Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 23:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5bf5a2dea8bd521d15db82dfbedd2c09_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5bf5a2dea8bd521d15db82dfbedd2c09_JaffaCakes118.exe
-
Size
199KB
-
MD5
5bf5a2dea8bd521d15db82dfbedd2c09
-
SHA1
7c63579fdf8f0639a90a0e520eab24980efff31b
-
SHA256
2370ca21360736bc3f7eec84b2d26fae4e3b676a2471a2609851b1b16415aa1a
-
SHA512
18c632be7f7a41e180f9f2fb1573b7845de634121b8ab71d037477775a4df0630d7cf7461dab1dbcccf950146cb375e805a7c9c3289c6916a590f61675667181
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqyvU2r1vsKM4ltg:PhOm2sI93UufdC67cihvH1Sz
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/624-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/956-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1076-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3784-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/656-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-324-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-346-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-385-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-392-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-394-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-404-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-432-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-458-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-465-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-475-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-485-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/956-498-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-543-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-601-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-632-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-748-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-783-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-986-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-1220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pddpj.exebhbnbn.exejvdpd.exerflxrfx.exefrfxlfx.exeppdpp.exe1rxxlll.exe9pvjv.exelflfllr.exebhnhhb.exexlrfflx.exe5tbtnn.exe7rxlfxl.exellxrfxr.exe5nnhtn.exevjjjd.exelxrlfff.exe7hhtnn.exepjjdd.exe3nnhnn.exethnhhb.exepvjvp.exexxllffx.exe9bhbhh.exennnhhh.exelxxxxff.exerxxrrxx.exe7nnnhh.exe1pddd.exexxxfxxx.exennbbnn.exevvjvj.exehbbbtt.exedpvjv.exerflfxrl.exe7xrlfff.exe1tnnhh.exe9pvpd.exejdppj.exefxxrrrl.exefxfxllr.exenhhbbt.exepppjj.exejddvp.exexrrlffx.exebnbbtt.exebthhnh.exejjjdd.exejddvv.exerfxrllf.exethnhbb.exebntttt.exe1ddvv.exepjpjj.exerxlfxxx.exexlllfff.exe9bbbhh.exejvvpp.exejjdvd.exe1flfxxr.exerlrlffx.exenbnhhn.exedjvvp.exedvdjp.exepid