Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 17:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe
-
Size
203KB
-
MD5
681146f9edea18bd7b89a324404989f7
-
SHA1
67e9993dd3a404fc8675317ba4a5e33152974918
-
SHA256
dab8440bba0fed6c322bfcec169d177da7e81fa081f7df775bc7a84b51137339
-
SHA512
ee1d75684f6332d49a9720bb065f42e7b1dc8561c90bad6df22f7457ebee56ceae0da12d1394f18086039e5e955b496e88fbe8b3dab2e8ced4187394be3d2761
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqyEzOICBZHFS15NV70wiww:PhOm2sI93UufdC67cihEzoY3NS
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3972-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-326-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-335-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-382-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-451-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-453-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-486-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-506-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-546-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-553-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-585-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-595-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-633-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-662-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-667-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-780-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/312-784-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-862-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-916-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-928-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-1146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-1620-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hhnhtn.exedjpjp.exeflxlxrl.exe9jjdd.exe5rfxrrl.exetnnbtn.exe1pdvp.exelrflrlx.exedvdvj.exerfllxfl.exehtbhtb.exepjpjv.exeffxlfff.exettthbn.exe9pjvd.exefxrllxf.exebbbtnn.exe3vjjv.exerffxlfx.exe1hhtbb.exexxrlffx.exefxlfrlr.exebnttnh.exevppjj.exerfrllfr.exebhhbtn.exe7xfxrrl.exerlfxffl.exehbnhtn.exe5vjvj.exe7xrflfl.exehbnhbt.exehbhbnn.exepjddp.exelfrlllx.exepjvvv.exe5xxllfl.exenhhbnn.exe5hbthn.exejddvj.exerlllxxr.exehbthbt.exetnbnhh.exejvdvv.exellxxfll.exenthnnn.exevppjv.exejpjvj.exelxfrllx.exeflxrllf.exe7tnttt.exedjvjd.exe9jjdp.exeflfxllf.exelfffxxx.exebtnnhh.exejvvpd.exevpdpv.exe7rxrxxf.exenntbtt.exe7pdvj.exedvvpj.exe9rxlffx.exehtbtbb.exepid process 3972 hhnhtn.exe 4348 djpjp.exe 2320 flxlxrl.exe 2396 9jjdd.exe 1212 5rfxrrl.exe 1960 tnnbtn.exe 1372 1pdvp.exe 4552 lrflrlx.exe 4996 dvdvj.exe 2300 rfllxfl.exe 3988 htbhtb.exe 2608 pjpjv.exe 512 ffxlfff.exe 4588 ttthbn.exe 4392 9pjvd.exe 1564 fxrllxf.exe 1924 bbbtnn.exe 3940 3vjjv.exe 4604 rffxlfx.exe 2380 1hhtbb.exe 528 xxrlffx.exe 4356 fxlfrlr.exe 