Analysis
- max time kernel
150s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 23:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5bf5a2dea8bd521d15db82dfbedd2c09_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 5bf5a2dea8bd521d15db82dfbedd2c09_JaffaCakes118.exe
- Size 199KB
- Sample240519-25c37sgc21
- SHA256 2370ca21360736bc3f7eec84b2d26fae4e3b676a2471a2609851b1b16415aa1a
- MD5 5bf5a2dea8bd521d15db82dfbedd2c09
- SHA1 7c63579fdf8f0639a90a0e520eab24980efff31b
- SHA512 18c632be7f7a41e180f9f2fb1573b7845de634121b8ab71d037477775a4df0630d7cf7461dab1dbcccf950146cb375e805a7c9c3289c6916a590f61675667181
- SSDEEP 1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqyvU2r1vsKM4ltg:PhOm2sI93UufdC67cihvH1Sz
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/624-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/956-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1076-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3784-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/656-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-324-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-346-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-385-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-392-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-394-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-404-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-432-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-458-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-465-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-475-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-485-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/956-498-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-543-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-601-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-632-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-748-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-783-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-986-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-1220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4400 pddpj.exe 392 bhbnbn.exe 3488 jvdpd.exe 4704 rflxrfx.exe 1748 frfxlfx.exe 4332 ppdpp.exe 4816 1rxxlll.exe 4136 9pvjv.exe 1664 lflfllr.exe 4080 bhnhhb.exe 4516 xlrfflx.exe 2852 5tbtnn.exe 1644 7rxlfxl.exe 4340 llxrfxr.exe 1016 5nnhtn.exe 544 vjjjd.exe 556 lxrlfff.exe 956 7hhtnn.exe 2416 pjjdd.exe 1036 3nnhnn.exe 1476 thnhhb.exe 3716 pvjvp.exe 1260 xxllffx.exe 3104 9bhbhh.exe 436 nnnhhh.exe 852 lxxxxff.exe 1076 rxxrrxx.exe 1952 7nnnhh.exe 4312 1pddd.exe 4412 xxxfxxx.exe 5036 nnbbnn.exe 2996 vvjvj.exe 2584 hbbbtt.exe 1304 dpvjv.exe 3444 rflfxrl.exe 3900 7xrlfff.exe 1632 1tnnhh.exe 1108 9pvpd.exe 2796 jdppj.exe 3784 fxxrrrl.exe 4980 fxfxllr.exe 2860 nhhbbt.exe 3616 pppjj.exe 2572 jddvp.exe 4500 xrrlffx.exe 1644 bnbbtt.exe 3648 bthhnh.exe 4984 jjjdd.exe 3712 jddvv.exe 1104 rfxrllf.exe 3128 thnhbb.exe 932 bntttt.exe 4228 1ddvv.exe 656 pjpjj.exe 4952 rxlfxxx.exe 3020 xlllfff.exe 3324 9bbbhh.exe 4940 jvvpp.exe 1288 jjdvd.exe 3104 1flfxxr.exe 692 rlrlffx.exe 852 nbnhhn.exe 3600 djvvp.exe 2208 dvdjp.exe -