process 4400 pddpj.exe 392 bhbnbn.exe 3488 jvdpd.exe 4704 rflxrfx.exe 1748 frfxlfx.exe 4332 ppdpp.exe 4816 1rxxlll.exe 4136 9pvjv.exe 1664 lflfllr.exe 4080 bhnhhb.exe 4516 xlrfflx.exe 2852 5tbtnn.exe 1644 7rxlfxl.exe 4340 llxrfxr.exe 1016 5nnhtn.exe 544 vjjjd.exe 556 lxrlfff.exe 956 7hhtnn.exe 2416 pjjdd.exe 1036 3nnhnn.exe 1476 thnhhb.exe 3716 pvjvp.exe 1260 xxllffx.exe 3104 9bhbhh.exe 436 nnnhhh.exe 852 lxxxxff.exe 1076 rxxrrxx.exe 1952 7nnnhh.exe 4312 1pddd.exe 4412 xxxfxxx.exe 5036 nnbbnn.exe 2996 vvjvj.exe 2584 hbbbtt.exe 1304 dpvjv.exe 3444 rflfxrl.exe 3900 7xrlfff.exe 1632 1tnnhh.exe 1108 9pvpd.exe 2796 jdppj.exe 3784 fxxrrrl.exe 4980 fxfxllr.exe 2860 nhhbbt.exe 3616 pppjj.exe 2572 jddvp.exe 4500 xrrlffx.exe 1644 bnbbtt.exe 3648 bthhnh.exe 4984 jjjdd.exe 3712 jddvv.exe 1104 rfxrllf.exe 3128 thnhbb.exe 932 bntttt.exe 4228 1ddvv.exe 656 pjpjj.exe 4952 rxlfxxx.exe 3020 xlllfff.exe 3324 9bbbhh.exe 4940 jvvpp.exe 1288 jjdvd.exe 3104 1flfxxr.exe 692 rlrlffx.exe 852 nbnhhn.exe 3600 djvvp.exe 2208 dvdjp.exe -
Processes:
resource yara_rule behavioral2/memory/4400-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/956-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1076-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3784-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-324-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-392-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-394-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-404-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-432-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-458-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-465-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-475-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-482-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-485-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/956-498-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-529-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-539-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5bf5a2dea8bd521d15db82dfbedd2c09_JaffaCakes118.exepddpj.exebhbnbn.exejvdpd.exerflxrfx.exefrfxlfx.exeppdpp.exe1rxxlll.exe9pvjv.exelflfllr.exebhnhhb.exexlrfflx.exe5tbtnn.exe7rxlfxl.exellxrfxr.exe5nnhtn.exevjjjd.exelxrlfff.exe7hhtnn.exepjjdd.exe3nnhnn.exethnhhb.exedescription pid process target process PID 624 wrote to memory of 4400 624 5bf5a2dea8bd521d15db82dfbedd2c09_JaffaCakes118.exe pddpj.exe PID 624 wrote to memory of 4400 624 5bf5a2dea8bd521d15db82dfbedd2c09_JaffaCakes118.exe pddpj.exe PID 624 wrote to memory of 4400 624 5bf5a2dea8bd521d15db82dfbedd2c09_JaffaCakes118.exe pddpj.exe PID 4400 wrote to memory of 392 4400 pddpj.exe