Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 04:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
49712d2fe62393d5668027667bc96d69_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
49712d2fe62393d5668027667bc96d69_JaffaCakes118.exe
-
Size
200KB
-
MD5
49712d2fe62393d5668027667bc96d69
-
SHA1
e75b7299e81516497ddbfaff0837fb830e5f4bce
-
SHA256
815dc41b2ba930e22ec3087c84895096fc8e49831c2264df3aface8bee4a0f09
-
SHA512
26ec5f96c3fc60c2e05d59a481381369e720cd4ca3ca78f0f98a05a89e5e63af812242ddf9785e7d1d418f85b20899a46bd3f90ad44ad33857450adb964e6321
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqyvU2r1vsKM4ltyjK:PhOm2sI93UufdC67cihvH1S/O
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1824-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3792-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/832-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-363-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-378-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-381-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-391-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-450-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-457-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-468-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-471-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-494-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-502-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-554-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/336-567-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-598-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-614-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-633-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-685-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-710-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-723-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-817-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1824 7vvpv.exe 4292 rlrlxrl.exe 624 5dppj.exe 3016 dpvjd.exe 4316 fxxrffr.exe 1208 1hbnbt.exe 3640 nhhnbb.exe 1236 pvvpd.exe 384 7lrflxf.exe 628 jjpdp.exe 2052 xxllflx.exe 3616 frxrflr.exe 2544 dppdd.exe 688 xrrfxfx.exe 1620 bnnnbn.exe 1712 dppjd.exe 1148 xrfxxxf.exe 2944 5ffxrrr.exe 2580 tntntt.exe 1880 xfxrlfx.exe 516 5lrlffx.exe 5028 thhhtt.exe 3672 jpvpd.exe 2536 frrlxxr.exe 4636 rffxrfx.exe 752 ttnntt.exe 2224 vdjvj.exe 2184 vdjdp.exe 3840 rffxrlf.exe 1132 nbhtnh.exe 2164 jjdpd.exe 3964 5pvpv.exe 4204 xflxrlf.exe 4812 bnthtn.exe 2672 ddpdv.exe 3792 9jdvp.exe 1624 rlfrfxr.exe 5000 tntbtt.exe 4352 hbbthn.exe 3664 jddvp.exe 1084 xflfxxl.exe 3928 rxlflll.exe 964 ttthbt.exe 3628 nttbnh.exe 4604 5xfrlfx.exe 1972 lrxrfxr.exe 2152 bnnnhh.exe 3448 jddpp.exe 1684 flrlxrl.exe 1504 bbnhbt.exe 2788 nbbtnh.exe 540 jvdvp.exe 744 rrxrffx.exe 2908 7xrlrlf.exe 4484 bhtnbb.exe 2640 dppjp.exe 628 fxlxxrx.exe 2004 rlxrxxf.exe 3120 9pjdv.exe 1452 rfllrrl.exe 1560 bbbtnh.exe 3836 7dvpd.exe 2180 1rlxrlf.exe 1620 lxxrllf.exe -
resource yara_rule behavioral2/memory/1824-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3792-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-323-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-353-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-363-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-367-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-378-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-391-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-443-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-450-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-457-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-468-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-471-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-494-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-498-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1816 