resource yara_rule behavioral2/memory/4400-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/956-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1076-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3784-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-324-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-392-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-394-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-404-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-432-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-458-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-465-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-475-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-482-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-485-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/956-498-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-529-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-539-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 624 wrote to memory of 4400 624 5bf5a2dea8bd521d15db82dfbedd2c09_JaffaCakes118.exe 91 PID 624 wrote to memory of 4400 624 5bf5a2dea8bd521d15db82dfbedd2c09_JaffaCakes118.exe 91 PID 624 wrote to memory of 4400 624 5bf5a2dea8bd521d15db82dfbedd2c09_JaffaCakes118.exe 91 PID 4400 wrote to memory of 392 4400 pddpj.exe 92 PID 4400 wrote to memory of 392 4400 pddpj.exe 92 PID 4400 wrote to memory of 392 4400 pddpj.exe 92 PID 392 wrote to memory of 3488 392 bhbnbn.exe 93 PID 392 wrote to memory of 3488 392 bhbnbn.exe 93 PID 392 wrote to memory of 3488 392 bhbnbn.exe 93 PID 3488 wrote to memory of 4704 3488 jvdpd.exe 94 PID 3488 wrote to memory of 4704 3488 jvdpd.exe 94 PID 3488 wrote to memory of 4704 3488 jvdpd.exe 94 PID 4704 wrote to memory of 1748 4704 rflxrfx.exe 95 PID 4704 wrote to memory of 1748 4704 rflxrfx.exe 95 PID 4704 wrote to memory of 1748 4704 rflxrfx.exe 95 PID 1748 wrote to memory of 4332 1748 frfxlfx.exe 96 PID 1748 wrote to memory of 4332 1748 frfxlfx.exe 96 PID 1748 wrote to memory of 4332 1748 frfxlfx.exe 96 PID 4332 wrote to memory of 4816 4332 ppdpp.exe 97 PID 4332 wrote to memory of 4816 4332 ppdpp.exe 97 PID 4332 wrote to memory of 4816 4332 ppdpp.exe 97 PID 4816 wrote to memory of 4136 4816 1rxxlll.exe 98 PID 4816 wrote to memory of 4136 4816 1rxxlll.exe 98 PID 4816 wrote to memory of 4136 4816 1rxxlll.exe 98 PID 4136 wrote to memory of 1664 4136 9pvjv.exe 99 PID 4136 wrote to memory of 1664 4136 9pvjv.exe 99 PID 4136 wrote to memory of 1664 4136 9pvjv.exe 99 PID 1664 wrote to memory of 4080 1664 lflfllr.exe 100 PID 1664 wrote to memory of 4080 1664 lflfllr.exe 100 PID 1664 wrote to memory of 4080 1664 lflfllr.exe 100 PID 4080 wrote to memory of 4516 4080 bhnhhb.exe 101 PID 4080 wrote to memory of 4516 4080 bhnhhb.exe 101 PID 4080 