Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 03:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02571da8f25665e3ec754d43822aec1d_JaffaCakes118.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
02571da8f25665e3ec754d43822aec1d_JaffaCakes118.exe
-
Size
198KB
-
MD5
02571da8f25665e3ec754d43822aec1d
-
SHA1
b5d19fe45266625319e2e2f1293a8b1779b3c789
-
SHA256
5849f424983eda4a8e4f1ee10e0c77d0338397d77a9acb91bebf34706c3da882
-
SHA512
c4229cd0f1560ac06807d0c212f7498fed24c955a8584b4b38d33cd5584704ec3873468069738748142ce07abfce83deef3f00eaebd02543b0b112c02ce76317
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqyV/TW:PhOm2sI93UufdC67cihV/TW
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2344-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2092-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/656-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-319-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-328-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-343-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-364-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-411-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-427-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-456-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-474-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-482-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-504-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-592-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-599-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1144-636-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-656-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-718-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-752-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-778-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-807-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-816-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-971-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-1166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-1176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3696 nnttnn.exe 1400 jpvpj.exe 4488 9flffff.exe 4212 tbbtnh.exe 2292 3djdd.exe 4756 fxlfffl.exe 3880 rlllffx.exe 3840 9nthhh.exe 5060 3jjjd.exe 3348 pdppj.exe 2928 hhtnnt.exe 2092 pvddd.exe 3524 3djdv.exe 3092 nhnhhb.exe 1280 jdjdv.exe 3356 xlrrlxr.exe 4216 hntttt.exe 4204 vpvvp.exe 4384 rrrrfxr.exe 1860 hbbhhn.exe 1196 3jjdp.exe 1404 ffrlxfx.exe 3972 ntbnnn.exe 2012 vpdvv.exe 2324 ffrlxxr.exe 3888 tnnnnn.exe 2892 ntbtnn.exe 5108 dpjdp.exe 1472 rffxxxx.exe 5004 nhbbbb.exe 656 djvpj.exe 2572 5pvpd.exe 1496 lxllxxr.exe 1068 hhnnhh.exe 1708 pvvpd.exe 5084 3dpdv.exe 1624 flflfrl.exe 4492 thttbb.exe 4164 3pvpd.exe 4280 pjpjd.exe 4300 3rfxxxf.exe 2440 lfrrxxl.exe 236 bbbbtt.exe 4560 vpjdd.exe 4932 rrllfll.exe 3560 9lrlffx.exe 3876 ntttnn.exe 4756 3ddvj.exe 3932 xxxfffx.exe 3484 bbnhnn.exe 212 dpdvd.exe 1892 fxrlffx.exe 4256 rrffxxx.exe 4572 tntntt.exe 3432 3hnhtt.exe 2696 3dpjv.exe 3976 jdvpd.exe 3424 7xxrlxx.exe 4564 xrrrllf.exe 3524 btthhb.exe 2688 hbbnhh.exe 4372 9vvvp.exe 1156 3vddd.exe 3120 frxxrxr.exe -
