Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 22:19
Static task
static1
Behavioral task
behavioral1
Sample
0145eccfee0be8208e4645c1baa71a45_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
0145eccfee0be8208e4645c1baa71a45_JaffaCakes118.exe
-
Size
234KB
-
MD5
0145eccfee0be8208e4645c1baa71a45
-
SHA1
55b4457c9ff5bdfe0348e7f2b83870549907a4d0
-
SHA256
14db0edec6e95cc9c19278329963a0700fbc9bbf16f4405ba67eb96e41b532c1
-
SHA512
52dfd8b6b2fb8c42eef5466a9c67ab0d6878f6fed9637c2dd3989551d1410a594ed62b1731933f3b6af18e8d5ecff5ce0c27ca5ad8005c513b40141aa3328ede
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31QNVrAIwsYs:n3C9BRo7MlrWKo+l0r5wsYs
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3316-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2472-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3652 tnthhh.exe 2320 ppvvp.exe 3996 rrrxllx.exe 3556 lllrrxx.exe 2592 bnttnt.exe 4696 ddvvp.exe 2568 tntnnn.exe 1432 ddddd.exe 3300 lxxffxx.exe 4712 btnntt.exe 2740 rrrxxll.exe 3596 ntbhhh.exe 3304 vpddd.exe 2940 nbhhhb.exe 2472 jddvv.exe 3964 xrrfrxf.exe 3692 ththhb.exe 2044 dvdvj.exe 3256 rxrrxrl.exe 2912 vdppd.exe 1400 btntnn.exe 4336 flrxrrl.exe 3264 nttnhb.exe 4488 9hnhnh.exe 4100 dvjjp.exe 2904 nthhhb.exe 4668 9jvdj.exe 5020 fxrfrfr.exe 4916 hbnttt.exe 4264 7djpd.exe 2372 vpjjd.exe 4020 rrxxfll.exe 924 tbhhht.exe 4044 ddjdd.exe 3456 rxllflr.exe 2120 rfrlllx.exe 1600 3thhnt.exe 1368 vdddv.exe 4472 xflllff.exe 3968 hthbbb.exe 4748 pjdjj.exe 1204 5xrllxl.exe 2712 thhbtt.exe 1772 nhnnnh.exe 4476 jdpjj.exe 2328 rlxxxxx.exe 4776 bnnbtt.exe 2740 nthtbt.exe 1544 ddpjj.exe 4112 rrxxflr.exe 4988 tnnttn.exe 3036 lrxlrrf.exe 2472 llrlllf.exe 3552 hbbhhn.exe 1896 pjvvj.exe 3756 pdjjj.exe 1708 frxrrlr.exe 1412 btnnbt.exe 1244 dvvvv.exe 2264 pppvv.exe 456 ffllrlr.exe 1400 9rfrflf.exe 3244 jjvdd.exe 4824 jpvvj.exe -
resource yara_rule behavioral2/memory/3316-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2472-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xffxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3316 wrote to memory of 3652 3316 0145eccfee0be8208e4645c1baa71a45_JaffaCakes118.exe 84 PID 3316 wrote to memory of 3652 3316 0145eccfee0be8208e4645c1baa71a45_JaffaCakes118.exe 84 PID 3316 wrote to memory of 3652 3316 0145eccfee0be8208e4645c1baa71a45_JaffaCakes118.exe 84 PID 3652 wrote to memory of 2320 3652 tnthhh.exe 85 PID 3652 wrote to memory of 2320 3652 tnthhh.exe 85 PID 3652 wrote to memory of 2320 3652 tnthhh.exe 85 PID 2320 wrote to memory of 3996 2320 ppvvp.exe 86 PID 2320 wrote to memory of 3996 2320 ppvvp.exe 86 PID 2320 wrote to memory of 3996 2320 ppvvp.exe 86 PID 3996 wrote to memory of 3556 3996 rrrxllx.exe 87 PID 3996 wrote to memory of 3556 3996 rrrxllx.exe 87 PID 3996 wrote to memory of 3556 3996 rrrxllx.exe 87 PID 3556 wrote to memory of 2592 3556 lllrrxx.exe 88 PID 3556 wrote to memory of 2592 3556 lllrrxx.exe 88 PID 3556 wrote to memory of 2592 3556 lllrrxx.exe 88 PID 2592 wrote to memory of 4696 2592 bnttnt.exe 89 PID 2592 wrote to memory of 4696 2592 bnttnt.exe 89 PID 2592 wrote to memory of 4696 2592 bnttnt.exe 89 PID 4696 wrote to memory of 2568 4696 ddvvp.exe 90 PID 4696 wrote to memory of 2568 4696 ddvvp.exe 90 PID 4696 wrote to memory