Analysis
-
max time kernel
150s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 10:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0767f9d87034325e62e6fa9e967c650e_JaffaCakes118.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
0767f9d87034325e62e6fa9e967c650e_JaffaCakes118.exe
-
Size
188KB
-
MD5
0767f9d87034325e62e6fa9e967c650e
-
SHA1
1eee318debcf15d0583fb4c282115d72b431c732
-
SHA256
a423ffeb394d1f6c833bcb0d7f21dfb4abc92b19db0c83255719d2846762c938
-
SHA512
6a18065daff329169ab68caebf4139670fa7d7894e7d7eb7c870834aa74e99266ba69cd691bf58fb3a9c5907f839ca917235e0573915b573c16fde3bd0fee501
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+C2HVMc:PhOm2sI93UufdC67ciJTU2HVB
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/852-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/632-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/320-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3820-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-379-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-398-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-429-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-456-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-463-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-473-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-484-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/984-505-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-523-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-530-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-546-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-614-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-618-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-622-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-729-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-736-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-868-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-950-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-1035-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-1078-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/984-1097-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4944 7llxlxl.exe 3420 5bhtnb.exe 532 jvvpp.exe 4564 ddjvj.exe 3676 rflxlfx.exe 4908 dpvpd.exe 4984 xflxrlf.exe 2004 3bnbtt.exe 5064 vddjv.exe 1996 vjpjv.exe 4988 dppdv.exe 4116 1vvjv.exe 4744 rllfrfx.exe 4336 tnbnbt.exe 1080 7jpdv.exe 2396 5rxxxfx.exe 4688 hhnbtn.exe 2388 jvdvj.exe 512 3ffxlfx.exe 1836 5bthbt.exe 2448 5vvjv.exe 2356 lxrrfxr.exe 4456 tnnhnh.exe 4340 jjjvj.exe 3008 lffxlfr.exe 2416 bhhbtn.exe 4804 pvdpv.exe 632 dvpjv.exe 3476 httntn.exe 2732 pvdpd.exe 2436 pdjvp.exe 744 rxxxrrl.exe 3996 bntnbt.exe 3036 ttnhbt.exe 1028 vdpjd.exe 4444 pvdvj.exe 3824 xrlfrlf.exe 4412 1nhbtt.exe 1824 nnnnhb.exe 4848 djpjd.exe 4880 3ddvj.exe 2896 xrlfrll.exe 3344 ththbn.exe 4176 nnnbnh.exe 1840 3vpjv.exe 700 vppdp.exe 2836 ffxlflf.exe 2780 3flfxrl.exe 4972 nbthtn.exe 5064 vpjvp.exe 688 pjjvv.exe 320 rlfxlff.exe 3820 llrrffr.exe 3432 btnbnh.exe 1660 3ttnbb.exe 4440 jdpjd.exe 1948 ddjjv.exe 2228 xffxlfx.exe 3672 ffxxxrr.exe 3032 7hhtnh.exe 4884 pjpdj.exe 1444 jjdpd.exe 1160 lfrrrll.exe 4696 3xrlxxr.exe -
