Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
ac27c6b54a296dbd640115bfdabd85b2_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
ac27c6b54a296dbd640115bfdabd85b2_JaffaCakes118.exe
-
Size
52KB
-
MD5
ac27c6b54a296dbd640115bfdabd85b2
-
SHA1
e7cccb0998b22af764d8a76c94c1d8a25c2c8750
-
SHA256
794dee63f6fc393e9ea70e448d5307d78a45c7b34e6151893816d202fbf4afee
-
SHA512
135a15c5cec81af209dd9e7b0aab9e5b4b96061049947a7fddbeb69b8ac8bf5f7d8977a15b1e9a2e5518614478d210565ecbf0fe31d21fb90026ff3c7f958723
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDod5k2nd:ymb3NkkiQ3mdBjFod5znd
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3112-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1352-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1896 hthbtt.exe 2520 jdvpj.exe 4032 fxflfxr.exe 2792 nbbtnh.exe 1352 7pjdv.exe 4236 1fxrxxr.exe 1156 1tnhtt.exe 1052 1ttthb.exe 368 lffxrlx.exe 2712 thbhtt.exe 2556 jvvjd.exe 5024 jvdpd.exe 1080 xrlfrrl.exe 1872 7lfrfrf.exe 3540 3thbtn.exe 4196 9vjdp.exe 768 xlxrlfr.exe 2100 9xfrfrl.exe 1276 tnbthb.exe 4696 pvvdj.exe 4404 9lxlxrl.exe 1996 fllfxrr.exe 3516 btnnhb.exe 3456 jvjjj.exe 3824 5jpjd.exe 712 flrlfxr.exe 4572 nbnntn.exe 4556 bhhnnb.exe 3644 7htnbt.exe 4340 9jvpv.exe 4392 flrlllf.exe 4484 llfrlll.exe 2084 hbttnn.exe 3524 jddvp.exe 2520 ffxrllx.exe 4252 fxrrlll.exe 4924 rxllrxf.exe 1652 htnhbb.exe 2788 1vddp.exe 1220 lrfllxx.exe 1796 rlrlllr.exe 4988 bttnbh.exe 1412 jjjvv.exe 3936 7vvdp.exe 532 fflrrrr.exe 2932 rfllxrl.exe 3796 hbbbbb.exe 2852 1dddv.exe 4248 djppp.exe 1948 7jdvp.exe 1540 llrrfll.exe 1952 lflfrlf.exe 1036 tnbntn.exe 4448 bbbttt.exe 4544 vpvpv.exe 3396 jvdjd.exe 1324 lfxllrr.exe 2572 rfxrlrl.exe 3772 thhnhn.exe 2896 pjvvd.exe 228 3ppjv.exe 4068 5rxrfrr.exe 3508 1fffxff.exe 4668 nhhtnn.exe -
resource yara_rule behavioral2/memory/3112-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-216-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3112 wrote to memory of 1896 3112 ac27c6b54a296dbd640115bfdabd85b2_JaffaCakes118.exe 84 PID 3112 wrote to memory of 1896 3112 ac27c6b54a296dbd640115bfdabd85b2_JaffaCakes118.exe 84 PID 3112 wrote to memory of 1896 3112 ac27c6b54a296dbd640115bfdabd85b2_JaffaCakes118.exe 84 PID 1896 wrote to memory of 2520 1896 hthbtt.exe 85 PID 1896 wrote to memory of 2520 1896 hthbtt.exe 85 PID 1896 wrote to memory of 2520 1896 hthbtt.exe 85 PID 2520 wrote to memory of 4032 2520 jdvpj.exe 86 PID 2520 wrote to memory of 4032 2520 jdvpj.exe 86 PID 2520 wrote to memory of 4032 2520 jdvpj.exe 86 PID 4032 wrote to memory of 2792 4032 fxflfxr.exe 88 PID 4032 wrote to memory of 2792 4032 fxflfxr.exe 88 PID 4032 wrote to memory of 2792 4032 fxflfxr.exe 88 PID 2792 wrote to memory of 1352 2792 nbbtnh.exe 89 PID 2792 wrote to memory of 1352 2792 nbbtnh.exe 89 PID 2792 wrote to memory of 1352 2792 nbbtnh.exe 89 PID 1352 wrote to memory of 4236 1352 7pjdv.exe 90 PID 1352 wrote to memory of 4236 1352 7pjdv.exe 90 PID 1352 wrote to memory of 4236 1352 7pjdv.exe 90 PID 4236 wrote to memory of 1156 4236 1fxrxxr.exe 91 PID 4236 wrote to memory of 1156 4236 1fxrxxr.exe 91 PID 4236 wrote to memory of 1156 4236 1fxrxxr.exe 91 PID 1156 