resource yara_rule behavioral2/memory/2344-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-343-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-356-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-364-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-405-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-411-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-427-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-456-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-474-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-482-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-504-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-559-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-566-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-576-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-592-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-599-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 3696 2344 02571da8f25665e3ec754d43822aec1d_JaffaCakes118.exe 81 PID 2344 wrote to memory of 3696 2344 02571da8f25665e3ec754d43822aec1d_JaffaCakes118.exe 81 PID 2344 wrote to memory of 3696 2344 02571da8f25665e3ec754d43822aec1d_JaffaCakes118.exe 81 PID 3696 wrote to memory of 1400 3696 nnttnn.exe 82 PID 3696 wrote to memory of 1400 3696 nnttnn.exe 82 PID 3696 wrote to memory of 1400 3696 nnttnn.exe 82 PID 1400 wrote to memory of 4488 1400 jpvpj.exe 83 PID 1400 wrote to memory of 4488 1400 jpvpj.exe 83 PID 1400 wrote to memory of 4488 1400 jpvpj.exe 83 PID 4488 wrote to memory of 4212 4488 9flffff.exe 84 PID 4488 wrote to memory of 4212 4488 9flffff.exe 84 PID 4488 wrote to memory of 4212 4488 9flffff.exe 84 PID 4212 wrote to memory of 2292 4212 tbbtnh.exe 86 PID 4212 wrote to memory of 2292 4212 tbbtnh.exe 86 PID 4212 wrote to memory of 2292 4212 tbbtnh.exe 86 PID 2292 wrote to memory of 4756 2292 3djdd.exe 87 PID 2292 wrote to memory of 4756 2292 3djdd.exe 87 PID 2292 wrote to memory of 4756 2292 3djdd.exe 87 PID 4756 wrote to memory of 3880 4756 fxlfffl.exe 88 PID 4756 wrote to memory of 3880 4756 fxlfffl.exe 88 PID 4756 wrote to memory of 3880 4756 fxlfffl.exe 88 PID 3880 wrote to memory of 3840 3880 rlllffx.exe 89 PID 3880 wrote to memory of 3840 3880 rlllffx.exe 89 PID 3880 wrote to memory of 3840 3880 rlllffx.exe 89 PID 3840 wrote to memory of 5060 3840 9nthhh.exe 90 PID 3840 wrote to memory of 5060 3840 9nthhh.exe 90 PID 3840 wrote to memory of 5060 3840 9nthhh.exe 90 PID 5060 wrote to memory of 3348 5060 3jjjd.exe 91 PID 5060 wrote to memory of 3348 5060 3jjjd.exe 91 PID 5060 wrote to memory of 3348 5060 3jjjd.exe 91 PID 3348 wrote to memory of 2928 3348 pdppj.exe 92 PID 3348 wrote to memory of 2928 3348 pdppj.exe 92 PID 3348 wrote to memory of 2928 3348 pdppj.exe 92 PID 2928 wrote to memory of 2092 2928 hhtnnt.exe 93 PID 2928 wrote to memory of 2092 2928 hhtnnt.exe 93 PID 2928 wrote to memory of 2092 2928 hhtnnt.exe 93 PID 2092 wrote to memory of 3524 2092 pvddd.exe 94 PID 2092 wrote to memory of 3524 2092 pvddd.exe 94 PID 2092 wrote to memory of 3524 2092 pvddd.exe 94 PID 3524 wrote to memory of 3092 3524 3djdv.exe 95 PID 3524 wrote to memory of 3092 3524 3djdv.exe 95 PID 3524 wrote to memory of 3092 3524 3djdv.exe 95 PID 3092 wrote to memory of 1280 3092 nhnhhb.exe 96 PID 3092 wrote to memory of 1280 3092 nhnhhb.exe 96 PID 3092 wrote to memory of 1280 3092 nhnhhb.exe 96 PID 1280 wrote to memory of 3356 1280 jdjdv.exe 97 PID 1280 wrote to memory of 3356 1280 jdjdv.exe 97 PID 1280 wrote to memory of 3356 1280 jdjdv.exe 97 PID 3356 wrote to memory of 4216 3356 xlrrlxr.exe 98 PID 3356 wrote to memory of 4216 3356 xlrrlxr.exe 98 PID 3356 wrote to memory of 4216 3356 xlrrlxr.exe 98 PID 4216 wrote to memory of 4204 4216 hntttt.exe 99 PID 4216 wrote to memory of 4204 4216 hntttt.exe 99 PID 4216 wrote to memory of 4204 4216 hntttt.exe 99 PID 4204 wrote to memory of 4384 4204 vpvvp.exe 100 PID 4204 wrote to memory of 4384 4204 vpvvp.exe 100 PID 4204 wrote to memory of 4384 4204 vpvvp.exe 100 PID 4384 wrote to memory of 1860 4384 rrrrfxr.exe 101 PID 4384 wrote to memory of 1860 4384 rrrrfxr.exe 101 PID 4384 wrote to memory of 1860 4384 rrrrfxr.exe 101 PID 1860 wrote to memory of 1196 1860 hbbhhn.exe 102 PID 1860 wrote to memory of 1196 1860 