Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 04:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f529b34255b8bb76491c487db563bb2c_JaffaCakes118.exe
Resource
win7-20240708-en
6 signatures
150 seconds
General
-
Target
f529b34255b8bb76491c487db563bb2c_JaffaCakes118.exe
-
Size
219KB
-
MD5
f529b34255b8bb76491c487db563bb2c
-
SHA1
1b49026c3556038259b17c38a8deed31d287e679
-
SHA256
32db4231dd42dc03c492f7ff48c9bde6a22cad07274019585ff511656593614a
-
SHA512
fd9cd0890fd18888c7966aaa0e13f78ebbba9ab8f19aa426e541d2b76cf29298c63e8f7b1736eb764e545572815c40278ad174cd656e67110362a0e23c3d81b1
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4SS4:n3C9BRo7MlrWKo+lx64
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2956-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2956 ffrlffx.exe 2044 1bhhnn.exe 2740 1dvpd.exe 3700 fflxrrl.exe 3988 3hnbbt.exe 404 jdjjj.exe 4872 lxflxxr.exe 868 lxfxlll.exe 5052 vdpjp.exe 3660 btbthh.exe 612 llrrflf.exe 1564 btbbtt.exe 3772 jpvpj.exe 1588 9rlfrlf.exe 1432 7llxrrl.exe 2916 pjvjv.exe 4508 5lxxfff.exe 1584 hbbbtb.exe 3908 lrllfxx.exe 4808 nhnnht.exe 1788 5djdv.exe 4444 lxrlxxr.exe 2268 btbtnh.exe 3516 3vppj.exe 3268 pjpdj.exe 4868 5bhthb.exe 5096 ddpjj.exe 2220 rrrrxfl.exe 3124 3ttnhn.exe 2536 3tbbhn.exe 5008 pjvpd.exe 3524 ddvvj.exe 2080 lffrlfx.exe 5116 xrxfxfx.exe 3340 bthbnb.exe 1576 vpvvj.exe 540 5ppjv.exe 4036 flxlffr.exe 1112 3tbtbb.exe 4204 tnbnhh.exe 1232 jpjdp.exe 3948 vvddj.exe 4060 lfxrxrx.exe 2628 lrlfxxl.exe 4844 nhnbtn.exe 556 nhbtnn.exe 4092 1pppv.exe 4692 pddvj.exe 2472 1rrrlfx.exe 3744 7fxrllf.exe 316 hbhhnt.exe 3460 bntnhb.exe 2364 dpdvp.exe 4544 vjvpd.exe 1564 llxrllf.exe 4488 ffllffr.exe 4892 ttnhnn.exe 4904 pjdpj.exe 3556 1vpjd.exe 312 lffxrrl.exe 4508 llxrllx.exe 2532 bbbtnh.exe 636 5hbtnh.exe 4464 dvppd.exe -
resource yara_rule behavioral2/memory/4456-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fffxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 2956 4456 f529b34255b8bb76491c487db563bb2c_JaffaCakes118.exe 84 PID 4456 wrote to memory of 2956 4456 f529b34255b8bb76491c487db563bb2c_JaffaCakes118.exe 84 PID 4456 wrote to memory of 2956 4456 f529b34255b8bb76491c487db563bb2c_JaffaCakes118.exe 84 PID 2956 wrote to memory of 2044 2956 ffrlffx.exe 85 PID 2956 wrote to memory of 2044 2956 ffrlffx.exe 85 PID 2956 wrote to memory of 2044 2956 ffrlffx.exe 85 PID 2044 wrote to memory of 2740 2044 1bhhnn.exe 86 PID 2044 wrote to memory of 2740 2044 1bhhnn.exe 86 PID 2044 wrote to memory of 2740 2044 1bhhnn.exe 86 PID 2740 wrote to memory of 3700 2740 1dvpd.exe 87 PID 2740 wrote to memory of 3700 2740 1dvpd.exe 87 PID 2740 wrote to memory of 3700 2740 1dvpd.exe 87 PID 3700 wrote to memory of 3988 3700 fflxrrl.exe 88 PID 3700 wrote to memory of 3988 3700 fflxrrl.exe 88 PID 3700 wrote to memory of 3988 3700 fflxrrl.exe 88 PID 3988 wrote to memory of 404 3988 3hnbbt.exe 89 PID 3988 wrote to memory of 404 3988 3hnbbt.exe 89 PID 3988 wrote to memory of 404 3988 3hnbbt.exe 89 PID 404 wrote to memory of 4872 404 jdjjj.exe 90 PID 404 wrote to memory of 4872 404 jdjjj.exe 90 PID 404 wrote to memory of 4872 404 jdjjj.exe 90 PID 4872 wrote to memory of 868 