Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 21:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06287fa228425e823150ed4af3bebd11_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
06287fa228425e823150ed4af3bebd11_JaffaCakes118.exe
-
Size
190KB
-
MD5
06287fa228425e823150ed4af3bebd11
-
SHA1
0995123376c401338ad81e3721f3dff77624b50c
-
SHA256
00772b2f101126e1d227af508946b205f166332dcd14e047ff5d1e7d862f6148
-
SHA512
43356483e92d36eff32e8ff4fe85f442f924a738c8e51bed515c26a20fb6414395c8b9652fe639c0acb1654aa25c67d696685e1e743830b06b7d17649d757a72
-
SSDEEP
1536:EvQBeOGtrYSSsrc93UBIfdC67m6AJiqjt3ufT/FRxZOYCqc:EhOm2sI93UufdC67ciyt3ujFf73c
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2960-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1276-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3884-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/992-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-792-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-868-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/992-937-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-1215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-1767-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-1889-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2972 xrrxxxf.exe 1620 bnnhbt.exe 5044 tntnbb.exe 3144 dppjd.exe 4520 pdppp.exe 2336 fxrlfxr.exe 664 lfffxxr.exe 3020 7tbbtt.exe 2384 5nnhbt.exe 4336 jvdvp.exe 3644 dvddp.exe 4800 rrfxxxf.exe 4792 frrfxlf.exe 1564 hnbhhn.exe 224 hhnhhh.exe 4928 9dppj.exe 3884 5dppj.exe 3360 fxfxxrl.exe 4020 lxffxxr.exe 3996 hhhbtt.exe 4272 nhhtnn.exe 5004 dvvvp.exe 1108 dpjdv.exe 4472 fxxxrrx.exe 4524 xllfxrr.exe 4168 nntnnn.exe 4884 nbhbnn.exe 4508 7dvvj.exe 5116 3vvpd.exe 1240 lffxxxr.exe 3876 lfffxxr.exe 4436 hbttth.exe 1948 bhnhtt.exe 1276 5dvpd.exe 3448 jdddp.exe 4612 3xlrffl.exe 3704 3ffxrrf.exe 3612 tnbntt.exe 5096 nhthbb.exe 3344 vpjvp.exe 4796 ddvpd.exe 4696 rllfrxr.exe 3436 llllfff.exe 1496 bbbtnn.exe 4676 tnbnbb.exe 2388 3jvjj.exe 3004 jdvpj.exe 4232 rrfxxrx.exe 1848 rxllfrl.exe 872 3bnnnt.exe 4288 nhhhtt.exe 4268 vdjdp.exe 3936 5vjpd.exe 3084 xlllfxr.exe 1384 rrxrllx.exe 3596 9bnbbh.exe 2684 pddvj.exe 5112 rrxxlfx.exe 3020 9bbtnh.exe 2384 nbbthb.exe 4736 ppdjv.exe 4980 fffxxlf.exe 3832 ttttnn.exe 4768 bbhhtt.exe -
resource yara_rule behavioral2/memory/2960-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1276-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/664-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/992-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-616-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2972 2960 06287fa228425e823150ed4af3bebd11_JaffaCakes118.exe 84 PID 2960 wrote to memory of 2972 2960 06287fa228425e823150ed4af3bebd11_JaffaCakes118.exe 84 PID 2960 wrote to memory of 2972 2960 06287fa228425e823150ed4af3bebd11_JaffaCakes118.exe 84 PID 2972 wrote to memory of 1620 2972 xrrxxxf.exe 85 PID 2972 wrote to memory of 1620 2972 xrrxxxf.exe 85 PID 2972 wrote to memory of 1620 2972 xrrxxxf.exe 85 PID 1620 wrote to memory of 5044 1620 bnnhbt.exe 86 PID 1620 wrote to memory of 5044 1620 bnnhbt.exe 86 PID 1620 wrote to memory of 5044 1620 bnnhbt.exe 86 PID 5044 wrote to memory of 3144 5044 tntnbb.exe 87 PID 5044 wrote to memory of 3144 5044 tntnbb.exe 87 PID 5044 wrote to memory of 