Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 17:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
25d9cbbdbb52b1c236b517884fae28ef_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
25d9cbbdbb52b1c236b517884fae28ef_JaffaCakes118.exe
-
Size
377KB
-
MD5
25d9cbbdbb52b1c236b517884fae28ef
-
SHA1
c8274516ccc464203f1541cd3a25c2c4e9e96482
-
SHA256
2af3b94af46618ff14c9597e22f42a8b75a7dccbb5e0a7ca6eb5bb156e9bffb4
-
SHA512
e905854181fba867fedb6445221fe29fcf4d5a718015936ab9599f5bbe4b7dfb0aa04261027b914653cac2b6066a86b05a803c9ae5cc264e6ba61c6d7e4d2b31
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFw8TCK:8cm7ImGddXmNt251UriZFwGCK
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3692-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/720-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-789-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-839-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-940-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3996 fflxrlr.exe 3256 3tbtnt.exe 2812 fxxlfxl.exe 3680 7bbtbh.exe 2952 9htnhb.exe 2220 fllfxfx.exe 636 7hbthh.exe 1556 1frlffx.exe 4832 pvddv.exe 3268 rllxrrl.exe 1164 hnnnnt.exe 4564 lffxrrl.exe 1020 ntbthh.exe 4500 1vvpj.exe 1776 nbnhnn.exe 3784 vpdvv.exe 3436 hhnhhb.exe 876 1ffxflf.exe 3688 btbbhh.exe 1352 ppvjd.exe 3472 rrxrlff.exe 3744 xfrlfxr.exe 3856 tntttt.exe 2840 xrxxxxx.exe 4624 tbbbtt.exe 1624 thhhtb.exe 2016 5ffrfxr.exe 5000 9vjdv.exe 3808 nbhttn.exe 3792 dpjvp.exe 1224 xrxrlll.exe 2884 nbhbbb.exe 2420 tnbtnn.exe 4540 fllffxr.exe 1368 jjddj.exe 1660 rxfxxlx.exe 4040 9rfffff.exe 4852 tnnttt.exe 720 vvpjj.exe 5096 1llrrrr.exe 4760 htbbtt.exe 4960 vpdjd.exe 3884 3xxfrrr.exe 2192 xlllfff.exe 1432 btnbbt.exe 624 pjppp.exe 4272 xffxllx.exe 2836 nntnnn.exe 2244 5hnbbt.exe 3820 djvpj.exe 3256 lflffll.exe 3672 ntbtbb.exe 3400 pvjdv.exe 3496 llrxxxr.exe 1580 xfrlflf.exe 2204 1ttnnn.exe 3696 jdjdd.exe 1672 lflfxxf.exe 1556 hhhbbt.exe 4368 ddjpp.exe 4512 rxfxxxx.exe 3268 lfxrrrr.exe 3712 thhbbt.exe 1392 jvvvp.exe -
resource yara_rule behavioral2/memory/3996-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/720-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-444-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3692 wrote to memory of 3996 3692 25d9cbbdbb52b1c236b517884fae28ef_JaffaCakes118.exe 82 PID 3692 wrote to memory of 3996 3692 25d9cbbdbb52b1c236b517884fae28ef_JaffaCakes118.exe 82 PID 3692 wrote to memory of 3996 3692 25d9cbbdbb52b1c236b517884fae28ef_JaffaCakes118.exe 82 PID 3996 wrote to memory of 3256 3996 fflxrlr.exe 83 PID 3996 wrote to memory of 3256 3996 fflxrlr.exe 83 PID 3996 wrote to memory of 3256 3996 fflxrlr.exe 83 PID 3256 wrote to memory of 2812 3256 3tbtnt.exe 85 PID 3256 wrote to memory of 2812 3256 3tbtnt.exe 85 PID 3256 wrote to memory of 2812 3256 3tbtnt.exe 85 PID 2812 wrote to memory of 3680 2812 fxxlfxl.exe 86 PID 2812 wrote to memory of 3680 2812 fxxlfxl.exe 86 PID 2812 wrote to memory of 3680 2812 fxxlfxl.exe 86 PID 3680 wrote to memory of 2952 3680 7bbtbh.exe 87 PID 3680 wrote to memory of 2952 3680 7bbtbh.exe 87 PID 3680 wrote to memory of 2952 3680 7bbtbh.exe 87 PID 2952 wrote to memory of 2220 2952 9htnhb.exe 88 PID 2952 wrote to memory of 2220 2952 9htnhb.exe 88 PID 2952 wrote to