Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 06:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16710183c9f7b074c19c73584c9536db_JaffaCakes118.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
16710183c9f7b074c19c73584c9536db_JaffaCakes118.exe
-
Size
400KB
-
MD5
16710183c9f7b074c19c73584c9536db
-
SHA1
8c795671c0179ddba613d703579518d82266107c
-
SHA256
34b8fc789b121f007058329ca7d79484968c143e7430632a6d52c4632c5eeea3
-
SHA512
63d3da2188103358b3bae6d2beea55948650b762754ef613ffdf23498e3b06d4245304dc17ba33dc287ba389b386b7b84ab3c0c21a0649a77cdbd0122971f7af
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFwzWGeaSRnv4bd3uXK:8cm7ImGddXmNt251UriZFwCJFngbUK
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3016-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/460-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/848-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-740-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-804-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-840-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-862-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3016 rrxrlrl.exe 1448 7bnhbb.exe 5080 frrllll.exe 460 vddvv.exe 4688 lxfxrlf.exe 856 hbbttn.exe 2688 pdjjd.exe 1904 rlfxrlf.exe 3164 hnnnhh.exe 3444 1pvpd.exe 676 9lrlffl.exe 3844 hthbbb.exe 4112 jddvp.exe 1576 tnhbnn.exe 4484 dpdvd.exe 3580 frlfrrl.exe 2608 5xfxllf.exe 2904 rllfxxf.exe 2256 tthhbb.exe 1992 dvjvd.exe 5112 pddjd.exe 1648 5frlrrx.exe 2040 tntthn.exe 2448 ttbtnh.exe 4392 dvdvj.exe 4996 5rxrffx.exe 4396 flrlfxx.exe 3204 1dvpd.exe 3008 9flfxxr.exe 4772 hbbttt.exe 1952 nnhnhh.exe 2956 pdvvd.exe 4060 7xrlxxr.exe 1680 rlffrrf.exe 3804 btttnn.exe 3864 tntnhh.exe 4888 1jvpd.exe 1796 1rxxrrl.exe 2348 xlxrrll.exe 5044 nnhnhh.exe 2280 bnbbnh.exe 848 1pjdj.exe 4348 3dpjv.exe 3016 flxrrrr.exe 1580 3nntnn.exe 2424 9dvpd.exe 1788 llllrrr.exe 460 7ntttt.exe 4864 nhnhth.exe 2028 dvddp.exe 2024 rrlfxxr.exe 4940 rxxxrxx.exe 5024 9thbbb.exe 3164 vjjdv.exe 740 7vjdp.exe 3244 lflfrrl.exe 916 nhnhht.exe 3108 3hnhtt.exe 528 vdjdp.exe 4876 rfffrrr.exe 208 7rxrllf.exe 4552 5hhbbt.exe 4648 vvppd.exe 4604 vvdpp.exe -
resource yara_rule behavioral2/memory/3016-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/460-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-667-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3816 wrote to memory of 3016 3816 16710183c9f7b074c19c73584c9536db_JaffaCakes118.exe 83 PID 3816 wrote to memory of 3016 3816 16710183c9f7b074c19c73584c9536db_JaffaCakes118.exe 83 PID 3816 wrote to memory of 3016 3816 16710183c9f7b074c19c73584c9536db_JaffaCakes118.exe 83 PID 3016 wrote to memory of 1448 3016 rrxrlrl.exe 84 PID 3016 wrote to memory of 1448 3016 rrxrlrl.exe 84 PID 3016 wrote to memory of 1448 3016 rrxrlrl.exe 84 PID 1448 wrote to memory of 5080 1448 7bnhbb.exe 85 PID 1448 wrote to memory of 5080 1448 7bnhbb.exe 85 PID 1448 wrote to memory of 5080 1448 7bnhbb.exe 85 PID 5080 wrote to memory of 460 5080 frrllll.exe 86 PID 5080 wrote to memory of 460 5080 frrllll.exe 86 PID 5080 wrote to memory of 460 5080 frrllll.exe 86 PID 460 wrote to memory of 4688 460 vddvv.exe 87 PID 460 wrote to memory of 4688 460 vddvv.exe 87 PID 460 wrote to memory