wrote to memory of 1052 1156 1tnhtt.exe 92 PID 1156 wrote to memory of 1052 1156 1tnhtt.exe 92 PID 1156 wrote to memory of 1052 1156 1tnhtt.exe 92 PID 1052 wrote to memory of 368 1052 1ttthb.exe 93 PID 1052 wrote to memory of 368 1052 1ttthb.exe 93 PID 1052 wrote to memory of 368 1052 1ttthb.exe 93 PID 368 wrote to memory of 2712 368 lffxrlx.exe 94 PID 368 wrote to memory of 2712 368 lffxrlx.exe 94 PID 368 wrote to memory of 2712 368 lffxrlx.exe 94 PID 2712 wrote to memory of 2556 2712 thbhtt.exe 95 PID 2712 wrote to memory of 2556 2712 thbhtt.exe 95 PID 2712 wrote to memory of 2556 2712 thbhtt.exe 95 PID 2556 wrote to memory of 5024 2556 jvvjd.exe 96 PID 2556 wrote to memory of 5024 2556 jvvjd.exe 96 PID 2556 wrote to memory of 5024 2556 jvvjd.exe 96 PID 5024 wrote to memory of 1080 5024 jvdpd.exe 98 PID 5024 wrote to memory of 1080 5024 jvdpd.exe 98 PID 5024 wrote to memory of 1080 5024 jvdpd.exe 98 PID 1080 wrote to memory of 1872 1080 xrlfrrl.exe 99 PID 1080 wrote to memory of 1872 1080 xrlfrrl.exe 99 PID 1080 wrote to memory of 1872 1080 xrlfrrl.exe 99 PID 1872 wrote to memory of 3540 1872 7lfrfrf.exe 100 PID 1872 wrote to memory of 3540 1872 7lfrfrf.exe 100 PID 1872 wrote to memory of 3540 1872 7lfrfrf.exe 100 PID 3540 wrote to memory of 4196 3540 3thbtn.exe 101 PID 3540 wrote to memory of 4196 3540 3thbtn.exe 101 PID 3540 wrote to memory of 4196 3540 3thbtn.exe 101 PID 4196 wrote to memory of 768 4196 9vjdp.exe 102 PID 4196 wrote to memory of 768 4196 9vjdp.exe 102 PID 4196 wrote to memory of 768 4196 9vjdp.exe 102 PID 768 wrote to memory of 2100 768 xlxrlfr.exe 103 PID 768 wrote to memory of 2100 768 xlxrlfr.exe 103 PID 768 wrote to memory of 2100 768 xlxrlfr.exe 103 PID 2100 wrote to memory of 1276 2100 9xfrfrl.exe 105 PID 2100 wrote to memory of 1276 2100 9xfrfrl.exe 105 PID 2100 wrote to memory of 1276 2100 9xfrfrl.exe 105 PID 1276 wrote to memory of 4696 1276 tnbthb.exe 106 PID 1276 wrote to memory of 4696 1276 tnbthb.exe 106 PID 1276 wrote to memory of 4696 1276 tnbthb.exe 106 PID 4696 wrote to memory of 4404 4696 pvvdj.exe 107 PID 4696 wrote to memory of 4404 4696 pvvdj.exe 107 PID 4696 wrote to memory of 4404 4696 pvvdj.exe 107 PID 4404 wrote to memory of 1996 4404 9lxlxrl.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac27c6b54a296dbd640115bfdabd85b2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ac27c6b54a296dbd640115bfdabd85b2_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\hthbtt.exec:\hthbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\jdvpj.exec:\jdvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\fxflfxr.exec:\fxflfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\nbbtnh.exec:\nbbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\7pjdv.exec:\7pjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\1fxrxxr.exec:\1fxrxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\1tnhtt.exec:\1tnhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\1ttthb.exec:\1ttthb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\lffxrlx.exec:\lffxrlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\thbhtt.exec:\thbhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