1180 bnttnh.exe 748 vppjj.exe 3628 rfrllfr.exe 1940 bhhbtn.exe 1484 7xfxrrl.exe 2764 rlfxffl.exe 4324 hbnhtn.exe 928 5vjvj.exe 1160 7xrflfl.exe 1008 hbnhbt.exe 2280 hbhbnn.exe 3092 pjddp.exe 744 lfrlllx.exe 1380 pjvvv.exe 3164 5xxllfl.exe 4936 nhhbnn.exe 3052 5hbthn.exe 448 jddvj.exe 5008 rlllxxr.exe 1116 hbthbt.exe 2460 tnbnhh.exe 2432 jvdvv.exe 1960 llxxfll.exe 3528 nthnnn.exe 4552 vppjv.exe 4480 jpjvj.exe 3172 lxfrllx.exe 3568 flxrllf.exe 3532 7tnttt.exe 2468 djvjd.exe 4084 9jjdp.exe 3308 flfxllf.exe 1376 lfffxxx.exe 3704 btnnhh.exe 840 jvvpd.exe 2944 vpdpv.exe 1164 7rxrxxf.exe 4772 nntbtt.exe 3764 7pdvj.exe 3608 dvvpj.exe 5000 9rxlffx.exe 528 htbtbb.exe -
Processes:
resource yara_rule behavioral2/memory/3972-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-326-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-335-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-382-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-390-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-399-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-429-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-451-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-453-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-486-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-499-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-506-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-546-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-553-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-581-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-585-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-595-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-633-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-662-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
681146f9edea18bd7b89a324404989f7_JaffaCakes118.exehhnhtn.exedjpjp.exeflxlxrl.exe9jjdd.exe5rfxrrl.exetnnbtn.exe1pdvp.exelrflrlx.exedvdvj.exerfllxfl.exehtbhtb.exepjpjv.exeffxlfff.exettthbn.exe9pjvd.exefxrllxf.exebbbtnn.exe3vjjv.exerffxlfx.exe1hhtbb.exexxrlffx.exedescription pid process target process PID 4200 wrote to memory of 3972 4200 681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe hhnhtn.exe PID 4200 wrote to memory of 3972 4200 681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe hhnhtn.exe PID 4200 wrote to memory of 3972 4200 681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe hhnhtn.exe PID 3972 wrote to memory of 4348 3972 hhnhtn.exe djpjp.exe PID 3972 wrote to memory of 4348 3972 hhnhtn.exe djpjp.exe PID 3972 wrote to memory of 4348 3972 hhnhtn.exe djpjp.exe PID 4348 wrote to memory of 2320 4348 djpjp.exe flxlxrl.exe PID 4348 wrote to memory of 2320 4348 djpjp.exe flxlxrl.exe PID 4348 wrote to memory of 2320 4348 djpjp.exe flxlxrl.exe PID 2320 wrote to memory of 2396 2320 flxlxrl.exe 9jjdd.exe PID 2320 