Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2024, 15:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
10d4a15bca794b6ef16152907fa0ab9d_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
10d4a15bca794b6ef16152907fa0ab9d_JaffaCakes118.exe
-
Size
211KB
-
MD5
10d4a15bca794b6ef16152907fa0ab9d
-
SHA1
d78da5933b9c51cc1c2cef17914a0e4663cc1712
-
SHA256
f05ad4441a6258ae559e1e6a499bd2a10d68ace224372e82322e6ac5fde4bb07
-
SHA512
622fc9034f68fcd7667812b677442f9d348f96b3de41ca0bd5715abd6550ead6cf17f6552abb8c5d432e72cdb8caffd7e9555766c8dc2d75886329f2642eec8a
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAQ5lpBoGs:Pcm7ImGddXtWrXF5lpKGs
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/868-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/364-318-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-354-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-358-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-387-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-388-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-406-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-436-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-470-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-475-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-482-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-496-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-511-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-547-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-564-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-586-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-620-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3792-631-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-1151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-1394-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-1486-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 868 djdpj.exe 5024 frfrrlf.exe 1608 frlrlfr.exe 2844 tnhbtn.exe 4544 3vdpj.exe 5020 1pdvj.exe 2576 thhbnh.exe 3364 7ddjv.exe 3980 fxrrlll.exe 3528 thnhnh.exe 3480 7ddvp.exe 1820 hntnhb.exe 1044 1dpjp.exe 4452 lxxrrrr.exe 4224 5hhbbt.exe 4820 xfffffr.exe 2468 tnntnn.exe 3824 1nbntt.exe 4852 vjpjp.exe 2320 hbbbhb.exe 408 xxxlxrf.exe 2432 htthtn.exe 4884 pdvdv.exe 1880 9rrfxxr.exe 4044 pjjjj.exe 1676 5vvjv.exe 2708 ntthht.exe 3404 7vpjd.exe 3112 fxxxlll.exe 2776 thhtnh.exe 2364 vjpdp.exe 2304 vjpjd.exe 1508 rllxlfr.exe 4560 3ttnbt.exe 4308 bnnbtn.exe 3920 pjpdj.exe 4396 5llrlfr.exe 3368 lxfxrll.exe 4492 nnnhbt.exe 3212 9bnhtn.exe 5000 7ppjv.exe 3388 pjdvj.exe 4700 1xrfxxl.exe 2984 hbhbnh.exe 3408 vpjdd.exe 5036 lxlfllr.exe 2956 nnttnt.exe 772 jpvpj.exe 4084 dvpjd.exe 3968 rlrfxrl.exe 2920 bnntbt.exe 4476 5pvjd.exe 4924 pjjvv.exe 4072 3flxxxf.exe 4404 rfrlfxx.exe 1064 3tthtn.exe 1952 thhbtn.exe 100 dvpjv.exe 664 9lfxlfx.exe 3168 9ffxlfr.exe 3216 nbbttn.exe 3060 tttnnh.exe 1468 vvvvj.exe 4852 xrlrllx.exe -