\jvvjd.exec:\jvvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\jvdpd.exec:\jvdpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\7lfrfrf.exec:\7lfrfrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\3thbtn.exec:\3thbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\9vjdp.exec:\9vjdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\xlxrlfr.exec:\xlxrlfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\9xfrfrl.exec:\9xfrfrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\tnbthb.exec:\tnbthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\pvvdj.exec:\pvvdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\9lxlxrl.exec:\9lxlxrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\fllfxrr.exec:\fllfxrr.exe23⤵
- Executes dropped EXE
PID:1996 -
\??\c:\btnnhb.exec:\btnnhb.exe24⤵
- Executes dropped EXE
PID:3516 -
\??\c:\jvjjj.exec:\jvjjj.exe25⤵
- Executes dropped EXE
PID:3456 -
\??\c:\5jpjd.exec:\5jpjd.exe26⤵
- Executes dropped EXE
PID:3824 -
\??\c:\flrlfxr.exec:\flrlfxr.exe27⤵
- Executes dropped EXE
PID:712 -
\??\c:\nbnntn.exec:\nbnntn.exe28⤵
- Executes dropped EXE
PID:4572 -
\??\c:\bhhnnb.exec:\bhhnnb.exe29⤵
- Executes dropped EXE
PID:4556 -
\??\c:\7htnbt.exec:\7htnbt.exe30⤵
- Executes dropped EXE
PID:3644 -
\??\c:\9jvpv.exec:\9jvpv.exe31⤵
- Executes dropped EXE
PID:4340 -
\??\c:\flrlllf.exec:\flrlllf.exe32⤵
- Executes dropped EXE
PID:4392 -
\??\c:\llfrlll.exec:\llfrlll.exe33⤵
- Executes dropped EXE
PID:4484 -
\??\c:\hbttnn.exec:\hbttnn.exe34⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jddvp.exec:\jddvp.exe35⤵
- Executes dropped EXE
PID:3524 -
\??\c:\ffxrllx.exec:\ffxrllx.exe36⤵
- Executes dropped EXE
PID:2520 -
\??\c:\fxrrlll.exec:\fxrrlll.exe37⤵
- Executes dropped EXE
PID:4252 -
\??\c:\rxllrxf.exec:\rxllrxf.exe38⤵
- Executes dropped EXE
PID:4924 -
\??\c:\htnhbb.exec:\htnhbb.exe39⤵
- Executes dropped EXE
PID:1652 -
\??\c:\1vddp.exec:\1vddp.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\lrfllxx.exec:\lrfllxx.exe41⤵
- Executes dropped EXE
PID:1220 -
\??\c:\rlrlllr.exec:\rlrlllr.exe42⤵
- Executes dropped EXE
PID:1796 -
\??\c:\bttnbh.exec:\bttnbh.exe43⤵
- Executes dropped EXE
PID:4988 -
\??\c:\jjjvv.exec:\jjjvv.exe44⤵
- Executes dropped EXE
PID:1412 -
\??\c:\7vvdp.exec:\7vvdp.exe45⤵
- Executes dropped EXE
PID:3936 -
\??\c:\fflrrrr.exec:\fflrrrr.exe46⤵
- Executes dropped EXE
PID:532 -
\??\c:\rfllxrl.exec:\rfllxrl.exe47⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hbbbbb.exec:\hbbbbb.exe48⤵
- Executes dropped EXE
PID:3796 -
\??\c:\1dddv.exec:\1dddv.exe49⤵
- Executes dropped EXE
PID:2852 -
\??\c:\djppp.exec:\djppp.exe50⤵
- Executes dropped EXE
PID:4248 -
\??\c:\7jdvp.exec:\7jdvp.exe51⤵
- Executes dropped EXE
PID:1948 -
\??\c:\llrrfll.exec:\llrrfll.exe52⤵
- Executes dropped EXE
PID:1540 -
\??\c:\lflfrlf.exec:\lflfrlf.exe53⤵
- Executes dropped EXE
PID:1952 -
\??\c:\tnbntn.exec:\tnbntn.exe54⤵
- Executes dropped EXE
PID:1036 -
\??\c:\bbbttt.exec:\bbbttt.exe55⤵
- Executes dropped EXE
PID:4448 -
\??\c:\vpvpv.exec:\vpvpv.exe56⤵
- Executes dropped EXE
PID:4544 -
\??\c:\jvdjd.exec:\jvdjd.exe57⤵
- Executes dropped EXE
PID:3396 -
\??\c:\lfxllrr.exec:\lfxllrr.exe58⤵