4872 lxflxxr.exe 91 PID 4872 wrote to memory of 868 4872 lxflxxr.exe 91 PID 4872 wrote to memory of 868 4872 lxflxxr.exe 91 PID 868 wrote to memory of 5052 868 lxfxlll.exe 92 PID 868 wrote to memory of 5052 868 lxfxlll.exe 92 PID 868 wrote to memory of 5052 868 lxfxlll.exe 92 PID 5052 wrote to memory of 3660 5052 vdpjp.exe 93 PID 5052 wrote to memory of 3660 5052 vdpjp.exe 93 PID 5052 wrote to memory of 3660 5052 vdpjp.exe 93 PID 3660 wrote to memory of 612 3660 btbthh.exe 94 PID 3660 wrote to memory of 612 3660 btbthh.exe 94 PID 3660 wrote to memory of 612 3660 btbthh.exe 94 PID 612 wrote to memory of 1564 612 llrrflf.exe 95 PID 612 wrote to memory of 1564 612 llrrflf.exe 95 PID 612 wrote to memory of 1564 612 llrrflf.exe 95 PID 1564 wrote to memory of 3772 1564 btbbtt.exe 96 PID 1564 wrote to memory of 3772 1564 btbbtt.exe 96 PID 1564 wrote to memory of 3772 1564 btbbtt.exe 96 PID 3772 wrote to memory of 1588 3772 jpvpj.exe 97 PID 3772 wrote to memory of 1588 3772 jpvpj.exe 97 PID 3772 wrote to memory of 1588 3772 jpvpj.exe 97 PID 1588 wrote to memory of 1432 1588 9rlfrlf.exe 98 PID 1588 wrote to memory of 1432 1588 9rlfrlf.exe 98 PID 1588 wrote to memory of 1432 1588 9rlfrlf.exe 98 PID 1432 wrote to memory of 2916 1432 7llxrrl.exe 100 PID 1432 wrote to memory of 2916 1432 7llxrrl.exe 100 PID 1432 wrote to memory of 2916 1432 7llxrrl.exe 100 PID 2916 wrote to memory of 4508 2916 pjvjv.exe 101 PID 2916 wrote to memory of 4508 2916 pjvjv.exe 101 PID 2916 wrote to memory of 4508 2916 pjvjv.exe 101 PID 4508 wrote to memory of 1584 4508 5lxxfff.exe 102 PID 4508 wrote to memory of 1584 4508 5lxxfff.exe 102 PID 4508 wrote to memory of 1584 4508 5lxxfff.exe 102 PID 1584 wrote to memory of 3908 1584 hbbbtb.exe 103 PID 1584 wrote to memory of 3908 1584 hbbbtb.exe 103 PID 1584 wrote to memory of 3908 1584 hbbbtb.exe 103 PID 3908 wrote to memory of 4808 3908 lrllfxx.exe 104 PID 3908 wrote to memory of 4808 3908 lrllfxx.exe 104 PID 3908 wrote to memory of 4808 3908 lrllfxx.exe 104 PID 4808 wrote to memory of 1788 4808 nhnnht.exe 105 PID 4808 wrote to memory of 1788 4808 nhnnht.exe 105 PID 4808 wrote to memory of 1788 4808 nhnnht.exe 105 PID 1788 wrote to memory of 4444 1788 5djdv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\f529b34255b8bb76491c487db563bb2c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f529b34255b8bb76491c487db563bb2c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\ffrlffx.exec:\ffrlffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\1bhhnn.exec:\1bhhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\1dvpd.exec:\1dvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\fflxrrl.exec:\fflxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\3hnbbt.exec:\3hnbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\jdjjj.exec:\jdjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\lxflxxr.exec:\lxflxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\lxfxlll.exec:\lxfxlll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\vdpjp.exec:\vdpjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\btbthh.exec:\btbthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\llrrflf.exec:\llrrflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\btbbtt.exec:\btbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\jpvpj.exec:\jpvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\9rlfrlf.exec:\9rlfrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\7llxrrl.exec:\7llxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\pjvjv.exec:\pjvjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\5lxxfff.exec:\5lxxfff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\hbbbtb.exec:\hbbbtb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\lrllfxx.exec:\lrllfxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\nhnnht.exec:\nhnnht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\5djdv.exec:\5djdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\lxrlxxr.exec:\lxrlxxr.exe23⤵
- Executes dropped EXE
PID:4444 -
\??\c:\btbtnh.exec:\btbtnh.exe24⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3vppj.exec:\3vppj.exe25⤵
- Executes dropped EXE
PID:3516 -
\??\c:\pjpdj.exec:\pjpdj.exe26⤵
- Executes dropped EXE
PID:3268 -
\??\c:\5bhthb.exec:\5bhthb.exe27⤵
- Executes dropped EXE
PID:4868 -
\??\c:\ddpjj.exec:\ddpjj.exe28⤵
- Executes dropped EXE
PID:5096 -
\??\c:\rrrrxfl.exec:\rrrrxfl.exe29⤵
- Executes dropped EXE
PID:2220 -
\??\c:\3ttnhn.exec:\3ttnhn.exe30⤵
- Executes dropped EXE
PID:3124 -
\??\c:\3tbbhn.exec:\3tbbhn.exe31⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pjvpd.exec:\pjvpd.exe32⤵
- Executes dropped EXE
PID:5008 -
\??\c:\ddvvj.exec:\ddvvj.exe33⤵
- Executes dropped EXE
PID:3524 -
\??\c:\lffrlfx.exec:\lffrlfx.exe34⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xrxfxfx.exec:\xrxfxfx.exe35⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bthbnb.exec:\bthbnb.exe36⤵
- Executes dropped EXE
PID:3340 -
\??\c:\vpvvj.exec:\vpvvj.exe37⤵
- Executes dropped EXE
PID:1576 -
\??\c:\5ppjv.exec:\5ppjv.exe38⤵
- Executes dropped EXE
PID:540 -
\??\c:\flxlffr.exec:\flxlffr.exe39⤵
- Executes dropped EXE
PID:4036 -
\??\c:\3tbtbb.exec:\3tbtbb.exe40⤵
- Executes dropped EXE
PID:1112 -
\??\c:\tnbnhh.exec:\tnbnhh.exe41⤵
- Executes dropped EXE
PID:4204 -
\??\c:\jpjdp.exec:\jpjdp.exe42⤵
- Executes dropped EXE
PID:1232 -
\??\c:\vvddj.exec:\vvddj.exe43⤵
- Executes dropped EXE
PID:3948 -
\??\c:\lfxrxrx.exec:\lfxrxrx.exe44⤵
- Executes dropped EXE
PID:4060 -
\??\c:\lrlfxxl.exec:\lrlfxxl.exe45⤵
- Executes dropped EXE
PID:2628 -
\??\c:\nhnbtn.exec:\nhnbtn.exe46⤵
- Executes dropped EXE
PID:4844 -
\??\c:\nhbtnn.exec:\nhbtnn.exe47⤵
- Executes dropped EXE
PID:556 -
\??\c:\1pppv.exec:\1pppv.exe48⤵
- Executes dropped EXE
PID:4092 -
\??\c:\pddvj.exec:\pddvj.exe49⤵
- Executes dropped EXE
PID:4692 -
\??\c:\1rrrlfx.exec:\1rrrlfx.exe50⤵
- Executes dropped EXE
PID:2472 -
\??\c:\7fxrllf.exec:\7fxrllf.exe51⤵
- Executes dropped EXE
PID:3744 -
\??\c:\hbhhnt.exec:\hbhhnt.exe52⤵
- Executes dropped EXE
PID:316 -
\??\c:\bntnhb.exec:\bntnhb.exe53⤵
- Executes dropped EXE
PID:3460 -
\??\c:\dpdvp.exec:\dpdvp.exe54⤵
- Executes dropped EXE
PID:2364 -
\??\c:\vjvpd.exec:\vjvpd.exe55⤵
- Executes dropped EXE
PID:4544 -
\??\c:\llxrllf.exec:\llxrllf.exe56⤵
- Executes dropped EXE
PID:1564 -
\??\c:\ffllffr.exec:\ffllffr.exe57⤵
