Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 19:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
60dcae1fae996736f647fa8280065e65_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
60dcae1fae996736f647fa8280065e65_JaffaCakes118.exe
-
Size
386KB
-
MD5
60dcae1fae996736f647fa8280065e65
-
SHA1
7aeb8ff842ff4b1fb8c609b495dbd7a0966aabd3
-
SHA256
bb683d400ba7da06fea8265438f9f2da38cb60c2c5d1dfe0ecf7243ac58a7068
-
SHA512
5f1002a3b4a34033f07b442ada15b693ae142227ad3a3fd8e9ecc82bce45455c06284cf6e3968b8af1a577716c75748e7e299c51e3ce9f939c61c5c8348acffa
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFw8TCvtcM72o+:8cm7ImGddXmNt251UriZFwGCvVQ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4816-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1508-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/704-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/648-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-750-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-845-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-895-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2116-911-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-1106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lffxrll.exe5htntb.exellxlrfr.exe7htbhb.exellfxlll.exenhnnhb.exefflfffx.exetbnnhh.exepjjdj.exebtttht.exelrxrrll.exetbbtnn.exedjvpp.exe1frlflf.exexrxrllr.exebntnht.exejvddv.exelrxxxxx.exehbnnht.exefflfxxr.exetbhbtt.exepdjjd.exerxxrllf.exebbhnhh.exejvvpp.exerlxxfff.exe7dddv.exerxxxrrl.exefxfxxrl.exebnbtnn.exehbhhbt.exerfffxrl.exejvddd.exennhbnb.exehttnhh.exejjjvj.exellllffl.exetthhbt.exeddpjp.exejdjjv.exexffxrlf.exehttnht.exe5dpjp.exerxfllfx.exexlfxrrl.exehttnhb.exeflllffr.exenthhhh.exe7djjd.exe7frlxxx.exehthhbb.exejdjdj.exerrxrrrr.exe3bbbnn.exepjvvp.exelllfxxr.exebbbhnb.exedjjvj.exellxlxfl.exenbhbtn.exeppvvp.exebthnbh.exeppvpj.exefflfxrl.exepid process 452 lffxrll.exe 3000 5htntb.exe 3616 llxlrfr.exe 4372 7htbhb.exe 1492 llfxlll.exe 628 nhnnhb.exe 1508 fflfffx.exe 3164 tbnnhh.exe 548 pjjdj.exe 4124 btttht.exe 3096 lrxrrll.exe 3064 tbbtnn.exe 3160 djvpp.exe 2204 1frlflf.exe 2260 xrxrllr.exe 1192 bntnht.exe 1892 jvddv.exe 1072 lrxxxxx.exe 1804 hbnnht.exe 1564 fflfxxr.exe 3696 tbhbtt.exe 5116 pdjjd.exe 1288 rxxrllf.exe 5056 bbhnhh.exe 4976 jvvpp.exe 4560 rlxxfff.exe 4856 7dddv.exe 3656 rxxxrrl.exe 2256 fxfxxrl.exe 1116 bnbtnn.exe 3204 hbhhbt.exe 1796 rfffxrl.exe 5028 jvddd.exe 2560 nnhbnb.exe 2876 httnhh.exe 392 jjjvj.exe 2140 llllffl.exe 3768 tthhbt.exe 2208 ddpjp.exe 