- Executes dropped EXE
PID:1324 -
\??\c:\rfxrlrl.exec:\rfxrlrl.exe59⤵
- Executes dropped EXE
PID:2572 -
\??\c:\thhnhn.exec:\thhnhn.exe60⤵
- Executes dropped EXE
PID:3772 -
\??\c:\pjvvd.exec:\pjvvd.exe61⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3ppjv.exec:\3ppjv.exe62⤵
- Executes dropped EXE
PID:228 -
\??\c:\5rxrfrr.exec:\5rxrfrr.exe63⤵
- Executes dropped EXE
PID:4068 -
\??\c:\1fffxff.exec:\1fffxff.exe64⤵
- Executes dropped EXE
PID:3508 -
\??\c:\nhhtnn.exec:\nhhtnn.exe65⤵
- Executes dropped EXE
PID:4668 -
\??\c:\djdvp.exec:\djdvp.exe66⤵PID:4240
-
\??\c:\jjjvp.exec:\jjjvp.exe67⤵PID:3456
-
\??\c:\xxrlffx.exec:\xxrlffx.exe68⤵PID:3144
-
\??\c:\ffrxllf.exec:\ffrxllf.exe69⤵PID:1164
-
\??\c:\nntnhn.exec:\nntnhn.exe70⤵PID:980
-
\??\c:\nnnnht.exec:\nnnnht.exe71⤵PID:2260
-
\??\c:\vjjdv.exec:\vjjdv.exe72⤵PID:844
-
\??\c:\pppjd.exec:\pppjd.exe73⤵PID:4848
-
\??\c:\xfflrxf.exec:\xfflrxf.exe74⤵PID:3028
-
\??\c:\lrrrrrl.exec:\lrrrrrl.exe75⤵PID:4092
-
\??\c:\tnnhbb.exec:\tnnhbb.exe76⤵PID:2908
-
\??\c:\tnttnn.exec:\tnttnn.exe77⤵PID:3208
-
\??\c:\ddppv.exec:\ddppv.exe78⤵PID:1216
-
\??\c:\ddpjd.exec:\ddpjd.exe79⤵PID:3524
-
\??\c:\5xfrllr.exec:\5xfrllr.exe80⤵PID:1004
-
\??\c:\1llfxll.exec:\1llfxll.exe81⤵PID:1848
-
\??\c:\frxrlxl.exec:\frxrlxl.exe82⤵PID:3696
-
\??\c:\htttnn.exec:\htttnn.exe83⤵PID:1132
-
\??\c:\pvvvv.exec:\pvvvv.exe84⤵PID:2488
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe85⤵PID:3128
-
\??\c:\nnnnnn.exec:\nnnnnn.exe86⤵PID:4808
-
\??\c:\ttttnn.exec:\ttttnn.exe87⤵PID:2044
-
\??\c:\pjpjj.exec:\pjpjj.exe88⤵PID:4084
-
\??\c:\xxrxxxr.exec:\xxrxxxr.exe89⤵PID:3384
-
\??\c:\rlfffff.exec:\rlfffff.exe90⤵PID:3992
-
\??\c:\9xxrrrl.exec:\9xxrrrl.exe91⤵PID:3136
-
\??\c:\9htttt.exec:\9htttt.exe92⤵PID:3876
-
\??\c:\bttbth.exec:\bttbth.exe93⤵PID:3180
-
\??\c:\vpdvp.exec:\vpdvp.exe94⤵PID:3916
-
\??\c:\dvddv.exec:\dvddv.exe95⤵PID:2612
-
\??\c:\rfrllrl.exec:\rfrllrl.exe96⤵PID:3252
-
\??\c:\rflfrlx.exec:\rflfrlx.exe97⤵PID:5036
-
\??\c:\3nnhhh.exec:\3nnhhh.exe98⤵PID:4220
-
\??\c:\5hthbb.exec:\5hthbb.exe99⤵PID:4196
-
\??\c:\7djjv.exec:\7djjv.exe100⤵PID:540
-
\??\c:\jdvjd.exec:\jdvjd.exe101⤵PID:2028
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe102⤵PID:1284
-
\??\c:\btnhth.exec:\btnhth.exe103⤵PID:1756
-
\??\c:\jddvd.exec:\jddvd.exe104⤵PID:716
-
\??\c:\pvvpj.exec:\pvvpj.exe105⤵PID:4900
-
\??\c:\ffffrlf.exec:\ffffrlf.exe106⤵PID:4800
-
\??\c:\ttnnhh.exec:\ttnnhh.exe107⤵PID:2772
-
\??\c:\hnbtnt.exec:\hnbtnt.exe108⤵PID:1996
-
\??\c:\ddddd.exec:\ddddd.exe109⤵PID:1940
-
\??\c:\7ddvd.exec:\7ddvd.exe110⤵PID:4140
-
\??\c:\xlxrlll.exec:\xlxrlll.exe111⤵PID:2376
-
\??\c:\btthtt.exec:\btthtt.exe112⤵PID:1900
-
\??\c:\5hnhhb.exec:\5hnhhb.exe113⤵PID:980
-
\??\c:\9jppj.exec:\9jppj.exe114⤵PID:4588
-
\??\c:\djjdv.exec:\djjdv.exe115⤵PID:4372
-
\??\c:\lfffrrr.exec:\lfffrrr.exe116⤵PID:4340
-
\??\c:\llfrlfx.exec:\llfrlfx.exe117⤵PID:3028
-
\??\c:\bbnhtn.exec:\bbnhtn.exe118⤵PID:3124
-
\??\c:\hnttnn.exec:\hnttnn.exe119⤵PID:3392
-
\??\c:\pvddp.exec:\pvddp.exe120⤵PID:4504
-
\??\c:\jpdvp.exec:\jpdvp.exe121⤵PID:4592
-
\??\c:\xffxrlx.exec:\xffxrlx.exe122⤵PID:3068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-