3144 5044 tntnbb.exe 87 PID 3144 wrote to memory of 4520 3144 dppjd.exe 88 PID 3144 wrote to memory of 4520 3144 dppjd.exe 88 PID 3144 wrote to memory of 4520 3144 dppjd.exe 88 PID 4520 wrote to memory of 2336 4520 pdppp.exe 89 PID 4520 wrote to memory of 2336 4520 pdppp.exe 89 PID 4520 wrote to memory of 2336 4520 pdppp.exe 89 PID 2336 wrote to memory of 664 2336 fxrlfxr.exe 90 PID 2336 wrote to memory of 664 2336 fxrlfxr.exe 90 PID 2336 wrote to memory of 664 2336 fxrlfxr.exe 90 PID 664 wrote to memory of 3020 664 lfffxxr.exe 91 PID 664 wrote to memory of 3020 664 lfffxxr.exe 91 PID 664 wrote to memory of 3020 664 lfffxxr.exe 91 PID 3020 wrote to memory of 2384 3020 7tbbtt.exe 92 PID 3020 wrote to memory of 2384 3020 7tbbtt.exe 92 PID 3020 wrote to memory of 2384 3020 7tbbtt.exe 92 PID 2384 wrote to memory of 4336 2384 5nnhbt.exe 93 PID 2384 wrote to memory of 4336 2384 5nnhbt.exe 93 PID 2384 wrote to memory of 4336 2384 5nnhbt.exe 93 PID 4336 wrote to memory of 3644 4336 jvdvp.exe 94 PID 4336 wrote to memory of 3644 4336 jvdvp.exe 94 PID 4336 wrote to memory of 3644 4336 jvdvp.exe 94 PID 3644 wrote to memory of 4800 3644 dvddp.exe 95 PID 3644 wrote to memory of 4800 3644 dvddp.exe 95 PID 3644 wrote to memory of 4800 3644 dvddp.exe 95 PID 4800 wrote to memory of 4792 4800 rrfxxxf.exe 96 PID 4800 wrote to memory of 4792 4800 rrfxxxf.exe 96 PID 4800 wrote to memory of 4792 4800 rrfxxxf.exe 96 PID 4792 wrote to memory of 1564 4792 frrfxlf.exe 97 PID 4792 wrote to memory of 1564 4792 frrfxlf.exe 97 PID 4792 wrote to memory of 1564 4792 frrfxlf.exe 97 PID 1564 wrote to memory of 224 1564 hnbhhn.exe 98 PID 1564 wrote to memory of 224 1564 hnbhhn.exe 98 PID 1564 wrote to memory of 224 1564 hnbhhn.exe 98 PID 224 wrote to memory of 4928 224 hhnhhh.exe 99 PID 224 wrote to memory of 4928 224 hhnhhh.exe 99 PID 224 wrote to memory of 4928 224 hhnhhh.exe 99 PID 4928 wrote to memory of 3884 4928 9dppj.exe 100 PID 4928 wrote to memory of 3884 4928 9dppj.exe 100 PID 4928 wrote to memory of 3884 4928 9dppj.exe 100 PID 3884 wrote to memory of 3360 3884 5dppj.exe 101 PID 3884 wrote to memory of 3360 3884 5dppj.exe 101 PID 3884 wrote to memory of 3360 3884 5dppj.exe 101 PID 3360 wrote to memory of 4020 3360 fxfxxrl.exe 102 PID 3360 wrote to memory of 4020 3360 fxfxxrl.exe 102 PID 3360 wrote to memory of 4020 3360 fxfxxrl.exe 102 PID 4020 wrote to memory of 3996 4020 lxffxxr.exe 103 PID 4020 wrote to memory of 3996 4020 lxffxxr.exe 103 PID 4020 wrote to memory of 3996 4020 lxffxxr.exe 103 PID 3996 wrote to memory of 4272 3996 hhhbtt.exe 104 PID 3996 wrote to memory of 4272 3996 hhhbtt.exe 104 PID 3996 wrote to memory of 4272 3996 hhhbtt.exe 104 PID 4272 wrote to memory of 5004 4272 nhhtnn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\06287fa228425e823150ed4af3bebd11_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\06287fa228425e823150ed4af3bebd11_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\xrrxxxf.exec:\xrrxxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\bnnhbt.exec:\bnnhbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\tntnbb.exec:\tntnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\dppjd.exec:\dppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\pdppp.exec:\pdppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\lfffxxr.exec:\lfffxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\7tbbtt.exec:\7tbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\5nnhbt.exec:\5nnhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\jvdvp.exec:\jvdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\dvddp.exec:\dvddp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\rrfxxxf.exec:\rrfxxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\frrfxlf.exec:\frrfxlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\hnbhhn.exec:\hnbhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\hhnhhh.exec:\hhnhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\9dppj.exec:\9dppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\5dppj.exec:\5dppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\fxfxxrl.exec:\fxfxxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\lxffxxr.exec:\lxffxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\hhhbtt.exec:\hhhbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\nhhtnn.exec:\nhhtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\dvvvp.exec:\dvvvp.exe23⤵
- Executes dropped EXE
PID:5004 -
\??\c:\dpjdv.exec:\dpjdv.exe24⤵
- Executes dropped EXE
PID:1108 -
\??\c:\fxxxrrx.exec:\fxxxrrx.exe25⤵
- Executes dropped EXE
PID:4472 -
\??\c:\xllfxrr.exec:\xllfxrr.exe26⤵
- Executes dropped EXE
PID:4524 -
\??\c:\nntnnn.exec:\nntnnn.exe27⤵
- Executes dropped EXE
PID:4168 -
\??\c:\nbhbnn.exec:\nbhbnn.exe28⤵
- Executes dropped EXE
PID:4884 -
\??\c:\7dvvj.exec:\7dvvj.exe29⤵
- Executes dropped EXE
PID:4508 -
\??\c:\3vvpd.exec:\3vvpd.exe30⤵
- Executes dropped EXE
PID:5116 -
\??\c:\lffxxxr.exec:\lffxxxr.exe31⤵
- Executes dropped EXE
PID:1240 -
\??\c:\lfffxxr.exec:\lfffxxr.exe32⤵
- Executes dropped EXE
PID:3876 -
\??\c:\hbttth.exec:\hbttth.exe33⤵
- Executes dropped EXE
PID:4436 -
\??\c:\bhnhtt.exec:\bhnhtt.exe34⤵
- Executes dropped EXE
PID:1948 -
\??\c:\5dvpd.exec:\5dvpd.exe35⤵
- Executes dropped EXE
PID:1276 -
\??\c:\jdddp.exec:\jdddp.exe36⤵
- Executes dropped EXE
PID:3448 -
\??\c:\3xlrffl.exec:\3xlrffl.exe37⤵
- Executes dropped EXE
PID:4612 -
\??\c:\3ffxrrf.exec:\3ffxrrf.exe38⤵
- Executes dropped EXE
PID:3704 -
\??\c:\tnbntt.exec:\tnbntt.exe39⤵
- Executes dropped EXE
PID:3612 -
\??\c:\nhthbb.exec:\nhthbb.exe40⤵
- Executes dropped EXE
PID:5096 -
\??\c:\vpjvp.exec:\vpjvp.exe41⤵
- Executes dropped EXE
PID:3344 -
\??\c:\ddvpd.exec:\ddvpd.exe42⤵
- Executes dropped EXE
PID:4796 -
\??\c:\rllfrxr.exec:\rllfrxr.exe43⤵
- Executes dropped EXE
PID:4696 -
\??\c:\llllfff.exec:\llllfff.exe44⤵
- Executes dropped EXE
PID:3436 -
\??\c:\bbbtnn.exec:\bbbtnn.exe45⤵
- Executes dropped EXE
PID:1496 -
\??\c:\tnbnbb.exec:\tnbnbb.exe46⤵
- Executes dropped EXE
PID:4676 -
\??\c:\3jvjj.exec:\3jvjj.exe47⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jdvpj.exec:\jdvpj.exe48⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rrfxxrx.exec:\rrfxxrx.exe49⤵
- Executes dropped EXE
PID:4232 -
\??\c:\rxllfrl.exec:\rxllfrl.exe50⤵
- Executes dropped EXE
PID:1848 -
\??\c:\3bnnnt.exec:\3bnnnt.exe51⤵
- Executes dropped EXE
PID:872 -
\??\c:\nhhhtt.exec:\nhhhtt.exe52⤵
- Executes dropped EXE
PID:4288 -
\??\c:\vdjdp.exec:\vdjdp.exe53⤵
- Executes dropped EXE
PID:4268 -
\??\c:\5vjpd.exec:\5vjpd.exe54⤵
- Executes dropped EXE
PID:3936 -
\??\c:\xlllfxr.exec:\xlllfxr.exe55⤵
- Executes dropped EXE
PID:3084 -
\??\c:\rrxrllx.exec:\rrxrllx.exe56⤵
- Executes dropped EXE
