Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 08:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16c404b1b2457e774eef9decec245e74_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
16c404b1b2457e774eef9decec245e74_JaffaCakes118.exe
-
Size
215KB
-
MD5
16c404b1b2457e774eef9decec245e74
-
SHA1
2a941d253d0088f487f5838a585247ea84aaf8b6
-
SHA256
19c238f30458b392902f9bfe66d65ab0d72e6964ba648faca28902907ffddcb2
-
SHA512
a3d8019f0027813b144b88cb58ea3a7a365675bb0fca773fee66efa9be4c5c9621789b5485035470f4bc015dc2a98d9ba7250078149f6fc5a22d5ac6942e70cc
-
SSDEEP
1536:evQBeOGtrYSSsrc93UBIfdC67m6AJiqzgLrTKBk3IU39TeYmKH:ehOm2sI93UufdC67ciRLPvx3teYmS
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1020-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/332-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/6120-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5776-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5696-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/6136-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/6128-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/708-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5748-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5624-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5588-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3272-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5216-748-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-902-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-989-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-1129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2980 nttnbh.exe 3476 7vpjv.exe 3980 1hhbnn.exe 332 hbbthh.exe 2580 vdjdv.exe 3404 3lfxlxr.exe 6120 hbbbtn.exe 4756 9bhhbn.exe 2564 jddvv.exe 2556 5nhhtt.exe 5776 5dvvp.exe 2944 bntnnn.exe 3624 dddvj.exe 4032 rllfxxr.exe 4972 flrlffx.exe 3392 pppjd.exe 1152 dvpjd.exe 1820 9lxrfxl.exe 5112 dddvv.exe 3848 pvdjd.exe 5188 frfxrrl.exe 4320 tbhbhh.exe 5488 1djdd.exe 4644 lrfxllr.exe 2148 btttnh.exe 5696 5jdvj.exe 3240 xlxrlll.exe 3440 1tnhbb.exe 3796 vjjvj.exe 1372 1fxrffx.exe 736 nhtntt.exe 1028 tnnnbh.exe 2432 pvjdv.exe 4520 ffxxlll.exe 744 flrlffx.exe 2008 bhnhhh.exe 2464 5vppj.exe 3004 rlxrrrx.exe 4244 7rfxffl.exe 3720 7bhhbb.exe 5416 7nnnhh.exe 4844 jddvp.exe 5548 5flfllr.exe 1936 xxlfxrr.exe 4692 hhhbth.exe 4988 ttnhtt.exe 4860 pjjpd.exe 4700 rffxxxr.exe 4940 thhbtt.exe 6136 bthbbb.exe 5016 pdjdv.exe 2612 pdpvj.exe 1444 xrrlxfx.exe 5440 rllfxxr.exe 3416 nnnbnn.exe 6128 pjvpj.exe 2932 rfxrxxr.exe 5520 rflllll.exe 684 thnnhh.exe 3692 btbthh.exe 708 vjpjd.exe 4232 lrxrffx.exe 5768 xlfxrrl.exe 5600 5thbtt.exe -
resource yara_rule behavioral2/memory/1020-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/332-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/6120-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5776-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5696-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/6136-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/6128-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/708-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5748-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5624-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5588-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5532-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5372-547-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1020 wrote to memory of 2980 1020 16c404b1b2457e774eef9decec245e74_JaffaCakes118.exe 82 PID 1020 wrote