3516 jdjjv.exe 1172 xffxrlf.exe 4868 httnht.exe 1468 5dpjp.exe 1220 rxfllfx.exe 4928 xlfxrrl.exe 4748 httnhb.exe 4948 flllffr.exe 4340 nthhhh.exe 640 7djjd.exe 4516 7frlxxx.exe 3760 hthhbb.exe 3616 jdjdj.exe 3444 rrxrrrr.exe 1492 3bbbnn.exe 4200 pjvvp.exe 2528 lllfxxr.exe 32 bbbhnb.exe 852 djjvj.exe 4652 llxlxfl.exe 3968 nbhbtn.exe 1040 ppvvp.exe 3136 bthnbh.exe 2680 ppvpj.exe 3064 fflfxrl.exe -
Processes:
resource yara_rule behavioral2/memory/4816-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/704-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-516-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
60dcae1fae996736f647fa8280065e65_JaffaCakes118.exelffxrll.exe5htntb.exellxlrfr.exe7htbhb.exellfxlll.exenhnnhb.exefflfffx.exetbnnhh.exepjjdj.exebtttht.exelrxrrll.exetbbtnn.exedjvpp.exe1frlflf.exexrxrllr.exebntnht.exejvddv.exelrxxxxx.exehbnnht.exefflfxxr.exetbhbtt.exedescription pid process target process PID 4816 wrote to memory of 452 4816 60dcae1fae996736f647fa8280065e65_JaffaCakes118.exe lffxrll.exe PID 4816 wrote to memory of 452 4816 60dcae1fae996736f647fa8280065e65_JaffaCakes118.exe lffxrll.exe PID 4816 wrote to memory of 452 4816 60dcae1fae996736f647fa8280065e65_JaffaCakes118.exe lffxrll.exe PID 452 wrote to memory of 3000 452 lffxrll.exe 5htntb.exe PID 452 wrote to memory of 3000 452 lffxrll.exe 5htntb.exe PID 452 wrote to memory of 3000 452 lffxrll.exe 5htntb.exe PID 3000 wrote to memory of 3616 3000 5htntb.exe llxlrfr.exe PID 3000 wrote to memory of 3616 3000 5htntb.exe llxlrfr.exe PID 3000 wrote to memory of 3616 3000 5htntb.exe llxlrfr.exe PID 3616 wrote to memory of 4372 3616 llxlrfr.exe 7htbhb.exe PID 3616 wrote to memory of 4372 3616 llxlrfr.exe 7htbhb.exe PID 3616 wrote to memory of 4372 3616 llxlrfr.exe 7htbhb.exe PID 4372 wrote to memory of 1492 4372 7htbhb.exe llfxlll.exe PID 4372 wrote to memory of 1492 4372 7htbhb.exe llfxlll.exe PID 4372 wrote to memory of 1492 4372 7htbhb.exe llfxlll.exe PID 1492 wrote to memory of 628 1492 llfxlll.exe nhnnhb.exe PID 1492 wrote to memory of 628 1492 llfxlll.exe nhnnhb.exe PID 1492 wrote to memory of 628 1492 llfxlll.exe nhnnhb.exe PID 628 wrote to memory of 1508 628 nhnnhb.exe fflfffx.exe PID 628 wrote to memory of 1508 628 nhnnhb.exe fflfffx.exe PID 628 wrote to memory of 1508 628 nhnnhb.exe fflfffx.exe PID 1508 wrote to memory of 3164 1508 fflfffx.exe tbnnhh.exe PID 1508 wrote to memory of 3164 1508 fflfffx.exe tbnnhh.exe PID 1508 wrote to memory of 3164 1508 fflfffx.exe tbnnhh.exe PID 3164 wrote to