.exe 912 01c07d09ff212f857e96c20e57e4b4fc_JaffaCakes118.exe 3792 FGEAZ.exe 3792 FGEAZ.exe 1840 VBO.exe 1840 VBO.exe 2948 XZPZ.exe 2948 XZPZ.exe 5032 CZXN.exe 5032 CZXN.exe 3972 XNUEKV.exe 3972 XNUEKV.exe 1580 BVIEW.exe 1580 BVIEW.exe 4548 SOZCW.exe 4548 SOZCW.exe 4032 QDKX.exe 4032 QDKX.exe 4272 QJKLS.exe 4272 QJKLS.exe 2612 FETQDNA.exe 2612 FETQDNA.exe 4280 EPS.exe 4280 EPS.exe 840 ZKXX.exe 840 ZKXX.exe 5052 KIADZ.exe 5052 KIADZ.exe 3512 VADVIV.exe 3512 VADVIV.exe 2516 ZIKV.exe 2516 ZIKV.exe 1900 KBNOC.exe 1900 KBNOC.exe 4996 CJPTGA.exe 4996 CJPTGA.exe 3772 NCKMOHW.exe 3772 NCKMOHW.exe 3360 RKYMS.exe 3360 RKYMS.exe 528 WVUT.exe 528 WVUT.exe 5000 TAAQM.exe 5000 TAAQM.exe 1304 PYYFTCI.exe 1304 PYYFTCI.exe 972 PQHGHPX.exe 972 PQHGHPX.exe 3252 RDLQ.exe 3252 RDLQ.exe 4340 LBNSQ.exe 4340 LBNSQ.exe 4932 DCHXTJ.exe 4932 DCHXTJ.exe 4884 MPRPJFS.exe 4884 MPRPJFS.exe 4356 ONSJPUA.exe 4356 ONSJPUA.exe 1360 KSYG.exe 1360 KSYG.exe 4048 FGDPHE.exe 4048 FGDPHE.exe 1636 ATA.exe 1636 ATA.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 912 01c07d09ff212f857e96c20e57e4b4fc_JaffaCakes118.exe 912 01c07d09ff212f857e96c20e57e4b4fc_JaffaCakes118.exe 3792 FGEAZ.exe 3792 FGEAZ.exe 1840 VBO.exe 1840 VBO.exe 2948 XZPZ.exe 2948 XZPZ.exe 5032 CZXN.exe 5032 CZXN.exe 3972 XNUEKV.exe 3972 XNUEKV.exe 1580 BVIEW.exe 1580 BVIEW.exe 4548 SOZCW.exe 4548 SOZCW.exe 4032 QDKX.exe 4032 QDKX.exe 4272 QJKLS.exe 4272 QJKLS.exe 2612 FETQDNA.exe 2612 FETQDNA.exe 4280 EPS.exe 4280 EPS.exe 840 ZKXX.exe 840 ZKXX.exe 5052 KIADZ.exe 5052 KIADZ.exe 3512 VADVIV.exe 3512 VADVIV.exe 2516 ZIKV.exe 2516 ZIKV.exe 1900 KBNOC.exe 1900 KBNOC.exe 4996 CJPTGA.exe 4996 CJPTGA.exe 3772 NCKMOHW.exe 3772 NCKMOHW.exe 3360 RKYMS.exe 3360 RKYMS.exe 528 WVUT.exe 528 WVUT.exe 5000 TAAQM.exe 5000 TAAQM.exe 1304 PYYFTCI.exe 1304 PYYFTCI.exe 972 PQHGHPX.exe 972 PQHGHPX.exe 3252 RDLQ.exe 3252 RDLQ.exe 4340 LBNSQ.exe 4340 LBNSQ.exe 4932 DCHXTJ.exe 4932 DCHXTJ.exe 4884 MPRPJFS.exe 4884 MPRPJFS.exe 4356 ONSJPUA.exe 4356 ONSJPUA.exe 1360 KSYG.exe 1360 KSYG.exe 4048 FGDPHE.exe 4048 FGDPHE.exe 1636 ATA.exe 1636 ATA.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 912 wrote to memory of 3084 912 01c07d09ff212f857e96c20e57e4b4fc_JaffaCakes118.exe 83 PID 912 wrote to memory of 3084 912 01c07d09ff212f857e96c20e57e4b4fc_JaffaCakes118.exe 83 PID 912 wrote to memory of 3084 912 01c07d09ff212f857e96c20e57e4b4fc_JaffaCakes118.exe 83 PID 3084 wrote to memory of 3792 3084 cmd.exe 87 PID 3084 wrote to memory of 3792 3084 cmd.exe 87 PID 3084 wrote to memory of 3792 3084 cmd.exe 87 PID 3792 wrote to memory of 1228 3792 FGEAZ.exe 89 PID 3792 wrote to memory of 1228 3792 FGEAZ.exe 89 PID 3792 wrote to memory of 1228 3792 FGEAZ.exe 89 PID 1228 wrote to memory of 1840 1228 cmd.exe 93 PID 1228 wrote to memory of 1840 1228 cmd.exe 93 PID 1228 wrote to memory of 1840 1228 cmd.exe 93 PID 1840 wrote to memory of 3876 1840 VBO.exe 94 PID 1840 wrote to memory of 3876 1840 VBO.exe 94 PID 1840 wrote to memory of 3876 1840 VBO.exe 94 PID 3876 wrote to memory of 2948 3876 cmd.exe 98 PID 3876 wrote to memory of 2948 3876 cmd.exe 98 PID 3876 wrote to memory of 2948 3876 cmd.exe 98 PID 2948 wrote to memory of 4412 2948 XZPZ.exe 99 PID 2948 wrote to memory of 4412 2948 XZPZ.exe 99 PID 2948 wrote to memory of 4412 2948 XZPZ.exe 99 PID 4412 wrote to memory of 5032 4412 cmd.exe 103 PID 4412 wrote to memory of 5032 4412 cmd.exe 103 PID 4412 wrote to memory of 5032 4412 cmd.exe 103 PID 5032 wrote to memory of 4056 5032 CZXN.exe 104 PID 5032 wrote to memory of 4056 5032 CZXN.exe 104 PID 5032 wrote to memory of 4056 5032 CZXN.exe 104 PID 4056 wrote to memory of 3972 4056 cmd.exe 108 PID 4056 wrote