Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 22:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61379a9da1e3d60709e4ee8da9016857_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
61379a9da1e3d60709e4ee8da9016857_JaffaCakes118.exe
-
Size
357KB
-
MD5
61379a9da1e3d60709e4ee8da9016857
-
SHA1
c679d21ba054ff0c76fbbf550f7719ebb98fd810
-
SHA256
396855475980ffea73fea4755ea8a3d82b16ba6a2aadd933fee24196def4adf4
-
SHA512
77156f900f17de1f2dcd06df3af667b1bd2d953e0217195fc64bfa47b237b412d94eab9924a1f29999572df6c164f05697971c71d15d5a4d7e79cd468b292a33
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jFX8fkYtB6J6eUTV4aTHDaLB:Pcm7ImGddXtWrXD486jFX88Y/eUBni
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2624-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/656-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-335-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-384-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-386-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-394-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-420-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-448-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3788-578-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-642-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-651-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-661-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-690-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-694-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-761-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-856-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-885-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-1050-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-1373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5hnhnb.exevpvpj.exehntnnt.exepdvvp.exejvdpj.exe1tbtnh.exexfllffl.exehttnhb.exerfffxxx.exe9bhbhh.exe7rrlffx.exe1djdd.exexxfrfrr.exentnhbt.exelrxrxxf.exerlrxrff.exevpvvv.exexxxrlrx.exeppjvp.exebnbhth.exejjpjd.exevvjdp.exelllrxfl.exe7nhnbh.exetbthhb.exedjpdd.exefxxrrxr.exerxxrffx.exebtbttn.exelxllrfr.exejjddj.exerfxrflf.exe1ddpj.exedpvjv.exexxxxrrl.exe7bhbtt.exe5jdvd.exelrxrlfx.exebtbtbt.exejvjdv.exepvddd.exelflfrxr.exe5nbbhb.exehnbbbb.exejvvdv.exeflrxfrx.exenhnnhb.exevdpjd.exexrffxlr.exebnhbnb.exepddvv.exe1vddd.exeffxxfll.exehnbtnn.exejvpdj.exexllfxxr.exetttnbt.exedjjvv.exepdpvv.exerlxrllf.exettbbtt.exejjvpv.exe9lrlffl.exefrrlffr.exepid process 2624 5hnhnb.exe 4956 vpvpj.exe 4428 hntnnt.exe 3496 pdvvp.exe 4064 jvdpj.exe 2792 1tbtnh.exe 1712 xfllffl.exe 4172 httnhb.exe 1908 rfffxxx.exe 2216 9bhbhh.exe 5032 7rrlffx.exe 3844 