to memory of 2980 1020 16c404b1b2457e774eef9decec245e74_JaffaCakes118.exe 82 PID 1020 wrote to memory of 2980 1020 16c404b1b2457e774eef9decec245e74_JaffaCakes118.exe 82 PID 2980 wrote to memory of 3476 2980 nttnbh.exe 83 PID 2980 wrote to memory of 3476 2980 nttnbh.exe 83 PID 2980 wrote to memory of 3476 2980 nttnbh.exe 83 PID 3476 wrote to memory of 3980 3476 7vpjv.exe 84 PID 3476 wrote to memory of 3980 3476 7vpjv.exe 84 PID 3476 wrote to memory of 3980 3476 7vpjv.exe 84 PID 3980 wrote to memory of 332 3980 1hhbnn.exe 85 PID 3980 wrote to memory of 332 3980 1hhbnn.exe 85 PID 3980 wrote to memory of 332 3980 1hhbnn.exe 85 PID 332 wrote to memory of 2580 332 hbbthh.exe 86 PID 332 wrote to memory of 2580 332 hbbthh.exe 86 PID 332 wrote to memory of 2580 332 hbbthh.exe 86 PID 2580 wrote to memory of 3404 2580 vdjdv.exe 87 PID 2580 wrote to memory of 3404 2580 vdjdv.exe 87 PID 2580 wrote to memory of 3404 2580 vdjdv.exe 87 PID 3404 wrote to memory of 6120 3404 3lfxlxr.exe 88 PID 3404 wrote to memory of 6120 3404 3lfxlxr.exe 88 PID 3404 wrote to memory of 6120 3404 3lfxlxr.exe 88 PID 6120 wrote to memory of 4756 6120 hbbbtn.exe 89 PID 6120 wrote to memory of 4756 6120 hbbbtn.exe 89 PID 6120 wrote to memory of 4756 6120 hbbbtn.exe 89 PID 4756 wrote to memory of 2564 4756 9bhhbn.exe 90 PID 4756 wrote to memory of 2564 4756 9bhhbn.exe 90 PID 4756 wrote to memory of 2564 4756 9bhhbn.exe 90 PID 2564 wrote to memory of 2556 2564 jddvv.exe 91 PID 2564 wrote to memory of 2556 2564 jddvv.exe 91 PID 2564 wrote to memory of 2556 2564 jddvv.exe 91 PID 2556 wrote to memory of 5776 2556 5nhhtt.exe 92 PID 2556 wrote to memory of 5776 2556 5nhhtt.exe 92 PID 2556 wrote to memory of 5776 2556 5nhhtt.exe 92 PID 5776 wrote to memory of 2944 5776 5dvvp.exe 93 PID 5776 wrote to memory of 2944 5776 5dvvp.exe 93 PID 5776 wrote to memory of 2944 5776 5dvvp.exe 93 PID 2944 wrote to memory of 3624 2944 bntnnn.exe 94 PID 2944 wrote to memory of 3624 2944 bntnnn.exe 94 PID 2944 wrote to memory of 3624 2944 bntnnn.exe 94 PID 3624 wrote to memory of 4032 3624 dddvj.exe 95 PID 3624 wrote to memory of 4032 3624 dddvj.exe 95 PID 3624 wrote to memory of 4032 3624 dddvj.exe 95 PID 4032 wrote to memory of 4972 4032 rllfxxr.exe 96 PID 4032 wrote to memory of 4972 4032 rllfxxr.exe 96 PID 4032 wrote to memory of 4972 4032 rllfxxr.exe 96 PID 4972 wrote to memory of 3392 4972 flrlffx.exe 97 PID 4972 wrote to memory of 3392 4972 flrlffx.exe 97 PID 4972 wrote to memory of 3392 4972 flrlffx.exe 97 PID 3392 wrote to memory of 1152 3392 pppjd.exe 98 PID 3392 wrote to memory of 1152 3392 pppjd.exe 98 PID 3392 wrote to memory of 1152 3392 pppjd.exe 98 PID 1152 wrote to memory of 1820 1152 dvpjd.exe 99 PID 1152 wrote to memory of 1820 1152 dvpjd.exe 99 PID 1152 wrote to memory of 1820 1152 dvpjd.exe 99 PID 1820 wrote to memory of 5112 1820 9lxrfxl.exe 100 PID 1820 wrote to memory of 5112 1820 9lxrfxl.exe 100 PID 1820 wrote to memory of 5112 1820 9lxrfxl.exe 100 PID 5112 wrote to memory of 3848 5112 dddvv.exe 101 PID 5112 wrote to memory of 3848 5112 dddvv.exe 101 PID 5112 wrote to memory of 3848 5112 dddvv.exe 101 PID 3848 wrote to memory of 5188 3848 pvdjd.exe 102 PID 3848 wrote to memory of 5188 3848 pvdjd.exe 102 PID 3848 wrote to memory of 5188 3848 pvdjd.exe 102 PID 5188 wrote to memory of 4320 5188 frfxrrl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\16c404b1b2457e774eef9decec245e74_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\16c404b1b2457e774eef9decec245e74_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\nttnbh.exec:\nttnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\7vpjv.exec:\7vpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\1hhbnn.exec:\1hhbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\hbbthh.exec:\hbbthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\vdjdv.exec:\vdjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\3lfxlxr.exec:\3lfxlxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\hbbbtn.exec:\hbbbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