bhbnbn.exe PID 4400 wrote to memory of 392 4400 pddpj.exe bhbnbn.exe PID 4400 wrote to memory of 392 4400 pddpj.exe bhbnbn.exe PID 392 wrote to memory of 3488 392 bhbnbn.exe jvdpd.exe PID 392 wrote to memory of 3488 392 bhbnbn.exe jvdpd.exe PID 392 wrote to memory of 3488 392 bhbnbn.exe jvdpd.exe PID 3488 wrote to memory of 4704 3488 jvdpd.exe rflxrfx.exe PID 3488 wrote to memory of 4704 3488 jvdpd.exe rflxrfx.exe PID 3488 wrote to memory of 4704 3488 jvdpd.exe rflxrfx.exe PID 4704 wrote to memory of 1748 4704 rflxrfx.exe frfxlfx.exe PID 4704 wrote to memory of 1748 4704 rflxrfx.exe frfxlfx.exe PID 4704 wrote to memory of 1748 4704 rflxrfx.exe frfxlfx.exe PID 1748 wrote to memory of 4332 1748 frfxlfx.exe ppdpp.exe PID 1748 wrote to memory of 4332 1748 frfxlfx.exe ppdpp.exe PID 1748 wrote to memory of 4332 1748 frfxlfx.exe ppdpp.exe PID 4332 wrote to memory of 4816 4332 ppdpp.exe 1rxxlll.exe PID 4332 wrote to memory of 4816 4332 ppdpp.exe 1rxxlll.exe PID 4332 wrote to memory of 4816 4332 ppdpp.exe 1rxxlll.exe PID 4816 wrote to memory of 4136 4816 1rxxlll.exe 9pvjv.exe PID 4816 wrote to memory of 4136 4816 1rxxlll.exe 9pvjv.exe PID 4816 wrote to memory of 4136 4816 1rxxlll.exe 9pvjv.exe PID 4136 wrote to memory of 1664 4136 9pvjv.exe lflfllr.exe PID 4136 wrote to memory of 1664 4136 9pvjv.exe lflfllr.exe PID 4136 wrote to memory of 1664 4136 9pvjv.exe lflfllr.exe PID 1664 wrote to memory of 4080 1664 lflfllr.exe bhnhhb.exe PID 1664 wrote to memory of 4080 1664 lflfllr.exe bhnhhb.exe PID 1664 wrote to memory of 4080 1664 lflfllr.exe bhnhhb.exe PID 4080 wrote to memory of 4516 4080 bhnhhb.exe xlrfflx.exe PID 4080 wrote to memory of 4516 4080 bhnhhb.exe xlrfflx.exe PID 4080 wrote to memory of 4516 4080 bhnhhb.exe xlrfflx.exe PID 4516 wrote to memory of 2852 4516 xlrfflx.exe 5tbtnn.exe PID 4516 wrote to memory of 2852 4516 xlrfflx.exe 5tbtnn.exe PID 4516 wrote to memory of 2852 4516 xlrfflx.exe 5tbtnn.exe PID 2852 wrote to memory of 1644 2852 5tbtnn.exe 7rxlfxl.exe PID 2852 wrote to memory of 1644 2852 5tbtnn.exe 7rxlfxl.exe PID 2852 wrote to memory of 1644 2852 5tbtnn.exe 7rxlfxl.exe PID 1644 wrote to memory of 4340 1644 7rxlfxl.exe llxrfxr.exe PID 1644 wrote to memory of 4340 1644 7rxlfxl.exe llxrfxr.exe PID 1644 wrote to memory of 4340 1644 7rxlfxl.exe llxrfxr.exe PID 4340 wrote to memory of 1016 4340 llxrfxr.exe 5nnhtn.exe PID 4340 wrote to memory of 1016 4340 llxrfxr.exe 5nnhtn.exe PID 4340 wrote to memory of 1016 4340 llxrfxr.exe 5nnhtn.exe PID 1016 wrote to memory of 544 1016 5nnhtn.exe vjjjd.exe PID 1016 wrote to memory of 544 1016 5nnhtn.exe vjjjd.exe PID 1016 wrote to memory of 544 1016 5nnhtn.exe vjjjd.exe PID 544 wrote to memory of 556 544 vjjjd.exe lxrlfff.exe PID 544 