wrote to memory of 4516 4080 bhnhhb.exe 101 PID 4516 wrote to memory of 2852 4516 xlrfflx.exe 102 PID 4516 wrote to memory of 2852 4516 xlrfflx.exe 102 PID 4516 wrote to memory of 2852 4516 xlrfflx.exe 102 PID 2852 wrote to memory of 1644 2852 5tbtnn.exe 103 PID 2852 wrote to memory of 1644 2852 5tbtnn.exe 103 PID 2852 wrote to memory of 1644 2852 5tbtnn.exe 103 PID 1644 wrote to memory of 4340 1644 7rxlfxl.exe 104 PID 1644 wrote to memory of 4340 1644 7rxlfxl.exe 104 PID 1644 wrote to memory of 4340 1644 7rxlfxl.exe 104 PID 4340 wrote to memory of 1016 4340 llxrfxr.exe 105 PID 4340 wrote to memory of 1016 4340 llxrfxr.exe 105 PID 4340 wrote to memory of 1016 4340 llxrfxr.exe 105 PID 1016 wrote to memory of 544 1016 5nnhtn.exe 106 PID 1016 wrote to memory of 544 1016 5nnhtn.exe 106 PID 1016 wrote to memory of 544 1016 5nnhtn.exe 106 PID 544 wrote to memory of 556 544 vjjjd.exe 107 PID 544 wrote to memory of 556 544 vjjjd.exe 107 PID 544 wrote to memory of 556 544 vjjjd.exe 107 PID 556 wrote to memory of 956 556 lxrlfff.exe 108 PID 556 wrote to memory of 956 556 lxrlfff.exe 108 PID 556 wrote to memory of 956 556 lxrlfff.exe 108 PID 956 wrote to memory of 2416 956 7hhtnn.exe 110 PID 956 wrote to memory of 2416 956 7hhtnn.exe 110 PID 956 wrote to memory of 2416 956 7hhtnn.exe 110 PID 2416 wrote to memory of 1036 2416 pjjdd.exe 111 PID 2416 wrote to memory of 1036 2416 pjjdd.exe 111 PID 2416 wrote to memory of 1036 2416 pjjdd.exe 111 PID 1036 wrote to memory of 1476 1036 3nnhnn.exe 112 PID 1036 wrote to memory of 1476 1036 3nnhnn.exe 112 PID 1036 wrote to memory of 1476 1036 3nnhnn.exe 112 PID 1476 wrote to memory of 3716 1476 thnhhb.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bf5a2dea8bd521d15db82dfbedd2c09_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5bf5a2dea8bd521d15db82dfbedd2c09_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\pddpj.exec:\pddpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\bhbnbn.exec:\bhbnbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\jvdpd.exec:\jvdpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\rflxrfx.exec:\rflxrfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\frfxlfx.exec:\frfxlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\ppdpp.exec:\ppdpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\1rxxlll.exec:\1rxxlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\9pvjv.exec:\9pvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\lflfllr.exec:\lflfllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\bhnhhb.exec:\bhnhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\xlrfflx.exec:\xlrfflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\5tbtnn.exec:\5tbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\7rxlfxl.exec:\7rxlfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\llxrfxr.exec:\llxrfxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\5nnhtn.exec:\5nnhtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\vjjjd.exec:\vjjjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\lxrlfff.exec:\lxrlfff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\7hhtnn.exec:\7hhtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\pjjdd.exec:\pjjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\3nnhnn.exec:\3nnhnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\thnhhb.exec:\thnhhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\pvjvp.exec:\pvjvp.exe23⤵