resource yara_rule behavioral2/memory/852-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/320-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3820-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-307-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-379-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-398-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-405-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-429-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-437-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-456-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-463-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-473-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-484-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-487-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-498-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-505-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-506-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-523-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-530-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 852 wrote to memory of 4944 852 0767f9d87034325e62e6fa9e967c650e_JaffaCakes118.exe 84 PID 852 wrote to memory of 4944 852 0767f9d87034325e62e6fa9e967c650e_JaffaCakes118.exe 84 PID 852 wrote to memory of 4944 852 0767f9d87034325e62e6fa9e967c650e_JaffaCakes118.exe 84 PID 4944 wrote to memory of 3420 4944 7llxlxl.exe 85 PID 4944 wrote to memory of 3420 4944 7llxlxl.exe 85 PID 4944 wrote to memory of 3420 4944 7llxlxl.exe 85 PID 3420 wrote to memory of 532 3420 5bhtnb.exe 86 PID 3420 wrote to memory of 532 3420 5bhtnb.exe 86 PID 3420 wrote to memory of 532 3420 5bhtnb.exe 86 PID 532 wrote to memory of 4564 532 jvvpp.exe 87 PID 532 wrote to memory of 4564 532 jvvpp.exe 87 PID 532 wrote to memory of 4564 532 jvvpp.exe 87 PID 4564 wrote to memory of 3676 4564 ddjvj.exe 88 PID 4564 wrote to memory of 3676 4564 ddjvj.exe 88 PID 4564 wrote to memory of 3676 4564 ddjvj.exe 88 PID 3676 wrote to memory of 4908 3676 rflxlfx.exe 89 PID 3676 wrote to memory of 4908 3676 rflxlfx.exe 89 PID 3676 wrote to memory of 4908 3676 rflxlfx.exe 89 PID 4908 wrote to memory of 4984 4908 dpvpd.exe 90 PID 4908 wrote to memory of 4984 4908 dpvpd.exe 90 PID 4908 wrote to memory of 4984 4908 dpvpd.exe 90 PID 4984 wrote to memory of 2004 4984 xflxrlf.exe 91 PID 4984 wrote to memory of 2004 4984 xflxrlf.exe 91 PID 4984 wrote to memory of 2004 4984 xflxrlf.exe 91 PID 2004 wrote to memory of 5064 2004 3bnbtt.exe 92 PID 2004 wrote to memory of 5064 2004 3bnbtt.exe 92 PID 2004 wrote to memory of 5064 2004 3bnbtt.exe 92 PID 5064 wrote to memory of 1996 5064 vddjv.exe 93 PID 5064 wrote to memory of 1996 5064 vddjv.exe 93 PID 5064 wrote to memory of 1996 5064 vddjv.exe 93 PID 1996 wrote to memory of 