of 2568 4696 ddvvp.exe 90 PID 2568 wrote to memory of 1432 2568 tntnnn.exe 91 PID 2568 wrote to memory of 1432 2568 tntnnn.exe 91 PID 2568 wrote to memory of 1432 2568 tntnnn.exe 91 PID 1432 wrote to memory of 3300 1432 ddddd.exe 92 PID 1432 wrote to memory of 3300 1432 ddddd.exe 92 PID 1432 wrote to memory of 3300 1432 ddddd.exe 92 PID 3300 wrote to memory of 4712 3300 lxxffxx.exe 93 PID 3300 wrote to memory of 4712 3300 lxxffxx.exe 93 PID 3300 wrote to memory of 4712 3300 lxxffxx.exe 93 PID 4712 wrote to memory of 2740 4712 btnntt.exe 94 PID 4712 wrote to memory of 2740 4712 btnntt.exe 94 PID 4712 wrote to memory of 2740 4712 btnntt.exe 94 PID 2740 wrote to memory of 3596 2740 rrrxxll.exe 95 PID 2740 wrote to memory of 3596 2740 rrrxxll.exe 95 PID 2740 wrote to memory of 3596 2740 rrrxxll.exe 95 PID 3596 wrote to memory of 3304 3596 ntbhhh.exe 96 PID 3596 wrote to memory of 3304 3596 ntbhhh.exe 96 PID 3596 wrote to memory of 3304 3596 ntbhhh.exe 96 PID 3304 wrote to memory of 2940 3304 vpddd.exe 97 PID 3304 wrote to memory of 2940 3304 vpddd.exe 97 PID 3304 wrote to memory of 2940 3304 vpddd.exe 97 PID 2940 wrote to memory of 2472 2940 nbhhhb.exe 98 PID 2940 wrote to memory of 2472 2940 nbhhhb.exe 98 PID 2940 wrote to memory of 2472 2940 nbhhhb.exe 98 PID 2472 wrote to memory of 3964 2472 jddvv.exe 99 PID 2472 wrote to memory of 3964 2472 jddvv.exe 99 PID 2472 wrote to memory of 3964 2472 jddvv.exe 99 PID 3964 wrote to memory of 3692 3964 xrrfrxf.exe 100 PID 3964 wrote to memory of 3692 3964 xrrfrxf.exe 100 PID 3964 wrote to memory of 3692 3964 xrrfrxf.exe 100 PID 3692 wrote to memory of 2044 3692 ththhb.exe 102 PID 3692 wrote to memory of 2044 3692 ththhb.exe 102 PID 3692 wrote to memory of 2044 3692 ththhb.exe 102 PID 2044 wrote to memory of 3256 2044 dvdvj.exe 103 PID 2044 wrote to memory of 3256 2044 dvdvj.exe 103 PID 2044 wrote to memory of 3256 2044 dvdvj.exe 103 PID 3256 wrote to memory of 2912 3256 rxrrxrl.exe 105 PID 3256 wrote to memory of 2912 3256 rxrrxrl.exe 105 PID 3256 wrote to memory of 2912 3256 rxrrxrl.exe 105 PID 2912 wrote to memory of 1400 2912 vdppd.exe 106 PID 2912 wrote to memory of 1400 2912 vdppd.exe 106 PID 2912 wrote to memory of 1400 2912 vdppd.exe 106 PID 1400 wrote to memory of 4336 1400 btntnn.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\0145eccfee0be8208e4645c1baa71a45_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0145eccfee0be8208e4645c1baa71a45_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\tnthhh.exec:\tnthhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\ppvvp.exec:\ppvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\rrrxllx.exec:\rrrxllx.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\lllrrxx.exec:\lllrrxx.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\bnttnt.exec:\bnttnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\ddvvp.exec:\ddvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\tntnnn.exec:\tntnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\ddddd.exec:\ddddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\lxxffxx.exec:\lxxffxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\btnntt.exec:\btnntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\rrrxxll.exec:\rrrxxll