1djdd.exe 5088 xxfrfrr.exe 2764 ntnhbt.exe 468 lrxrxxf.exe 656 rlrxrff.exe 2384 vpvvv.exe 3052 xxxrlrx.exe 2188 ppjvp.exe 2944 bnbhth.exe 3880 jjpjd.exe 4636 vvjdp.exe 1848 lllrxfl.exe 3464 7nhnbh.exe 3092 tbthhb.exe 3980 djpdd.exe 2892 fxxrrxr.exe 2616 rxxrffx.exe 3976 btbttn.exe 1304 lxllrfr.exe 1464 jjddj.exe 1844 rfxrflf.exe 2100 1ddpj.exe 400 dpvjv.exe 232 xxxxrrl.exe 2168 7bhbtt.exe 4316 5jdvd.exe 4388 lrxrlfx.exe 2388 btbtbt.exe 2624 jvjdv.exe 2232 pvddd.exe 860 lflfrxr.exe 2888 5nbbhb.exe 4516 hnbbbb.exe 4088 jvvdv.exe 1312 flrxfrx.exe 1680 nhnnhb.exe 4472 vdpjd.exe 1800 xrffxlr.exe 2024 bnhbnb.exe 1908 pddvv.exe 376 1vddd.exe 2216 ffxxfll.exe 2240 hnbtnn.exe 5012 jvpdj.exe 516 xllfxxr.exe 3972 tttnbt.exe 4740 djjvv.exe 5096 pdpvv.exe 3924 rlxrllf.exe 4432 ttbbtt.exe 656 jjvpv.exe 1984 9lrlffl.exe 1284 frrlffr.exe -
Processes:
resource yara_rule behavioral2/memory/2624-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1848-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-305-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-323-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-335-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-386-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-389-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-394-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-404-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-408-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-420-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-448-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/708-472-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
61379a9da1e3d60709e4ee8da9016857_JaffaCakes118.exe5hnhnb.exevpvpj.exehntnnt.exepdvvp.exejvdpj.exe1tbtnh.exexfllffl.exehttnhb.exerfffxxx.exe9bhbhh.exe7rrlffx.exe1djdd.exexxfrfrr.exentnhbt.exelrxrxxf.exerlrxrff.exevpvvv.exexxxrlrx.exeppjvp.exebnbhth.exejjpjd.exedescription pid process target process PID 1588 wrote to memory of 2624 1588 61379a9da1e3d60709e4ee8da9016857_JaffaCakes118.exe 5hnhnb.exe PID 1588 wrote to memory of 2624 1588 61379a9da1e3d60709e4ee8da9016857_JaffaCakes118.exe 5hnhnb.exe PID 1588 wrote to memory of 2624 1588 61379a9da1e3d60709e4ee8da9016857_JaffaCakes118.exe 5hnhnb.exe PID 2624 wrote to memory of 4956 2624 5hnhnb.exe vpvpj.exe PID 2624 wrote to memory of 4956 2624 5hnhnb.exe vpvpj.exe PID 2624 wrote to memory of 4956 2624 5hnhnb.exe vpvpj.exe PID 4956 wrote to memory of 4428 4956 vpvpj.exe hntnnt.exe PID 4956 wrote to memory of 4428 4956 vpvpj.exe hntnnt.exe PID 4956 wrote to memory of 4428 4956 vpvpj.exe hntnnt.exe PID 4428 wrote to memory of 3496 4428 hntnnt.exe pdvvp.exe