\??\c:\9bhhbn.exec:\9bhhbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\jddvv.exec:\jddvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\5nhhtt.exec:\5nhhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\5dvvp.exec:\5dvvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
\??\c:\bntnnn.exec:\bntnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\dddvj.exec:\dddvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\rllfxxr.exec:\rllfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\flrlffx.exec:\flrlffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\pppjd.exec:\pppjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\dvpjd.exec:\dvpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\9lxrfxl.exec:\9lxrfxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\dddvv.exec:\dddvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\pvdjd.exec:\pvdjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\frfxrrl.exec:\frfxrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
\??\c:\tbhbhh.exec:\tbhbhh.exe23⤵
- Executes dropped EXE
PID:4320 -
\??\c:\1djdd.exec:\1djdd.exe24⤵
- Executes dropped EXE
PID:5488 -
\??\c:\lrfxllr.exec:\lrfxllr.exe25⤵
- Executes dropped EXE
PID:4644 -
\??\c:\btttnh.exec:\btttnh.exe26⤵
- Executes dropped EXE
PID:2148 -
\??\c:\5jdvj.exec:\5jdvj.exe27⤵
- Executes dropped EXE
PID:5696 -
\??\c:\xlxrlll.exec:\xlxrlll.exe28⤵
- Executes dropped EXE
PID:3240 -
\??\c:\1tnhbb.exec:\1tnhbb.exe29⤵
- Executes dropped EXE
PID:3440 -
\??\c:\vjjvj.exec:\vjjvj.exe30⤵
- Executes dropped EXE
PID:3796 -
\??\c:\1fxrffx.exec:\1fxrffx.exe31⤵
- Executes dropped EXE
PID:1372 -
\??\c:\nhtntt.exec:\nhtntt.exe32⤵
- Executes dropped EXE
PID:736 -
\??\c:\tnnnbh.exec:\tnnnbh.exe33⤵
- Executes dropped EXE
PID:1028 -
\??\c:\pvjdv.exec:\pvjdv.exe34⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ffxxlll.exec:\ffxxlll.exe35⤵
- Executes dropped EXE
PID:4520 -
\??\c:\flrlffx.exec:\flrlffx.exe36⤵
- Executes dropped EXE
PID:744 -
\??\c:\bhnhhh.exec:\bhnhhh.exe37⤵
- Executes dropped EXE
PID:2008 -
\??\c:\5vppj.exec:\5vppj.exe38⤵
- Executes dropped EXE
PID:2464 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe39⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7rfxffl.exec:\7rfxffl.exe40⤵
- Executes dropped EXE
PID:4244 -
\??\c:\7bhhbb.exec:\7bhhbb.exe41⤵
- Executes dropped EXE
PID:3720 -
\??\c:\7nnnhh.exec:\7nnnhh.exe42⤵
- Executes dropped EXE
PID:5416 -
\??\c:\jddvp.exec:\jddvp.exe43⤵
- Executes dropped EXE
PID:4844 -
\??\c:\5flfllr.exec:\5flfllr.exe44⤵
- Executes dropped EXE
PID:5548 -
\??\c:\xxlfxrr.exec:\xxlfxrr.exe45⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hhhbth.exec:\hhhbth.exe46⤵
- Executes dropped EXE
PID:4692 -
\??\c:\ttnhtt.exec:\ttnhtt.exe47⤵
- Executes dropped EXE
PID:4988 -
\??\c:\pjjpd.exec:\pjjpd.exe48⤵
- Executes dropped EXE
PID:4860 -
\??\c:\rffxxxr.exec:\rffxxxr.exe49⤵
- Executes dropped EXE
PID:4700 -
\??\c:\thhbtt.exec:\thhbtt.exe50⤵
- Executes dropped EXE
PID:4940 -
\??\c:\bthbbb.exec:\bthbbb.exe51⤵
- Executes dropped EXE
PID:6136 -
\??\c:\pdjdv.exec:\pdjdv.exe52⤵
- Executes dropped EXE