wrote to memory of 556 544 vjjjd.exe lxrlfff.exe PID 544 wrote to memory of 556 544 vjjjd.exe lxrlfff.exe PID 556 wrote to memory of 956 556 lxrlfff.exe 7hhtnn.exe PID 556 wrote to memory of 956 556 lxrlfff.exe 7hhtnn.exe PID 556 wrote to memory of 956 556 lxrlfff.exe 7hhtnn.exe PID 956 wrote to memory of 2416 956 7hhtnn.exe pjjdd.exe PID 956 wrote to memory of 2416 956 7hhtnn.exe pjjdd.exe PID 956 wrote to memory of 2416 956 7hhtnn.exe pjjdd.exe PID 2416 wrote to memory of 1036 2416 pjjdd.exe 3nnhnn.exe PID 2416 wrote to memory of 1036 2416 pjjdd.exe 3nnhnn.exe PID 2416 wrote to memory of 1036 2416 pjjdd.exe 3nnhnn.exe PID 1036 wrote to memory of 1476 1036 3nnhnn.exe thnhhb.exe PID 1036 wrote to memory of 1476 1036 3nnhnn.exe thnhhb.exe PID 1036 wrote to memory of 1476 1036 3nnhnn.exe thnhhb.exe PID 1476 wrote to memory of 3716 1476 thnhhb.exe pvjvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bf5a2dea8bd521d15db82dfbedd2c09_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5bf5a2dea8bd521d15db82dfbedd2c09_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\pddpj.exec:\pddpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\bhbnbn.exec:\bhbnbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\jvdpd.exec:\jvdpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\rflxrfx.exec:\rflxrfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\frfxlfx.exec:\frfxlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\ppdpp.exec:\ppdpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\1rxxlll.exec:\1rxxlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\9pvjv.exec:\9pvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\lflfllr.exec:\lflfllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\bhnhhb.exec:\bhnhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\xlrfflx.exec:\xlrfflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\5tbtnn.exec:\5tbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\7rxlfxl.exec:\7rxlfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\llxrfxr.exec:\llxrfxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\5nnhtn.exec:\5nnhtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\vjjjd.exec:\vjjjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\lxrlfff.exec:\lxrlfff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\7hhtnn.exec:\7hhtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\pjjdd.exec:\pjjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\3nnhnn.exec:\3nnhnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\thnhhb.exec:\thnhhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\pvjvp.exec:\pvjvp.exe23⤵
- Executes dropped EXE
PID:3716 -
\??\c:\xxllffx.exec:\xxllffx.exe24⤵
- Executes dropped EXE
PID:1260 -