of 4688 460 vddvv.exe 87 PID 4688 wrote to memory of 856 4688 lxfxrlf.exe 88 PID 4688 wrote to memory of 856 4688 lxfxrlf.exe 88 PID 4688 wrote to memory of 856 4688 lxfxrlf.exe 88 PID 856 wrote to memory of 2688 856 hbbttn.exe 89 PID 856 wrote to memory of 2688 856 hbbttn.exe 89 PID 856 wrote to memory of 2688 856 hbbttn.exe 89 PID 2688 wrote to memory of 1904 2688 pdjjd.exe 91 PID 2688 wrote to memory of 1904 2688 pdjjd.exe 91 PID 2688 wrote to memory of 1904 2688 pdjjd.exe 91 PID 1904 wrote to memory of 3164 1904 rlfxrlf.exe 93 PID 1904 wrote to memory of 3164 1904 rlfxrlf.exe 93 PID 1904 wrote to memory of 3164 1904 rlfxrlf.exe 93 PID 3164 wrote to memory of 3444 3164 hnnnhh.exe 94 PID 3164 wrote to memory of 3444 3164 hnnnhh.exe 94 PID 3164 wrote to memory of 3444 3164 hnnnhh.exe 94 PID 3444 wrote to memory of 676 3444 1pvpd.exe 96 PID 3444 wrote to memory of 676 3444 1pvpd.exe 96 PID 3444 wrote to memory of 676 3444 1pvpd.exe 96 PID 676 wrote to memory of 3844 676 9lrlffl.exe 97 PID 676 wrote to memory of 3844 676 9lrlffl.exe 97 PID 676 wrote to memory of 3844 676 9lrlffl.exe 97 PID 3844 wrote to memory of 4112 3844 hthbbb.exe 98 PID 3844 wrote to memory of 4112 3844 hthbbb.exe 98 PID 3844 wrote to memory of 4112 3844 hthbbb.exe 98 PID 4112 wrote to memory of 1576 4112 jddvp.exe 99 PID 4112 wrote to memory of 1576 4112 jddvp.exe 99 PID 4112 wrote to memory of 1576 4112 jddvp.exe 99 PID 1576 wrote to memory of 4484 1576 tnhbnn.exe 100 PID 1576 wrote to memory of 4484 1576 tnhbnn.exe 100 PID 1576 wrote to memory of 4484 1576 tnhbnn.exe 100 PID 4484 wrote to memory of 3580 4484 dpdvd.exe 101 PID 4484 wrote to memory of 3580 4484 dpdvd.exe 101 PID 4484 wrote to memory of 3580 4484 dpdvd.exe 101 PID 3580 wrote to memory of 2608 3580 frlfrrl.exe 102 PID 3580 wrote to memory of 2608 3580 frlfrrl.exe 102 PID 3580 wrote to memory of 2608 3580 frlfrrl.exe 102 PID 2608 wrote to memory of 2904 2608 5xfxllf.exe 103 PID 2608 wrote to memory of 2904 2608 5xfxllf.exe 103 PID 2608 wrote to memory of 2904 2608 5xfxllf.exe 103 PID 2904 wrote to memory of 2256 2904 rllfxxf.exe 104 PID 2904 wrote to memory of 2256 2904 rllfxxf.exe 104 PID 2904 wrote to memory of 2256 2904 rllfxxf.exe 104 PID 2256 wrote to memory of 1992 2256 tthhbb.exe 105 PID 2256 wrote to memory of 1992 2256 tthhbb.exe 105 PID 2256 wrote to memory of 1992 2256 tthhbb.exe 105 PID 1992 wrote to memory of 5112 1992 dvjvd.exe 106 PID 1992 wrote to memory of 5112 1992 dvjvd.exe 106 PID 1992 wrote to memory of 5112 1992 dvjvd.exe 106 PID 5112 wrote to memory of 1648 5112 pddjd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\16710183c9f7b074c19c73584c9536db_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\16710183c9f7b074c19c73584c9536db_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\rrxrlrl.exec:\rrxrlrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\7bnhbb.exec:\7bnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\frrllll.exec:\frrllll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\vddvv.exec:\vddvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\hbbttn.exec:\hbbttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\pdjjd.exec:\pdjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\hnnnhh.exec:\hnnnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\1pvpd.exec:\1pvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\9lrlffl.exec:\9lrlffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\hthbbb.exec:\hthbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\jddvp.exec:\jddvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\tnhbnn.exec:\tnhbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\dpdvd.exec:\dpdvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\frlfrrl.exec:\frlfrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\5xfxllf.exec:\5xfxllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\rllfxxf.exec:\rllfxxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\tthhbb.exec:\tthhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\dvjvd.exec:\dvjvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\pddjd.exec:\pddjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\5frlrrx.exec:\5frlrrx.exe23⤵
- Executes dropped EXE
PID:1648 -
\??\c:\tntthn.exec:\tntthn.exe24⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ttbtnh.exec:\ttbtnh.exe25⤵
- Executes dropped EXE
PID:2448 -
\??\c:\dvdvj.exec:\dvdvj.exe26⤵
- Executes dropped EXE
PID:4392 -
\??\c:\5rxrffx.exec:\5rxrffx.exe27⤵
- Executes dropped EXE
PID:4996 -
\??\c:\flrlfxx.exec:\flrlfxx.exe28⤵
- Executes dropped EXE
PID:4396 -
\??\c:\1dvpd.exec:\1dvpd.exe29⤵
- Executes dropped EXE
PID:3204 -
\??\c:\9flfxxr.exec:\9flfxxr.exe30⤵
- Executes dropped EXE
PID:3008 -
\??\c:\hbbttt.exec:\hbbttt.exe31⤵
- Executes dropped EXE
PID:4772 -
\??\c:\nnhnhh.exec:\nnhnhh.exe32⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pdvvd.exec:\pdvvd.exe33⤵
- Executes dropped EXE
PID:2956 -
\??\c:\7xrlxxr.exec:\7xrlxxr.exe34⤵
- Executes dropped EXE
PID:4060 -
\??\c:\rlffrrf.exec:\rlffrrf.exe35⤵
- Executes dropped EXE
PID:1680 -
\??\c:\btttnn.exec:\btttnn.exe36⤵
- Executes dropped EXE
PID:3804 -
\??\c:\tntnhh.exec:\tntnhh.exe37⤵
- Executes dropped EXE
PID:3864 -
\??\c:\1jvpd.exec:\1jvpd.exe38⤵
- Executes dropped EXE
PID:4888 -
\??\c:\1rxxrrl.exec:\1rxxrrl.exe39⤵
- Executes dropped EXE
PID:1796 -
\??\c:\xlxrrll.exec:\xlxrrll.exe40⤵
- Executes dropped EXE
PID:2348 -
\??\c:\nnhnhh.exec:\nnhnhh.exe41⤵
- Executes dropped EXE
PID:5044 -
\??\c:\bnbbnh.exec:\bnbbnh.exe42⤵
- Executes dropped EXE
PID:2280 -
\??\c:\1pjdj.exec:\1pjdj.exe43⤵
- Executes dropped EXE
PID:848 -
\??\c:\3dpjv.exec:\3dpjv.exe44⤵
- Executes dropped EXE
PID:4348 -
\??\c:\flxrrrr.exec:\flxrrrr.exe45⤵
- Executes dropped EXE
PID:3016 -
\??\c:\3nntnn.exec:\3nntnn.exe46⤵
- Executes dropped EXE
PID:1580 -
\??\c:\9dvpd.exec:\9dvpd.exe47⤵
- Executes dropped EXE
PID:2424 -
\??\c:\llllrrr.exec:\llllrrr.exe48⤵
- Executes dropped EXE
PID:1788 -
\??\c:\7ntttt.exec:\7ntttt.exe49⤵
- Executes dropped EXE
PID:460 -
\??\c:\nhnhth.exec:\nhnhth.exe50⤵
- Executes dropped EXE
PID:4864 -
\??\c:\dvddp.exec:\dvddp.exe51⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe52⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rxxxrxx.exec:\rxxxrxx.exe53⤵
- Executes dropped EXE
PID:4940 -
\??\c:\9thbbb.exec:\9thbbb.exe54⤵
- Executes dropped EXE
PID:5024 -
\??\c:\vjjdv.exec:\vjjdv.exe55⤵
- Executes dropped EXE
PID:3164 -
\??\c:\7vjdp.exec:\7vjdp.exe56⤵
- Executes dropped EXE