wrote to memory of 1824 1816 49712d2fe62393d5668027667bc96d69_JaffaCakes118.exe 82 PID 1816 wrote to memory of 1824 1816 49712d2fe62393d5668027667bc96d69_JaffaCakes118.exe 82 PID 1816 wrote to memory of 1824 1816 49712d2fe62393d5668027667bc96d69_JaffaCakes118.exe 82 PID 1824 wrote to memory of 4292 1824 7vvpv.exe 83 PID 1824 wrote to memory of 4292 1824 7vvpv.exe 83 PID 1824 wrote to memory of 4292 1824 7vvpv.exe 83 PID 4292 wrote to memory of 624 4292 rlrlxrl.exe 84 PID 4292 wrote to memory of 624 4292 rlrlxrl.exe 84 PID 4292 wrote to memory of 624 4292 rlrlxrl.exe 84 PID 624 wrote to memory of 3016 624 5dppj.exe 85 PID 624 wrote to memory of 3016 624 5dppj.exe 85 PID 624 wrote to memory of 3016 624 5dppj.exe 85 PID 3016 wrote to memory of 4316 3016 dpvjd.exe 86 PID 3016 wrote to memory of 4316 3016 dpvjd.exe 86 PID 3016 wrote to memory of 4316 3016 dpvjd.exe 86 PID 4316 wrote to memory of 1208 4316 fxxrffr.exe 87 PID 4316 wrote to memory of 1208 4316 fxxrffr.exe 87 PID 4316 wrote to memory of 1208 4316 fxxrffr.exe 87 PID 1208 wrote to memory of 3640 1208 1hbnbt.exe 88 PID 1208 wrote to memory of 3640 1208 1hbnbt.exe 88 PID 1208 wrote to memory of 3640 1208 1hbnbt.exe 88 PID 3640 wrote to memory of 1236 3640 nhhnbb.exe 89 PID 3640 wrote to memory of 1236 3640 nhhnbb.exe 89 PID 3640 wrote to memory of 1236 3640 nhhnbb.exe 89 PID 1236 wrote to memory of 384 1236 pvvpd.exe 90 PID 1236 wrote to memory of 384 1236 pvvpd.exe 90 PID 1236 wrote to memory of 384 1236 pvvpd.exe 90 PID 384 wrote to memory of 628 384 7lrflxf.exe 91 PID 384 wrote to memory of 628 384 7lrflxf.exe 91 PID 384 wrote to memory of 628 384 7lrflxf.exe 91 PID 628 wrote to memory of 2052 628 jjpdp.exe 92 PID 628 wrote to memory of 2052 628 jjpdp.exe 92 PID 628 wrote to memory of 2052 628 jjpdp.exe 92 PID 2052 wrote to memory of 3616 2052 xxllflx.exe 93 PID 2052 wrote to memory of 3616 2052 xxllflx.exe 93 PID 2052 wrote to memory of 3616 2052 xxllflx.exe 93 PID 3616 wrote to memory of 2544 3616 frxrflr.exe 94 PID 3616 wrote to memory of 2544 3616 frxrflr.exe 94 PID 3616 wrote to memory of 2544 3616 frxrflr.exe 94 PID 2544 wrote to memory of 688 2544 dppdd.exe 95 PID 2544 wrote to memory of 688 2544 dppdd.exe 95 PID 2544 wrote to memory of 688 2544 dppdd.exe 95 PID 688 wrote to memory of 1620 688 xrrfxfx.exe 96 PID 688 wrote to memory of 1620 688 xrrfxfx.exe 96 PID 688 wrote to memory of 1620 688 xrrfxfx.exe 96 PID 1620 wrote to memory of 1712 1620 bnnnbn.exe 97 PID 1620 wrote to memory of 1712 1620 bnnnbn.exe 97 PID 1620 wrote to memory of 1712 1620 bnnnbn.exe 97 PID 1712 wrote to memory of 1148 1712 dppjd.exe 98 PID 1712 wrote to memory of 1148 1712 dppjd.exe 98 PID 1712 wrote to memory of 1148 1712 dppjd.exe 98 PID 1148 wrote to memory of 2944 1148 xrfxxxf.exe 99 PID 1148 wrote to memory of 2944 1148 xrfxxxf.exe 99 PID 1148 wrote to memory of 2944 1148 xrfxxxf.exe 99 PID 2944 wrote to memory of 2580 2944 5ffxrrr.exe 100 PID 2944 wrote to memory of 2580 2944 5ffxrrr.exe 100 PID 2944 wrote to memory of 2580 2944 5ffxrrr.exe 100 PID 2580 wrote to memory of 1880 2580 tntntt.exe 101 PID 2580 wrote to memory of 1880 2580 tntntt.exe 101 PID 2580 wrote to memory of 1880 2580 tntntt.exe 101 PID 1880 wrote to memory of 516 1880 xfxrlfx.exe 102 PID 1880 wrote to memory of 516 1880 xfxrlfx.exe 102 PID 1880 wrote to memory of 516 1880 xfxrlfx.exe 102 PID 516 wrote to memory of 