\??\c:\9bhbhh.exec:\9bhbhh.exe25⤵
- Executes dropped EXE
PID:3104 -
\??\c:\nnnhhh.exec:\nnnhhh.exe26⤵
- Executes dropped EXE
PID:436 -
\??\c:\lxxxxff.exec:\lxxxxff.exe27⤵
- Executes dropped EXE
PID:852 -
\??\c:\rxxrrxx.exec:\rxxrrxx.exe28⤵
- Executes dropped EXE
PID:1076 -
\??\c:\7nnnhh.exec:\7nnnhh.exe29⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1pddd.exec:\1pddd.exe30⤵
- Executes dropped EXE
PID:4312 -
\??\c:\xxxfxxx.exec:\xxxfxxx.exe31⤵
- Executes dropped EXE
PID:4412 -
\??\c:\nnbbnn.exec:\nnbbnn.exe32⤵
- Executes dropped EXE
PID:5036 -
\??\c:\vvjvj.exec:\vvjvj.exe33⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hbbbtt.exec:\hbbbtt.exe34⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dpvjv.exec:\dpvjv.exe35⤵
- Executes dropped EXE
PID:1304 -
\??\c:\rflfxrl.exec:\rflfxrl.exe36⤵
- Executes dropped EXE
PID:3444 -
\??\c:\7xrlfff.exec:\7xrlfff.exe37⤵
- Executes dropped EXE
PID:3900 -
\??\c:\1tnnhh.exec:\1tnnhh.exe38⤵
- Executes dropped EXE
PID:1632 -
\??\c:\9pvpd.exec:\9pvpd.exe39⤵
- Executes dropped EXE
PID:1108 -
\??\c:\jdppj.exec:\jdppj.exe40⤵
- Executes dropped EXE
PID:2796 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe41⤵
- Executes dropped EXE
PID:3784 -
\??\c:\fxfxllr.exec:\fxfxllr.exe42⤵
- Executes dropped EXE
PID:4980 -
\??\c:\nhhbbt.exec:\nhhbbt.exe43⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pppjj.exec:\pppjj.exe44⤵
- Executes dropped EXE
PID:3616 -
\??\c:\jddvp.exec:\jddvp.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xrrlffx.exec:\xrrlffx.exe46⤵
- Executes dropped EXE
PID:4500 -
\??\c:\bnbbtt.exec:\bnbbtt.exe47⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bthhnh.exec:\bthhnh.exe48⤵
- Executes dropped EXE
PID:3648 -
\??\c:\jjjdd.exec:\jjjdd.exe49⤵
- Executes dropped EXE
PID:4984 -
\??\c:\jddvv.exec:\jddvv.exe50⤵
- Executes dropped EXE
PID:3712 -
\??\c:\rfxrllf.exec:\rfxrllf.exe51⤵
- Executes dropped EXE
PID:1104 -
\??\c:\thnhbb.exec:\thnhbb.exe52⤵
- Executes dropped EXE
PID:3128 -
\??\c:\bntttt.exec:\bntttt.exe53⤵
- Executes dropped EXE
PID:932 -
\??\c:\1ddvv.exec:\1ddvv.exe54⤵
- Executes dropped EXE
PID:4228 -
\??\c:\pjpjj.exec:\pjpjj.exe55⤵
- Executes dropped EXE
PID:656 -
\??\c:\rxlfxxx.exec:\rxlfxxx.exe56⤵
- Executes dropped EXE
PID:4952 -
\??\c:\xlllfff.exec:\xlllfff.exe57⤵
- Executes dropped EXE
PID:3020 -
\??\c:\9bbbhh.exec:\9bbbhh.exe58⤵
- Executes dropped EXE
PID:3324 -
\??\c:\jvvpp.exec:\jvvpp.exe59⤵
- Executes dropped EXE
PID:4940 -
\??\c:\jjdvd.exec:\jjdvd.exe60⤵
- Executes dropped EXE
PID:1288 -
\??\c:\1flfxxr.exec:\1flfxxr.exe61⤵
- Executes dropped EXE
PID:3104 -
\??\c:\rlrlffx.exec:\rlrlffx.exe62⤵
- Executes dropped EXE
PID:692 -
\??\c:\nbnhhn.exec:\nbnhhn.exe63⤵
- Executes dropped EXE
PID:852 -