4988 1996 vjpjv.exe 94 PID 1996 wrote to memory of 4988 1996 vjpjv.exe 94 PID 1996 wrote to memory of 4988 1996 vjpjv.exe 94 PID 4988 wrote to memory of 4116 4988 dppdv.exe 95 PID 4988 wrote to memory of 4116 4988 dppdv.exe 95 PID 4988 wrote to memory of 4116 4988 dppdv.exe 95 PID 4116 wrote to memory of 4744 4116 1vvjv.exe 96 PID 4116 wrote to memory of 4744 4116 1vvjv.exe 96 PID 4116 wrote to memory of 4744 4116 1vvjv.exe 96 PID 4744 wrote to memory of 4336 4744 rllfrfx.exe 97 PID 4744 wrote to memory of 4336 4744 rllfrfx.exe 97 PID 4744 wrote to memory of 4336 4744 rllfrfx.exe 97 PID 4336 wrote to memory of 1080 4336 tnbnbt.exe 99 PID 4336 wrote to memory of 1080 4336 tnbnbt.exe 99 PID 4336 wrote to memory of 1080 4336 tnbnbt.exe 99 PID 1080 wrote to memory of 2396 1080 7jpdv.exe 100 PID 1080 wrote to memory of 2396 1080 7jpdv.exe 100 PID 1080 wrote to memory of 2396 1080 7jpdv.exe 100 PID 2396 wrote to memory of 4688 2396 5rxxxfx.exe 101 PID 2396 wrote to memory of 4688 2396 5rxxxfx.exe 101 PID 2396 wrote to memory of 4688 2396 5rxxxfx.exe 101 PID 4688 wrote to memory of 2388 4688 hhnbtn.exe 102 PID 4688 wrote to memory of 2388 4688 hhnbtn.exe 102 PID 4688 wrote to memory of 2388 4688 hhnbtn.exe 102 PID 2388 wrote to memory of 512 2388 jvdvj.exe 104 PID 2388 wrote to memory of 512 2388 jvdvj.exe 104 PID 2388 wrote to memory of 512 2388 jvdvj.exe 104 PID 512 wrote to memory of 1836 512 3ffxlfx.exe 105 PID 512 wrote to memory of 1836 512 3ffxlfx.exe 105 PID 512 wrote to memory of 1836 512 3ffxlfx.exe 105 PID 1836 wrote to memory of 2448 1836 5bthbt.exe 106 PID 1836 wrote to memory of 2448 1836 5bthbt.exe 106 PID 1836 wrote to memory of 2448 1836 5bthbt.exe 106 PID 2448 wrote to memory of 2356 2448 5vvjv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\0767f9d87034325e62e6fa9e967c650e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0767f9d87034325e62e6fa9e967c650e_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\7llxlxl.exec:\7llxlxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\5bhtnb.exec:\5bhtnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\jvvpp.exec:\jvvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\ddjvj.exec:\ddjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\rflxlfx.exec:\rflxlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\dpvpd.exec:\dpvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\xflxrlf.exec:\xflxrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\3bnbtt.exec:\3bnbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\vddjv.exec:\vddjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\vjpjv.exec:\vjpjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\dppdv.exec:\dppdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\1vvjv.exec:\1vvjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\rllfrfx.exec:\rllfrfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\tnbnbt.exec:\tnbnbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\7jpdv.exec:\7jpdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