resource yara_rule behavioral2/memory/376-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/364-318-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3792-346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-358-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-387-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-388-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-406-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-432-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-436-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-470-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-471-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-475-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-482-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-496-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-511-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/444-512-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-534-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-547-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-564-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 376 wrote to memory of 868 376 10d4a15bca794b6ef16152907fa0ab9d_JaffaCakes118.exe 83 PID 376 wrote to memory of 868 376 10d4a15bca794b6ef16152907fa0ab9d_JaffaCakes118.exe 83 PID 376 wrote to memory of 868 376 10d4a15bca794b6ef16152907fa0ab9d_JaffaCakes118.exe 83 PID 868 wrote to memory of 5024 868 djdpj.exe 84 PID 868 wrote to memory of 5024 868 djdpj.exe 84 PID 868 wrote to memory of 5024 868 djdpj.exe 84 PID 5024 wrote to memory of 1608 5024 frfrrlf.exe 85 PID 5024 wrote to memory of 1608 5024 frfrrlf.exe 85 PID 5024 wrote to memory of 1608 5024 frfrrlf.exe 85 PID 1608 wrote to memory of 2844 1608 frlrlfr.exe 86 PID 1608 wrote to memory of 2844 1608 frlrlfr.exe 86 PID 1608 wrote to memory of 2844 1608 frlrlfr.exe 86 PID 2844 wrote to memory of 4544 2844 tnhbtn.exe 87 PID 2844 wrote to memory of 4544 2844 tnhbtn.exe 87 PID 2844 wrote to memory of 4544 2844 tnhbtn.exe 87 PID 4544 wrote to memory of 5020 4544 3vdpj.exe 88 PID 4544 wrote to memory of 5020 4544 3vdpj.exe 88 PID 4544 wrote to memory of 5020 4544 3vdpj.exe 88 PID 5020 wrote to memory of 2576 5020 1pdvj.exe 89 PID 5020 wrote to memory of 2576 5020 1pdvj.exe 89 PID 5020 wrote to memory of 2576 5020 1pdvj.exe 89 PID 2576 wrote to memory of 3364 2576 thhbnh.exe 90 PID 2576 wrote to memory of 3364 2576 thhbnh.exe 90 PID 2576 wrote to memory of 3364 2576 thhbnh.exe 90 PID 3364 wrote to memory of 3980 3364 7ddjv.exe 91 PID 3364 wrote to memory of 3980 3364 7ddjv.exe 91 PID 3364 wrote to memory of 3980 3364 7ddjv.exe 91 PID 3980 wrote to memory of 3528 3980 fxrrlll.exe 92 PID 3980 wrote to memory of 3528 3980 fxrrlll.exe 92 PID 3980 wrote to memory of 3528 3980 fxrrlll.exe 92 PID 3528 wrote to memory of 3480 3528 thnhnh.exe 93 PID 3528 wrote to memory of 3480 3528 thnhnh.exe 93 PID 3528 wrote to memory of 3480 3528 thnhnh.exe 93 PID 3480 wrote to