hbbhhn.exe 102 PID 1860 wrote to memory of 1196 1860 hbbhhn.exe 102 PID 1196 wrote to memory of 1404 1196 3jjdp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\02571da8f25665e3ec754d43822aec1d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02571da8f25665e3ec754d43822aec1d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\nnttnn.exec:\nnttnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\jpvpj.exec:\jpvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\9flffff.exec:\9flffff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\tbbtnh.exec:\tbbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\3djdd.exec:\3djdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\fxlfffl.exec:\fxlfffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\rlllffx.exec:\rlllffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\9nthhh.exec:\9nthhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\3jjjd.exec:\3jjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\pdppj.exec:\pdppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\hhtnnt.exec:\hhtnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\pvddd.exec:\pvddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\3djdv.exec:\3djdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\nhnhhb.exec:\nhnhhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\jdjdv.exec:\jdjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\xlrrlxr.exec:\xlrrlxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\hntttt.exec:\hntttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\vpvvp.exec:\vpvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\rrrrfxr.exec:\rrrrfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\hbbhhn.exec:\hbbhhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\3jjdp.exec:\3jjdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\ffrlxfx.exec:\ffrlxfx.exe23⤵
- Executes dropped EXE
PID:1404 -
\??\c:\ntbnnn.exec:\ntbnnn.exe24⤵
- Executes dropped EXE
PID:3972 -
\??\c:\vpdvv.exec:\vpdvv.exe25⤵
- Executes dropped EXE
PID:2012 -
\??\c:\ffrlxxr.exec:\ffrlxxr.exe26⤵
- Executes dropped EXE
PID:2324 -
\??\c:\tnnnnn.exec:\tnnnnn.exe27⤵
- Executes dropped EXE
PID:3888 -
\??\c:\ntbtnn.exec:\ntbtnn.exe28⤵
- Executes dropped EXE
PID:2892 -
\??\c:\dpjdp.exec:\dpjdp.exe29⤵
- Executes dropped EXE
PID:5108 -
\??\c:\rffxxxx.exec:\rffxxxx.exe30⤵
- Executes dropped EXE
PID:1472 -
\??\c:\nhbbbb.exec:\nhbbbb.exe31⤵
- Executes dropped EXE
PID:5004 -
\??\c:\djvpj.exec:\djvpj.exe32⤵
- Executes dropped EXE
PID:656 -
\??\c:\5pvpd.exec:\5pvpd.exe33⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lxllxxr.exec:\lxllxxr.exe34⤵
- Executes dropped EXE
PID:1496 -
\??\c:\hhnnhh.exec:\hhnnhh.exe35⤵
- Executes dropped EXE
PID:1068 -
\??\c:\pvvpd.exec:\pvvpd.exe36⤵
- Executes dropped EXE
PID:1708 -
\??\c:\3dpdv.exec:\3dpdv.exe37⤵
- Executes dropped EXE
PID:5084 -
\??\c:\flflfrl.exec:\flflfrl.exe38⤵
- Executes dropped EXE
PID:1624 -
\??\c:\thttbb.exec:\thttbb.exe39⤵
- Executes dropped EXE
PID:4492 -
\??\c:\3pvpd.exec:\3pvpd.exe40⤵
- Executes dropped EXE
PID:4164 -
\??\c:\pjpjd.exec:\pjpjd.exe41⤵
- Executes dropped EXE
PID:4280 -
\??\c:\3rfxxxf.exec:\3rfxxxf.exe42⤵
- Executes dropped EXE
PID:4300 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe43⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bbbbtt.exec:\bbbbtt.exe44⤵
- Executes dropped EXE
PID:236 -
\??\c:\vpjdd.exec:\vpjdd.exe45⤵
- Executes dropped EXE
PID:4560 -
\??\c:\rrllfll.exec:\rrllfll.exe46⤵
- Executes dropped EXE
PID:4932 -
\??\c:\9lrlffx.exec:\9lrlffx.exe47⤵
- Executes dropped EXE
PID:3560 -
\??\c:\ntttnn.exec:\ntttnn.exe48⤵
- Executes dropped EXE
PID:3876 -
\??\c:\3ddvj.exec:\3ddvj.exe49⤵
- Executes dropped EXE
PID:4756 -
\??\c:\xxxfffx.exec:\xxxfffx.exe50⤵
