Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 01:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
48f3a645e6ba5e99e1a145501c31fcf4_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
48f3a645e6ba5e99e1a145501c31fcf4_JaffaCakes118.exe
-
Size
357KB
-
MD5
48f3a645e6ba5e99e1a145501c31fcf4
-
SHA1
71c656e2d3b14ed8c7bcf9f582491ac0948500a6
-
SHA256
297f6163c0f7065a973e873d3febd87da197d499d9a7aaab56c2838bc09f91cd
-
SHA512
b50260b8c3afc18869ef0ecedcd70139ed3a47afd5d535658b498adb3525e2d360a2d30b9b05eb86eb1b78c9d7497b114430c0a29f7f5ca18d8ddc2794b716c5
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jFX8fkYtB6J6eUTV4aTHDaL6:Pcm7ImGddXtWrXD486jFX88Y/eUBnt
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1332-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4304-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-374-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-384-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-391-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-398-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-408-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-423-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-442-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-496-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-523-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-540-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-605-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-750-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-766-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-1034-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-1072-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-1229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-1318-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1332 3lfxrrl.exe 3828 nnnnnt.exe 3292 vjjpp.exe 1880 xxxxxxx.exe 2084 ffllxfl.exe 4632 bbnnhn.exe 5056 9nbttt.exe 3432 vddvj.exe 3036 ntnhhb.exe 4304 fflllff.exe 2540 pppjv.exe 1132 xllrxxr.exe 4904 ntbbtt.exe 2756 hhbtnt.exe 4916 vjjdd.exe 2868 rrrrrll.exe 1028 fflllll.exe 2668 ttbtnn.exe 3024 vvddv.exe 1488 rlxrfff.exe 3684 9rxrlxr.exe 4452 5tnbtt.exe 3972 1frlffx.exe 3196 lfffrlr.exe 4804 xllfxrf.exe 4252 vpvvp.exe 4716 ttbbth.exe 1632 vvjjv.exe 940 xrffxrl.exe 2840 1vdjd.exe 2276 9rxxrlf.exe 3504 dppdv.exe 5088 fffxxlf.exe 1616 jvvvv.exe 932 lxxxxrl.exe 3264 hnhnht.exe 3824 vdpdv.exe 4116 frflfll.exe 2096 tntnnn.exe 2160 rlrrllf.exe 3164 llfxrff.exe 4036 jpvvv.exe 4156 flrlffx.exe 3560 bbbtnn.exe 3364 ppjdv.exe 3160 lllllll.exe 1736 nhbbtt.exe 3688 vpjjj.exe 3920 7xxrrrl.exe 60 fxllrrr.exe 5012 djjdd.exe 4420 vpvpp.exe 4304 fxxrlll.exe 4808 nnbbtb.exe 4464 7llllxx.exe 512 7bhbtb.exe 2652 3jvpj.exe 3996 vjppp.exe 3212 rrllfff.exe 1528 dvvvp.exe 3216 vdjvp.exe 4640 bnnntb.exe 4384 lflrrxx.exe 2996 hbnhnt.exe -