wrote to memory of 2396 2320 flxlxrl.exe 9jjdd.exe PID 2320 wrote to memory of 2396 2320 flxlxrl.exe 9jjdd.exe PID 2396 wrote to memory of 1212 2396 9jjdd.exe 5rfxrrl.exe PID 2396 wrote to memory of 1212 2396 9jjdd.exe 5rfxrrl.exe PID 2396 wrote to memory of 1212 2396 9jjdd.exe 5rfxrrl.exe PID 1212 wrote to memory of 1960 1212 5rfxrrl.exe tnnbtn.exe PID 1212 wrote to memory of 1960 1212 5rfxrrl.exe tnnbtn.exe PID 1212 wrote to memory of 1960 1212 5rfxrrl.exe tnnbtn.exe PID 1960 wrote to memory of 1372 1960 tnnbtn.exe 1pdvp.exe PID 1960 wrote to memory of 1372 1960 tnnbtn.exe 1pdvp.exe PID 1960 wrote to memory of 1372 1960 tnnbtn.exe 1pdvp.exe PID 1372 wrote to memory of 4552 1372 1pdvp.exe lrflrlx.exe PID 1372 wrote to memory of 4552 1372 1pdvp.exe lrflrlx.exe PID 1372 wrote to memory of 4552 1372 1pdvp.exe lrflrlx.exe PID 4552 wrote to memory of 4996 4552 lrflrlx.exe dvdvj.exe PID 4552 wrote to memory of 4996 4552 lrflrlx.exe dvdvj.exe PID 4552 wrote to memory of 4996 4552 lrflrlx.exe dvdvj.exe PID 4996 wrote to memory of 2300 4996 dvdvj.exe rfllxfl.exe PID 4996 wrote to memory of 2300 4996 dvdvj.exe rfllxfl.exe PID 4996 wrote to memory of 2300 4996 dvdvj.exe rfllxfl.exe PID 2300 wrote to memory of 3988 2300 rfllxfl.exe htbhtb.exe PID 2300 wrote to memory of 3988 2300 rfllxfl.exe htbhtb.exe PID 2300 wrote to memory of 3988 2300 rfllxfl.exe htbhtb.exe PID 3988 wrote to memory of 2608 3988 htbhtb.exe pjpjv.exe PID 3988 wrote to memory of 2608 3988 htbhtb.exe pjpjv.exe PID 3988 wrote to memory of 2608 3988 htbhtb.exe pjpjv.exe PID 2608 wrote to memory of 512 2608 pjpjv.exe ffxlfff.exe PID 2608 wrote to memory of 512 2608 pjpjv.exe ffxlfff.exe PID 2608 wrote to memory of 512 2608 pjpjv.exe ffxlfff.exe PID 512 wrote to memory of 4588 512 ffxlfff.exe ttthbn.exe PID 512 wrote to memory of 4588 512 ffxlfff.exe ttthbn.exe PID 512 wrote to memory of 4588 512 ffxlfff.exe ttthbn.exe PID 4588 wrote to memory of 4392 4588 ttthbn.exe 9pjvd.exe PID 4588 wrote to memory of 4392 4588 ttthbn.exe 9pjvd.exe PID 4588 wrote to memory of 4392 4588 ttthbn.exe 9pjvd.exe PID 4392 wrote to memory of 1564 4392 9pjvd.exe fxrllxf.exe PID 4392 wrote to memory of 1564 4392 9pjvd.exe fxrllxf.exe PID 4392 wrote to memory of 1564 4392 9pjvd.exe fxrllxf.exe PID 1564 wrote to memory of 1924 1564 fxrllxf.exe bbbtnn.exe PID 1564 wrote to memory of 1924 1564 fxrllxf.exe bbbtnn.exe PID 1564 wrote to memory of 1924 1564 fxrllxf.exe bbbtnn.exe PID 1924 wrote to memory of 3940 1924 bbbtnn.exe 3vjjv.exe PID 1924 wrote to memory of 3940 1924 bbbtnn.exe 3vjjv.exe PID 1924 wrote to memory of 3940 1924 bbbtnn.exe 3vjjv.exe PID 3940 wrote to memory of 4604 3940 3vjjv.exe rffxlfx.exe PID 3940 wrote to memory of 4604 3940 3vjjv.exe rffxlfx.exe PID 3940 wrote to memory of 4604 3940 3vjjv.exe rffxlfx.exe PID 4604 wrote to memory of 2380 4604 rffxlfx.exe 1hhtbb.exe PID 