- Executes dropped EXE
PID:3932 -
\??\c:\bbnhnn.exec:\bbnhnn.exe51⤵
- Executes dropped EXE
PID:3484 -
\??\c:\dpdvd.exec:\dpdvd.exe52⤵
- Executes dropped EXE
PID:212 -
\??\c:\fxrlffx.exec:\fxrlffx.exe53⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rrffxxx.exec:\rrffxxx.exe54⤵
- Executes dropped EXE
PID:4256 -
\??\c:\tntntt.exec:\tntntt.exe55⤵
- Executes dropped EXE
PID:4572 -
\??\c:\3hnhtt.exec:\3hnhtt.exe56⤵
- Executes dropped EXE
PID:3432 -
\??\c:\3dpjv.exec:\3dpjv.exe57⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jdvpd.exec:\jdvpd.exe58⤵
- Executes dropped EXE
PID:3976 -
\??\c:\7xxrlxx.exec:\7xxrlxx.exe59⤵
- Executes dropped EXE
PID:3424 -
\??\c:\xrrrllf.exec:\xrrrllf.exe60⤵
- Executes dropped EXE
PID:4564 -
\??\c:\btthhb.exec:\btthhb.exe61⤵
- Executes dropped EXE
PID:3524 -
\??\c:\hbbnhh.exec:\hbbnhh.exe62⤵
- Executes dropped EXE
PID:2688 -
\??\c:\9vvvp.exec:\9vvvp.exe63⤵
- Executes dropped EXE
PID:4372 -
\??\c:\3vddd.exec:\3vddd.exe64⤵
- Executes dropped EXE
PID:1156 -
\??\c:\frxxrxr.exec:\frxxrxr.exe65⤵
- Executes dropped EXE
PID:3120 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe66⤵PID:4200
-
\??\c:\nbbbnh.exec:\nbbbnh.exe67⤵PID:1668
-
\??\c:\dppdd.exec:\dppdd.exe68⤵PID:932
-
\??\c:\vpjdv.exec:\vpjdv.exe69⤵PID:4432
-
\??\c:\llfxxrx.exec:\llfxxrx.exe70⤵PID:3900
-
\??\c:\flllfff.exec:\flllfff.exe71⤵PID:3772
-
\??\c:\thtnht.exec:\thtnht.exe72⤵PID:1872
-
\??\c:\7nntht.exec:\7nntht.exe73⤵PID:3404
-
\??\c:\vppdv.exec:\vppdv.exe74⤵PID:856
-
\??\c:\dvpjv.exec:\dvpjv.exe75⤵PID:4340
-
\??\c:\lfxrfrr.exec:\lfxrfrr.exe76⤵PID:2884
-
\??\c:\ddpjp.exec:\ddpjp.exe77⤵PID:4924
-
\??\c:\djpjv.exec:\djpjv.exe78⤵PID:4040
-
\??\c:\7rffxxx.exec:\7rffxxx.exe79⤵PID:4472
-
\??\c:\hhhbbn.exec:\hhhbbn.exe80⤵PID:4596
-
\??\c:\bthhbn.exec:\bthhbn.exe81⤵PID:1924
-
\??\c:\dpdvv.exec:\dpdvv.exe82⤵PID:2364
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe83⤵PID:1816
-
\??\c:\lfxfxxr.exec:\lfxfxxr.exe84⤵PID:4296
-
\??\c:\bbhhbb.exec:\bbhhbb.exe85⤵PID:4952
-
\??\c:\nnbnbn.exec:\nnbnbn.exe86⤵PID:2268
-
\??\c:\pjjdv.exec:\pjjdv.exe87⤵PID:2844
-
\??\c:\5rxrlll.exec:\5rxrlll.exe88⤵PID:2320
-
\??\c:\xxxrrxf.exec:\xxxrrxf.exe89⤵PID:5084
-
\??\c:\btnhhh.exec:\btnhhh.exe90⤵PID:2260
-
\??\c:\5vvpj.exec:\5vvpj.exe91⤵PID:3452
-
\??\c:\djjdv.exec:\djjdv.exe92⤵PID:4356
-
\??\c:\lfxrllr.exec:\lfxrllr.exe93⤵PID:2124
-
\??\c:\xlrrlll.exec:\xlrrlll.exe94⤵PID:4328
-
\??\c:\thnttn.exec:\thnttn.exe95⤵PID:3696
-
\??\c:\nhhbtt.exec:\nhhbtt.exe96⤵PID:4032
-
\??\c:\vvvvv.exec:\vvvvv.exe97⤵PID:1572
-
\??\c:\llxxxxx.exec:\llxxxxx.exe98⤵PID:2396
-
\??\c:\bbhhnn.exec:\bbhhnn.exe99⤵PID:2836
-
\??\c:\nhhnhh.exec:\nhhnhh.exe100⤵PID:3504
-
\??\c:\nhhhtt.exec:\nhhhtt.exe101⤵PID:4868
-
\??\c:\jjpjd.exec:\jjpjd.exe102⤵PID:4268
-
\??\c:\rlxfffl.exec:\rlxfffl.exe103⤵PID:3816
-
\??\c:\frffffx.exec:\frffffx.exe104⤵PID:3616
-
\??\c:\btnnhh.exec:\btnnhh.exe105⤵PID:1616
-
\??\c:\hbbhbb.exec:\hbbhbb.exe106⤵PID:4592
-
\??\c:\jdpjp.exec:\jdpjp.exe107⤵PID:4128
-
\??\c:\rrrrfll.exec:\rrrrfll.exe108⤵PID:4572
-
\??\c:\fxxxxff.exec:\fxxxxff.exe109⤵PID:3432
-
\??\c:\3tbthh.exec:\3tbthh.exe110⤵PID:3116
-
\??\c:\7hhtnn.exec:\7hhtnn.exe111⤵PID:3256
-
\??\c:\vppjj.exec:\vppjj.exe112⤵PID:2820
-
\??\c:\rfflfff.exec:\rfflfff.exe113⤵PID:2680
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe114⤵PID:4600
-
\??\c:\thnnbb.exec:\thnnbb.exe115⤵PID:2688
-
\??\c:\dpdvv.exec:\dpdvv.exe116⤵PID:4372
-
\??\c:\ppvvd.exec:\ppvvd.exe117⤵PID:1156
-
\??\c:\rlrllrr.exec:\rlrllrr.exe118⤵PID:2984
-
\??\c:\thnnhh.exec:\thnnhh.exe119⤵PID:2044
-
\??\c:\7vjdd.exec:\7vjdd.exe120⤵PID:1668
-
\??\c:\3ppjv.exec:\3ppjv.exe121⤵PID:3480
-
\??\c:\lrlxrrr.exec:\lrlxrrr.exe122⤵PID:4432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-