resource yara_rule behavioral2/memory/1332-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4304-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-332-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-349-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-374-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-391-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-398-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-408-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/908-409-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-423-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-424-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-428-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-438-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1796 wrote to memory of 1332 1796 48f3a645e6ba5e99e1a145501c31fcf4_JaffaCakes118.exe 82 PID 1796 wrote to memory of 1332 1796 48f3a645e6ba5e99e1a145501c31fcf4_JaffaCakes118.exe 82 PID 1796 wrote to memory of 1332 1796 48f3a645e6ba5e99e1a145501c31fcf4_JaffaCakes118.exe 82 PID 1332 wrote to memory of 3828 1332 3lfxrrl.exe 83 PID 1332 wrote to memory of 3828 1332 3lfxrrl.exe 83 PID 1332 wrote to memory of 3828 1332 3lfxrrl.exe 83 PID 3828 wrote to memory of 3292 3828 nnnnnt.exe 84 PID 3828 wrote to memory of 3292 3828 nnnnnt.exe 84 PID 3828 wrote to memory of 3292 3828 nnnnnt.exe 84 PID 3292 wrote to memory of 1880 3292 vjjpp.exe 85 PID 3292 wrote to memory of 1880 3292 vjjpp.exe 85 PID 3292 wrote to memory of 1880 3292 vjjpp.exe 85 PID 1880 wrote to memory of 2084 1880 xxxxxxx.exe 86 PID 1880 wrote to memory of 2084 1880 xxxxxxx.exe 86 PID 1880 wrote to memory of 2084 1880 xxxxxxx.exe 86 PID 2084 wrote to memory of 4632 2084 ffllxfl.exe 88 PID 2084 wrote to memory of 4632 2084 ffllxfl.exe 88 PID 2084 wrote to memory of 4632 2084 ffllxfl.exe 88 PID 4632 wrote to memory of 5056 4632 bbnnhn.exe 89 PID 4632 wrote to memory of 5056 4632 bbnnhn.exe 89 PID 4632 wrote to memory of 5056 4632 bbnnhn.exe 89 PID 5056 wrote to memory of 3432 5056 9nbttt.exe 90 PID 5056 wrote to memory of 3432 5056 9nbttt.exe 90 PID 5056 wrote to memory of 3432 5056 9nbttt.exe 90 PID 3432 wrote to memory of 3036 3432 vddvj.exe 92 PID 3432 wrote to memory of 3036 3432 vddvj.exe 92 PID 3432 wrote to memory of 3036 3432 vddvj.exe 92 PID 3036 wrote to memory of 4304 3036 ntnhhb.exe 93 PID 3036 wrote to memory of 4304 3036 ntnhhb.exe 93 PID 3036 wrote to memory of 4304 3036 ntnhhb.exe 93 PID 4304 wrote to memory of 2540 4304 fflllff.exe 94 PID 4304 wrote to memory of 2540 4304 fflllff.exe 94 PID 4304 wrote to memory of 2540 4304 fflllff.exe 94 PID 2540 wrote to memory of 1132 2540 pppjv.exe 95 PID 2540 wrote to memory of 1132 2540 pppjv.exe 95 PID 2540 wrote to memory of 1132 2540 pppjv.exe 95 PID 1132 wrote to memory of 4904 1132 xllrxxr.exe 96 PID 1132 wrote to memory of 4904 