memory of 548 3164 tbnnhh.exe pjjdj.exe PID 3164 wrote to memory of 548 3164 tbnnhh.exe pjjdj.exe PID 3164 wrote to memory of 548 3164 tbnnhh.exe pjjdj.exe PID 548 wrote to memory of 4124 548 pjjdj.exe btttht.exe PID 548 wrote to memory of 4124 548 pjjdj.exe btttht.exe PID 548 wrote to memory of 4124 548 pjjdj.exe btttht.exe PID 4124 wrote to memory of 3096 4124 btttht.exe lrxrrll.exe PID 4124 wrote to memory of 3096 4124 btttht.exe lrxrrll.exe PID 4124 wrote to memory of 3096 4124 btttht.exe lrxrrll.exe PID 3096 wrote to memory of 3064 3096 lrxrrll.exe tbbtnn.exe PID 3096 wrote to memory of 3064 3096 lrxrrll.exe tbbtnn.exe PID 3096 wrote to memory of 3064 3096 lrxrrll.exe tbbtnn.exe PID 3064 wrote to memory of 3160 3064 tbbtnn.exe djvpp.exe PID 3064 wrote to memory of 3160 3064 tbbtnn.exe djvpp.exe PID 3064 wrote to memory of 3160 3064 tbbtnn.exe djvpp.exe PID 3160 wrote to memory of 2204 3160 djvpp.exe 1frlflf.exe PID 3160 wrote to memory of 2204 3160 djvpp.exe 1frlflf.exe PID 3160 wrote to memory of 2204 3160 djvpp.exe 1frlflf.exe PID 2204 wrote to memory of 2260 2204 1frlflf.exe xrxrllr.exe PID 2204 wrote to memory of 2260 2204 1frlflf.exe xrxrllr.exe PID 2204 wrote to memory of 2260 2204 1frlflf.exe xrxrllr.exe PID 2260 wrote to memory of 1192 2260 xrxrllr.exe bntnht.exe PID 2260 wrote to memory of 1192 2260 xrxrllr.exe bntnht.exe PID 2260 wrote to memory of 1192 2260 xrxrllr.exe bntnht.exe PID 1192 wrote to memory of 1892 1192 bntnht.exe jvddv.exe PID 1192 wrote to memory of 1892 1192 bntnht.exe jvddv.exe PID 1192 wrote to memory of 1892 1192 bntnht.exe jvddv.exe PID 1892 wrote to memory of 1072 1892 jvddv.exe lrxxxxx.exe PID 1892 wrote to memory of 1072 1892 jvddv.exe lrxxxxx.exe PID 1892 wrote to memory of 1072 1892 jvddv.exe lrxxxxx.exe PID 1072 wrote to memory of 1804 1072 lrxxxxx.exe hbnnht.exe PID 1072 wrote to memory of 1804 1072 lrxxxxx.exe hbnnht.exe PID 1072 wrote to memory of 1804 1072 lrxxxxx.exe hbnnht.exe PID 1804 wrote to memory of 1564 1804 hbnnht.exe fflfxxr.exe PID 1804 wrote to memory of 1564 1804 hbnnht.exe fflfxxr.exe PID 1804 wrote to memory of 1564 1804 hbnnht.exe fflfxxr.exe PID 1564 wrote to memory of 3696 1564 fflfxxr.exe tbhbtt.exe PID 1564 wrote to memory of 3696 1564 fflfxxr.exe tbhbtt.exe PID 1564 wrote to memory of 3696 1564 fflfxxr.exe tbhbtt.exe PID 3696 wrote to memory of 5116 3696 tbhbtt.exe pdjjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60dcae1fae996736f647fa8280065e65_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\60dcae1fae996736f647fa8280065e65_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\lffxrll.exec:\lffxrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\5htntb.exec:\5htntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\llxlrfr.exec:\llxlrfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\7htbhb.exec:\7htbhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\llfxlll.exec:\llfxlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\nhnnhb.exec:\nhnnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\fflfffx.exec:\fflfffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\tbnnhh.exec:\tbnnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\pjjdj.exec:\pjjdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\btttht.exec:\btttht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\lrxrrll.exec:\lrxrrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\tbbtnn.exec:\tbbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\djvpp.exec:\djvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\1frlflf.exec:\1frlflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\xrxrllr.exec:\xrxrllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\bntnht.exec:\bntnht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\jvddv.exec:\jvddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\lrxxxxx.exec:\lrxxxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\hbnnht.exec:\hbnnht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\fflfxxr.exec:\fflfxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\tbhbtt.exec:\tbhbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\pdjjd.exec:\pdjjd.exe23⤵
- Executes dropped EXE
PID:5116 -
\??\c:\rxxrllf.exec:\rxxrllf.exe24⤵
- Executes dropped EXE
PID:1288 -
\??\c:\bbhnhh.exec:\bbhnhh.exe25⤵
- Executes dropped EXE
PID:5056 -
\??\c:\jvvpp.exec:\jvvpp.exe26⤵
- Executes dropped EXE
PID:4976 -
\??\c:\rlxxfff.exec:\rlxxfff.exe27⤵
- Executes dropped EXE
PID:4560 -
\??\c:\7dddv.exec:\7dddv.exe28⤵
- Executes dropped EXE
PID:4856 -
\??\c:\rxxxrrl.exec:\rxxxrrl.exe29⤵
- Executes dropped EXE
PID:3656 -
\??\c:\fxfxxrl.exec:\fxfxxrl.exe30⤵
- Executes dropped EXE
PID:2256 -
\??\c:\bnbtnn.exec:\bnbtnn.exe31⤵
- Executes dropped EXE
PID:1116 -
\??\c:\hbhhbt.exec:\hbhhbt.exe32⤵
- Executes dropped EXE
PID:3204 -
\??\c:\rfffxrl.exec:\rfffxrl.exe33⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jvddd.exec:\jvddd.exe34⤵
- Executes dropped EXE
PID:5028 -
\??\c:\nnhbnb.exec:\nnhbnb.exe35⤵
- Executes dropped EXE
PID:2560 -