to memory of 3972 4056 cmd.exe 108 PID 4056 wrote to memory of 3972 4056 cmd.exe 108 PID 3972 wrote to memory of 3952 3972 XNUEKV.exe 109 PID 3972 wrote to memory of 3952 3972 XNUEKV.exe 109 PID 3972 wrote to memory of 3952 3972 XNUEKV.exe 109 PID 3952 wrote to memory of 1580 3952 cmd.exe 113 PID 3952 wrote to memory of 1580 3952 cmd.exe 113 PID 3952 wrote to memory of 1580 3952 cmd.exe 113 PID 1580 wrote to memory of 1504 1580 BVIEW.exe 114 PID 1580 wrote to memory of 1504 1580 BVIEW.exe 114 PID 1580 wrote to memory of 1504 1580 BVIEW.exe 114 PID 1504 wrote to memory of 4548 1504 cmd.exe 118 PID 1504 wrote to memory of 4548 1504 cmd.exe 118 PID 1504 wrote to memory of 4548 1504 cmd.exe 118 PID 4548 wrote to memory of 4596 4548 SOZCW.exe 119 PID 4548 wrote to memory of 4596 4548 SOZCW.exe 119 PID 4548 wrote to memory of 4596 4548 SOZCW.exe 119 PID 4596 wrote to memory of 4032 4596 cmd.exe 123 PID 4596 wrote to memory of 4032 4596 cmd.exe 123 PID 4596 wrote to memory of 4032 4596 cmd.exe 123 PID 4032 wrote to memory of 2440 4032 QDKX.exe 124 PID 4032 wrote to memory of 2440 4032 QDKX.exe 124 PID 4032 wrote to memory of 2440 4032 QDKX.exe 124 PID 2440 wrote to memory of 4272 2440 cmd.exe 128 PID 2440 wrote to memory of 4272 2440 cmd.exe 128 PID 2440 wrote to memory of 4272 2440 cmd.exe 128 PID 4272 wrote to memory of 4852 4272 QJKLS.exe 129 PID 4272 wrote to memory of 4852 4272 QJKLS.exe 129 PID 4272 wrote to memory of 4852 4272 QJKLS.exe 129 PID 4852 wrote to memory of 2612 4852 cmd.exe 133 PID 4852 wrote to memory of 2612 4852 cmd.exe 133 PID 4852 wrote to memory of 2612 4852 cmd.exe 133 PID 2612 wrote to memory of 3384 2612 FETQDNA.exe 134 PID 2612 wrote to memory of 3384 2612 FETQDNA.exe 134 PID 2612 wrote to memory of 3384 2612 FETQDNA.exe 134 PID 3384 wrote to memory of 4280 3384 cmd.exe 138
Processes
-
C:\Users\Admin\AppData\Local\Temp\01c07d09ff212f857e96c20e57e4b4fc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\01c07d09ff212f857e96c20e57e4b4fc_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGEAZ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\windows\SysWOW64\FGEAZ.exeC:\windows\system32\FGEAZ.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBO.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\windows\system\VBO.exeC:\windows\system\VBO.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XZPZ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\windows\SysWOW64\XZPZ.exeC:\windows\system32\XZPZ.exe7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CZXN.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\SysWOW64\CZXN.exeC:\windows\system32\CZXN.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XNUEKV.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\windows\system\XNUEKV.exeC:\windows\system\XNUEKV.exe11⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVIEW.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\windows\SysWOW64\BVIEW.exeC:\windows\system32\BVIEW.exe13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SOZCW.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\windows\system\SOZCW.exeC:\windows\system\SOZCW.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QDKX.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\windows\SysWOW64\QDKX.exeC:\windows\system32\QDKX.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QJKLS.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\windows\QJKLS.exeC:\windows\QJKLS.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FETQDNA.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\windows\system\FETQDNA.exeC:\windows\system\FETQDNA.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EPS.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\windows\EPS.exeC:\windows\EPS.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZKXX.exe.bat" "24⤵PID:4332