PID 4428 wrote to memory of 3496 4428 hntnnt.exe pdvvp.exe PID 4428 wrote to memory of 3496 4428 hntnnt.exe pdvvp.exe PID 3496 wrote to memory of 4064 3496 pdvvp.exe jvdpj.exe PID 3496 wrote to memory of 4064 3496 pdvvp.exe jvdpj.exe PID 3496 wrote to memory of 4064 3496 pdvvp.exe jvdpj.exe PID 4064 wrote to memory of 2792 4064 jvdpj.exe 1tbtnh.exe PID 4064 wrote to memory of 2792 4064 jvdpj.exe 1tbtnh.exe PID 4064 wrote to memory of 2792 4064 jvdpj.exe 1tbtnh.exe PID 2792 wrote to memory of 1712 2792 1tbtnh.exe xfllffl.exe PID 2792 wrote to memory of 1712 2792 1tbtnh.exe xfllffl.exe PID 2792 wrote to memory of 1712 2792 1tbtnh.exe xfllffl.exe PID 1712 wrote to memory of 4172 1712 xfllffl.exe httnhb.exe PID 1712 wrote to memory of 4172 1712 xfllffl.exe httnhb.exe PID 1712 wrote to memory of 4172 1712 xfllffl.exe httnhb.exe PID 4172 wrote to memory of 1908 4172 httnhb.exe rfffxxx.exe PID 4172 wrote to memory of 1908 4172 httnhb.exe rfffxxx.exe PID 4172 wrote to memory of 1908 4172 httnhb.exe rfffxxx.exe PID 1908 wrote to memory of 2216 1908 rfffxxx.exe 9bhbhh.exe PID 1908 wrote to memory of 2216 1908 rfffxxx.exe 9bhbhh.exe PID 1908 wrote to memory of 2216 1908 rfffxxx.exe 9bhbhh.exe PID 2216 wrote to memory of 5032 2216 9bhbhh.exe 7rrlffx.exe PID 2216 wrote to memory of 5032 2216 9bhbhh.exe 7rrlffx.exe PID 2216 wrote to memory of 5032 2216 9bhbhh.exe 7rrlffx.exe PID 5032 wrote to memory of 3844 5032 7rrlffx.exe 1djdd.exe PID 5032 wrote to memory of 3844 5032 7rrlffx.exe 1djdd.exe PID 5032 wrote to memory of 3844 5032 7rrlffx.exe 1djdd.exe PID 3844 wrote to memory of 5088 3844 1djdd.exe xxfrfrr.exe PID 3844 wrote to memory of 5088 3844 1djdd.exe xxfrfrr.exe PID 3844 wrote to memory of 5088 3844 1djdd.exe xxfrfrr.exe PID 5088 wrote to memory of 2764 5088 xxfrfrr.exe ntnhbt.exe PID 5088 wrote to memory of 2764 5088 xxfrfrr.exe ntnhbt.exe PID 5088 wrote to memory of 2764 5088 xxfrfrr.exe ntnhbt.exe PID 2764 wrote to memory of 468 2764 ntnhbt.exe lrxrxxf.exe PID 2764 wrote to memory of 468 2764 ntnhbt.exe lrxrxxf.exe PID 2764 wrote to memory of 468 2764 ntnhbt.exe lrxrxxf.exe PID 468 wrote to memory of 656 468 lrxrxxf.exe rlrxrff.exe PID 468 wrote to memory of 656 468 lrxrxxf.exe rlrxrff.exe PID 468 wrote to memory of 656 468 lrxrxxf.exe rlrxrff.exe PID 656 wrote to memory of 2384 656 rlrxrff.exe vpvvv.exe PID 656 wrote to memory of 2384 656 rlrxrff.exe vpvvv.exe PID 656 wrote to memory of 2384 656 rlrxrff.exe vpvvv.exe PID 2384 wrote to memory of 3052 2384 vpvvv.exe xxxrlrx.exe PID 2384 wrote to memory of 3052 2384 vpvvv.exe xxxrlrx.exe PID 2384 wrote to memory of 3052 2384 vpvvv.exe xxxrlrx.exe PID 3052 wrote to memory