\??\c:\djvvp.exec:\djvvp.exe64⤵
- Executes dropped EXE
PID:3600 -
\??\c:\dvdjp.exec:\dvdjp.exe65⤵
- Executes dropped EXE
PID:2208 -
\??\c:\llrlxrx.exec:\llrlxrx.exe66⤵PID:4408
-
\??\c:\hbbbtt.exec:\hbbbtt.exe67⤵PID:2336
-
\??\c:\9ntnhb.exec:\9ntnhb.exe68⤵PID:4412
-
\??\c:\3jjpj.exec:\3jjpj.exe69⤵PID:2112
-
\??\c:\vjvpj.exec:\vjvpj.exe70⤵PID:2996
-
\??\c:\xrrxrfx.exec:\xrrxrfx.exe71⤵PID:4212
-
\??\c:\frxxrrr.exec:\frxxrrr.exe72⤵PID:1396
-
\??\c:\hhhbtn.exec:\hhhbtn.exe73⤵PID:2544
-
\??\c:\ppjdv.exec:\ppjdv.exe74⤵PID:3176
-
\??\c:\xfxflxf.exec:\xfxflxf.exe75⤵PID:2576
-
\??\c:\hbhtbt.exec:\hbhtbt.exe76⤵PID:2280
-
\??\c:\nthbtt.exec:\nthbtt.exe77⤵PID:2292
-
\??\c:\vjjvj.exec:\vjjvj.exe78⤵PID:4224
-
\??\c:\7pddd.exec:\7pddd.exe79⤵PID:5028
-
\??\c:\rflffxr.exec:\rflffxr.exe80⤵PID:3008
-
\??\c:\7tbbtb.exec:\7tbbtb.exe81⤵PID:4080
-
\??\c:\nnnhbt.exec:\nnnhbt.exe82⤵PID:3924
-
\??\c:\1djvp.exec:\1djvp.exe83⤵PID:4808
-
\??\c:\rlrlllr.exec:\rlrlllr.exe84⤵PID:2856
-
\??\c:\tbbbtn.exec:\tbbbtn.exe85⤵PID:3644
-
\??\c:\nhthnh.exec:\nhthnh.exe86⤵PID:2816
-
\??\c:\vjpdv.exec:\vjpdv.exe87⤵PID:3660
-
\??\c:\3lrrfff.exec:\3lrrfff.exe88⤵PID:556
-
\??\c:\bttnhb.exec:\bttnhb.exe89⤵PID:4492
-
\??\c:\3nnhtt.exec:\3nnhtt.exe90⤵PID:2416
-
\??\c:\jvjdp.exec:\jvjdp.exe91⤵PID:924
-
\??\c:\dvvpd.exec:\dvvpd.exe92⤵PID:4592
-
\??\c:\1lrfxff.exec:\1lrfxff.exe93⤵PID:4100
-
\??\c:\9hbtnn.exec:\9hbtnn.exe94⤵PID:3684
-
\??\c:\nhbnnb.exec:\nhbnnb.exe95⤵PID:3288
-
\??\c:\9dppd.exec:\9dppd.exe96⤵PID:1912
-
\??\c:\7flfxfx.exec:\7flfxfx.exe97⤵PID:4076
-
\??\c:\tbhbtn.exec:\tbhbtn.exe98⤵PID:2240
-
\??\c:\bbhbhb.exec:\bbhbhb.exe99⤵PID:3572
-
\??\c:\ppdvp.exec:\ppdvp.exe100⤵PID:2300
-
\??\c:\rllxlfx.exec:\rllxlfx.exe101⤵PID:2208
-
\??\c:\htnhbb.exec:\htnhbb.exe102⤵PID:624
-
\??\c:\xfrxrxr.exec:\xfrxrxr.exe103⤵PID:4824
-
\??\c:\tbbhbn.exec:\tbbhbn.exe104⤵PID:4412
-
\??\c:\1btnbt.exec:\1btnbt.exe105⤵PID:628
-
\??\c:\jddvp.exec:\jddvp.exe106⤵PID:2760
-
\??\c:\jvvpd.exec:\jvvpd.exe107⤵PID:4212
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe108⤵PID:3444
-
\??\c:\btthhb.exec:\btthhb.exe109⤵PID:448
-
\??\c:\pvvpj.exec:\pvvpj.exe110⤵PID:3080
-
\??\c:\xrlxrll.exec:\xrlxrll.exe111⤵PID:2408
-
\??\c:\fxfxllr.exec:\fxfxllr.exe112⤵PID:2620
-
\??\c:\bnhnbb.exec:\bnhnbb.exe113⤵PID:2444
-
\??\c:\btthbt.exec:\btthbt.exe114⤵PID:3916
-
\??\c:\djvvp.exec:\djvvp.exe115⤵PID:640
-
\??\c:\vppjv.exec:\vppjv.exe116⤵PID:2860
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe117⤵PID:4080
-
\??\c:\nnbthn.exec:\nnbthn.exe118⤵PID:3616
-
\??\c:\3hnhbh.exec:\3hnhbh.exe119⤵PID:3088
-
\??\c:\djjpj.exec:\djjpj.exe120⤵PID:2856
-
\??\c:\9ppjp.exec:\9ppjp.exe121⤵PID:2816
-
\??\c:\frfxrrl.exec:\frfxrrl.exe122⤵PID:3252
-
\??\c:\xrxrrlr.exec:\xrxrrlr.exe123⤵PID:956