-
C:\windows\system\ZKXX.exeC:\windows\system\ZKXX.exe25⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KIADZ.exe.bat" "26⤵PID:3484
-
C:\windows\system\KIADZ.exeC:\windows\system\KIADZ.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VADVIV.exe.bat" "28⤵PID:4848
-
C:\windows\system\VADVIV.exeC:\windows\system\VADVIV.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZIKV.exe.bat" "30⤵PID:1380
-
C:\windows\SysWOW64\ZIKV.exeC:\windows\system32\ZIKV.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KBNOC.exe.bat" "32⤵PID:3272
-
C:\windows\KBNOC.exeC:\windows\KBNOC.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CJPTGA.exe.bat" "34⤵PID:1536
-
C:\windows\system\CJPTGA.exeC:\windows\system\CJPTGA.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NCKMOHW.exe.bat" "36⤵PID:1424
-
C:\windows\SysWOW64\NCKMOHW.exeC:\windows\system32\NCKMOHW.exe37⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RKYMS.exe.bat" "38⤵PID:3036
-
C:\windows\RKYMS.exeC:\windows\RKYMS.exe39⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WVUT.exe.bat" "40⤵PID:4844
-
C:\windows\system\WVUT.exeC:\windows\system\WVUT.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TAAQM.exe.bat" "42⤵PID:3500
-
C:\windows\SysWOW64\TAAQM.exeC:\windows\system32\TAAQM.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PYYFTCI.exe.bat" "44⤵PID:4988
-
C:\windows\PYYFTCI.exeC:\windows\PYYFTCI.exe45⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQHGHPX.exe.bat" "46⤵PID:3480
-
C:\windows\system\PQHGHPX.exeC:\windows\system\PQHGHPX.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RDLQ.exe.bat" "48⤵PID:4936
-
C:\windows\system\RDLQ.exeC:\windows\system\RDLQ.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LBNSQ.exe.bat" "50⤵PID:2152
-
C:\windows\system\LBNSQ.exeC:\windows\system\LBNSQ.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DCHXTJ.exe.bat" "52⤵PID:4008
-
C:\windows\system\DCHXTJ.exeC:\windows\system\DCHXTJ.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MPRPJFS.exe.bat" "54⤵PID:4300
-
C:\windows\system\MPRPJFS.exeC:\windows\system\MPRPJFS.exe55⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ONSJPUA.exe.bat" "56⤵PID:2984
-
C:\windows\system\ONSJPUA.exeC:\windows\system\ONSJPUA.exe57⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KSYG.exe.bat" "58⤵PID:2624
-
C:\windows\KSYG.exeC:\windows\KSYG.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGDPHE.exe.bat" "60⤵PID:1884
-
C:\windows\SysWOW64\FGDPHE.exeC:\windows\system32\FGDPHE.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATA.exe.bat" "62⤵PID:4248
-
C:\windows\system\ATA.exeC:\windows\system\ATA.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGEQ.exe.bat" "64⤵PID:4084
-
C:\windows\system\UGEQ.exeC:\windows\system\UGEQ.exe65⤵
- Executes dropped EXE
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XCJADD.exe.bat" "66⤵PID:2924
-
C:\windows\SysWOW64\XCJADD.exeC:\windows\system32\XCJADD.exe67⤵
- Executes dropped EXE
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPO.exe.bat" "68⤵PID:3120
-
C:\windows\system\RPO.exeC:\windows\system\RPO.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RZX.exe.bat" "70⤵PID:2292
-
C:\windows\system\RZX.exeC:\windows\system\RZX.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SCBGH.exe.bat" "72⤵PID:3112
-
C:\windows\SCBGH.exeC:\windows\SCBGH.exe73⤵
- Executes dropped EXE
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DVEZPN.exe.bat" "74⤵PID:4548
-
C:\windows\DVEZPN.exeC:\windows\DVEZPN.exe75⤵