memory of 1820 3480 7ddvp.exe 94 PID 3480 wrote to memory of 1820 3480 7ddvp.exe 94 PID 3480 wrote to memory of 1820 3480 7ddvp.exe 94 PID 1820 wrote to memory of 1044 1820 hntnhb.exe 95 PID 1820 wrote to memory of 1044 1820 hntnhb.exe 95 PID 1820 wrote to memory of 1044 1820 hntnhb.exe 95 PID 1044 wrote to memory of 4452 1044 1dpjp.exe 97 PID 1044 wrote to memory of 4452 1044 1dpjp.exe 97 PID 1044 wrote to memory of 4452 1044 1dpjp.exe 97 PID 4452 wrote to memory of 4224 4452 lxxrrrr.exe 98 PID 4452 wrote to memory of 4224 4452 lxxrrrr.exe 98 PID 4452 wrote to memory of 4224 4452 lxxrrrr.exe 98 PID 4224 wrote to memory of 4820 4224 5hhbbt.exe 99 PID 4224 wrote to memory of 4820 4224 5hhbbt.exe 99 PID 4224 wrote to memory of 4820 4224 5hhbbt.exe 99 PID 4820 wrote to memory of 2468 4820 xfffffr.exe 100 PID 4820 wrote to memory of 2468 4820 xfffffr.exe 100 PID 4820 wrote to memory of 2468 4820 xfffffr.exe 100 PID 2468 wrote to memory of 3824 2468 tnntnn.exe 101 PID 2468 wrote to memory of 3824 2468 tnntnn.exe 101 PID 2468 wrote to memory of 3824 2468 tnntnn.exe 101 PID 3824 wrote to memory of 4852 3824 1nbntt.exe 102 PID 3824 wrote to memory of 4852 3824 1nbntt.exe 102 PID 3824 wrote to memory of 4852 3824 1nbntt.exe 102 PID 4852 wrote to memory of 2320 4852 vjpjp.exe 104 PID 4852 wrote to memory of 2320 4852 vjpjp.exe 104 PID 4852 wrote to memory of 2320 4852 vjpjp.exe 104 PID 2320 wrote to memory of 408 2320 hbbbhb.exe 105 PID 2320 wrote to memory of 408 2320 hbbbhb.exe 105 PID 2320 wrote to memory of 408 2320 hbbbhb.exe 105 PID 408 wrote to memory of 2432 408 xxxlxrf.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\10d4a15bca794b6ef16152907fa0ab9d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\10d4a15bca794b6ef16152907fa0ab9d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\djdpj.exec:\djdpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\frfrrlf.exec:\frfrrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\frlrlfr.exec:\frlrlfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\tnhbtn.exec:\tnhbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\3vdpj.exec:\3vdpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\1pdvj.exec:\1pdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\thhbnh.exec:\thhbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\7ddjv.exec:\7ddjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\fxrrlll.exec:\fxrrlll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\thnhnh.exec:\thnhnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\7ddvp.exec:\7ddvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\hntnhb.exec:\hntnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\1dpjp.exec:\1dpjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\lxxrrrr.exec:\lxxrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\5hhbbt.exec:\5hhbbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\xfffffr.exec:\xfffffr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\tnntnn.exec:\tnntnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\1nbntt.exec:\1nbntt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\vjpjp.exec:\vjpjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\hbbbhb.exec:\hbbbhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\xxxlxrf.exec:\xxxlxrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\htthtn.exec:\htthtn.exe23⤵