1132 xllrxxr.exe 96 PID 1132 wrote to memory of 4904 1132 xllrxxr.exe 96 PID 4904 wrote to memory of 2756 4904 ntbbtt.exe 97 PID 4904 wrote to memory of 2756 4904 ntbbtt.exe 97 PID 4904 wrote to memory of 2756 4904 ntbbtt.exe 97 PID 2756 wrote to memory of 4916 2756 hhbtnt.exe 98 PID 2756 wrote to memory of 4916 2756 hhbtnt.exe 98 PID 2756 wrote to memory of 4916 2756 hhbtnt.exe 98 PID 4916 wrote to memory of 2868 4916 vjjdd.exe 99 PID 4916 wrote to memory of 2868 4916 vjjdd.exe 99 PID 4916 wrote to memory of 2868 4916 vjjdd.exe 99 PID 2868 wrote to memory of 1028 2868 rrrrrll.exe 101 PID 2868 wrote to memory of 1028 2868 rrrrrll.exe 101 PID 2868 wrote to memory of 1028 2868 rrrrrll.exe 101 PID 1028 wrote to memory of 2668 1028 fflllll.exe 102 PID 1028 wrote to memory of 2668 1028 fflllll.exe 102 PID 1028 wrote to memory of 2668 1028 fflllll.exe 102 PID 2668 wrote to memory of 3024 2668 ttbtnn.exe 103 PID 2668 wrote to memory of 3024 2668 ttbtnn.exe 103 PID 2668 wrote to memory of 3024 2668 ttbtnn.exe 103 PID 3024 wrote to memory of 1488 3024 vvddv.exe 104 PID 3024 wrote to memory of 1488 3024 vvddv.exe 104 PID 3024 wrote to memory of 1488 3024 vvddv.exe 104 PID 1488 wrote to memory of 3684 1488 rlxrfff.exe 105 PID 1488 wrote to memory of 3684 1488 rlxrfff.exe 105 PID 1488 wrote to memory of 3684 1488 rlxrfff.exe 105 PID 3684 wrote to memory of 4452 3684 9rxrlxr.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\48f3a645e6ba5e99e1a145501c31fcf4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\48f3a645e6ba5e99e1a145501c31fcf4_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\3lfxrrl.exec:\3lfxrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\nnnnnt.exec:\nnnnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\vjjpp.exec:\vjjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\ffllxfl.exec:\ffllxfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\bbnnhn.exec:\bbnnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\9nbttt.exec:\9nbttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\vddvj.exec:\vddvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\ntnhhb.exec:\ntnhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\fflllff.exec:\fflllff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\pppjv.exec:\pppjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xllrxxr.exec:\xllrxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\ntbbtt.exec:\ntbbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\hhbtnt.exec:\hhbtnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vjjdd.exec:\vjjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\rrrrrll.exec:\rrrrrll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\fflllll.exec:\fflllll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\ttbtnn.exec:\ttbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\vvddv.exec:\vvddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\rlxrfff.exec:\rlxrfff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\9rxrlxr.exec:\9rxrlxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\5tnbtt.exec:\5tnbtt.exe23⤵