4604 wrote to memory of 2380 4604 rffxlfx.exe 1hhtbb.exe PID 4604 wrote to memory of 2380 4604 rffxlfx.exe 1hhtbb.exe PID 2380 wrote to memory of 528 2380 1hhtbb.exe xxrlffx.exe PID 2380 wrote to memory of 528 2380 1hhtbb.exe xxrlffx.exe PID 2380 wrote to memory of 528 2380 1hhtbb.exe xxrlffx.exe PID 528 wrote to memory of 4356 528 xxrlffx.exe fxlfrlr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\681146f9edea18bd7b89a324404989f7_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\hhnhtn.exec:\hhnhtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\djpjp.exec:\djpjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\flxlxrl.exec:\flxlxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\9jjdd.exec:\9jjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\5rfxrrl.exec:\5rfxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\tnnbtn.exec:\tnnbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\1pdvp.exec:\1pdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\lrflrlx.exec:\lrflrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\dvdvj.exec:\dvdvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\rfllxfl.exec:\rfllxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\htbhtb.exec:\htbhtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\pjpjv.exec:\pjpjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\ffxlfff.exec:\ffxlfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\ttthbn.exec:\ttthbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\9pjvd.exec:\9pjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\fxrllxf.exec:\fxrllxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\bbbtnn.exec:\bbbtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\3vjjv.exec:\3vjjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\rffxlfx.exec:\rffxlfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\1hhtbb.exec:\1hhtbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\xxrlffx.exec:\xxrlffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\fxlfrlr.exec:\fxlfrlr.exe23⤵
- Executes dropped EXE
PID:4356 -
\??\c:\bnttnh.exec:\bnttnh.exe24⤵
- Executes dropped EXE
PID:1180 -
\??\c:\vppjj.exec:\vppjj.exe25⤵
- Executes dropped EXE
PID:748 -
\??\c:\rfrllfr.exec:\rfrllfr.exe26⤵
- Executes dropped EXE
PID:3628 -
\??\c:\bhhbtn.exec:\bhhbtn.exe27⤵
- Executes dropped EXE
PID:1940 -
\??\c:\7xfxrrl.exec:\7xfxrrl.exe28⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rlfxffl.exec:\rlfxffl.exe29⤵
- Executes dropped EXE
PID:2764 -
\??\c:\hbnhtn.exec:\hbnhtn.exe30⤵
- Executes dropped EXE
PID:4324 -
\??\c:\5vjvj.exec:\5vjvj.exe31⤵
- Executes dropped EXE
PID:928 -
\??\c:\7xrflfl.exec:\7xrflfl.exe32⤵
- Executes dropped EXE
PID:1160 -
\??\c:\hbnhbt.exec:\hbnhbt.exe33⤵
- Executes dropped EXE
PID:1008 -
\??\c:\hbhbnn.exec:\hbhbnn.exe34⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pjddp.exec:\pjddp.exe35⤵