\5rxxxfx.exec:\5rxxxfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\hhnbtn.exec:\hhnbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\jvdvj.exec:\jvdvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\3ffxlfx.exec:\3ffxlfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\5bthbt.exec:\5bthbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\5vvjv.exec:\5vvjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\lxrrfxr.exec:\lxrrfxr.exe23⤵
- Executes dropped EXE
PID:2356 -
\??\c:\tnnhnh.exec:\tnnhnh.exe24⤵
- Executes dropped EXE
PID:4456 -
\??\c:\jjjvj.exec:\jjjvj.exe25⤵
- Executes dropped EXE
PID:4340 -
\??\c:\lffxlfr.exec:\lffxlfr.exe26⤵
- Executes dropped EXE
PID:3008 -
\??\c:\bhhbtn.exec:\bhhbtn.exe27⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pvdpv.exec:\pvdpv.exe28⤵
- Executes dropped EXE
PID:4804 -
\??\c:\dvpjv.exec:\dvpjv.exe29⤵
- Executes dropped EXE
PID:632 -
\??\c:\httntn.exec:\httntn.exe30⤵
- Executes dropped EXE
PID:3476 -
\??\c:\pvdpd.exec:\pvdpd.exe31⤵
- Executes dropped EXE
PID:2732 -
\??\c:\pdjvp.exec:\pdjvp.exe32⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rxxxrrl.exec:\rxxxrrl.exe33⤵
- Executes dropped EXE
PID:744 -
\??\c:\bntnbt.exec:\bntnbt.exe34⤵
- Executes dropped EXE
PID:3996 -
\??\c:\ttnhbt.exec:\ttnhbt.exe35⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vdpjd.exec:\vdpjd.exe36⤵
- Executes dropped EXE
PID:1028 -
\??\c:\pvdvj.exec:\pvdvj.exe37⤵
- Executes dropped EXE
PID:4444 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe38⤵
- Executes dropped EXE
PID:3824 -
\??\c:\1nhbtt.exec:\1nhbtt.exe39⤵
- Executes dropped EXE
PID:4412 -
\??\c:\nnnnhb.exec:\nnnnhb.exe40⤵
- Executes dropped EXE
PID:1824 -
\??\c:\djpjd.exec:\djpjd.exe41⤵
- Executes dropped EXE
PID:4848 -
\??\c:\3ddvj.exec:\3ddvj.exe42⤵
- Executes dropped EXE
PID:4880 -
\??\c:\xrlfrll.exec:\xrlfrll.exe43⤵
- Executes dropped EXE
PID:2896 -
\??\c:\ththbn.exec:\ththbn.exe44⤵
- Executes dropped EXE
PID:3344 -
\??\c:\nnnbnh.exec:\nnnbnh.exe45⤵
- Executes dropped EXE
PID:4176 -
\??\c:\3vpjv.exec:\3vpjv.exe46⤵
- Executes dropped EXE
PID:1840 -
\??\c:\vppdp.exec:\vppdp.exe47⤵
- Executes dropped EXE
PID:700 -
\??\c:\ffxlflf.exec:\ffxlflf.exe48⤵
- Executes dropped EXE
PID:2836 -
\??\c:\3flfxrl.exec:\3flfxrl.exe49⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nbthtn.exec:\nbthtn.exe50⤵
- Executes dropped EXE
PID:4972 -
\??\c:\vpjvp.exec:\vpjvp.exe51⤵
- Executes dropped EXE
PID:5064 -
\??\c:\pjjvv.exec:\pjjvv.exe52⤵
- Executes dropped EXE
PID:688 -
\??\c:\rlfxlff.exec:\rlfxlff.exe53⤵
- Executes dropped EXE
PID:320 -
\??\c:\llrrffr.exec:\llrrffr.exe54⤵
- Executes dropped EXE
PID:3820 -
\??\c:\btnbnh.exec:\btnbnh.exe55⤵
- Executes dropped EXE
PID:3432 -
\??\c:\3ttnbb.exec:\3ttnbb.exe56⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jdpjd.exec:\jdpjd.exe57⤵
- Executes dropped EXE
PID:4440 -
\??\c:\ddjjv.exec:\ddjjv.exe58⤵
- Executes dropped EXE
PID:1948 -
\??\c:\xffxlfx.exec:\xffxlfx.exe59⤵
- Executes dropped EXE
PID:2228 -
\??\c:\ffxxxrr.exec:\ffxxxrr.exe60⤵