of 2188 3052 xxxrlrx.exe ppjvp.exe PID 3052 wrote to memory of 2188 3052 xxxrlrx.exe ppjvp.exe PID 3052 wrote to memory of 2188 3052 xxxrlrx.exe ppjvp.exe PID 2188 wrote to memory of 2944 2188 ppjvp.exe bnbhth.exe PID 2188 wrote to memory of 2944 2188 ppjvp.exe bnbhth.exe PID 2188 wrote to memory of 2944 2188 ppjvp.exe bnbhth.exe PID 2944 wrote to memory of 3880 2944 bnbhth.exe jjpjd.exe PID 2944 wrote to memory of 3880 2944 bnbhth.exe jjpjd.exe PID 2944 wrote to memory of 3880 2944 bnbhth.exe jjpjd.exe PID 3880 wrote to memory of 4636 3880 jjpjd.exe vvjdp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61379a9da1e3d60709e4ee8da9016857_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\61379a9da1e3d60709e4ee8da9016857_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\5hnhnb.exec:\5hnhnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\vpvpj.exec:\vpvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\hntnnt.exec:\hntnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\pdvvp.exec:\pdvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\jvdpj.exec:\jvdpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\1tbtnh.exec:\1tbtnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\xfllffl.exec:\xfllffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\httnhb.exec:\httnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\rfffxxx.exec:\rfffxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\9bhbhh.exec:\9bhbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\7rrlffx.exec:\7rrlffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\1djdd.exec:\1djdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\xxfrfrr.exec:\xxfrfrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\ntnhbt.exec:\ntnhbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\lrxrxxf.exec:\lrxrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\rlrxrff.exec:\rlrxrff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\vpvvv.exec:\vpvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\xxxrlrx.exec:\xxxrlrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\ppjvp.exec:\ppjvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\bnbhth.exec:\bnbhth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\jjpjd.exec:\jjpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\vvjdp.exec:\vvjdp.exe23⤵
- Executes dropped EXE
PID:4636 -
\??\c:\lllrxfl.exec:\lllrxfl.exe24⤵
- Executes dropped EXE
PID:1848 -
\??\c:\7nhnbh.exec:\7nhnbh.exe25⤵
- Executes dropped EXE
PID:3464 -
\??\c:\tbthhb.exec:\tbthhb.exe26⤵
- Executes dropped EXE
PID:3092 -
\??\c:\djpdd.exec:\djpdd.exe27⤵
- Executes dropped EXE
PID:3980 -