- Executes dropped EXE
PID:3092 -
\??\c:\lfrlllx.exec:\lfrlllx.exe36⤵
- Executes dropped EXE
PID:744 -
\??\c:\pjvvv.exec:\pjvvv.exe37⤵
- Executes dropped EXE
PID:1380 -
\??\c:\5xxllfl.exec:\5xxllfl.exe38⤵
- Executes dropped EXE
PID:3164 -
\??\c:\nhhbnn.exec:\nhhbnn.exe39⤵
- Executes dropped EXE
PID:4936 -
\??\c:\5hbthn.exec:\5hbthn.exe40⤵
- Executes dropped EXE
PID:3052 -
\??\c:\jddvj.exec:\jddvj.exe41⤵
- Executes dropped EXE
PID:448 -
\??\c:\rlllxxr.exec:\rlllxxr.exe42⤵
- Executes dropped EXE
PID:5008 -
\??\c:\hbthbt.exec:\hbthbt.exe43⤵
- Executes dropped EXE
PID:1116 -
\??\c:\tnbnhh.exec:\tnbnhh.exe44⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jvdvv.exec:\jvdvv.exe45⤵
- Executes dropped EXE
PID:2432 -
\??\c:\llxxfll.exec:\llxxfll.exe46⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nthnnn.exec:\nthnnn.exe47⤵
- Executes dropped EXE
PID:3528 -
\??\c:\vppjv.exec:\vppjv.exe48⤵
- Executes dropped EXE
PID:4552 -
\??\c:\jpjvj.exec:\jpjvj.exe49⤵
- Executes dropped EXE
PID:4480 -
\??\c:\lxfrllx.exec:\lxfrllx.exe50⤵
- Executes dropped EXE
PID:3172 -
\??\c:\flxrllf.exec:\flxrllf.exe51⤵
- Executes dropped EXE
PID:3568 -
\??\c:\7tnttt.exec:\7tnttt.exe52⤵
- Executes dropped EXE
PID:3532 -
\??\c:\djvjd.exec:\djvjd.exe53⤵
- Executes dropped EXE
PID:2468 -
\??\c:\9jjdp.exec:\9jjdp.exe54⤵
- Executes dropped EXE
PID:4084 -
\??\c:\flfxllf.exec:\flfxllf.exe55⤵
- Executes dropped EXE
PID:3308 -
\??\c:\lfffxxx.exec:\lfffxxx.exe56⤵
- Executes dropped EXE
PID:1376 -
\??\c:\btnnhh.exec:\btnnhh.exe57⤵
- Executes dropped EXE
PID:3704 -
\??\c:\jvvpd.exec:\jvvpd.exe58⤵
- Executes dropped EXE
PID:840 -
\??\c:\vpdpv.exec:\vpdpv.exe59⤵
- Executes dropped EXE
PID:2944 -
\??\c:\7rxrxxf.exec:\7rxrxxf.exe60⤵
- Executes dropped EXE
PID:1164 -
\??\c:\nntbtt.exec:\nntbtt.exe61⤵
- Executes dropped EXE
PID:4772 -
\??\c:\7pdvj.exec:\7pdvj.exe62⤵
- Executes dropped EXE
PID:3764 -
\??\c:\dvvpj.exec:\dvvpj.exe63⤵
- Executes dropped EXE
PID:3608 -
\??\c:\9rxlffx.exec:\9rxlffx.exe64⤵
- Executes dropped EXE
PID:5000 -
\??\c:\htbtbb.exec:\htbtbb.exe65⤵
- Executes dropped EXE
PID:528 -
\??\c:\nntnbh.exec:\nntnbh.exe66⤵PID:4856
-
\??\c:\pdpdp.exec:\pdpdp.exe67⤵PID:5036
-
\??\c:\lrfxllf.exec:\lrfxllf.exe68⤵PID:960
-
\??\c:\1lfxrfx.exec:\1lfxrfx.exe69⤵PID:3060
-
\??\c:\tnnhbt.exec:\tnnhbt.exe70⤵PID:2316
-
\??\c:\tnttnh.exec:\tnttnh.exe71⤵PID:3080
-
\??\c:\9ddpd.exec:\9ddpd.exe72⤵PID:3564
-
\??\c:\rfrfrrl.exec:\rfrfrrl.exe73⤵PID:4504
-
\??\c:\tnhhtt.exec:\tnhhtt.exe74⤵PID:2780
-
\??\c:\3btnbb.exec:\3btnbb.exe75⤵PID:3692
-
\??\c:\jvdvd.exec:\jvdvd.exe76⤵PID:4840
-
\??\c:\xrlxrfx.exec:\xrlxrfx.exe77⤵PID:5112
-
\??\c:\hbtntt.exec:\hbtntt.exe78⤵PID:3740
-
\??\c:\9vddv.exec:\9vddv.exe79⤵PID:1768
-
\??\c:\3ddvp.exec:\3ddvp.exe80⤵PID:1160
-
\??\c:\llfxllf.exec:\llfxllf.exe81⤵PID:4540
-
\??\c:\bhhhbb.exec:\bhhhbb.exe82⤵PID:3992
-
\??\c:\bhbtnn.exec:\bhbtnn.exe83⤵PID:1148