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ntbhhh.exec:\ntbhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\vpddd.exec:\vpddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\nbhhhb.exec:\nbhhhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\jddvv.exec:\jddvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\xrrfrxf.exec:\xrrfrxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\ththhb.exec:\ththhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\dvdvj.exec:\dvdvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\rxrrxrl.exec:\rxrrxrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\vdppd.exec:\vdppd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\btntnn.exec:\btntnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\flrxrrl.exec:\flrxrrl.exe23⤵
- Executes dropped EXE
PID:4336 -
\??\c:\nttnhb.exec:\nttnhb.exe24⤵
- Executes dropped EXE
PID:3264 -
\??\c:\9hnhnh.exec:\9hnhnh.exe25⤵
- Executes dropped EXE
PID:4488 -
\??\c:\dvjjp.exec:\dvjjp.exe26⤵
- Executes dropped EXE
PID:4100 -
\??\c:\nthhhb.exec:\nthhhb.exe27⤵
- Executes dropped EXE
PID:2904 -
\??\c:\9jvdj.exec:\9jvdj.exe28⤵
- Executes dropped EXE
PID:4668 -
\??\c:\fxrfrfr.exec:\fxrfrfr.exe29⤵
- Executes dropped EXE
PID:5020 -
\??\c:\hbnttt.exec:\hbnttt.exe30⤵
- Executes dropped EXE
PID:4916 -
\??\c:\7djpd.exec:\7djpd.exe31⤵
- Executes dropped EXE
PID:4264 -
\??\c:\vpjjd.exec:\vpjjd.exe32⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rrxxfll.exec:\rrxxfll.exe33⤵
- Executes dropped EXE
PID:4020 -
\??\c:\tbhhht.exec:\tbhhht.exe34⤵
- Executes dropped EXE
PID:924 -
\??\c:\ddjdd.exec:\ddjdd.exe35⤵
- Executes dropped EXE
PID:4044 -
\??\c:\rxllflr.exec:\rxllflr.exe36⤵
- Executes dropped EXE
PID:3456 -
\??\c:\rfrlllx.exec:\rfrlllx.exe37⤵
- Executes dropped EXE
PID:2120 -
\??\c:\3thhnt.exec:\3thhnt.exe38⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vdddv.exec:\vdddv.exe39⤵
- Executes dropped EXE
PID:1368 -
\??\c:\xflllff.exec:\xflllff.exe40⤵
- Executes dropped EXE
PID:4472 -
\??\c:\hthbbb.exec:\hthbbb.exe41⤵
- Executes dropped EXE
PID:3968 -
\??\c:\pjdjj.exec:\pjdjj.exe42⤵
- Executes dropped EXE
PID:4748 -
\??\c:\5xrllxl.exec:\5xrllxl.exe43⤵
- Executes dropped EXE
PID:1204 -
\??\c:\thhbtt.exec:\thhbtt.exe44⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nhnnnh.exec:\nhnnnh.exe45⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jdpjj.exec:\jdpjj.exe46⤵
- Executes dropped EXE
PID:4476 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe47⤵
- Executes dropped EXE
PID:2328 -
\??\c:\bnnbtt.exec:\bnnbtt.exe48⤵
- Executes dropped EXE
PID:4776 -
\??\c:\nthtbt.exec:\nthtbt.exe49⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ddpjj.exec:\ddpjj.exe50⤵
- Executes dropped EXE
PID:1544 -
\??\c:\rrxxflr.exec:\rrxxflr.exe51⤵
- Executes dropped EXE
PID:4112 -
\??\c:\tnnttn.exec:\tnnttn.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4988 -
\??\c:\lrxlrrf.exec:\lrxlrrf.exe53⤵
- Executes dropped EXE
PID:3036 -
\??\c:\llrlllf.exec:\llrlllf.exe54⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hbbhhn.exec:\hbbhhn.exe55⤵
- Executes dropped EXE
PID:3552 -
\??\c:\pjvvj.exec:\pjvvj.exe56⤵
- Executes dropped EXE
PID:1896 -
\??\c:\pdjjj.exec:\pdjjj.exe57⤵
- Executes dropped EXE
PID:3756 -