memory of 2220 2952 9htnhb.exe 88 PID 2220 wrote to memory of 636 2220 fllfxfx.exe 89 PID 2220 wrote to memory of 636 2220 fllfxfx.exe 89 PID 2220 wrote to memory of 636 2220 fllfxfx.exe 89 PID 636 wrote to memory of 1556 636 7hbthh.exe 90 PID 636 wrote to memory of 1556 636 7hbthh.exe 90 PID 636 wrote to memory of 1556 636 7hbthh.exe 90 PID 1556 wrote to memory of 4832 1556 1frlffx.exe 91 PID 1556 wrote to memory of 4832 1556 1frlffx.exe 91 PID 1556 wrote to memory of 4832 1556 1frlffx.exe 91 PID 4832 wrote to memory of 3268 4832 pvddv.exe 92 PID 4832 wrote to memory of 3268 4832 pvddv.exe 92 PID 4832 wrote to memory of 3268 4832 pvddv.exe 92 PID 3268 wrote to memory of 1164 3268 rllxrrl.exe 93 PID 3268 wrote to memory of 1164 3268 rllxrrl.exe 93 PID 3268 wrote to memory of 1164 3268 rllxrrl.exe 93 PID 1164 wrote to memory of 4564 1164 hnnnnt.exe 94 PID 1164 wrote to memory of 4564 1164 hnnnnt.exe 94 PID 1164 wrote to memory of 4564 1164 hnnnnt.exe 94 PID 4564 wrote to memory of 1020 4564 lffxrrl.exe 95 PID 4564 wrote to memory of 1020 4564 lffxrrl.exe 95 PID 4564 wrote to memory of 1020 4564 lffxrrl.exe 95 PID 1020 wrote to memory of 4500 1020 ntbthh.exe 96 PID 1020 wrote to memory of 4500 1020 ntbthh.exe 96 PID 1020 wrote to memory of 4500 1020 ntbthh.exe 96 PID 4500 wrote to memory of 1776 4500 1vvpj.exe 97 PID 4500 wrote to memory of 1776 4500 1vvpj.exe 97 PID 4500 wrote to memory of 1776 4500 1vvpj.exe 97 PID 1776 wrote to memory of 3784 1776 nbnhnn.exe 98 PID 1776 wrote to memory of 3784 1776 nbnhnn.exe 98 PID 1776 wrote to memory of 3784 1776 nbnhnn.exe 98 PID 3784 wrote to memory of 3436 3784 vpdvv.exe 99 PID 3784 wrote to memory of 3436 3784 vpdvv.exe 99 PID 3784 wrote to memory of 3436 3784 vpdvv.exe 99 PID 3436 wrote to memory of 876 3436 hhnhhb.exe 100 PID 3436 wrote to memory of 876 3436 hhnhhb.exe 100 PID 3436 wrote to memory of 876 3436 hhnhhb.exe 100 PID 876 wrote to memory of 3688 876 1ffxflf.exe 101 PID 876 wrote to memory of 3688 876 1ffxflf.exe 101 PID 876 wrote to memory of 3688 876 1ffxflf.exe 101 PID 3688 wrote to memory of 1352 3688 btbbhh.exe 102 PID 3688 wrote to memory of 1352 3688 btbbhh.exe 102 PID 3688 wrote to memory of 1352 3688 btbbhh.exe 102 PID 1352 wrote to memory of 3472 1352 ppvjd.exe 103 PID 1352 wrote to memory of 3472 1352 ppvjd.exe 103 PID 1352 wrote to memory of 3472 1352 ppvjd.exe 103 PID 3472 wrote to memory of 3744 3472 rrxrlff.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\25d9cbbdbb52b1c236b517884fae28ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\25d9cbbdbb52b1c236b517884fae28ef_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\fflxrlr.exec:\fflxrlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\3tbtnt.exec:\3tbtnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\fxxlfxl.exec:\fxxlfxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\7bbtbh.exec:\7bbtbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\9htnhb.exec:\9htnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\fllfxfx.exec:\fllfxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\7hbthh.exec:\7hbthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\1frlffx.exec:\1frlffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\pvddv.exec:\pvddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\rllxrrl.exec:\rllxrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\hnnnnt.exec:\hnnnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\lffxrrl.exec:\lffxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\ntbthh.exec:\ntbthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\1vvpj.exec:\1vvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\nbnhnn.exec:\nbnhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\vpdvv.exec:\vpdvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\hhnhhb.exec:\hhnhhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\1ffxflf.exec:\1ffxflf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\btbbhh.exec:\btbbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\ppvjd.exec:\ppvjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\rrxrlff.exec:\rrxrlff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\xfrlfxr.exec:\xfrlfxr.exe23⤵
- Executes dropped EXE
PID:3744 -
\??\c:\tntttt.exec:\tntttt.exe24⤵
- Executes dropped EXE
PID:3856 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe25⤵
- Executes dropped EXE
PID:2840 -
\??\c:\tbbbtt.exec:\tbbbtt.exe26⤵
- Executes dropped EXE
PID:4624 -
\??\c:\thhhtb.exec:\thhhtb.exe27⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5ffrfxr.exec:\5ffrfxr.exe28⤵
- Executes dropped EXE
PID:2016 -
\??\c:\9vjdv.exec:\9vjdv.exe29⤵
- Executes dropped EXE
PID:5000 -
\??\c:\nbhttn.exec:\nbhttn.exe30⤵
- Executes dropped EXE
PID:3808 -
\??\c:\dpjvp.exec:\dpjvp.exe31⤵
- Executes dropped EXE
PID:3792 -
\??\c:\xrxrlll.exec:\xrxrlll.exe32⤵
- Executes dropped EXE
PID:1224 -
\??\c:\nbhbbb.exec:\nbhbbb.exe33⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tnbtnn.exec:\tnbtnn.exe34⤵
- Executes dropped EXE
PID:2420 -
\??\c:\fllffxr.exec:\fllffxr.exe35⤵
- Executes dropped EXE
PID:4540 -
\??\c:\jjddj.exec:\jjddj.exe36⤵
- Executes dropped EXE
PID:1368 -
\??\c:\rxfxxlx.exec:\rxfxxlx.exe37⤵
- Executes dropped EXE
PID:1660 -
\??\c:\9rfffff.exec:\9rfffff.exe38⤵
- Executes dropped EXE
PID:4040 -
\??\c:\tnnttt.exec:\tnnttt.exe39⤵
- Executes dropped EXE
PID:4852 -
\??\c:\vvpjj.exec:\vvpjj.exe40⤵
- Executes dropped EXE
PID:720 -
\??\c:\1llrrrr.exec:\1llrrrr.exe41⤵
- Executes dropped EXE
PID:5096 -
\??\c:\htbbtt.exec:\htbbtt.exe42⤵
- Executes dropped EXE
PID:4760 -
\??\c:\vpdjd.exec:\vpdjd.exe43⤵
- Executes dropped EXE
PID:4960 -
\??\c:\3xxfrrr.exec:\3xxfrrr.exe44⤵
- Executes dropped EXE
PID:3884 -
\??\c:\xlllfff.exec:\xlllfff.exe45⤵
- Executes dropped EXE
PID:2192 -
\??\c:\btnbbt.exec:\btnbbt.exe46⤵
- Executes dropped EXE
PID:1432 -
\??\c:\pjppp.exec:\pjppp.exe47⤵
- Executes dropped EXE
PID:624 -
\??\c:\xffxllx.exec:\xffxllx.exe48⤵
- Executes dropped EXE
PID:4272 -
\??\c:\nntnnn.exec:\nntnnn.exe49⤵
- Executes dropped EXE
PID:2836 -
\??\c:\5hnbbt.exec:\5hnbbt.exe50⤵
- Executes dropped EXE
PID:2244 -
\??\c:\djvpj.exec:\djvpj.exe51⤵
- Executes dropped EXE
PID:3820 -
\??\c:\lflffll.exec:\lflffll.exe52⤵
- Executes dropped EXE
PID:3256 -
\??\c:\ntbtbb.exec:\ntbtbb.exe53⤵
- Executes dropped EXE
PID:3672 -
\??\c:\pvjdv.exec:\pvjdv.exe54⤵
- Executes dropped EXE
PID:3400 -
\??\c:\llrxxxr.exec:\llrxxxr.exe55⤵
- Executes dropped EXE
PID:3496 -
\??\c:\xfrlflf.exec:\xfrlflf.exe56⤵
- Executes dropped EXE
PID:1580 -