-
\??\c:\pdpjj.exec:\pdpjj.exe84⤵PID:376
-
\??\c:\pvjdp.exec:\pvjdp.exe85⤵PID:3316
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe86⤵PID:3260
-
\??\c:\bttnhb.exec:\bttnhb.exe87⤵PID:3192
-
\??\c:\bbnhtt.exec:\bbnhtt.exe88⤵PID:4208
-
\??\c:\jjvpv.exec:\jjvpv.exe89⤵PID:4828
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe90⤵PID:1056
-
\??\c:\xrllxxr.exec:\xrllxxr.exe91⤵PID:1624
-
\??\c:\tbbtnn.exec:\tbbtnn.exe92⤵PID:1212
-
\??\c:\djvpd.exec:\djvpd.exe93⤵PID:1620
-
\??\c:\pdvpd.exec:\pdvpd.exe94⤵PID:4372
-
\??\c:\lflfxrr.exec:\lflfxrr.exe95⤵PID:4880
-
\??\c:\httnhh.exec:\httnhh.exe96⤵PID:3528
-
\??\c:\jpvpj.exec:\jpvpj.exe97⤵PID:620
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe98⤵PID:2512
-
\??\c:\thtnhn.exec:\thtnhn.exe99⤵PID:872
-
\??\c:\pdjjp.exec:\pdjjp.exe100⤵PID:116
-
\??\c:\rllxlfx.exec:\rllxlfx.exe101⤵PID:4536
-
\??\c:\bntnhh.exec:\bntnhh.exe102⤵PID:2468
-
\??\c:\jpvpd.exec:\jpvpd.exe103⤵PID:4084
-
\??\c:\5vpdp.exec:\5vpdp.exe104⤵PID:4392
-
\??\c:\llrfxxl.exec:\llrfxxl.exe105⤵PID:2024
-
\??\c:\5nhbtb.exec:\5nhbtb.exe106⤵PID:4484
-
\??\c:\5vpjv.exec:\5vpjv.exe107⤵PID:3940
-
\??\c:\jdpdv.exec:\jdpdv.exe108⤵PID:5016
-
\??\c:\flfxllf.exec:\flfxllf.exe109⤵PID:1084
-
\??\c:\hhtbtt.exec:\hhtbtt.exe110⤵PID:4332
-
\??\c:\btbtnn.exec:\btbtnn.exe111⤵PID:1152
-
\??\c:\vpppj.exec:\vpppj.exe112⤵PID:5000
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe113⤵PID:3436
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe114⤵PID:4956
-
\??\c:\bttnbb.exec:\bttnbb.exe115⤵PID:4224
-
\??\c:\9bhbhh.exec:\9bhbhh.exe116⤵PID:1076
-
\??\c:\jdvjv.exec:\jdvjv.exe117⤵PID:412
-
\??\c:\jpdpj.exec:\jpdpj.exe118⤵PID:4820
-
\??\c:\xxfxxrx.exec:\xxfxxrx.exe119⤵PID:3820
-
\??\c:\lffxxrr.exec:\lffxxrr.exe120⤵PID:1796
-
\??\c:\tbhbth.exec:\tbhbth.exe121⤵PID:2596
-
\??\c:\pvdvj.exec:\pvdvj.exe122⤵PID:2780
-
\??\c:\jvpjj.exec:\jvpjj.exe123⤵PID:4308
-
\??\c:\7lrlxxr.exec:\7lrlxxr.exe124⤵PID:4268
-
\??\c:\hntnnh.exec:\hntnnh.exe125⤵PID:928
-
\??\c:\htnhtn.exec:\htnhtn.exe126⤵PID:4528
-
\??\c:\dvvpp.exec:\dvvpp.exe127⤵PID:1768
-
\??\c:\pdpdv.exec:\pdpdv.exe128⤵PID:1160
-
\??\c:\lllfffr.exec:\lllfffr.exe129⤵PID:4540
-
\??\c:\7flfxrf.exec:\7flfxrf.exe130⤵PID:4320
-
\??\c:\ttbtnh.exec:\ttbtnh.exe131⤵PID:4404
-
\??\c:\dpjdp.exec:\dpjdp.exe132⤵PID:996
-
\??\c:\pdvdj.exec:\pdvdj.exe133⤵PID:3548
-
\??\c:\lrrfrlf.exec:\lrrfrlf.exe134⤵PID:4768
-
\??\c:\1frrfff.exec:\1frrfff.exe135⤵PID:4832
-
\??\c:\nhhtnn.exec:\nhhtnn.exe136⤵PID:3332
-
\??\c:\1djdd.exec:\1djdd.exe137⤵PID:4828
-
\??\c:\vvjdv.exec:\vvjdv.exe138⤵PID:1056
-
\??\c:\flrlllf.exec:\flrlllf.exe139⤵PID:4076
-
\??\c:\bnbtnh.exec:\bnbtnh.exe140⤵PID:3280
-
\??\c:\nhtnhh.exec:\nhtnhh.exe141⤵PID:2464
-
\??\c:\pjpjv.exec:\pjpjv.exe142⤵PID:4496
-
\??\c:\rlrlffx.exec:\rlrlffx.exe143⤵PID:4708
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe144⤵PID:2528
-
\??\c:\9ntnbt.exec:\9ntnbt.exe145⤵PID:60