PID:1384 -
\??\c:\9bnbbh.exec:\9bnbbh.exe57⤵
- Executes dropped EXE
PID:3596 -
\??\c:\pddvj.exec:\pddvj.exe58⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rrxxlfx.exec:\rrxxlfx.exe59⤵
- Executes dropped EXE
PID:5112 -
\??\c:\9bbtnh.exec:\9bbtnh.exe60⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nbbthb.exec:\nbbthb.exe61⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ppdjv.exec:\ppdjv.exe62⤵
- Executes dropped EXE
PID:4736 -
\??\c:\fffxxlf.exec:\fffxxlf.exe63⤵
- Executes dropped EXE
PID:4980 -
\??\c:\ttttnn.exec:\ttttnn.exe64⤵
- Executes dropped EXE
PID:3832 -
\??\c:\bbhhtt.exec:\bbhhtt.exe65⤵
- Executes dropped EXE
PID:4768 -
\??\c:\pjpjd.exec:\pjpjd.exe66⤵PID:1640
-
\??\c:\fxffxrx.exec:\fxffxrx.exe67⤵PID:1464
-
\??\c:\tnbbtt.exec:\tnbbtt.exe68⤵PID:2052
-
\??\c:\jvvpj.exec:\jvvpj.exe69⤵PID:2252
-
\??\c:\dpdvd.exec:\dpdvd.exe70⤵PID:636
-
\??\c:\9lxxlrr.exec:\9lxxlrr.exe71⤵PID:3880
-
\??\c:\nnbtnn.exec:\nnbtnn.exe72⤵PID:2940
-
\??\c:\1tnhnh.exec:\1tnhnh.exe73⤵PID:1444
-
\??\c:\1fxfxfx.exec:\1fxfxfx.exe74⤵PID:3540
-
\??\c:\5bnnhn.exec:\5bnnhn.exe75⤵PID:1828
-
\??\c:\7ppjj.exec:\7ppjj.exe76⤵PID:4168
-
\??\c:\vpdvv.exec:\vpdvv.exe77⤵PID:1016
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe78⤵PID:3152
-
\??\c:\btthnn.exec:\btthnn.exe79⤵PID:3556
-
\??\c:\3jjjv.exec:\3jjjv.exe80⤵PID:2680
-
\??\c:\dvvvp.exec:\dvvvp.exe81⤵PID:3664
-
\??\c:\xxxxxxl.exec:\xxxxxxl.exe82⤵PID:4704
-
\??\c:\bhnnhh.exec:\bhnnhh.exe83⤵PID:4688
-
\??\c:\nnhnhh.exec:\nnhnhh.exe84⤵PID:2956
-
\??\c:\jdpjj.exec:\jdpjj.exe85⤵PID:4612
-
\??\c:\vvdvp.exec:\vvdvp.exe86⤵PID:728
-
\??\c:\xxlffxf.exec:\xxlffxf.exe87⤵PID:2444
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe88⤵PID:4856
-
\??\c:\hbnnnn.exec:\hbnnnn.exe89⤵PID:2556
-
\??\c:\jjppp.exec:\jjppp.exe90⤵PID:4796
-
\??\c:\rllrlrl.exec:\rllrlrl.exe91⤵PID:1128
-
\??\c:\jvvjd.exec:\jvvjd.exe92⤵PID:1956
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe93⤵PID:3196
-
\??\c:\nhhtnb.exec:\nhhtnb.exe94⤵PID:2388
-
\??\c:\7lffxxr.exec:\7lffxxr.exe95⤵PID:3076
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe96⤵PID:3632
-
\??\c:\tntnhn.exec:\tntnhn.exe97⤵PID:3708
-
\??\c:\jppjv.exec:\jppjv.exe98⤵PID:4216
-
\??\c:\xrlflfx.exec:\xrlflfx.exe99⤵PID:3284
-
\??\c:\7lxrlfr.exec:\7lxrlfr.exe100⤵PID:3240
-
\??\c:\3nbtnh.exec:\3nbtnh.exe101⤵PID:1668
-
\??\c:\dppdp.exec:\dppdp.exe102⤵PID:1848
-
\??\c:\rrxxrlf.exec:\rrxxrlf.exe103⤵PID:872
-
\??\c:\7bnhbt.exec:\7bnhbt.exe104⤵PID:3892
-
\??\c:\vppjv.exec:\vppjv.exe105⤵PID:3872
-
\??\c:\3nhbtt.exec:\3nhbtt.exe106⤵PID:4360
-
\??\c:\bnnnhh.exec:\bnnnhh.exe107⤵PID:2660
-
\??\c:\jdjdd.exec:\jdjdd.exe108⤵PID:3420
-
\??\c:\ntbbbb.exec:\ntbbbb.exe109⤵PID:3144
-
\??\c:\bbbttt.exec:\bbbttt.exe110⤵PID:3048
-
\??\c:\ddvpd.exec:\ddvpd.exe111⤵PID:1224
-
\??\c:\rlxrrll.exec:\rlxrrll.exe112⤵PID:116
-
\??\c:\hhbnbn.exec:\hhbnbn.exe113⤵PID:1788
-
\??\c:\dvdvp.exec:\dvdvp.exe114⤵PID:3596
-
\??\c:\7btnhh.exec:\7btnhh.exe115⤵PID:3640
-
\??\c:\bhttnn.exec:\bhttnn.exe116⤵PID:4420
-
\??\c:\5flfrrl.exec:\5flfrrl.exe117⤵PID:1584
-
\??\c:\7nhttt.exec:\7nhttt.exe118⤵PID:2380
-
\??\c:\3jpjd.exec:\3jpjd.exe119⤵PID:4868
-
\??\c:\vvdvj.exec:\vvdvj.exe120⤵PID:2400
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe121⤵PID:3644
-
\??\c:\jpdvd.exec:\jpdvd.exe122⤵PID:1592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-