- Executes dropped EXE
PID:2432 -
\??\c:\pdvdv.exec:\pdvdv.exe24⤵
- Executes dropped EXE
PID:4884 -
\??\c:\9rrfxxr.exec:\9rrfxxr.exe25⤵
- Executes dropped EXE
PID:1880 -
\??\c:\pjjjj.exec:\pjjjj.exe26⤵
- Executes dropped EXE
PID:4044 -
\??\c:\5vvjv.exec:\5vvjv.exe27⤵
- Executes dropped EXE
PID:1676 -
\??\c:\ntthht.exec:\ntthht.exe28⤵
- Executes dropped EXE
PID:2708 -
\??\c:\7vpjd.exec:\7vpjd.exe29⤵
- Executes dropped EXE
PID:3404 -
\??\c:\fxxxlll.exec:\fxxxlll.exe30⤵
- Executes dropped EXE
PID:3112 -
\??\c:\thhtnh.exec:\thhtnh.exe31⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vjpdp.exec:\vjpdp.exe32⤵
- Executes dropped EXE
PID:2364 -
\??\c:\vjpjd.exec:\vjpjd.exe33⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rllxlfr.exec:\rllxlfr.exe34⤵
- Executes dropped EXE
PID:1508 -
\??\c:\3ttnbt.exec:\3ttnbt.exe35⤵
- Executes dropped EXE
PID:4560 -
\??\c:\bnnbtn.exec:\bnnbtn.exe36⤵
- Executes dropped EXE
PID:4308 -
\??\c:\pjpdj.exec:\pjpdj.exe37⤵
- Executes dropped EXE
PID:3920 -
\??\c:\5llrlfr.exec:\5llrlfr.exe38⤵
- Executes dropped EXE
PID:4396 -
\??\c:\lxfxrll.exec:\lxfxrll.exe39⤵
- Executes dropped EXE
PID:3368 -
\??\c:\nnnhbt.exec:\nnnhbt.exe40⤵
- Executes dropped EXE
PID:4492 -
\??\c:\9bnhtn.exec:\9bnhtn.exe41⤵
- Executes dropped EXE
PID:3212 -
\??\c:\7ppjv.exec:\7ppjv.exe42⤵
- Executes dropped EXE
PID:5000 -
\??\c:\pjdvj.exec:\pjdvj.exe43⤵
- Executes dropped EXE
PID:3388 -
\??\c:\1xrfxxl.exec:\1xrfxxl.exe44⤵
- Executes dropped EXE
PID:4700 -
\??\c:\hbhbnh.exec:\hbhbnh.exe45⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vpjdd.exec:\vpjdd.exe46⤵
- Executes dropped EXE
PID:3408 -
\??\c:\lxlfllr.exec:\lxlfllr.exe47⤵
- Executes dropped EXE
PID:5036 -
\??\c:\nnttnt.exec:\nnttnt.exe48⤵
- Executes dropped EXE
PID:2956 -
\??\c:\jpvpj.exec:\jpvpj.exe49⤵
- Executes dropped EXE
PID:772 -
\??\c:\dvpjd.exec:\dvpjd.exe50⤵
- Executes dropped EXE
PID:4084 -
\??\c:\rlrfxrl.exec:\rlrfxrl.exe51⤵
- Executes dropped EXE
PID:3968 -
\??\c:\bnntbt.exec:\bnntbt.exe52⤵
- Executes dropped EXE
PID:2920 -
\??\c:\5pvjd.exec:\5pvjd.exe53⤵
- Executes dropped EXE
PID:4476 -
\??\c:\pjjvv.exec:\pjjvv.exe54⤵
- Executes dropped EXE
PID:4924 -
\??\c:\3flxxxf.exec:\3flxxxf.exe55⤵
- Executes dropped EXE
PID:4072 -
\??\c:\rfrlfxx.exec:\rfrlfxx.exe56⤵
- Executes dropped EXE
PID:4404 -
\??\c:\3tthtn.exec:\3tthtn.exe57⤵
- Executes dropped EXE
PID:1064 -
\??\c:\thhbtn.exec:\thhbtn.exe58⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dvpjv.exec:\dvpjv.exe59⤵
- Executes dropped EXE
PID:100 -
\??\c:\9lfxlfx.exec:\9lfxlfx.exe60⤵
- Executes dropped EXE