\??\c:\fxxrrxr.exec:\fxxrrxr.exe28⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rxxrffx.exec:\rxxrffx.exe29⤵
- Executes dropped EXE
PID:2616 -
\??\c:\btbttn.exec:\btbttn.exe30⤵
- Executes dropped EXE
PID:3976 -
\??\c:\lxllrfr.exec:\lxllrfr.exe31⤵
- Executes dropped EXE
PID:1304 -
\??\c:\jjddj.exec:\jjddj.exe32⤵
- Executes dropped EXE
PID:1464 -
\??\c:\rfxrflf.exec:\rfxrflf.exe33⤵
- Executes dropped EXE
PID:1844 -
\??\c:\1ddpj.exec:\1ddpj.exe34⤵
- Executes dropped EXE
PID:2100 -
\??\c:\dpvjv.exec:\dpvjv.exe35⤵
- Executes dropped EXE
PID:400 -
\??\c:\xxxxrrl.exec:\xxxxrrl.exe36⤵
- Executes dropped EXE
PID:232 -
\??\c:\7bhbtt.exec:\7bhbtt.exe37⤵
- Executes dropped EXE
PID:2168 -
\??\c:\5jdvd.exec:\5jdvd.exe38⤵
- Executes dropped EXE
PID:4316 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe39⤵
- Executes dropped EXE
PID:4388 -
\??\c:\btbtbt.exec:\btbtbt.exe40⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jvjdv.exec:\jvjdv.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pvddd.exec:\pvddd.exe42⤵
- Executes dropped EXE
PID:2232 -
\??\c:\lflfrxr.exec:\lflfrxr.exe43⤵
- Executes dropped EXE
PID:860 -
\??\c:\5nbbhb.exec:\5nbbhb.exe44⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hnbbbb.exec:\hnbbbb.exe45⤵
- Executes dropped EXE
PID:4516 -
\??\c:\jvvdv.exec:\jvvdv.exe46⤵
- Executes dropped EXE
PID:4088 -
\??\c:\flrxfrx.exec:\flrxfrx.exe47⤵
- Executes dropped EXE
PID:1312 -
\??\c:\nhnnhb.exec:\nhnnhb.exe48⤵
- Executes dropped EXE
PID:1680 -
\??\c:\vdpjd.exec:\vdpjd.exe49⤵
- Executes dropped EXE
PID:4472 -
\??\c:\xrffxlr.exec:\xrffxlr.exe50⤵
- Executes dropped EXE
PID:1800 -
\??\c:\bnhbnb.exec:\bnhbnb.exe51⤵
- Executes dropped EXE
PID:2024 -
\??\c:\pddvv.exec:\pddvv.exe52⤵
- Executes dropped EXE
PID:1908 -
\??\c:\1vddd.exec:\1vddd.exe53⤵
- Executes dropped EXE
PID:376 -
\??\c:\ffxxfll.exec:\ffxxfll.exe54⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hnbtnn.exec:\hnbtnn.exe55⤵
- Executes dropped EXE
PID:2240 -
\??\c:\jvpdj.exec:\jvpdj.exe56⤵
- Executes dropped EXE
PID:5012 -
\??\c:\xllfxxr.exec:\xllfxxr.exe57⤵
- Executes dropped EXE
PID:516 -
\??\c:\tttnbt.exec:\tttnbt.exe58⤵
- Executes dropped EXE
PID:3972 -
\??\c:\djjvv.exec:\djjvv.exe59⤵
- Executes dropped EXE
PID:4740 -
\??\c:\pdpvv.exec:\pdpvv.exe60⤵
- Executes dropped EXE
PID:5096 -
\??\c:\rlxrllf.exec:\rlxrllf.exe61⤵
- Executes dropped EXE
PID:3924 -
\??\c:\ttbbtt.exec:\ttbbtt.exe62⤵
- Executes dropped EXE
PID:4432 -
\??\c:\jjvpv.exec:\jjvpv.exe63⤵
- Executes dropped EXE
PID:656 -
\??\c:\9lrlffl.exec:\9lrlffl.exe64⤵
- Executes dropped EXE
PID:1984 -
\??\c:\frrlffr.exec:\frrlffr.exe65⤵
- Executes dropped EXE
PID:1284 -
\??\c:\vpjdv.exec:\vpjdv.exe66⤵PID:2316
-