5028 516 5lrlffx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\49712d2fe62393d5668027667bc96d69_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\49712d2fe62393d5668027667bc96d69_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\7vvpv.exec:\7vvpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\rlrlxrl.exec:\rlrlxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\5dppj.exec:\5dppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\dpvjd.exec:\dpvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\fxxrffr.exec:\fxxrffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\1hbnbt.exec:\1hbnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\nhhnbb.exec:\nhhnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\pvvpd.exec:\pvvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\7lrflxf.exec:\7lrflxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\jjpdp.exec:\jjpdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\xxllflx.exec:\xxllflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\frxrflr.exec:\frxrflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\dppdd.exec:\dppdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\xrrfxfx.exec:\xrrfxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\bnnnbn.exec:\bnnnbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\dppjd.exec:\dppjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\xrfxxxf.exec:\xrfxxxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\5ffxrrr.exec:\5ffxrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\tntntt.exec:\tntntt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\5lrlffx.exec:\5lrlffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\thhhtt.exec:\thhhtt.exe23⤵
- Executes dropped EXE
PID:5028 -
\??\c:\jpvpd.exec:\jpvpd.exe24⤵
- Executes dropped EXE
PID:3672 -
\??\c:\frrlxxr.exec:\frrlxxr.exe25⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rffxrfx.exec:\rffxrfx.exe26⤵
- Executes dropped EXE
PID:4636 -
\??\c:\ttnntt.exec:\ttnntt.exe27⤵
- Executes dropped EXE
PID:752 -
\??\c:\vdjvj.exec:\vdjvj.exe28⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vdjdp.exec:\vdjdp.exe29⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rffxrlf.exec:\rffxrlf.exe30⤵
- Executes dropped EXE
PID:3840 -
\??\c:\nbhtnh.exec:\nbhtnh.exe31⤵
- Executes dropped EXE
PID:1132 -
\??\c:\jjdpd.exec:\jjdpd.exe32⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5pvpv.exec:\5pvpv.exe33⤵
- Executes dropped EXE
PID:3964 -
\??\c:\xflxrlf.exec:\xflxrlf.exe34⤵
- Executes dropped EXE
PID:4204 -
\??\c:\bnthtn.exec:\bnthtn.exe35⤵
- Executes dropped EXE
PID:4812 -
\??\c:\ddpdv.exec:\ddpdv.exe36⤵
- Executes dropped EXE
PID:2672 -
\??\c:\9jdvp.exec:\9jdvp.exe37⤵
- Executes dropped EXE
PID:3792 -
\??\c:\rlfrfxr.exec:\rlfrfxr.exe38⤵
- Executes dropped EXE
PID:1624 -
\??\c:\tntbtt.exec:\tntbtt.exe39⤵
- Executes dropped EXE
PID:5000 -
\??\c:\hbbthn.exec:\hbbthn.exe40⤵
- Executes dropped EXE
PID:4352 -
\??\c:\jddvp.exec:\jddvp.exe41⤵
- Executes dropped EXE
PID:3664 -
\??\c:\xflfxxl.exec:\xflfxxl.exe42⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rxlflll.exec:\rxlflll.exe43⤵
- Executes dropped EXE
PID:3928 -
\??\c:\ttthbt.exec:\ttthbt.exe44⤵
- Executes dropped EXE
PID:964 -
\??\c:\nttbnh.exec:\nttbnh.exe45⤵
- Executes dropped EXE
PID:3628 -
\??\c:\5xfrlfx.exec:\5xfrlfx.exe46⤵
- Executes dropped EXE
PID:4604 -
\??\c:\lrxrfxr.exec:\lrxrfxr.exe47⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bnnnhh.exec:\bnnnhh.exe48⤵
- Executes dropped EXE
PID:2152 -
\??\c:\jddpp.exec:\jddpp.exe49⤵
- Executes dropped EXE
PID:3448 -
\??\c:\flrlxrl.exec:\flrlxrl.exe50⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bbnhbt.exec:\bbnhbt.exe51⤵