- Checks computer location settings
- Executes dropped EXE
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OOZ.exe.bat" "76⤵PID:2420
-
C:\windows\SysWOW64\OOZ.exeC:\windows\system32\OOZ.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HRKODK.exe.bat" "78⤵PID:4844
-
C:\windows\SysWOW64\HRKODK.exeC:\windows\system32\HRKODK.exe79⤵
- Checks computer location settings
- Executes dropped EXE
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WMUSOFC.exe.bat" "80⤵PID:4952
-
C:\windows\SysWOW64\WMUSOFC.exeC:\windows\system32\WMUSOFC.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RZZJ.exe.bat" "82⤵PID:1516
-
C:\windows\system\RZZJ.exeC:\windows\system\RZZJ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VHTRB.exe.bat" "84⤵PID:1828
-
C:\windows\system\VHTRB.exeC:\windows\system\VHTRB.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZXZROWA.exe.bat" "86⤵PID:2460
-
C:\windows\SysWOW64\ZXZROWA.exeC:\windows\system32\ZXZROWA.exe87⤵
- Executes dropped EXE
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DFUZR.exe.bat" "88⤵PID:2636
-
C:\windows\DFUZR.exeC:\windows\DFUZR.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQYFWMY.exe.bat" "90⤵PID:2248
-
C:\windows\IQYFWMY.exeC:\windows\IQYFWMY.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QBYHKQN.exe.bat" "92⤵PID:4932
-
C:\windows\SysWOW64\QBYHKQN.exeC:\windows\system32\QBYHKQN.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BTB.exe.bat" "94⤵PID:4884
-
C:\windows\SysWOW64\BTB.exeC:\windows\system32\BTB.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PZH.exe.bat" "96⤵PID:2324
-
C:\windows\PZH.exeC:\windows\PZH.exe97⤵
- Executes dropped EXE
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SMMY.exe.bat" "98⤵PID:3484
-
C:\windows\system\SMMY.exeC:\windows\system\SMMY.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NZRILH.exe.bat" "100⤵PID:4660
-
C:\windows\SysWOW64\NZRILH.exeC:\windows\system32\NZRILH.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVW.exe.bat" "102⤵PID:1920
-
C:\windows\SysWOW64\HVW.exeC:\windows\system32\HVW.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNRK.exe.bat" "104⤵PID:3972
-
C:\windows\SNRK.exeC:\windows\SNRK.exe105⤵
- Executes dropped EXE
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SYZLKA.exe.bat" "106⤵PID:3232
-
C:\windows\system\SYZLKA.exeC:\windows\system\SYZLKA.exe107⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EQCESH.exe.bat" "108⤵PID:1772
-
C:\windows\SysWOW64\EQCESH.exeC:\windows\system32\EQCESH.exe109⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JRK.exe.bat" "110⤵PID:1424
-
C:\windows\JRK.exeC:\windows\JRK.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BZMX.exe.bat" "112⤵PID:2588
-
C:\windows\system\BZMX.exeC:\windows\system\BZMX.exe113⤵
- Checks computer location settings
- Executes dropped EXE
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RPLAQB.exe.bat" "114⤵PID:1260
-
C:\windows\RPLAQB.exeC:\windows\RPLAQB.exe115⤵
- Checks computer location settings
- Executes dropped EXE
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUQXF.exe.bat" "116⤵PID:1704
-
C:\windows\SysWOW64\OUQXF.exeC:\windows\system32\OUQXF.exe117⤵
- Checks computer location settings
- Executes dropped EXE
PID:1884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AIJ.exe.bat" "118⤵PID:3928
-
C:\windows\AIJ.exeC:\windows\AIJ.exe119⤵
- Checks computer location settings
- Executes dropped EXE
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVOXJ.exe.bat" "120⤵PID:3068
-
C:\windows\system\VVOXJ.exeC:\windows\system\VVOXJ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QISHTQU.exe.bat" "122⤵PID:1436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-