\??\c:\frxlrrr.exec:\frxlrrr.exe67⤵PID:1120
-
\??\c:\btthbn.exec:\btthbn.exe68⤵PID:2944
-
\??\c:\5nttbb.exec:\5nttbb.exe69⤵PID:1720
-
\??\c:\jvpjv.exec:\jvpjv.exe70⤵PID:4056
-
\??\c:\jdpjd.exec:\jdpjd.exe71⤵PID:1988
-
\??\c:\9rxxxff.exec:\9rxxxff.exe72⤵PID:4212
-
\??\c:\nttbhh.exec:\nttbhh.exe73⤵PID:3604
-
\??\c:\jdjdd.exec:\jdjdd.exe74⤵PID:1552
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe75⤵PID:4180
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe76⤵PID:4244
-
\??\c:\tnnhhb.exec:\tnnhhb.exe77⤵PID:3456
-
\??\c:\jjppv.exec:\jjppv.exe78⤵PID:1196
-
\??\c:\vdjdj.exec:\vdjdj.exe79⤵PID:2616
-
\??\c:\fffxxxx.exec:\fffxxxx.exe80⤵PID:3976
-
\??\c:\hthbhn.exec:\hthbhn.exe81⤵PID:1652
-
\??\c:\vpdjj.exec:\vpdjj.exe82⤵PID:1304
-
\??\c:\lfffxlx.exec:\lfffxlx.exe83⤵PID:4452
-
\??\c:\ntbttb.exec:\ntbttb.exe84⤵PID:1596
-
\??\c:\jjvdp.exec:\jjvdp.exe85⤵PID:1732
-
\??\c:\3vvjj.exec:\3vvjj.exe86⤵PID:5100
-
\??\c:\llrrlfx.exec:\llrrlfx.exe87⤵PID:744
-
\??\c:\fxffllr.exec:\fxffllr.exe88⤵PID:4320
-
\??\c:\tttbnt.exec:\tttbnt.exe89⤵PID:4316
-
\??\c:\jddvv.exec:\jddvv.exe90⤵PID:2096
-
\??\c:\jjddd.exec:\jjddd.exe91⤵PID:4428
-
\??\c:\rrrrlxx.exec:\rrrrlxx.exe92⤵PID:4376
-
\??\c:\ttbbbb.exec:\ttbbbb.exe93⤵PID:3692
-
\??\c:\hthtbt.exec:\hthtbt.exe94⤵PID:4064
-
\??\c:\fxffxxx.exec:\fxffxxx.exe95⤵PID:2792
-
\??\c:\bnbtnn.exec:\bnbtnn.exe96⤵PID:1012
-
\??\c:\9tttnt.exec:\9tttnt.exe97⤵PID:1432
-
\??\c:\ppddj.exec:\ppddj.exe98⤵PID:4564
-
\??\c:\lfrrlrr.exec:\lfrrlrr.exe99⤵PID:4504
-
\??\c:\3nnbth.exec:\3nnbth.exe100⤵PID:4112
-
\??\c:\jdpjd.exec:\jdpjd.exe101⤵PID:376
-
\??\c:\jdvvp.exec:\jdvvp.exe102⤵PID:3920
-
\??\c:\7xffxxf.exec:\7xffxxf.exe103⤵PID:4960
-
\??\c:\hnnnhn.exec:\hnnnhn.exe104⤵PID:4016
-
\??\c:\bnhhth.exec:\bnhhth.exe105⤵PID:5088
-
\??\c:\ppjdd.exec:\ppjdd.exe106⤵PID:3552
-
\??\c:\lxlfxfx.exec:\lxlfxfx.exe107⤵PID:4544
-
\??\c:\rllllll.exec:\rllllll.exe108⤵PID:468
-
\??\c:\btbbtb.exec:\btbbtb.exe109⤵PID:4528
-
\??\c:\9djvp.exec:\9djvp.exe110⤵PID:2584
-
\??\c:\jdvvd.exec:\jdvvd.exe111⤵PID:3492
-
\??\c:\fxffxxx.exec:\fxffxxx.exe112⤵PID:3800
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe113⤵PID:3852
-
\??\c:\hnbbnn.exec:\hnbbnn.exe114⤵PID:1704
-
\??\c:\vpddp.exec:\vpddp.exe115⤵PID:5064
-
\??\c:\rrffflr.exec:\rrffflr.exe116⤵PID:708
-
\??\c:\tnbbhn.exec:\tnbbhn.exe117⤵PID:4636
-
\??\c:\flrlfff.exec:\flrlfff.exe118⤵PID:2032
-
\??\c:\ffllllr.exec:\ffllllr.exe119⤵PID:3944
-
\??\c:\nthhbh.exec:\nthhbh.exe120⤵PID:5084
-
\??\c:\bhnnnt.exec:\bhnnnt.exe121⤵PID:872
-
\??\c:\vjdvp.exec:\vjdvp.exe122⤵PID:2180
-
\??\c:\llxffrr.exec:\llxffrr.exe123⤵PID:4288
-
\??\c:\7rxrrrr.exec:\7rxrrrr.exe124⤵PID:3488
-
\??\c:\1nnhhn.exec:\1nnhhn.exe125⤵PID:4344