\??\c:\httnhh.exec:\httnhh.exe36⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jjjvj.exec:\jjjvj.exe37⤵
- Executes dropped EXE
PID:392 -
\??\c:\llllffl.exec:\llllffl.exe38⤵
- Executes dropped EXE
PID:2140 -
\??\c:\tthhbt.exec:\tthhbt.exe39⤵
- Executes dropped EXE
PID:3768 -
\??\c:\ddpjp.exec:\ddpjp.exe40⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jdjjv.exec:\jdjjv.exe41⤵
- Executes dropped EXE
PID:3516 -
\??\c:\xffxrlf.exec:\xffxrlf.exe42⤵
- Executes dropped EXE
PID:1172 -
\??\c:\httnht.exec:\httnht.exe43⤵
- Executes dropped EXE
PID:4868 -
\??\c:\5dpjp.exec:\5dpjp.exe44⤵
- Executes dropped EXE
PID:1468 -
\??\c:\rxfllfx.exec:\rxfllfx.exe45⤵
- Executes dropped EXE
PID:1220 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe46⤵
- Executes dropped EXE
PID:4928 -
\??\c:\httnhb.exec:\httnhb.exe47⤵
- Executes dropped EXE
PID:4748 -
\??\c:\flllffr.exec:\flllffr.exe48⤵
- Executes dropped EXE
PID:4948 -
\??\c:\nthhhh.exec:\nthhhh.exe49⤵
- Executes dropped EXE
PID:4340 -
\??\c:\7djjd.exec:\7djjd.exe50⤵
- Executes dropped EXE
PID:640 -
\??\c:\7frlxxx.exec:\7frlxxx.exe51⤵
- Executes dropped EXE
PID:4516 -
\??\c:\hthhbb.exec:\hthhbb.exe52⤵
- Executes dropped EXE
PID:3760 -
\??\c:\jdjdj.exec:\jdjdj.exe53⤵
- Executes dropped EXE
PID:3616 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe54⤵
- Executes dropped EXE
PID:3444 -
\??\c:\3bbbnn.exec:\3bbbnn.exe55⤵
- Executes dropped EXE
PID:1492 -
\??\c:\pjvvp.exec:\pjvvp.exe56⤵
- Executes dropped EXE
PID:4200 -
\??\c:\lllfxxr.exec:\lllfxxr.exe57⤵
- Executes dropped EXE
PID:2528 -
\??\c:\bbbhnb.exec:\bbbhnb.exe58⤵
- Executes dropped EXE
PID:32 -
\??\c:\djjvj.exec:\djjvj.exe59⤵
- Executes dropped EXE
PID:852 -
\??\c:\llxlxfl.exec:\llxlxfl.exe60⤵
- Executes dropped EXE
PID:4652 -
\??\c:\nbhbtn.exec:\nbhbtn.exe61⤵
- Executes dropped EXE
PID:3968 -
\??\c:\ppvvp.exec:\ppvvp.exe62⤵
- Executes dropped EXE
PID:1040 -
\??\c:\bthnbh.exec:\bthnbh.exe63⤵
- Executes dropped EXE
PID:3136 -
\??\c:\ppvpj.exec:\ppvpj.exe64⤵
- Executes dropped EXE
PID:2680 -
\??\c:\fflfxrl.exec:\fflfxrl.exe65⤵
- Executes dropped EXE
PID:3064 -
\??\c:\llrrllf.exec:\llrrllf.exe66⤵PID:3160
-
\??\c:\9nnhnn.exec:\9nnhnn.exe67⤵PID:3848
-
\??\c:\5ppjd.exec:\5ppjd.exe68⤵PID:376
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe69⤵PID:1788
-
\??\c:\btbnhh.exec:\btbnhh.exe70⤵PID:5032
-
\??\c:\9djdv.exec:\9djdv.exe71⤵PID:1192
-
\??\c:\5ppjd.exec:\5ppjd.exe72⤵PID:2032
-
\??\c:\xffxlxr.exec:\xffxlxr.exe73⤵PID:2500
-
\??\c:\thnnth.exec:\thnnth.exe74⤵PID:1900
-
\??\c:\vjppj.exec:\vjppj.exe75⤵PID:1132