-
\??\c:\bttnhh.exec:\bttnhh.exe124⤵PID:2740
-
\??\c:\dpvpv.exec:\dpvpv.exe125⤵PID:3168
-
\??\c:\vjjvj.exec:\vjjvj.exe126⤵PID:1752
-
\??\c:\lxllfrl.exec:\lxllfrl.exe127⤵PID:4100
-
\??\c:\xlfllll.exec:\xlfllll.exe128⤵PID:3684
-
\??\c:\ntbtnn.exec:\ntbtnn.exe129⤵PID:1288
-
\??\c:\pppjj.exec:\pppjj.exe130⤵PID:4000
-
\??\c:\dvvpj.exec:\dvvpj.exe131⤵PID:4484
-
\??\c:\xxlxrll.exec:\xxlxrll.exe132⤵PID:3600
-
\??\c:\rlrxrlf.exec:\rlrxrlf.exe133⤵PID:4420
-
\??\c:\hnnbtb.exec:\hnnbtb.exe134⤵PID:2300
-
\??\c:\3tnhbb.exec:\3tnhbb.exe135⤵PID:4604
-
\??\c:\9jpdj.exec:\9jpdj.exe136⤵PID:4400
-
\??\c:\xlfrfxl.exec:\xlfrfxl.exe137⤵PID:2528
-
\??\c:\rrfrlfx.exec:\rrfrlfx.exe138⤵PID:2180
-
\??\c:\3tbbhn.exec:\3tbbhn.exe139⤵PID:1396
-
\??\c:\vjdvp.exec:\vjdvp.exe140⤵PID:2544
-
\??\c:\ddpjd.exec:\ddpjd.exe141⤵PID:3080
-
\??\c:\xlrlxrl.exec:\xlrlxrl.exe142⤵PID:2388
-
\??\c:\rffxxxr.exec:\rffxxxr.exe143⤵PID:4224
-
\??\c:\tnbtbb.exec:\tnbtbb.exe144⤵PID:640
-
\??\c:\pdppv.exec:\pdppv.exe145⤵PID:3984
-
\??\c:\jppdv.exec:\jppdv.exe146⤵PID:4340
-
\??\c:\9fxlffr.exec:\9fxlffr.exe147⤵PID:3088
-
\??\c:\fflrlll.exec:\fflrlll.exe148⤵PID:3740
-
\??\c:\bbnnhb.exec:\bbnnhb.exe149⤵PID:932
-
\??\c:\vpvjv.exec:\vpvjv.exe150⤵PID:1292
-
\??\c:\vdvdv.exec:\vdvdv.exe151⤵PID:2352
-
\??\c:\fllfxrr.exec:\fllfxrr.exe152⤵PID:4952
-
\??\c:\rxrlxrl.exec:\rxrlxrl.exe153⤵PID:4720
-
\??\c:\htnhnn.exec:\htnhnn.exe154⤵PID:2092
-
\??\c:\jjpdv.exec:\jjpdv.exe155⤵PID:3544
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe156⤵PID:4308
-
\??\c:\rllfxrr.exec:\rllfxrr.exe157⤵PID:1992
-
\??\c:\bthtnt.exec:\bthtnt.exe158⤵PID:852
-
\??\c:\jdddv.exec:\jdddv.exe159⤵PID:2580
-
\??\c:\frxrfxr.exec:\frxrfxr.exe160⤵PID:4312
-
\??\c:\rflfxxl.exec:\rflfxxl.exe161⤵PID:4616
-
\??\c:\3nhbtb.exec:\3nhbtb.exe162⤵PID:464
-
\??\c:\jpdvp.exec:\jpdvp.exe163⤵PID:1380
-
\??\c:\fxffxxr.exec:\fxffxxr.exe164⤵PID:1184
-
\??\c:\xrrxrxr.exec:\xrrxrxr.exe165⤵PID:4184
-
\??\c:\hbbtnh.exec:\hbbtnh.exe166⤵PID:4992
-
\??\c:\ddjjj.exec:\ddjjj.exe167⤵PID:2288
-
\??\c:\frrrlfl.exec:\frrrlfl.exe168⤵PID:2980
-
\??\c:\bntnhb.exec:\bntnhb.exe169⤵PID:2408
-
\??\c:\tbtnhb.exec:\tbtnhb.exe170⤵PID:2388
-
\??\c:\tbbbtn.exec:\tbbbtn.exe171⤵PID:988
-
\??\c:\jjjdd.exec:\jjjdd.exe172⤵PID:4080
-
\??\c:\xxrffff.exec:\xxrffff.exe173⤵PID:2468
-
\??\c:\nhthbt.exec:\nhthbt.exe174⤵PID:2772
-
\??\c:\rxffxrr.exec:\rxffxrr.exe175⤵PID:3088
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe176⤵PID:3740
-
\??\c:\ntnnnn.exec:\ntnnnn.exe177⤵PID:3192
-
\??\c:\vpvpj.exec:\vpvpj.exe178⤵PID:2416
-
\??\c:\jvpvv.exec:\jvpvv.exe179⤵PID:5064
-
\??\c:\fxrfrlf.exec:\fxrfrlf.exe180⤵PID:4036
-
\??\c:\nnhbtt.exec:\nnhbtt.exe181⤵PID:2380
-
\??\c:\bbhbbb.exec:\bbhbbb.exe182⤵PID:3544
-