\??\c:\frxrrlr.exec:\frxrrlr.exe58⤵
- Executes dropped EXE
PID:1708 -
\??\c:\btnnbt.exec:\btnnbt.exe59⤵
- Executes dropped EXE
PID:1412 -
\??\c:\dvvvv.exec:\dvvvv.exe60⤵
- Executes dropped EXE
PID:1244 -
\??\c:\pppvv.exec:\pppvv.exe61⤵
- Executes dropped EXE
PID:2264 -
\??\c:\ffllrlr.exec:\ffllrlr.exe62⤵
- Executes dropped EXE
PID:456 -
\??\c:\9rfrflf.exec:\9rfrflf.exe63⤵
- Executes dropped EXE
PID:1400 -
\??\c:\jjvdd.exec:\jjvdd.exe64⤵
- Executes dropped EXE
PID:3244 -
\??\c:\jpvvj.exec:\jpvvj.exe65⤵
- Executes dropped EXE
PID:4824 -
\??\c:\bbbnnt.exec:\bbbnnt.exe66⤵PID:4436
-
\??\c:\vvddp.exec:\vvddp.exe67⤵PID:3776
-
\??\c:\xffxxxf.exec:\xffxxxf.exe68⤵PID:380
-
\??\c:\3lxxfff.exec:\3lxxfff.exe69⤵PID:4932
-
\??\c:\jdvvj.exec:\jdvvj.exe70⤵
- System Location Discovery: System Language Discovery
PID:4576 -
\??\c:\vjjjj.exec:\vjjjj.exe71⤵PID:4888
-
\??\c:\rlrfflx.exec:\rlrfflx.exe72⤵PID:4652
-
\??\c:\hthnbh.exec:\hthnbh.exe73⤵PID:4180
-
\??\c:\pjpvd.exec:\pjpvd.exe74⤵PID:4332
-
\??\c:\rflllrr.exec:\rflllrr.exe75⤵PID:4036
-
\??\c:\bhtttt.exec:\bhtttt.exe76⤵PID:1268
-
\??\c:\tthhhh.exec:\tthhhh.exe77⤵PID:3312
-
\??\c:\jvvvp.exec:\jvvvp.exe78⤵PID:3888
-
\??\c:\jjjpd.exec:\jjjpd.exe79⤵
- System Location Discovery: System Language Discovery
PID:3416 -
\??\c:\5xrrfll.exec:\5xrrfll.exe80⤵PID:4500
-
\??\c:\xxxxxxf.exec:\xxxxxxf.exe81⤵PID:872
-
\??\c:\btthtb.exec:\btthtb.exe82⤵PID:1768
-
\??\c:\3dvdd.exec:\3dvdd.exe83⤵PID:4808
-
\??\c:\jvjjd.exec:\jvjjd.exe84⤵PID:4404
-
\??\c:\rrllfll.exec:\rrllfll.exe85⤵PID:5012
-
\??\c:\hbhnhh.exec:\hbhnhh.exe86⤵PID:4912
-
\??\c:\5djjv.exec:\5djjv.exe87⤵PID:980
-
\??\c:\ffxxxlr.exec:\ffxxxlr.exe88⤵PID:4728
-
\??\c:\nnnbnn.exec:\nnnbnn.exe89⤵PID:644
-
\??\c:\ttbbbn.exec:\ttbbbn.exe90⤵PID:4304
-
\??\c:\vjpjd.exec:\vjpjd.exe91⤵PID:956
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe92⤵PID:4764
-
\??\c:\nbtnnn.exec:\nbtnnn.exe93⤵PID:4344
-
\??\c:\vvjdv.exec:\vvjdv.exe94⤵PID:4716
-
\??\c:\jvvjv.exec:\jvvjv.exe95⤵PID:732
-
\??\c:\rxrrlfr.exec:\rxrrlfr.exe96⤵PID:3272
-
\??\c:\jjdvp.exec:\jjdvp.exe97⤵PID:3348
-
\??\c:\3lfxxxr.exec:\3lfxxxr.exe98⤵PID:2500
-
\??\c:\tnnnnt.exec:\tnnnnt.exe99⤵PID:2716
-
\??\c:\pvjdd.exec:\pvjdd.exe100⤵PID:4880
-
\??\c:\rxxxrxx.exec:\rxxxrxx.exe101⤵PID:712
-
\??\c:\tttttt.exec:\tttttt.exe102⤵PID:1856
-
\??\c:\vjppd.exec:\vjppd.exe103⤵PID:512
-
\??\c:\dpvpp.exec:\dpvpp.exe104⤵PID:4348
-
\??\c:\lxfxxll.exec:\lxfxxll.exe105⤵PID:668
-
\??\c:\bnnnhn.exec:\bnnnhn.exe106⤵PID:2696
-
\??\c:\bnbhtb.exec:\bnbhtb.exe107⤵PID:1532
-
\??\c:\vpddv.exec:\vpddv.exe108⤵PID:316
-
\??\c:\xrxxrxf.exec:\xrxxrxf.exe109⤵PID:2236
-
\??\c:\1frrflx.exec:\1frrflx.exe110⤵PID:1360
-
\??\c:\nttbbh.exec:\nttbbh.exe111⤵PID:380
-
\??\c:\vvdvd.exec:\vvdvd.exe112⤵PID:4932
-
\??\c:\rrrrlll.exec:\rrrrlll.exe113⤵PID:1504
-
\??\c:\ttbtth.exec:\ttbtth.exe114⤵PID:4572
-
\??\c:\vvjjp.exec:\vvjjp.exe115⤵PID:4652
-
\??\c:\jvvdd.exec:\jvvdd.exe116⤵PID:4180
-
\??\c:\rfrxflr.exec:\rfrxflr.exe117⤵PID:4236
-
\??\c:\bbtbth.exec:\bbtbth.exe118⤵PID:924
-
\??\c:\jppvd.exec:\jppvd.exe119⤵PID:2320
-
\??\c:\9xrlfxr.exec:\9xrlfxr.exe120⤵PID:2232
-
\??\c:\fxllrfr.exec:\fxllrfr.exe121⤵PID:4700
-
\??\c:\nnnnbh.exec:\nnnnbh.exe122⤵PID:3416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-