PID:740 -
\??\c:\lflfrrl.exec:\lflfrrl.exe57⤵
- Executes dropped EXE
PID:3244 -
\??\c:\nhnhht.exec:\nhnhht.exe58⤵
- Executes dropped EXE
PID:916 -
\??\c:\3hnhtt.exec:\3hnhtt.exe59⤵
- Executes dropped EXE
PID:3108 -
\??\c:\vdjdp.exec:\vdjdp.exe60⤵
- Executes dropped EXE
PID:528 -
\??\c:\rfffrrr.exec:\rfffrrr.exe61⤵
- Executes dropped EXE
PID:4876 -
\??\c:\7rxrllf.exec:\7rxrllf.exe62⤵
- Executes dropped EXE
PID:208 -
\??\c:\5hhbbt.exec:\5hhbbt.exe63⤵
- Executes dropped EXE
PID:4552 -
\??\c:\vvppd.exec:\vvppd.exe64⤵
- Executes dropped EXE
PID:4648 -
\??\c:\vvdpp.exec:\vvdpp.exe65⤵
- Executes dropped EXE
PID:4604 -
\??\c:\xllrfll.exec:\xllrfll.exe66⤵PID:4596
-
\??\c:\tnnhbt.exec:\tnnhbt.exe67⤵PID:1468
-
\??\c:\jpvpp.exec:\jpvpp.exe68⤵PID:1220
-
\??\c:\frxxrlf.exec:\frxxrlf.exe69⤵PID:1116
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe70⤵PID:1916
-
\??\c:\ttbhbn.exec:\ttbhbn.exe71⤵PID:4452
-
\??\c:\vpvvd.exec:\vpvvd.exe72⤵PID:2060
-
\??\c:\jjjvv.exec:\jjjvv.exe73⤵PID:2788
-
\??\c:\xxrlfff.exec:\xxrlfff.exe74⤵PID:4160
-
\??\c:\9hnhnn.exec:\9hnhnn.exe75⤵PID:4108
-
\??\c:\3jddp.exec:\3jddp.exe76⤵PID:1424
-
\??\c:\jjpjd.exec:\jjpjd.exe77⤵PID:4392
-
\??\c:\frxrlxr.exec:\frxrlxr.exe78⤵PID:4472
-
\??\c:\rflfxrl.exec:\rflfxrl.exe79⤵PID:1660
-
\??\c:\nhhbtn.exec:\nhhbtn.exe80⤵PID:3204
-
\??\c:\pjjvd.exec:\pjjvd.exe81⤵PID:3084
-
\??\c:\vpppj.exec:\vpppj.exe82⤵PID:2364
-
\??\c:\lxrlrrl.exec:\lxrlrrl.exe83⤵PID:3944
-
\??\c:\xrxlfxr.exec:\xrxlfxr.exe84⤵PID:3500
-
\??\c:\bhtbhh.exec:\bhtbhh.exe85⤵PID:4104
-
\??\c:\3pppd.exec:\3pppd.exe86⤵PID:1872
-
\??\c:\xrrlfff.exec:\xrrlfff.exe87⤵PID:3988
-
\??\c:\dvdvd.exec:\dvdvd.exe88⤵PID:1416
-
\??\c:\1ddvj.exec:\1ddvj.exe89⤵PID:3564
-
\??\c:\7ffxlfx.exec:\7ffxlfx.exe90⤵PID:4040
-
\??\c:\9bnhtn.exec:\9bnhtn.exe91⤵PID:4428
-
\??\c:\jjpjj.exec:\jjpjj.exe92⤵PID:3708
-
\??\c:\xlllfxr.exec:\xlllfxr.exe93⤵PID:3512
-
\??\c:\7nnbht.exec:\7nnbht.exe94⤵PID:664
-
\??\c:\5hthtn.exec:\5hthtn.exe95⤵PID:1256
-
\??\c:\3ddvd.exec:\3ddvd.exe96⤵PID:1464
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe97⤵PID:5080
-
\??\c:\lrlfrll.exec:\lrlfrll.exe98⤵PID:544
-
\??\c:\tnnhnn.exec:\tnnhnn.exe99⤵PID:1876
-
\??\c:\7jpdj.exec:\7jpdj.exe100⤵PID:3196
-
\??\c:\7ddpj.exec:\7ddpj.exe101⤵PID:4184
-
\??\c:\1lrfrlr.exec:\1lrfrlr.exe102⤵PID:2136
-
\??\c:\1hhbtn.exec:\1hhbtn.exe103⤵PID:1824
-
\??\c:\nbbhnn.exec:\nbbhnn.exe104⤵PID:4540
-
\??\c:\pddjv.exec:\pddjv.exe105⤵PID:912
-
\??\c:\7pjvj.exec:\7pjvj.exe106⤵PID:1476
-
\??\c:\9lfxlfx.exec:\9lfxlfx.exe107⤵PID:620
-
\??\c:\lrxlxrl.exec:\lrxlxrl.exe108⤵PID:3244
-
\??\c:\bnnbtt.exec:\bnnbtt.exe109⤵PID:60
-
\??\c:\vjjvp.exec:\vjjvp.exe110⤵PID:4700
-
\??\c:\pvvjv.exec:\pvvjv.exe111⤵PID:2496
-
\??\c:\xrlfxrf.exec:\xrlfxrf.exe112⤵PID:3128
-
\??\c:\thnbtn.exec:\thnbtn.exe113⤵PID:1724
-
\??\c:\jvvjp.exec:\jvvjp.exe114⤵PID:3996
-
\??\c:\3pppj.exec:\3pppj.exe115⤵PID:4484
-
\??\c:\xrrfrlf.exec:\xrrfrlf.exe116⤵PID:2540
-
\??\c:\nththh.exec:\nththh.exe117⤵PID:3580
-
\??\c:\9nnhbt.exec:\9nnhbt.exe118⤵PID:2820
-
\??\c:\vpppv.exec:\vpppv.exe119⤵PID:2284
-
\??\c:\jvdpj.exec:\jvdpj.exe120⤵PID:1444
-
\??\c:\fflfrrf.exec:\fflfrrf.exe121⤵PID:996
-
\??\c:\5nnnnh.exec:\5nnnnh.exe122⤵PID:1924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-