\??\c:\1ttnnn.exec:\1ttnnn.exe57⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jdjdd.exec:\jdjdd.exe58⤵
- Executes dropped EXE
PID:3696 -
\??\c:\lflfxxf.exec:\lflfxxf.exe59⤵
- Executes dropped EXE
PID:1672 -
\??\c:\hhhbbt.exec:\hhhbbt.exe60⤵
- Executes dropped EXE
PID:1556 -
\??\c:\ddjpp.exec:\ddjpp.exe61⤵
- Executes dropped EXE
PID:4368 -
\??\c:\rxfxxxx.exec:\rxfxxxx.exe62⤵
- Executes dropped EXE
PID:4512 -
\??\c:\lfxrrrr.exec:\lfxrrrr.exe63⤵
- Executes dropped EXE
PID:3268 -
\??\c:\thhbbt.exec:\thhbbt.exe64⤵
- Executes dropped EXE
PID:3712 -
\??\c:\jvvvp.exec:\jvvvp.exe65⤵
- Executes dropped EXE
PID:1392 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe66⤵PID:5072
-
\??\c:\9bhhbh.exec:\9bhhbh.exe67⤵PID:2376
-
\??\c:\pjpjj.exec:\pjpjj.exe68⤵PID:1116
-
\??\c:\vjvpp.exec:\vjvpp.exe69⤵PID:3116
-
\??\c:\xxxlfrr.exec:\xxxlfrr.exe70⤵PID:3868
-
\??\c:\5ttttt.exec:\5ttttt.exe71⤵PID:1756
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe72⤵PID:3436
-
\??\c:\1tnnhh.exec:\1tnnhh.exe73⤵PID:2964
-
\??\c:\5pvpp.exec:\5pvpp.exe74⤵PID:876
-
\??\c:\vjjvj.exec:\vjjvj.exe75⤵PID:2808
-
\??\c:\rflfxrr.exec:\rflfxrr.exe76⤵PID:1352
-
\??\c:\rffrffr.exec:\rffrffr.exe77⤵PID:4072
-
\??\c:\nnbbtt.exec:\nnbbtt.exe78⤵PID:3472
-
\??\c:\dpdvp.exec:\dpdvp.exe79⤵PID:3744
-
\??\c:\rllxxrr.exec:\rllxxrr.exe80⤵PID:3944
-
\??\c:\5ntnnn.exec:\5ntnnn.exe81⤵PID:4000
-
\??\c:\jddvv.exec:\jddvv.exe82⤵PID:736
-
\??\c:\rflfffx.exec:\rflfffx.exe83⤵PID:4444
-
\??\c:\1tthnh.exec:\1tthnh.exe84⤵PID:4112
-
\??\c:\thttnh.exec:\thttnh.exe85⤵PID:4844
-
\??\c:\dvdvv.exec:\dvdvv.exe86⤵PID:4336
-
\??\c:\fflxrlf.exec:\fflxrlf.exe87⤵PID:5000
-
\??\c:\hbhbbb.exec:\hbhbbb.exe88⤵PID:2028
-
\??\c:\htbbbn.exec:\htbbbn.exe89⤵PID:1664
-
\??\c:\vppjp.exec:\vppjp.exe90⤵PID:2984
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe91⤵PID:1952
-
\??\c:\nbnhhh.exec:\nbnhhh.exe92⤵PID:3280
-
\??\c:\tnthbt.exec:\tnthbt.exe93⤵PID:3828
-
\??\c:\ddvvp.exec:\ddvvp.exe94⤵PID:5108
-
\??\c:\flllfxr.exec:\flllfxr.exe95⤵PID:2568
-
\??\c:\7btnnn.exec:\7btnnn.exe96⤵PID:1368
-
\??\c:\vvdvj.exec:\vvdvj.exe97⤵PID:1660
-
\??\c:\5xxrlff.exec:\5xxrlff.exe98⤵PID:4508
-
\??\c:\hbhhbb.exec:\hbhhbb.exe99⤵PID:4452
-
\??\c:\tnnhbt.exec:\tnnhbt.exe100⤵PID:720
-
\??\c:\pjppj.exec:\pjppj.exe101⤵PID:2044
-
\??\c:\rrrlxxf.exec:\rrrlxxf.exe102⤵PID:4196
-
\??\c:\bnhbhh.exec:\bnhbhh.exe103⤵PID:4388
-
\??\c:\djjvj.exec:\djjvj.exe104⤵PID:4516
-
\??\c:\jjdpd.exec:\jjdpd.exe105⤵PID:4584
-
\??\c:\nhnhbn.exec:\nhnhbn.exe106⤵PID:2988
-
\??\c:\thhbtn.exec:\thhbtn.exe107⤵PID:4272
-
\??\c:\jvdvv.exec:\jvdvv.exe108⤵PID:5064
-
\??\c:\fxrlffr.exec:\fxrlffr.exe109⤵PID:2244
-
\??\c:\9llfxrl.exec:\9llfxrl.exe110⤵PID:3820
-
\??\c:\tnnbtn.exec:\tnnbtn.exe111⤵PID:3468
-
\??\c:\pvvpj.exec:\pvvpj.exe112⤵PID:3040
-
\??\c:\lxxrfxr.exec:\lxxrfxr.exe113⤵PID:3864
-
\??\c:\nhnhhh.exec:\nhnhhh.exe114⤵PID:1456
-
\??\c:\5ntthh.exec:\5ntthh.exe115⤵PID:2468
-
\??\c:\5ddpd.exec:\5ddpd.exe116⤵PID:2204
-
\??\c:\flrxxrr.exec:\flrxxrr.exe117⤵PID:3084
-
\??\c:\nttthh.exec:\nttthh.exe118⤵PID:4404
-
\??\c:\7dvpj.exec:\7dvpj.exe119⤵PID:904
-
\??\c:\3ddvj.exec:\3ddvj.exe120⤵PID:3032
-
\??\c:\xlrlxxx.exec:\xlrlxxx.exe121⤵PID:2272
-
\??\c:\1nnhtb.exec:\1nnhtb.exe122⤵PID:3652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-