- Executes dropped EXE
PID:4488 -
\??\c:\ttnhnn.exec:\ttnhnn.exe58⤵
- Executes dropped EXE
PID:4892 -
\??\c:\pjdpj.exec:\pjdpj.exe59⤵
- Executes dropped EXE
PID:4904 -
\??\c:\1vpjd.exec:\1vpjd.exe60⤵
- Executes dropped EXE
PID:3556 -
\??\c:\lffxrrl.exec:\lffxrrl.exe61⤵
- Executes dropped EXE
PID:312 -
\??\c:\llxrllx.exec:\llxrllx.exe62⤵
- Executes dropped EXE
PID:4508 -
\??\c:\bbbtnh.exec:\bbbtnh.exe63⤵
- Executes dropped EXE
PID:2532 -
\??\c:\5hbtnh.exec:\5hbtnh.exe64⤵
- Executes dropped EXE
PID:636 -
\??\c:\dvppd.exec:\dvppd.exe65⤵
- Executes dropped EXE
PID:4464 -
\??\c:\dvvdp.exec:\dvvdp.exe66⤵PID:1052
-
\??\c:\frfxrrl.exec:\frfxrrl.exe67⤵PID:4320
-
\??\c:\3rxrllf.exec:\3rxrllf.exe68⤵PID:3012
-
\??\c:\ntnnnn.exec:\ntnnnn.exe69⤵PID:2684
-
\??\c:\btnhtn.exec:\btnhtn.exe70⤵PID:1836
-
\??\c:\vjjpd.exec:\vjjpd.exe71⤵PID:3268
-
\??\c:\pjvpj.exec:\pjvpj.exe72⤵PID:5032
-
\??\c:\frrfrrl.exec:\frrfrrl.exe73⤵PID:3036
-
\??\c:\llrlfxx.exec:\llrlfxx.exe74⤵PID:2556
-
\??\c:\tbnhhn.exec:\tbnhhn.exe75⤵PID:5048
-
\??\c:\hntnbt.exec:\hntnbt.exe76⤵PID:2220
-
\??\c:\vvvpd.exec:\vvvpd.exe77⤵PID:3332
-
\??\c:\djdpv.exec:\djdpv.exe78⤵PID:1872
-
\??\c:\9xxxrrr.exec:\9xxxrrr.exe79⤵PID:1916
-
\??\c:\rflfxxx.exec:\rflfxxx.exe80⤵PID:4648
-
\??\c:\7hhbtt.exec:\7hhbtt.exe81⤵PID:2080
-
\??\c:\hbttnn.exec:\hbttnn.exe82⤵PID:2292
-
\??\c:\9vvpj.exec:\9vvpj.exe83⤵PID:2016
-
\??\c:\pppjd.exec:\pppjd.exe84⤵PID:1072
-
\??\c:\5llxfxr.exec:\5llxfxr.exe85⤵PID:4348
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe86⤵PID:4036
-
\??\c:\btnhbb.exec:\btnhbb.exe87⤵PID:5004
-
\??\c:\nbnbnn.exec:\nbnbnn.exe88⤵PID:3532
-
\??\c:\1jdpd.exec:\1jdpd.exe89⤵PID:1448
-
\??\c:\ddjjj.exec:\ddjjj.exe90⤵PID:3948
-
\??\c:\rfrlffx.exec:\rfrlffx.exe91⤵PID:4940
-
\??\c:\lxrrlff.exec:\lxrrlff.exe92⤵PID:2160
-
\??\c:\hbbtnn.exec:\hbbtnn.exe93⤵PID:524
-
\??\c:\bhnhtt.exec:\bhnhtt.exe94⤵PID:2968
-
\??\c:\jdpjj.exec:\jdpjj.exe95⤵PID:2412
-
\??\c:\3jdpj.exec:\3jdpj.exe96⤵PID:5036
-
\??\c:\3ffrffx.exec:\3ffrffx.exe97⤵PID:4268
-
\??\c:\3rxrlfx.exec:\3rxrlfx.exe98⤵PID:5052
-
\??\c:\nnhbhb.exec:\nnhbhb.exe99⤵PID:464
-
\??\c:\7pjjd.exec:\7pjjd.exe100⤵PID:1740
-
\??\c:\ppjpp.exec:\ppjpp.exe101⤵PID:612
-
\??\c:\tnhthh.exec:\tnhthh.exe102⤵PID:3712
-
\??\c:\bntnhh.exec:\bntnhh.exe103⤵PID:3384
-
\??\c:\pjjdp.exec:\pjjdp.exe104⤵PID:5076
-
\??\c:\vdjdd.exec:\vdjdd.exe105⤵PID:1216
-
\??\c:\tbbtnn.exec:\tbbtnn.exe106⤵PID:2592
-
\??\c:\tbhhnh.exec:\tbhhnh.exe107⤵PID:4504
-
\??\c:\vjpdv.exec:\vjpdv.exe108⤵PID:4508
-
\??\c:\rllffxr.exec:\rllffxr.exe109⤵PID:3908
-
\??\c:\xflrlfx.exec:\xflrlfx.exe110⤵PID:5000
-
\??\c:\ttbbtb.exec:\ttbbtb.exe111⤵PID:2204
-
\??\c:\7nthtn.exec:\7nthtn.exe112⤵PID:4596
-
\??\c:\jdvpj.exec:\jdvpj.exe113⤵PID:4384
-
\??\c:\pjddd.exec:\pjddd.exe114⤵PID:392
-
\??\c:\xllfrrx.exec:\xllfrrx.exe115⤵PID:4628
-
\??\c:\rrrlffx.exec:\rrrlffx.exe116⤵PID:4276
-
\??\c:\hbnnnt.exec:\hbnnnt.exe117⤵PID:2092
-
\??\c:\dvvvj.exec:\dvvvj.exe118⤵PID:2452
-
\??\c:\pvppj.exec:\pvppj.exe119⤵PID:812
-
\??\c:\1rllrrf.exec:\1rllrrf.exe120⤵PID:4356
-
\??\c:\nbhtnt.exec:\nbhtnt.exe121⤵PID:2488
-
\??\c:\tbhtnb.exec:\tbhtnb.exe122⤵PID:5008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-