- Executes dropped EXE
PID:4452 -
\??\c:\1frlffx.exec:\1frlffx.exe24⤵
- Executes dropped EXE
PID:3972 -
\??\c:\lfffrlr.exec:\lfffrlr.exe25⤵
- Executes dropped EXE
PID:3196 -
\??\c:\xllfxrf.exec:\xllfxrf.exe26⤵
- Executes dropped EXE
PID:4804 -
\??\c:\vpvvp.exec:\vpvvp.exe27⤵
- Executes dropped EXE
PID:4252 -
\??\c:\ttbbth.exec:\ttbbth.exe28⤵
- Executes dropped EXE
PID:4716 -
\??\c:\vvjjv.exec:\vvjjv.exe29⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xrffxrl.exec:\xrffxrl.exe30⤵
- Executes dropped EXE
PID:940 -
\??\c:\1vdjd.exec:\1vdjd.exe31⤵
- Executes dropped EXE
PID:2840 -
\??\c:\9rxxrlf.exec:\9rxxrlf.exe32⤵
- Executes dropped EXE
PID:2276 -
\??\c:\dppdv.exec:\dppdv.exe33⤵
- Executes dropped EXE
PID:3504 -
\??\c:\fffxxlf.exec:\fffxxlf.exe34⤵
- Executes dropped EXE
PID:5088 -
\??\c:\jvvvv.exec:\jvvvv.exe35⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lxxxxrl.exec:\lxxxxrl.exe36⤵
- Executes dropped EXE
PID:932 -
\??\c:\hnhnht.exec:\hnhnht.exe37⤵
- Executes dropped EXE
PID:3264 -
\??\c:\vdpdv.exec:\vdpdv.exe38⤵
- Executes dropped EXE
PID:3824 -
\??\c:\frflfll.exec:\frflfll.exe39⤵
- Executes dropped EXE
PID:4116 -
\??\c:\tntnnn.exec:\tntnnn.exe40⤵
- Executes dropped EXE
PID:2096 -
\??\c:\rlrrllf.exec:\rlrrllf.exe41⤵
- Executes dropped EXE
PID:2160 -
\??\c:\llfxrff.exec:\llfxrff.exe42⤵
- Executes dropped EXE
PID:3164 -
\??\c:\jpvvv.exec:\jpvvv.exe43⤵
- Executes dropped EXE
PID:4036 -
\??\c:\flrlffx.exec:\flrlffx.exe44⤵
- Executes dropped EXE
PID:4156 -
\??\c:\bbbtnn.exec:\bbbtnn.exe45⤵
- Executes dropped EXE
PID:3560 -
\??\c:\ppjdv.exec:\ppjdv.exe46⤵
- Executes dropped EXE
PID:3364 -
\??\c:\lllllll.exec:\lllllll.exe47⤵
- Executes dropped EXE
PID:3160 -
\??\c:\nhbbtt.exec:\nhbbtt.exe48⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vpjjj.exec:\vpjjj.exe49⤵
- Executes dropped EXE
PID:3688 -
\??\c:\7xxrrrl.exec:\7xxrrrl.exe50⤵
- Executes dropped EXE
PID:3920 -
\??\c:\fxllrrr.exec:\fxllrrr.exe51⤵
- Executes dropped EXE
PID:60 -
\??\c:\djjdd.exec:\djjdd.exe52⤵
- Executes dropped EXE
PID:5012 -
\??\c:\vpvpp.exec:\vpvpp.exe53⤵
- Executes dropped EXE
PID:4420 -
\??\c:\fxxrlll.exec:\fxxrlll.exe54⤵
- Executes dropped EXE
PID:4304 -
\??\c:\nnbbtb.exec:\nnbbtb.exe55⤵
- Executes dropped EXE
PID:4808 -
\??\c:\7llllxx.exec:\7llllxx.exe56⤵
- Executes dropped EXE
PID:4464 -
\??\c:\7bhbtb.exec:\7bhbtb.exe57⤵
- Executes dropped EXE
PID:512 -
\??\c:\3jvpj.exec:\3jvpj.exe58⤵
- Executes dropped EXE
PID:2652 -
\??\c:\vjppp.exec:\vjppp.exe59⤵
- Executes dropped EXE
PID:3996 -
\??\c:\rrllfff.exec:\rrllfff.exe60⤵
- Executes dropped EXE
PID:3212 -
\??\c:\dvvvp.exec:\dvvvp.exe61⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vdjvp.exec:\vdjvp.exe62⤵