-
\??\c:\jvjpv.exec:\jvjpv.exe126⤵PID:4444
-
\??\c:\llfxrrr.exec:\llfxrrr.exe127⤵PID:4456
-
\??\c:\7lrxxff.exec:\7lrxxff.exe128⤵PID:3976
-
\??\c:\bthhhh.exec:\bthhhh.exe129⤵PID:1652
-
\??\c:\nnbbbb.exec:\nnbbbb.exe130⤵PID:1464
-
\??\c:\pjppp.exec:\pjppp.exe131⤵PID:1420
-
\??\c:\3flllrl.exec:\3flllrl.exe132⤵PID:4392
-
\??\c:\5xffxll.exec:\5xffxll.exe133⤵PID:232
-
\??\c:\bbhhbb.exec:\bbhhbb.exe134⤵PID:3380
-
\??\c:\pdvpd.exec:\pdvpd.exe135⤵PID:4388
-
\??\c:\pdvdd.exec:\pdvdd.exe136⤵PID:3560
-
\??\c:\fffxxxx.exec:\fffxxxx.exe137⤵PID:4560
-
\??\c:\5nhbbh.exec:\5nhbbh.exe138⤵PID:3252
-
\??\c:\pvddv.exec:\pvddv.exe139⤵PID:4876
-
\??\c:\9vjjd.exec:\9vjjd.exe140⤵PID:4472
-
\??\c:\5ffflrr.exec:\5ffflrr.exe141⤵PID:1800
-
\??\c:\btbtbb.exec:\btbtbb.exe142⤵PID:3296
-
\??\c:\tnttnb.exec:\tnttnb.exe143⤵PID:1908
-
\??\c:\dvjdd.exec:\dvjdd.exe144⤵PID:3328
-
\??\c:\xxxrlll.exec:\xxxrlll.exe145⤵PID:2320
-
\??\c:\7nhhhn.exec:\7nhhhn.exe146⤵PID:2176
-
\??\c:\ttthth.exec:\ttthth.exe147⤵PID:3644
-
\??\c:\djddj.exec:\djddj.exe148⤵PID:4736
-
\??\c:\lflllff.exec:\lflllff.exe149⤵PID:2976
-
\??\c:\fxlffff.exec:\fxlffff.exe150⤵PID:3788
-
\??\c:\pjddj.exec:\pjddj.exe151⤵PID:4312
-
\??\c:\vjvdj.exec:\vjvdj.exe152⤵PID:3924
-
\??\c:\xxrlffx.exec:\xxrlffx.exe153⤵PID:3668
-
\??\c:\tnbtnn.exec:\tnbtnn.exe154⤵PID:1984
-
\??\c:\hhhnbb.exec:\hhhnbb.exe155⤵PID:1284
-
\??\c:\ddjpp.exec:\ddjpp.exe156⤵PID:2680
-
\??\c:\rlffflx.exec:\rlffflx.exe157⤵PID:2516
-
\??\c:\fllfffx.exec:\fllfffx.exe158⤵PID:4936
-
\??\c:\hbnhnn.exec:\hbnhnn.exe159⤵PID:2504
-
\??\c:\ddvdd.exec:\ddvdd.exe160⤵PID:4732
-
\??\c:\ddjjj.exec:\ddjjj.exe161⤵PID:4056
-
\??\c:\9xllllr.exec:\9xllllr.exe162⤵PID:4264
-
\??\c:\nbhhhh.exec:\nbhhhh.exe163⤵PID:4276
-
\??\c:\ttbbbh.exec:\ttbbbh.exe164⤵PID:1568
-
\??\c:\ppppj.exec:\ppppj.exe165⤵PID:4200
-
\??\c:\fxffxxx.exec:\fxffxxx.exe166⤵PID:1796
-
\??\c:\ffflrrr.exec:\ffflrrr.exe167⤵PID:3812
-
\??\c:\bhtbbh.exec:\bhtbbh.exe168⤵PID:4424
-
\??\c:\nhtnnn.exec:\nhtnnn.exe169⤵PID:2548
-
\??\c:\dddvp.exec:\dddvp.exe170⤵PID:4764
-
\??\c:\xlxxxff.exec:\xlxxxff.exe171⤵PID:2724
-
\??\c:\lfffxxx.exec:\lfffxxx.exe172⤵PID:4452
-
\??\c:\bbhnhn.exec:\bbhnhn.exe173⤵PID:1464
-
\??\c:\vvvvp.exec:\vvvvp.exe174⤵PID:2296
-
\??\c:\lfllfff.exec:\lfllfff.exe175⤵PID:2848
-
\??\c:\nbhntn.exec:\nbhntn.exe176⤵PID:64
-
\??\c:\jdpjp.exec:\jdpjp.exe177⤵PID:4956
-
\??\c:\djpjj.exec:\djpjj.exe178⤵PID:1212
-
\??\c:\llrrrxx.exec:\llrrrxx.exe179⤵PID:1604
-
\??\c:\thhhhn.exec:\thhhhn.exe180⤵PID:4816
-
\??\c:\thhhhn.exec:\thhhhn.exe181⤵PID:3252
-
\??\c:\vvppj.exec:\vvppj.exe182⤵PID:828
-
\??\c:\rlrlfff.exec:\rlrlfff.exe183⤵PID:4472
-
\??\c:\xxlxxxx.exec:\xxlxxxx.exe184⤵PID:1800