- Executes dropped EXE
PID:3716 -
\??\c:\xxllffx.exec:\xxllffx.exe24⤵
- Executes dropped EXE
PID:1260 -
\??\c:\9bhbhh.exec:\9bhbhh.exe25⤵
- Executes dropped EXE
PID:3104 -
\??\c:\nnnhhh.exec:\nnnhhh.exe26⤵
- Executes dropped EXE
PID:436 -
\??\c:\lxxxxff.exec:\lxxxxff.exe27⤵
- Executes dropped EXE
PID:852 -
\??\c:\rxxrrxx.exec:\rxxrrxx.exe28⤵
- Executes dropped EXE
PID:1076 -
\??\c:\7nnnhh.exec:\7nnnhh.exe29⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1pddd.exec:\1pddd.exe30⤵
- Executes dropped EXE
PID:4312 -
\??\c:\xxxfxxx.exec:\xxxfxxx.exe31⤵
- Executes dropped EXE
PID:4412 -
\??\c:\nnbbnn.exec:\nnbbnn.exe32⤵
- Executes dropped EXE
PID:5036 -
\??\c:\vvjvj.exec:\vvjvj.exe33⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hbbbtt.exec:\hbbbtt.exe34⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dpvjv.exec:\dpvjv.exe35⤵
- Executes dropped EXE
PID:1304 -
\??\c:\rflfxrl.exec:\rflfxrl.exe36⤵
- Executes dropped EXE
PID:3444 -
\??\c:\7xrlfff.exec:\7xrlfff.exe37⤵
- Executes dropped EXE
PID:3900 -
\??\c:\1tnnhh.exec:\1tnnhh.exe38⤵
- Executes dropped EXE
PID:1632 -
\??\c:\9pvpd.exec:\9pvpd.exe39⤵
- Executes dropped EXE
PID:1108 -
\??\c:\jdppj.exec:\jdppj.exe40⤵
- Executes dropped EXE
PID:2796 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe41⤵
- Executes dropped EXE
PID:3784 -
\??\c:\fxfxllr.exec:\fxfxllr.exe42⤵
- Executes dropped EXE
PID:4980 -
\??\c:\nhhbbt.exec:\nhhbbt.exe43⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pppjj.exec:\pppjj.exe44⤵
- Executes dropped EXE
PID:3616 -
\??\c:\jddvp.exec:\jddvp.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xrrlffx.exec:\xrrlffx.exe46⤵
- Executes dropped EXE
PID:4500 -
\??\c:\bnbbtt.exec:\bnbbtt.exe47⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bthhnh.exec:\bthhnh.exe48⤵
- Executes dropped EXE
PID:3648 -
\??\c:\jjjdd.exec:\jjjdd.exe49⤵
- Executes dropped EXE
PID:4984 -
\??\c:\jddvv.exec:\jddvv.exe50⤵
- Executes dropped EXE
PID:3712 -
\??\c:\rfxrllf.exec:\rfxrllf.exe51⤵
- Executes dropped EXE
PID:1104 -
\??\c:\thnhbb.exec:\thnhbb.exe52⤵
- Executes dropped EXE
PID:3128 -
\??\c:\bntttt.exec:\bntttt.exe53⤵
- Executes dropped EXE
PID:932 -
\??\c:\1ddvv.exec:\1ddvv.exe54⤵
- Executes dropped EXE
PID:4228 -
\??\c:\pjpjj.exec:\pjpjj.exe55⤵
- Executes dropped EXE
PID:656 -
\??\c:\rxlfxxx.exec:\rxlfxxx.exe56⤵
- Executes dropped EXE
PID:4952 -
\??\c:\xlllfff.exec:\xlllfff.exe57⤵
- Executes dropped EXE
PID:3020 -
\??\c:\9bbbhh.exec:\9bbbhh.exe58⤵
- Executes dropped EXE
PID:3324 -
\??\c:\jvvpp.exec:\jvvpp.exe59⤵
- Executes dropped EXE
PID:4940 -
\??\c:\jjdvd.exec:\jjdvd.exe60⤵