- Executes dropped EXE
PID:3216 -
\??\c:\bnnntb.exec:\bnnntb.exe63⤵
- Executes dropped EXE
PID:4640 -
\??\c:\lflrrxx.exec:\lflrrxx.exe64⤵
- Executes dropped EXE
PID:4384 -
\??\c:\hbnhnt.exec:\hbnhnt.exe65⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hhhhbb.exec:\hhhhbb.exe66⤵PID:4476
-
\??\c:\pjvpp.exec:\pjvpp.exe67⤵PID:2912
-
\??\c:\fxxrllf.exec:\fxxrllf.exe68⤵PID:2696
-
\??\c:\nntnnn.exec:\nntnnn.exe69⤵PID:3684
-
\??\c:\ddpjd.exec:\ddpjd.exe70⤵PID:708
-
\??\c:\ppdvv.exec:\ppdvv.exe71⤵PID:3508
-
\??\c:\fxrllxx.exec:\fxrllxx.exe72⤵PID:2336
-
\??\c:\hhnhtt.exec:\hhnhtt.exe73⤵PID:3956
-
\??\c:\bbhbtt.exec:\bbhbtt.exe74⤵PID:1496
-
\??\c:\ddddd.exec:\ddddd.exe75⤵PID:2656
-
\??\c:\frflxrl.exec:\frflxrl.exe76⤵PID:1040
-
\??\c:\flllrfx.exec:\flllrfx.exe77⤵PID:1632
-
\??\c:\5thhbh.exec:\5thhbh.exe78⤵PID:3568
-
\??\c:\jvvjp.exec:\jvvjp.exe79⤵PID:2896
-
\??\c:\xlrllrl.exec:\xlrllrl.exe80⤵PID:4600
-
\??\c:\bntnnh.exec:\bntnnh.exe81⤵PID:2744
-
\??\c:\jpdvd.exec:\jpdvd.exe82⤵PID:2468
-
\??\c:\dpddd.exec:\dpddd.exe83⤵PID:1920
-
\??\c:\rlfxxrf.exec:\rlfxxrf.exe84⤵PID:2256
-
\??\c:\ttbtbb.exec:\ttbtbb.exe85⤵PID:4440
-
\??\c:\vjppj.exec:\vjppj.exe86⤵PID:3060
-
\??\c:\xfrlffl.exec:\xfrlffl.exe87⤵PID:4680
-
\??\c:\nhnnnn.exec:\nhnnnn.exe88⤵PID:2440
-
\??\c:\pdpvd.exec:\pdpvd.exe89⤵PID:1656
-
\??\c:\jvjjv.exec:\jvjjv.exe90⤵PID:4136
-
\??\c:\llxfrfx.exec:\llxfrfx.exe91⤵PID:1640
-
\??\c:\nbnnhh.exec:\nbnnhh.exe92⤵PID:1572
-
\??\c:\vddpp.exec:\vddpp.exe93⤵PID:4584
-
\??\c:\jpvvv.exec:\jpvvv.exe94⤵PID:2920
-
\??\c:\7tnhnn.exec:\7tnhnn.exe95⤵PID:1736
-
\??\c:\7bbbtt.exec:\7bbbtt.exe96⤵PID:3920
-
\??\c:\7jvvd.exec:\7jvvd.exe97⤵PID:908
-
\??\c:\xxxrlll.exec:\xxxrlll.exe98⤵PID:2344
-
\??\c:\hhnbnt.exec:\hhnbnt.exe99⤵PID:4808
-
\??\c:\pvjdd.exec:\pvjdd.exe100⤵PID:856
-
\??\c:\rrrfrrl.exec:\rrrfrrl.exe101⤵PID:1928
-
\??\c:\lxrxllx.exec:\lxrxllx.exe102⤵PID:2756
-
\??\c:\bthhtb.exec:\bthhtb.exe103⤵PID:3436
-
\??\c:\xrxllff.exec:\xrxllff.exe104⤵PID:2068
-
\??\c:\5lrrflr.exec:\5lrrflr.exe105⤵PID:2868
-
\??\c:\5vdvv.exec:\5vdvv.exe106⤵PID:4480
-
\??\c:\jddjj.exec:\jddjj.exe107⤵PID:3632
-
\??\c:\hbtnnn.exec:\hbtnnn.exe108⤵PID:4524
-
\??\c:\1tbttt.exec:\1tbttt.exe109⤵PID:3616
-
\??\c:\vvvjj.exec:\vvvjj.exe110⤵PID:1488
-
\??\c:\3pddp.exec:\3pddp.exe111⤵PID:872
-
\??\c:\xxrfflx.exec:\xxrfflx.exe112⤵PID:4608
-
\??\c:\bthbhh.exec:\bthbhh.exe113⤵PID:4452
-
\??\c:\jdjdj.exec:\jdjdj.exe114⤵PID:1216
-
\??\c:\lxrfrfl.exec:\lxrfrfl.exe115⤵PID:4076
-
\??\c:\vvpvd.exec:\vvpvd.exe116⤵PID:4412
-
\??\c:\ffrfxxx.exec:\ffrfxxx.exe117⤵PID:4252
-
\??\c:\hntbhh.exec:\hntbhh.exe118⤵PID:1496
-
\??\c:\lfxxrlf.exec:\lfxxrlf.exe119⤵PID:1500
-
\??\c:\dppjd.exec:\dppjd.exe120⤵PID:3908
-
\??\c:\xrflfrx.exec:\xrflfrx.exe121⤵PID:3100
-
\??\c:\bbttnn.exec:\bbttnn.exe122⤵PID:3556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-