-
\??\c:\djpjd.exec:\djpjd.exe76⤵PID:2464
-
\??\c:\7flfrrr.exec:\7flfrrr.exe77⤵PID:3172
-
\??\c:\tbhbtt.exec:\tbhbtt.exe78⤵PID:3636
-
\??\c:\pjdvd.exec:\pjdvd.exe79⤵PID:3088
-
\??\c:\rlrlffx.exec:\rlrlffx.exe80⤵PID:2944
-
\??\c:\xxxrllr.exec:\xxxrllr.exe81⤵PID:2864
-
\??\c:\ttbtnh.exec:\ttbtnh.exe82⤵PID:940
-
\??\c:\dppvp.exec:\dppvp.exe83⤵PID:2292
-
\??\c:\jvjdv.exec:\jvjdv.exe84⤵PID:372
-
\??\c:\fxrlffx.exec:\fxrlffx.exe85⤵PID:3352
-
\??\c:\nbbtnn.exec:\nbbtnn.exe86⤵PID:2192
-
\??\c:\vdpvp.exec:\vdpvp.exe87⤵PID:3204
-
\??\c:\jjjdv.exec:\jjjdv.exe88⤵PID:2636
-
\??\c:\nhtttt.exec:\nhtttt.exe89⤵PID:4972
-
\??\c:\jvdvd.exec:\jvdvd.exe90⤵PID:2416
-
\??\c:\xxxrllx.exec:\xxxrllx.exe91⤵PID:1452
-
\??\c:\nhttbb.exec:\nhttbb.exe92⤵PID:1464
-
\??\c:\bbhbtt.exec:\bbhbtt.exe93⤵PID:4056
-
\??\c:\rfllfff.exec:\rfllfff.exe94⤵PID:3952
-
\??\c:\ttbnth.exec:\ttbnth.exe95⤵PID:1360
-
\??\c:\9vdvd.exec:\9vdvd.exe96⤵PID:4648
-
\??\c:\jdjjj.exec:\jdjjj.exe97⤵PID:2892
-
\??\c:\fxfrllx.exec:\fxfrllx.exe98⤵PID:4732
-
\??\c:\fxlffxr.exec:\fxlffxr.exe99⤵PID:4288
-
\??\c:\tnhhbb.exec:\tnhhbb.exe100⤵PID:3148
-
\??\c:\pjjdv.exec:\pjjdv.exe101⤵PID:4092
-
\??\c:\xlffrxf.exec:\xlffrxf.exe102⤵PID:1784
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe103⤵PID:1704
-
\??\c:\tttbtt.exec:\tttbtt.exe104⤵PID:3964
-
\??\c:\pvpvv.exec:\pvpvv.exe105⤵PID:1488
-
\??\c:\llllflf.exec:\llllflf.exe106⤵PID:4516
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe107⤵PID:636
-
\??\c:\ttbtnn.exec:\ttbtnn.exe108⤵PID:3616
-
\??\c:\jvjdv.exec:\jvjdv.exe109⤵PID:1896
-
\??\c:\xfflxff.exec:\xfflxff.exe110⤵PID:804
-
\??\c:\hnbtbb.exec:\hnbtbb.exe111⤵PID:4200
-
\??\c:\7vdvj.exec:\7vdvj.exe112⤵PID:4804
-
\??\c:\flxrlfx.exec:\flxrlfx.exe113⤵PID:3784
-
\??\c:\7btnhh.exec:\7btnhh.exe114⤵PID:1928
-
\??\c:\btbbtt.exec:\btbbtt.exe115⤵PID:4808
-
\??\c:\dvpvv.exec:\dvpvv.exe116⤵PID:552
-
\??\c:\7xlxffr.exec:\7xlxffr.exe117⤵PID:1836
-
\??\c:\bnttnb.exec:\bnttnb.exe118⤵PID:3572
-
\??\c:\pjjpj.exec:\pjjpj.exe119⤵PID:3688
-
\??\c:\vjppp.exec:\vjppp.exe120⤵PID:704
-
\??\c:\fxxrllf.exec:\fxxrllf.exe121⤵PID:2144
-
\??\c:\nnhbhh.exec:\nnhbhh.exe122⤵PID:3836
-
\??\c:\pjjjd.exec:\pjjjd.exe123⤵PID:5088
-
\??\c:\xfrxxlr.exec:\xfrxxlr.exe124⤵PID:4180
-
\??\c:\bbhhbb.exec:\bbhhbb.exe125⤵PID:4136
-
\??\c:\jjvpp.exec:\jjvpp.exe126⤵PID:4540
-
\??\c:\pdpjd.exec:\pdpjd.exe127⤵PID:2036
-
\??\c:\5rxrrrr.exec:\5rxrrrr.exe128⤵PID:3272
-
\??\c:\3tbbhh.exec:\3tbbhh.exe129⤵PID:4256
-
\??\c:\jjpjd.exec:\jjpjd.exe130⤵PID:1804
-
\??\c:\vjdvp.exec:\vjdvp.exe131⤵PID:648