- Executes dropped EXE
PID:3672 -
\??\c:\7hhtnh.exec:\7hhtnh.exe61⤵
- Executes dropped EXE
PID:3032 -
\??\c:\pjpdj.exec:\pjpdj.exe62⤵
- Executes dropped EXE
PID:4884 -
\??\c:\jjdpd.exec:\jjdpd.exe63⤵
- Executes dropped EXE
PID:1444 -
\??\c:\lfrrrll.exec:\lfrrrll.exe64⤵
- Executes dropped EXE
PID:1160 -
\??\c:\3xrlxxr.exec:\3xrlxxr.exe65⤵
- Executes dropped EXE
PID:4696 -
\??\c:\7htnnh.exec:\7htnnh.exe66⤵PID:4632
-
\??\c:\jvjdj.exec:\jvjdj.exe67⤵PID:2816
-
\??\c:\rrrlffr.exec:\rrrlffr.exe68⤵PID:1168
-
\??\c:\tbbnbt.exec:\tbbnbt.exe69⤵PID:2220
-
\??\c:\dvppj.exec:\dvppj.exe70⤵PID:2244
-
\??\c:\rflfrrl.exec:\rflfrrl.exe71⤵PID:3964
-
\??\c:\xffrllf.exec:\xffrllf.exe72⤵PID:1304
-
\??\c:\bnnhbb.exec:\bnnhbb.exe73⤵PID:4604
-
\??\c:\thnnhn.exec:\thnnhn.exe74⤵PID:752
-
\??\c:\vvpvp.exec:\vvpvp.exe75⤵PID:4804
-
\??\c:\vjvpp.exec:\vjvpp.exe76⤵PID:3832
-
\??\c:\rxfxlfx.exec:\rxfxlfx.exe77⤵PID:384
-
\??\c:\llrrlxr.exec:\llrrlxr.exe78⤵PID:2732
-
\??\c:\ttnnhb.exec:\ttnnhb.exe79⤵PID:4512
-
\??\c:\nnhtbt.exec:\nnhtbt.exe80⤵PID:2436
-
\??\c:\9pvjv.exec:\9pvjv.exe81⤵PID:1452
-
\??\c:\ppdvp.exec:\ppdvp.exe82⤵PID:3724
-
\??\c:\lxxrllf.exec:\lxxrllf.exe83⤵PID:2336
-
\??\c:\xrrxllf.exec:\xrrxllf.exe84⤵PID:4596
-
\??\c:\tbbthb.exec:\tbbthb.exe85⤵PID:3824
-
\??\c:\3pvdd.exec:\3pvdd.exe86⤵PID:4412
-
\??\c:\pvdpd.exec:\pvdpd.exe87⤵PID:4944
-
\??\c:\fxffxfl.exec:\fxffxfl.exe88⤵PID:4680
-
\??\c:\llffxrx.exec:\llffxrx.exe89⤵PID:532
-
\??\c:\nnbnhn.exec:\nnbnhn.exe90⤵PID:3668
-
\??\c:\9hnbtb.exec:\9hnbtb.exe91⤵PID:4940
-
\??\c:\jvvpd.exec:\jvvpd.exe92⤵PID:3676
-
\??\c:\dvdvp.exec:\dvdvp.exe93⤵PID:1332
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe94⤵PID:3780
-
\??\c:\5htnhb.exec:\5htnhb.exe95⤵PID:2780
-
\??\c:\httnnh.exec:\httnnh.exe96⤵PID:4972
-
\??\c:\fxlxrlx.exec:\fxlxrlx.exe97⤵PID:208
-
\??\c:\7ffxrlf.exec:\7ffxrlf.exe98⤵PID:2564
-
\??\c:\9hhtnh.exec:\9hhtnh.exe99⤵PID:1756
-
\??\c:\jvdvv.exec:\jvdvv.exe100⤵PID:5028
-
\??\c:\vpvpj.exec:\vpvpj.exe101⤵PID:684
-
\??\c:\lfxllfx.exec:\lfxllfx.exe102⤵PID:4064
-
\??\c:\llrlfxr.exec:\llrlfxr.exe103⤵PID:1684
-
\??\c:\btbtnh.exec:\btbtnh.exe104⤵PID:2968
-
\??\c:\dvpjd.exec:\dvpjd.exe105⤵PID:4624
-
\??\c:\lxxrfxr.exec:\lxxrfxr.exe106⤵PID:4936
-
\??\c:\hntnhb.exec:\hntnhb.exe107⤵PID:4472
-
\??\c:\htnhbb.exec:\htnhbb.exe108⤵PID:1568
-
\??\c:\dvpjp.exec:\dvpjp.exe109⤵PID:2664
-
\??\c:\lrrlxlf.exec:\lrrlxlf.exe110⤵PID:936
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe111⤵PID:380
-
\??\c:\btnnbt.exec:\btnnbt.exe112⤵PID:1168
-
\??\c:\bhnnbt.exec:\bhnnbt.exe113⤵PID:4072
-
\??\c:\5jdvj.exec:\5jdvj.exe114⤵PID:2244
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe115⤵PID:3964
-
\??\c:\nbnbtn.exec:\nbnbtn.exe116⤵PID:4784
-
\??\c:\nbnhhb.exec:\nbnhhb.exe117⤵PID:988
-
\??\c:\vpjdp.exec:\vpjdp.exe118⤵PID:3256
-
\??\c:\3dvpv.exec:\3dvpv.exe119⤵PID:4588
-
\??\c:\bnnhtn.exec:\bnnhtn.exe120⤵PID:3988
-
\??\c:\3bbnbt.exec:\3bbnbt.exe121⤵PID:2920
-
\??\c:\jpvjv.exec:\jpvjv.exe122⤵PID:3968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-