PID:5016 -
\??\c:\pdpvj.exec:\pdpvj.exe53⤵
- Executes dropped EXE
PID:2612 -
\??\c:\xrrlxfx.exec:\xrrlxfx.exe54⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rllfxxr.exec:\rllfxxr.exe55⤵
- Executes dropped EXE
PID:5440 -
\??\c:\nnnbnn.exec:\nnnbnn.exe56⤵
- Executes dropped EXE
PID:3416 -
\??\c:\pjvpj.exec:\pjvpj.exe57⤵
- Executes dropped EXE
PID:6128 -
\??\c:\rfxrxxr.exec:\rfxrxxr.exe58⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rflllll.exec:\rflllll.exe59⤵
- Executes dropped EXE
PID:5520 -
\??\c:\thnnhh.exec:\thnnhh.exe60⤵
- Executes dropped EXE
PID:684 -
\??\c:\btbthh.exec:\btbthh.exe61⤵
- Executes dropped EXE
PID:3692 -
\??\c:\vjpjd.exec:\vjpjd.exe62⤵
- Executes dropped EXE
PID:708 -
\??\c:\lrxrffx.exec:\lrxrffx.exe63⤵
- Executes dropped EXE
PID:4232 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe64⤵
- Executes dropped EXE
PID:5768 -
\??\c:\5thbtt.exec:\5thbtt.exe65⤵
- Executes dropped EXE
PID:5600 -
\??\c:\bbbnhh.exec:\bbbnhh.exe66⤵PID:5656
-
\??\c:\1jpjv.exec:\1jpjv.exe67⤵PID:3216
-
\??\c:\vdjdp.exec:\vdjdp.exe68⤵PID:3220
-
\??\c:\lrfxrrr.exec:\lrfxrrr.exe69⤵PID:1576
-
\??\c:\9ttnnn.exec:\9ttnnn.exe70⤵PID:408
-
\??\c:\1hhbnn.exec:\1hhbnn.exe71⤵PID:1120
-
\??\c:\ffrrllr.exec:\ffrrllr.exe72⤵PID:1308
-
\??\c:\nnnhhn.exec:\nnnhhn.exe73⤵PID:1696
-
\??\c:\9thbbh.exec:\9thbbh.exe74⤵PID:1868
-
\??\c:\5jddp.exec:\5jddp.exe75⤵PID:3408
-
\??\c:\xrrrlll.exec:\xrrrlll.exe76⤵PID:4416
-
\??\c:\llllffx.exec:\llllffx.exe77⤵PID:4724
-
\??\c:\tbbthh.exec:\tbbthh.exe78⤵PID:2888
-
\??\c:\hbnhhb.exec:\hbnhhb.exe79⤵PID:4788
-
\??\c:\vjvjd.exec:\vjvjd.exe80⤵PID:3008
-
\??\c:\9lflxxx.exec:\9lflxxx.exe81⤵PID:4768
-
\??\c:\xrrrllr.exec:\xrrrllr.exe82⤵PID:3560
-
\??\c:\9tbbtt.exec:\9tbbtt.exe83⤵PID:6084
-
\??\c:\jjpjd.exec:\jjpjd.exe84⤵PID:5632
-
\??\c:\lfrllrx.exec:\lfrllrx.exe85⤵PID:2068
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe86⤵PID:2660
-
\??\c:\bbntnn.exec:\bbntnn.exe87⤵PID:3648
-
\??\c:\vjpjv.exec:\vjpjv.exe88⤵PID:2416
-
\??\c:\vjvpd.exec:\vjvpd.exe89⤵PID:1384
-
\??\c:\xfxfrlx.exec:\xfxfrlx.exe90⤵PID:5624
-
\??\c:\thnhhh.exec:\thnhhh.exe91⤵PID:5748
-
\??\c:\nhhbbn.exec:\nhhbbn.exe92⤵PID:2232
-
\??\c:\jpddd.exec:\jpddd.exe93⤵PID:3336
-
\??\c:\vdjjd.exec:\vdjjd.exe94⤵PID:1708
-
\??\c:\fflffff.exec:\fflffff.exe95⤵PID:2676
-
\??\c:\1tbbht.exec:\1tbbht.exe96⤵PID:5588
-
\??\c:\bbthhb.exec:\bbthhb.exe97⤵PID:4672
-
\??\c:\ddddp.exec:\ddddp.exe98⤵PID:5532
-
\??\c:\xlxrrll.exec:\xlxrrll.exe99⤵PID:3324
-
\??\c:\hhnnhb.exec:\hhnnhb.exe100⤵PID:4312
-
\??\c:\ttthht.exec:\ttthht.exe101⤵PID:4328
-
\??\c:\9pjdv.exec:\9pjdv.exe102⤵PID:3580
-
\??\c:\jjpjd.exec:\jjpjd.exe103⤵PID:4484
-
\??\c:\xxrrflx.exec:\xxrrflx.exe104⤵PID:3272
-
\??\c:\xlrllll.exec:\xlrllll.exe105⤵PID:812
-
\??\c:\bbthhn.exec:\bbthhn.exe106⤵PID:2716
-
\??\c:\5ppjd.exec:\5ppjd.exe107⤵PID:5608
-
\??\c:\rffxrrl.exec:\rffxrrl.exe108⤵PID:1460
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe109⤵PID:2104
-
\??\c:\nbnhhn.exec:\nbnhhn.exe110⤵PID:3436
-
\??\c:\hnnhbh.exec:\hnnhbh.exe111⤵PID:2628
-
\??\c:\3vvvj.exec:\3vvvj.exe112⤵PID:3092
-
\??\c:\frxrlxx.exec:\frxrlxx.exe113⤵PID:2004
-
\??\c:\frllffl.exec:\frllffl.exe114⤵PID:1720
-
\??\c:\9nnnnn.exec:\9nnnnn.exe115⤵PID:3440
-
\??\c:\jjvvd.exec:\jjvvd.exe116⤵PID:3796
-
\??\c:\btbnnh.exec:\btbnnh.exe117⤵PID:4516
-
\??\c:\3bbhtb.exec:\3bbhtb.exe118⤵PID:1000
-
\??\c:\vdddp.exec:\vdddp.exe119⤵PID:4464
-
\??\c:\1xfffff.exec:\1xfffff.exe120⤵PID:1028
-
\??\c:\rlrxxxx.exec:\rlrxxxx.exe121⤵PID:3808
-
\??\c:\3hhbbb.exec:\3hhbbb.exe122⤵PID:3136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-