-
\??\c:\1xlfllr.exec:\1xlfllr.exe132⤵PID:1708
-
\??\c:\httnhh.exec:\httnhh.exe133⤵PID:4280
-
\??\c:\dvdvp.exec:\dvdvp.exe134⤵PID:5056
-
\??\c:\xfflfxx.exec:\xfflfxx.exe135⤵PID:4024
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe136⤵PID:4944
-
\??\c:\pjjdd.exec:\pjjdd.exe137⤵PID:940
-
\??\c:\pjjpj.exec:\pjjpj.exe138⤵PID:3040
-
\??\c:\flffxxx.exec:\flffxxx.exe139⤵PID:1908
-
\??\c:\bhbtnn.exec:\bhbtnn.exe140⤵PID:348
-
\??\c:\ddppp.exec:\ddppp.exe141⤵PID:2188
-
\??\c:\9ffxrll.exec:\9ffxrll.exe142⤵PID:388
-
\??\c:\lrrlllf.exec:\lrrlllf.exe143⤵PID:5028
-
\??\c:\tnbbtt.exec:\tnbbtt.exe144⤵PID:4300
-
\??\c:\vjjdv.exec:\vjjdv.exe145⤵PID:4564
-
\??\c:\pppdv.exec:\pppdv.exe146⤵PID:1672
-
\??\c:\flxrllf.exec:\flxrllf.exe147⤵PID:4612
-
\??\c:\nbhhbb.exec:\nbhhbb.exe148⤵PID:3768
-
\??\c:\dpddv.exec:\dpddv.exe149⤵PID:4056
-
\??\c:\1rxrffr.exec:\1rxrffr.exe150⤵PID:3952
-
\??\c:\nnntnn.exec:\nnntnn.exe151⤵PID:1360
-
\??\c:\hbnhhh.exec:\hbnhhh.exe152⤵PID:4648
-
\??\c:\ppvvd.exec:\ppvvd.exe153⤵PID:4396
-
\??\c:\lffffff.exec:\lffffff.exe154⤵PID:4732
-
\??\c:\xllfxlf.exec:\xllfxlf.exe155⤵PID:4288
-
\??\c:\btbtnt.exec:\btbtnt.exe156⤵PID:4080
-
\??\c:\jvvdj.exec:\jvvdj.exe157⤵PID:4948
-
\??\c:\xrffrrx.exec:\xrffrrx.exe158⤵PID:1784
-
\??\c:\ttbtnh.exec:\ttbtnh.exe159⤵PID:3584
-
\??\c:\nnnhhb.exec:\nnnhhb.exe160⤵PID:2248
-
\??\c:\vpjdp.exec:\vpjdp.exe161⤵PID:2052
-
\??\c:\fflllll.exec:\fflllll.exe162⤵PID:1168
-
\??\c:\lrrfffx.exec:\lrrfffx.exe163⤵PID:3616
-
\??\c:\nhtnhh.exec:\nhtnhh.exe164⤵PID:2776
-
\??\c:\vpdpp.exec:\vpdpp.exe165⤵PID:2328
-
\??\c:\fxllrxr.exec:\fxllrxr.exe166⤵PID:4200
-
\??\c:\9thbtb.exec:\9thbtb.exe167⤵PID:4804
-
\??\c:\hbtntt.exec:\hbtntt.exe168⤵PID:548
-
\??\c:\7vjjd.exec:\7vjjd.exe169⤵PID:4756
-
\??\c:\rrffxll.exec:\rrffxll.exe170⤵PID:1976
-
\??\c:\9ntbtt.exec:\9ntbtt.exe171⤵PID:552
-
\??\c:\tnnhbh.exec:\tnnhbh.exe172⤵PID:1836
-
\??\c:\jdddj.exec:\jdddj.exe173⤵PID:3572
-
\??\c:\lllfffx.exec:\lllfffx.exe174⤵PID:1196
-
\??\c:\hnbttt.exec:\hnbttt.exe175⤵PID:5012
-
\??\c:\tthntb.exec:\tthntb.exe176⤵PID:2144
-
\??\c:\vppjd.exec:\vppjd.exe177⤵PID:2824
-
\??\c:\9fxrxxl.exec:\9fxrxxl.exe178⤵PID:5088
-
\??\c:\hbnhtb.exec:\hbnhtb.exe179⤵PID:5032
-
\??\c:\7dvdp.exec:\7dvdp.exe180⤵PID:4136
-
\??\c:\1vvvp.exec:\1vvvp.exe181⤵PID:4504
-
\??\c:\9llfffx.exec:\9llfffx.exe182⤵PID:2788
-
\??\c:\1nttnn.exec:\1nttnn.exe183⤵PID:1292
-
\??\c:\jdvvp.exec:\jdvvp.exe184⤵PID:3588
-
\??\c:\7jpjv.exec:\7jpjv.exe185⤵PID:3696
-
\??\c:\fxlfffl.exec:\fxlfffl.exe186⤵PID:5100
-