- Executes dropped EXE
PID:1288 -
\??\c:\1flfxxr.exec:\1flfxxr.exe61⤵
- Executes dropped EXE
PID:3104 -
\??\c:\rlrlffx.exec:\rlrlffx.exe62⤵
- Executes dropped EXE
PID:692 -
\??\c:\nbnhhn.exec:\nbnhhn.exe63⤵
- Executes dropped EXE
PID:852 -
\??\c:\djvvp.exec:\djvvp.exe64⤵
- Executes dropped EXE
PID:3600 -
\??\c:\dvdjp.exec:\dvdjp.exe65⤵
- Executes dropped EXE
PID:2208 -
\??\c:\llrlxrx.exec:\llrlxrx.exe66⤵PID:4408
-
\??\c:\hbbbtt.exec:\hbbbtt.exe67⤵PID:2336
-
\??\c:\9ntnhb.exec:\9ntnhb.exe68⤵PID:4412
-
\??\c:\3jjpj.exec:\3jjpj.exe69⤵PID:2112
-
\??\c:\vjvpj.exec:\vjvpj.exe70⤵PID:2996
-
\??\c:\xrrxrfx.exec:\xrrxrfx.exe71⤵PID:4212
-
\??\c:\frxxrrr.exec:\frxxrrr.exe72⤵PID:1396
-
\??\c:\hhhbtn.exec:\hhhbtn.exe73⤵PID:2544
-
\??\c:\ppjdv.exec:\ppjdv.exe74⤵PID:3176
-
\??\c:\xfxflxf.exec:\xfxflxf.exe75⤵PID:2576
-
\??\c:\hbhtbt.exec:\hbhtbt.exe76⤵PID:2280
-
\??\c:\nthbtt.exec:\nthbtt.exe77⤵PID:2292
-
\??\c:\vjjvj.exec:\vjjvj.exe78⤵PID:4224
-
\??\c:\7pddd.exec:\7pddd.exe79⤵PID:5028
-
\??\c:\rflffxr.exec:\rflffxr.exe80⤵PID:3008
-
\??\c:\7tbbtb.exec:\7tbbtb.exe81⤵PID:4080
-
\??\c:\nnnhbt.exec:\nnnhbt.exe82⤵PID:3924
-
\??\c:\1djvp.exec:\1djvp.exe83⤵PID:4808
-
\??\c:\rlrlllr.exec:\rlrlllr.exe84⤵PID:2856
-
\??\c:\tbbbtn.exec:\tbbbtn.exe85⤵PID:3644
-
\??\c:\nhthnh.exec:\nhthnh.exe86⤵PID:2816
-
\??\c:\vjpdv.exec:\vjpdv.exe87⤵PID:3660
-
\??\c:\3lrrfff.exec:\3lrrfff.exe88⤵PID:556
-
\??\c:\bttnhb.exec:\bttnhb.exe89⤵PID:4492
-
\??\c:\3nnhtt.exec:\3nnhtt.exe90⤵PID:2416
-
\??\c:\jvjdp.exec:\jvjdp.exe91⤵PID:924
-
\??\c:\dvvpd.exec:\dvvpd.exe92⤵PID:4592
-
\??\c:\1lrfxff.exec:\1lrfxff.exe93⤵PID:4100
-
\??\c:\9hbtnn.exec:\9hbtnn.exe94⤵PID:3684
-
\??\c:\nhbnnb.exec:\nhbnnb.exe95⤵PID:3288
-
\??\c:\9dppd.exec:\9dppd.exe96⤵PID:1912
-
\??\c:\7flfxfx.exec:\7flfxfx.exe97⤵PID:4076
-
\??\c:\tbhbtn.exec:\tbhbtn.exe98⤵PID:2240
-
\??\c:\bbhbhb.exec:\bbhbhb.exe99⤵PID:3572
-
\??\c:\ppdvp.exec:\ppdvp.exe100⤵PID:2300
-
\??\c:\rllxlfx.exec:\rllxlfx.exe101⤵PID:2208
-
\??\c:\htnhbb.exec:\htnhbb.exe102⤵PID:624
-
\??\c:\xfrxrxr.exec:\xfrxrxr.exe103⤵PID:4824
-
\??\c:\tbbhbn.exec:\tbbhbn.exe104⤵PID:4412
-
\??\c:\1btnbt.exec:\1btnbt.exe105⤵PID:628
-
\??\c:\jddvp.exec:\jddvp.exe106⤵PID:2760
-
\??\c:\jvvpd.exec:\jvvpd.exe107⤵PID:4212
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe108⤵PID:3444
-
\??\c:\btthhb.exec:\btthhb.exe109⤵PID:448
-
\??\c:\pvvpj.exec:\pvvpj.exe110⤵PID:3080
-
\??\c:\xrlxrll.exec:\xrlxrll.exe111⤵PID:2408
-
\??\c:\fxfxllr.exec:\fxfxllr.exe112⤵PID:2620
-
\??\c:\bnhnbb.exec:\bnhnbb.exe113⤵PID:2444
-
\??\c:\btthbt.exec:\btthbt.exe114⤵PID:3916
-
\??\c:\djvvp.exec:\djvvp.exe115⤵PID:640
-
\??\c:\vppjv.exec:\vppjv.exe116⤵PID:2860
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe117⤵PID:4080
-
\??\c:\nnbthn.exec:\nnbthn.exe118⤵PID:3616
-
\??\c:\3hnhbh.exec:\3hnhbh.exe119⤵PID:3088
-
\??\c:\djjpj.exec:\djjpj.exe120⤵PID:2856
-
\??\c:\9ppjp.exec:\9ppjp.exe121⤵PID:2816
-
\??\c:\frfxrrl.exec:\frfxrrl.exe122⤵PID:3252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-