- Executes dropped EXE
PID:1504 -
\??\c:\nbbtnh.exec:\nbbtnh.exe52⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jvdvp.exec:\jvdvp.exe53⤵
- Executes dropped EXE
PID:540 -
\??\c:\rrxrffx.exec:\rrxrffx.exe54⤵
- Executes dropped EXE
PID:744 -
\??\c:\7xrlrlf.exec:\7xrlrlf.exe55⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bhtnbb.exec:\bhtnbb.exe56⤵
- Executes dropped EXE
PID:4484 -
\??\c:\dppjp.exec:\dppjp.exe57⤵
- Executes dropped EXE
PID:2640 -
\??\c:\fxlxxrx.exec:\fxlxxrx.exe58⤵
- Executes dropped EXE
PID:628 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe59⤵
- Executes dropped EXE
PID:2004 -
\??\c:\9pjdv.exec:\9pjdv.exe60⤵
- Executes dropped EXE
PID:3120 -
\??\c:\rfllrrl.exec:\rfllrrl.exe61⤵
- Executes dropped EXE
PID:1452 -
\??\c:\bbbtnh.exec:\bbbtnh.exe62⤵
- Executes dropped EXE
PID:1560 -
\??\c:\7dvpd.exec:\7dvpd.exe63⤵
- Executes dropped EXE
PID:3836 -
\??\c:\1rlxrlf.exec:\1rlxrlf.exe64⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lxxrllf.exec:\lxxrllf.exe65⤵
- Executes dropped EXE
PID:1620 -
\??\c:\htthtb.exec:\htthtb.exe66⤵PID:2280
-
\??\c:\btnhtt.exec:\btnhtt.exe67⤵PID:5108
-
\??\c:\lxxrflf.exec:\lxxrflf.exe68⤵PID:2944
-
\??\c:\fffxxrl.exec:\fffxxrl.exe69⤵PID:2580
-
\??\c:\htbtbt.exec:\htbtbt.exe70⤵PID:2684
-
\??\c:\jjdvj.exec:\jjdvj.exe71⤵PID:832
-
\??\c:\dpjdp.exec:\dpjdp.exe72⤵PID:376
-
\??\c:\3hnnhn.exec:\3hnnhn.exe73⤵PID:3672
-
\??\c:\hhnbnh.exec:\hhnbnh.exe74⤵PID:3096
-
\??\c:\jddpj.exec:\jddpj.exe75⤵PID:4636
-
\??\c:\ffrlxrl.exec:\ffrlxrl.exe76⤵PID:4044
-
\??\c:\1flfxxr.exec:\1flfxxr.exe77⤵PID:2224
-
\??\c:\bttnhh.exec:\bttnhh.exe78⤵PID:4916
-
\??\c:\1jpjv.exec:\1jpjv.exe79⤵PID:2688
-
\??\c:\vpvvp.exec:\vpvvp.exe80⤵PID:3588
-
\??\c:\xlfxlff.exec:\xlfxlff.exe81⤵PID:2780
-
\??\c:\7ttbbn.exec:\7ttbbn.exe82⤵PID:1864
-
\??\c:\bhnhbb.exec:\bhnhbb.exe83⤵PID:1048
-
\??\c:\djjdp.exec:\djjdp.exe84⤵PID:2572
-
\??\c:\rrlfxrr.exec:\rrlfxrr.exe85⤵PID:2056
-
\??\c:\1xlfxxf.exec:\1xlfxxf.exe86⤵PID:2896
-
\??\c:\ttnhbb.exec:\ttnhbb.exe87⤵PID:3132
-
\??\c:\pdpdd.exec:\pdpdd.exe88⤵PID:3436
-
\??\c:\pvvvj.exec:\pvvvj.exe89⤵PID:3376
-
\??\c:\rxxrffr.exec:\rxxrffr.exe90⤵PID:3200
-
\??\c:\bhhbtn.exec:\bhhbtn.exe91⤵PID:1552
-
\??\c:\ppjdv.exec:\ppjdv.exe92⤵PID:2264
-
\??\c:\fxllffx.exec:\fxllffx.exe93⤵PID:632
-
\??\c:\fllfrlf.exec:\fllfrlf.exe94⤵PID:4360
-
\??\c:\bnhbnh.exec:\bnhbnh.exe95⤵PID:4968
-
\??\c:\jjpjv.exec:\jjpjv.exe96⤵PID:4436
-
\??\c:\lrfrlfx.exec:\lrfrlfx.exe97⤵PID:4444
-
\??\c:\9rfflrr.exec:\9rfflrr.exe98⤵PID:1972
-
\??\c:\hnthtt.exec:\hnthtt.exe99⤵PID:2152
-
\??\c:\3hnhtn.exec:\3hnhtn.exe100⤵PID:4292
-
\??\c:\vppjv.exec:\vppjv.exe101⤵PID:2112
-
\??\c:\9rffrlx.exec:\9rffrlx.exe102⤵PID:3876
-
\??\c:\1rxlfxl.exec:\1rxlfxl.exe103⤵PID:4972
-
\??\c:\hbtnbn.exec:\hbtnbn.exe104⤵PID:1260
-
\??\c:\bntbtn.exec:\bntbtn.exe105⤵PID:4692
-
\??\c:\5pdvj.exec:\5pdvj.exe106⤵PID:1300
-
\??\c:\fxfxrfx.exec:\fxfxrfx.exe107⤵PID:3692
-
\??\c:\rlxrrlr.exec:\rlxrrlr.exe108⤵PID:2004
-
\??\c:\hhnhhh.exec:\hhnhhh.exe109⤵PID:3432
-
\??\c:\pvvpj.exec:\pvvpj.exe110⤵PID:4612
-
\??\c:\rffxxrr.exec:\rffxxrr.exe111⤵PID:2704
-
\??\c:\thhhbn.exec:\thhhbn.exe112⤵PID:2516
-
\??\c:\nbnhnt.exec:\nbnhnt.exe113⤵PID:1168
-
\??\c:\jjvjv.exec:\jjvjv.exe114⤵PID:2204
-
\??\c:\fxfrrrx.exec:\fxfrrrx.exe115⤵PID:3104
-
\??\c:\llfxrrf.exec:\llfxrrf.exe116⤵PID:4644
-
\??\c:\bthbtn.exec:\bthbtn.exe117⤵PID:3160
-
\??\c:\3vjjd.exec:\3vjjd.exe118⤵PID:832
-
\??\c:\dvvpj.exec:\dvvpj.exe119⤵PID:1448
-
\??\c:\lxxfrfx.exec:\lxxfrfx.exe120⤵PID:3188
-
\??\c:\btnbhb.exec:\btnbhb.exe121⤵PID:3096
-
\??\c:\vpddj.exec:\vpddj.exe122⤵PID:2652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-