PID:664 -
\??\c:\9ffxlfr.exec:\9ffxlfr.exe61⤵
- Executes dropped EXE
PID:3168 -
\??\c:\nbbttn.exec:\nbbttn.exe62⤵
- Executes dropped EXE
PID:3216 -
\??\c:\tttnnh.exec:\tttnnh.exe63⤵
- Executes dropped EXE
PID:3060 -
\??\c:\vvvvj.exec:\vvvvj.exe64⤵
- Executes dropped EXE
PID:1468 -
\??\c:\xrlrllx.exec:\xrlrllx.exe65⤵
- Executes dropped EXE
PID:4852 -
\??\c:\rlffrfx.exec:\rlffrfx.exe66⤵PID:684
-
\??\c:\bhhbnh.exec:\bhhbnh.exe67⤵PID:408
-
\??\c:\hbnbbh.exec:\hbnbbh.exe68⤵PID:2620
-
\??\c:\7vvdv.exec:\7vvdv.exe69⤵PID:2724
-
\??\c:\fllfxrr.exec:\fllfxrr.exe70⤵PID:364
-
\??\c:\3xrlfxr.exec:\3xrlfxr.exe71⤵PID:2832
-
\??\c:\tbtnhb.exec:\tbtnhb.exe72⤵PID:1880
-
\??\c:\jvvjd.exec:\jvvjd.exe73⤵PID:2328
-
\??\c:\dvdvv.exec:\dvdvv.exe74⤵PID:832
-
\??\c:\5frfxlx.exec:\5frfxlx.exe75⤵PID:4892
-
\??\c:\lxxxrfx.exec:\lxxxrfx.exe76⤵PID:4984
-
\??\c:\bhnhhb.exec:\bhnhhb.exe77⤵PID:776
-
\??\c:\tnthtn.exec:\tnthtn.exe78⤵PID:2964
-
\??\c:\7vpdd.exec:\7vpdd.exe79⤵PID:3956
-
\??\c:\pjdvp.exec:\pjdvp.exe80⤵PID:3792
-
\??\c:\xlrffxx.exec:\xlrffxx.exe81⤵PID:3996
-
\??\c:\rlxrlff.exec:\rlxrlff.exe82⤵PID:2364
-
\??\c:\tnhhnn.exec:\tnhhnn.exe83⤵PID:2304
-
\??\c:\5jjdv.exec:\5jjdv.exe84⤵PID:1692
-
\??\c:\jjvpj.exec:\jjvpj.exe85⤵PID:1768
-
\??\c:\xfllfll.exec:\xfllfll.exe86⤵PID:4308
-
\??\c:\5rlfrlf.exec:\5rlfrlf.exe87⤵PID:3920
-
\??\c:\nbbnbt.exec:\nbbnbt.exe88⤵PID:1612
-
\??\c:\9nhbtt.exec:\9nhbtt.exe89⤵PID:4524
-
\??\c:\vppdv.exec:\vppdv.exe90⤵PID:4492
-
\??\c:\dvvpp.exec:\dvvpp.exe91⤵PID:3212
-
\??\c:\lxxfrlf.exec:\lxxfrlf.exe92⤵PID:2844
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe93⤵PID:3496
-
\??\c:\1ttbtt.exec:\1ttbtt.exe94⤵PID:4544
-
\??\c:\nhbtbb.exec:\nhbtbb.exe95⤵PID:4808
-
\??\c:\1pdvj.exec:\1pdvj.exe96⤵PID:5108
-
\??\c:\dvdpd.exec:\dvdpd.exe97⤵PID:2712
-
\??\c:\7rlxlfx.exec:\7rlxlfx.exe98⤵PID:1792
-
\??\c:\xxfxxrl.exec:\xxfxxrl.exe99⤵PID:772
-
\??\c:\tnbtnh.exec:\tnbtnh.exe100⤵PID:3748
-
\??\c:\5vdvp.exec:\5vdvp.exe101⤵PID:3980
-
\??\c:\vjppp.exec:\vjppp.exe102⤵PID:3580
-
\??\c:\ffxrxrl.exec:\ffxrxrl.exe103⤵PID:1820
-
\??\c:\xfrlxxl.exec:\xfrlxxl.exe104⤵PID:220
-
\??\c:\btnhbh.exec:\btnhbh.exe105⤵PID:4452
-
\??\c:\vjpjv.exec:\vjpjv.exe106⤵PID:1272
-
\??\c:\9vppj.exec:\9vppj.exe107⤵PID:4712
-
\??\c:\fxxrffx.exec:\fxxrffx.exe108⤵PID:3216
-
\??\c:\fxxrxxl.exec:\fxxrxxl.exe109⤵PID:2320
-
\??\c:\9nnhtb.exec:\9nnhtb.exe110⤵PID:3888
-
\??\c:\5hthhb.exec:\5hthhb.exe111⤵PID:2772
-
\??\c:\vvpjv.exec:\vvpjv.exe112⤵PID:4672
-
\??\c:\pvddd.exec:\pvddd.exe113⤵PID:4144
-
\??\c:\xlrllll.exec:\xlrllll.exe114⤵PID:1520
-
\??\c:\pvdvj.exec:\pvdvj.exe115⤵PID:884
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe116⤵PID:1772
-
\??\c:\frrlrlr.exec:\frrlrlr.exe117⤵PID:4020
-
\??\c:\bnnhtt.exec:\bnnhtt.exe118⤵PID:1728
-
\??\c:\1btttn.exec:\1btttn.exe119⤵PID:832
-
\??\c:\jdpjv.exec:\jdpjv.exe120⤵PID:4972
-
\??\c:\fxxxlrl.exec:\fxxxlrl.exe121⤵PID:4436
-
\??\c:\fxfxlfl.exec:\fxfxlfl.exe122⤵PID:3404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-