\??\c:\7ddvj.exec:\7ddvj.exe183⤵PID:4176
-
\??\c:\7rrlffx.exec:\7rrlffx.exe184⤵PID:2240
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe185⤵PID:4532
-
\??\c:\nhhbhb.exec:\nhhbhb.exe186⤵PID:4420
-
\??\c:\thhhtt.exec:\thhhtt.exe187⤵PID:3152
-
\??\c:\jpvpd.exec:\jpvpd.exe188⤵PID:5036
-
\??\c:\lfllllr.exec:\lfllllr.exe189⤵PID:4400
-
\??\c:\9hbbtn.exec:\9hbbtn.exe190⤵PID:2528
-
\??\c:\htbtth.exec:\htbtth.exe191⤵PID:4300
-
\??\c:\vppdv.exec:\vppdv.exe192⤵PID:4060
-
\??\c:\frrxrlf.exec:\frrxrlf.exe193⤵PID:1884
-
\??\c:\rllfxrl.exec:\rllfxrl.exe194⤵PID:4944
-
\??\c:\hbnhtt.exec:\hbnhtt.exe195⤵PID:4980
-
\??\c:\pjpjp.exec:\pjpjp.exe196⤵PID:4200
-
\??\c:\1pdpj.exec:\1pdpj.exe197⤵PID:4500
-
\??\c:\rllxlrf.exec:\rllxlrf.exe198⤵PID:2852
-
\??\c:\7xfxfxl.exec:\7xfxfxl.exe199⤵PID:1644
-
\??\c:\tbhtnh.exec:\tbhtnh.exe200⤵PID:408
-
\??\c:\1vdvv.exec:\1vdvv.exe201⤵PID:556
-
\??\c:\vpdpj.exec:\vpdpj.exe202⤵PID:5084
-
\??\c:\1rxrrlx.exec:\1rxrrlx.exe203⤵PID:4140
-
\??\c:\xrfrllf.exec:\xrfrllf.exe204⤵PID:4240
-
\??\c:\hnbtnn.exec:\hnbtnn.exe205⤵PID:2364
-
\??\c:\pdpjd.exec:\pdpjd.exe206⤵PID:436
-
\??\c:\pjjvj.exec:\pjjvj.exe207⤵PID:2648
-
\??\c:\xlrrlll.exec:\xlrrlll.exe208⤵PID:824
-
\??\c:\hbtnhb.exec:\hbtnhb.exe209⤵PID:4456
-
\??\c:\5hnhbt.exec:\5hnhbt.exe210⤵PID:3600
-
\??\c:\jvvpp.exec:\jvvpp.exe211⤵PID:4404
-
\??\c:\fxfxlll.exec:\fxfxlll.exe212⤵PID:4392
-
\??\c:\xfrrxrx.exec:\xfrrxrx.exe213⤵PID:4356
-
\??\c:\tttnhb.exec:\tttnhb.exe214⤵PID:4412
-
\??\c:\vjvjd.exec:\vjvjd.exe215⤵PID:4704
-
\??\c:\vjdvj.exec:\vjdvj.exe216⤵PID:2484
-
\??\c:\3rlfrrx.exec:\3rlfrrx.exe217⤵PID:4992
-
\??\c:\btttnh.exec:\btttnh.exe218⤵PID:2288
-
\??\c:\bntnhn.exec:\bntnhn.exe219⤵PID:2980
-
\??\c:\jpvpj.exec:\jpvpj.exe220⤵PID:1612
-
\??\c:\9jpjj.exec:\9jpjj.exe221⤵PID:5088
-
\??\c:\5rrfxxx.exec:\5rrfxxx.exe222⤵PID:4200
-
\??\c:\hnhhbt.exec:\hnhhbt.exe223⤵PID:4500
-
\??\c:\hntnhb.exec:\hntnhb.exe224⤵PID:4976
-
\??\c:\jvvdd.exec:\jvvdd.exe225⤵PID:1644
-
\??\c:\5lfxrrr.exec:\5lfxrrr.exe226⤵PID:408
-
\??\c:\1frfxxr.exec:\1frfxxr.exe227⤵PID:1036
-
\??\c:\nhbthh.exec:\nhbthh.exe228⤵PID:4952
-
\??\c:\pvpjd.exec:\pvpjd.exe229⤵PID:3716
-
\??\c:\vvjdv.exec:\vvjdv.exe230⤵PID:4240
-
\??\c:\frxrrll.exec:\frxrrll.exe231⤵PID:2364
-
\??\c:\hbhnnt.exec:\hbhnnt.exe232⤵PID:3644
-
\??\c:\vjjdv.exec:\vjjdv.exe233⤵PID:1076
-
\??\c:\vjpjd.exec:\vjpjd.exe234⤵PID:4456
-
\??\c:\rflfffx.exec:\rflfffx.exe235⤵PID:4312
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe236⤵PID:4604
-
\??\c:\tbhbtt.exec:\tbhbtt.exe237⤵PID:2336
-
\??\c:\3bbhtt.exec:\3bbhtt.exe238⤵PID:2984
-
\??\c:\9jvpd.exec:\9jvpd.exe239⤵PID:2412
-
\??\c:\xlrflfl.exec:\xlrflfl.exe240⤵PID:4184
-
\??\c:\rfxrlff.exec:\rfxrlff.exe241⤵PID:4060
-
\??\c:\1thtnb.exec:\1thtnb.exe242⤵PID:2712