\??\c:\tnnnhb.exec:\tnnnhb.exe187⤵PID:4660
-
\??\c:\vjdjp.exec:\vjdjp.exe188⤵PID:2980
-
\??\c:\9pddv.exec:\9pddv.exe189⤵PID:1540
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe190⤵PID:2740
-
\??\c:\bbtnhh.exec:\bbtnhh.exe191⤵PID:4940
-
\??\c:\1dddd.exec:\1dddd.exe192⤵PID:2184
-
\??\c:\vpvpp.exec:\vpvpp.exe193⤵PID:1176
-
\??\c:\frfrxxl.exec:\frfrxxl.exe194⤵PID:4308
-
\??\c:\ttttnt.exec:\ttttnt.exe195⤵PID:2316
-
\??\c:\jdjjd.exec:\jdjjd.exe196⤵PID:2628
-
\??\c:\jpvdj.exec:\jpvdj.exe197⤵PID:3204
-
\??\c:\fxfxrlx.exec:\fxfxrlx.exe198⤵PID:2880
-
\??\c:\nhhbtt.exec:\nhhbtt.exe199⤵PID:2396
-
\??\c:\vvvpj.exec:\vvvpj.exe200⤵PID:4656
-
\??\c:\dvdpj.exec:\dvdpj.exe201⤵PID:4400
-
\??\c:\xflfxfx.exec:\xflfxfx.exe202⤵PID:2116
-
\??\c:\bbbbhb.exec:\bbbbhb.exe203⤵PID:2524
-
\??\c:\djppd.exec:\djppd.exe204⤵PID:2504
-
\??\c:\djvpj.exec:\djvpj.exe205⤵PID:4568
-
\??\c:\rxffxxx.exec:\rxffxxx.exe206⤵PID:4520
-
\??\c:\hbnhbb.exec:\hbnhbb.exe207⤵PID:4852
-
\??\c:\pppjd.exec:\pppjd.exe208⤵PID:740
-
\??\c:\7xxrllf.exec:\7xxrllf.exe209⤵PID:1104
-
\??\c:\3rxrffl.exec:\3rxrffl.exe210⤵PID:3148
-
\??\c:\thnnhn.exec:\thnnhn.exe211⤵PID:4384
-
\??\c:\vddvv.exec:\vddvv.exe212⤵PID:4380
-
\??\c:\xfllrrx.exec:\xfllrrx.exe213⤵PID:1704
-
\??\c:\1flffxx.exec:\1flffxx.exe214⤵PID:2488
-
\??\c:\tnbthh.exec:\tnbthh.exe215⤵PID:3492
-
\??\c:\dvpjj.exec:\dvpjj.exe216⤵PID:1536
-
\??\c:\vpddp.exec:\vpddp.exe217⤵PID:1004
-
\??\c:\llrffxx.exec:\llrffxx.exe218⤵PID:4672
-
\??\c:\bntnnn.exec:\bntnnn.exe219⤵PID:4860
-
\??\c:\vppjv.exec:\vppjv.exe220⤵PID:2776
-
\??\c:\ppvpp.exec:\ppvpp.exe221⤵PID:4796
-
\??\c:\rflfxxx.exec:\rflfxxx.exe222⤵PID:536
-
\??\c:\nhbtnh.exec:\nhbtnh.exe223⤵PID:4804
-
\??\c:\nththh.exec:\nththh.exe224⤵PID:1692
-
\??\c:\ppdpv.exec:\ppdpv.exe225⤵PID:4756
-
\??\c:\xrffxxr.exec:\xrffxxr.exe226⤵PID:4828
-
\??\c:\nthbhh.exec:\nthbhh.exe227⤵PID:4496
-
\??\c:\ntbbtb.exec:\ntbbtb.exe228⤵PID:3688
-
\??\c:\1ddvd.exec:\1ddvd.exe229⤵PID:2128
-
\??\c:\flxfxll.exec:\flxfxll.exe230⤵PID:1196
-
\??\c:\htthbt.exec:\htthbt.exe231⤵PID:5012
-
\??\c:\pjpjd.exec:\pjpjd.exe232⤵PID:2144
-
\??\c:\dpjdd.exec:\dpjdd.exe233⤵PID:2784
-
\??\c:\rxflxxf.exec:\rxflxxf.exe234⤵PID:5088
-
\??\c:\7hbhhn.exec:\7hbhhn.exe235⤵PID:5032
-
\??\c:\nnbbtb.exec:\nnbbtb.exe236⤵PID:2032
-
\??\c:\jpjdv.exec:\jpjdv.exe237⤵PID:2036
-
\??\c:\7fllfll.exec:\7fllfll.exe238⤵PID:1900
-
\??\c:\thhhtn.exec:\thhhtn.exe239⤵PID:1668
-
\??\c:\jjjjd.exec:\jjjjd.exe240⤵PID:3692
-
\??\c:\5ffxfff.exec:\5ffxfff.exe241⤵PID:1088
-
\??\c:\frxxrfx.exec:\frxxrfx.exe242⤵PID:5020