-
\??\c:\bthhnt.exec:\bthhnt.exe185⤵PID:3296
-
\??\c:\vjdjd.exec:\vjdjd.exe186⤵PID:2400
-
\??\c:\fflflfl.exec:\fflflfl.exe187⤵PID:3844
-
\??\c:\nnhhbh.exec:\nnhhbh.exe188⤵PID:3672
-
\??\c:\ddppv.exec:\ddppv.exe189⤵PID:4016
-
\??\c:\vpvvv.exec:\vpvvv.exe190⤵PID:5088
-
\??\c:\xrffxxr.exec:\xrffxxr.exe191⤵PID:3148
-
\??\c:\hbhbbh.exec:\hbhbbh.exe192⤵PID:4964
-
\??\c:\1hnnnn.exec:\1hnnnn.exe193⤵PID:1316
-
\??\c:\ddpjj.exec:\ddpjj.exe194⤵PID:1588
-
\??\c:\pjvpp.exec:\pjvpp.exe195⤵PID:1676
-
\??\c:\lxfxlll.exec:\lxfxlll.exe196⤵PID:468
-
\??\c:\nbhbbb.exec:\nbhbbb.exe197⤵PID:2584
-
\??\c:\nbhhbb.exec:\nbhhbb.exe198⤵PID:3448
-
\??\c:\ddjjd.exec:\ddjjd.exe199⤵PID:2188
-
\??\c:\7pvjd.exec:\7pvjd.exe200⤵PID:4400
-
\??\c:\3rrlxxr.exec:\3rrlxxr.exe201⤵PID:1704
-
\??\c:\xrrxrrx.exec:\xrrxrrx.exe202⤵PID:4552
-
\??\c:\hhthbn.exec:\hhthbn.exe203⤵PID:1720
-
\??\c:\vvpjd.exec:\vvpjd.exe204⤵PID:1820
-
\??\c:\xxlffff.exec:\xxlffff.exe205⤵PID:4212
-
\??\c:\rllxrrl.exec:\rllxrrl.exe206⤵PID:3052
-
\??\c:\tntbtb.exec:\tntbtb.exe207⤵PID:3944
-
\??\c:\vppjd.exec:\vppjd.exe208⤵PID:5084
-
\??\c:\rrffrlx.exec:\rrffrlx.exe209⤵PID:2180
-
\??\c:\1rrllfx.exec:\1rrllfx.exe210⤵PID:456
-
\??\c:\3bbttt.exec:\3bbttt.exe211⤵PID:4336
-
\??\c:\vppdp.exec:\vppdp.exe212⤵PID:5116
-
\??\c:\pdjdv.exec:\pdjdv.exe213⤵PID:3992
-
\??\c:\xfllxxr.exec:\xfllxxr.exe214⤵PID:1532
-
\??\c:\xllfxrl.exec:\xllfxrl.exe215⤵PID:392
-
\??\c:\hbbtnn.exec:\hbbtnn.exe216⤵PID:4668
-
\??\c:\7jdvp.exec:\7jdvp.exe217⤵PID:1652
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe218⤵PID:2544
-
\??\c:\xlffxfx.exec:\xlffxfx.exe219⤵PID:4392
-
\??\c:\5bhbtt.exec:\5bhbtt.exe220⤵PID:232
-
\??\c:\tbnhhb.exec:\tbnhhb.exe221⤵PID:3380
-
\??\c:\jvpjd.exec:\jvpjd.exe222⤵PID:4388
-
\??\c:\1xfrlxr.exec:\1xfrlxr.exe223⤵PID:5012
-
\??\c:\xrrfrlx.exec:\xrrfrlx.exe224⤵PID:472
-
\??\c:\hbhbhb.exec:\hbhbhb.exe225⤵PID:4652
-
\??\c:\9vvpj.exec:\9vvpj.exe226⤵PID:4876
-
\??\c:\ddvpp.exec:\ddvpp.exe227⤵PID:3252
-
\??\c:\xxrlllf.exec:\xxrlllf.exe228⤵PID:4172
-
\??\c:\bhhhbh.exec:\bhhhbh.exe229⤵PID:3900
-
\??\c:\jpjjj.exec:\jpjjj.exe230⤵PID:2756
-
\??\c:\jppjd.exec:\jppjd.exe231⤵PID:4960
-
\??\c:\rrxrxxx.exec:\rrxrxxx.exe232⤵PID:4576
-
\??\c:\tbnhth.exec:\tbnhth.exe233⤵PID:2500
-
\??\c:\tbbttt.exec:\tbbttt.exe234⤵PID:2764
-
\??\c:\dvddd.exec:\dvddd.exe235⤵PID:4008
-
\??\c:\lrrfxfl.exec:\lrrfxfl.exe236⤵PID:1528
-
\??\c:\xfxxxxf.exec:\xfxxxxf.exe237⤵PID:4544
-
\??\c:\nbttnb.exec:\nbttnb.exe238⤵PID:3740
-
\??\c:\pjjvj.exec:\pjjvj.exe239⤵PID:4852
-
\??\c:\fxxrllf.exec:\fxxrllf.exe240⤵PID:3924
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe241⤵PID:3668
-
\??\c:\bthhtt.exec:\bthhtt.exe242⤵PID:404