-
\??\c:\vddvp.exec:\vddvp.exe146⤵PID:3000
-
\??\c:\9flffxf.exec:\9flffxf.exe147⤵PID:396
-
\??\c:\xlrlfrl.exec:\xlrlfrl.exe148⤵PID:4220
-
\??\c:\9nhhtt.exec:\9nhhtt.exe149⤵PID:4800
-
\??\c:\9ttbtt.exec:\9ttbtt.exe150⤵PID:3468
-
\??\c:\5djpj.exec:\5djpj.exe151⤵PID:5016
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe152⤵PID:2204
-
\??\c:\lrxrxxl.exec:\lrxrxxl.exe153⤵PID:1896
-
\??\c:\bhnnhb.exec:\bhnnhb.exe154⤵PID:1136
-
\??\c:\vjpjd.exec:\vjpjd.exe155⤵PID:2576
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe156⤵PID:960
-
\??\c:\xrrrrrx.exec:\xrrrrrx.exe157⤵PID:2220
-
\??\c:\jvvvp.exec:\jvvvp.exe158⤵PID:3576
-
\??\c:\xllfffx.exec:\xllfffx.exe159⤵PID:3080
-
\??\c:\lxxrrll.exec:\lxxrrll.exe160⤵PID:4004
-
\??\c:\hbhbtt.exec:\hbhbtt.exe161⤵PID:4504
-
\??\c:\vdjdv.exec:\vdjdv.exe162⤵PID:1124
-
\??\c:\tnbtth.exec:\tnbtth.exe163⤵PID:4876
-
\??\c:\bnbttt.exec:\bnbttt.exe164⤵PID:1492
-
\??\c:\frfxrrr.exec:\frfxrrr.exe165⤵PID:4308
-
\??\c:\bntnhh.exec:\bntnhh.exe166⤵PID:4268
-
\??\c:\jvjdv.exec:\jvjdv.exe167⤵PID:928
-
\??\c:\bthhbb.exec:\bthhbb.exe168⤵PID:1436
-
\??\c:\dvddv.exec:\dvddv.exe169⤵PID:1768
-
\??\c:\lfxrffr.exec:\lfxrffr.exe170⤵PID:3992
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe171⤵PID:4540
-
\??\c:\1ttnhh.exec:\1ttnhh.exe172⤵PID:4320
-
\??\c:\jvjdd.exec:\jvjdd.exe173⤵PID:4940
-
\??\c:\jdjdv.exec:\jdjdv.exe174⤵PID:900
-
\??\c:\7ffrffx.exec:\7ffrffx.exe175⤵PID:908
-
\??\c:\1hhtnh.exec:\1hhtnh.exe176⤵PID:4832
-
\??\c:\tntntt.exec:\tntntt.exe177⤵PID:1548
-
\??\c:\dvjdp.exec:\dvjdp.exe178⤵PID:1644
-
\??\c:\fflffff.exec:\fflffff.exe179⤵PID:2460
-
\??\c:\9xxlffx.exec:\9xxlffx.exe180⤵PID:2464
-
\??\c:\7ttnhh.exec:\7ttnhh.exe181⤵PID:2592
-
\??\c:\dvdvp.exec:\dvdvp.exe182⤵PID:4996
-
\??\c:\rlxllfl.exec:\rlxllfl.exe183⤵PID:3488
-
\??\c:\xrxrllf.exec:\xrxrllf.exe184⤵PID:3988
-
\??\c:\9hbttt.exec:\9hbttt.exe185⤵PID:460
-
\??\c:\1dpvd.exec:\1dpvd.exe186⤵PID:4588
-
\??\c:\pjpjp.exec:\pjpjp.exe187⤵PID:4948
-
\??\c:\fllxffx.exec:\fllxffx.exe188⤵PID:4136
-
\??\c:\7nttnn.exec:\7nttnn.exe189⤵PID:3468
-
\??\c:\hhhbtn.exec:\hhhbtn.exe190⤵PID:5016
-
\??\c:\ddvvp.exec:\ddvvp.exe191⤵PID:844
-
\??\c:\pvvpp.exec:\pvvpp.exe192⤵PID:884
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe193⤵PID:4856
-
\??\c:\rfllfxr.exec:\rfllfxr.exe194⤵PID:5036
-
\??\c:\tbhbtn.exec:\tbhbtn.exe195⤵PID:748
-
\??\c:\vpdvj.exec:\vpdvj.exe196⤵PID:4224
-
\??\c:\xflfrrr.exec:\xflfrrr.exe197⤵PID:3632
-
\??\c:\5tbtnn.exec:\5tbtnn.exe198⤵PID:2728
-
\??\c:\nnthnn.exec:\nnthnn.exe199⤵PID:3588
-
\??\c:\1jjdv.exec:\1jjdv.exe200⤵PID:2148
-
\??\c:\3pjvv.exec:\3pjvv.exe201⤵PID:2636
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe202⤵PID:1948
-
\??\c:\hhnnnt.exec:\hhnnnt.exe203⤵PID:4840
-
\??\c:\1btnbb.exec:\1btnbb.exe204⤵PID:1416
-
\??\c:\1jjdv.exec:\1jjdv.exe205⤵PID:3740
-
\??\c:\ppdpd.exec:\ppdpd.exe206⤵PID:1560
-
\??\c:\rfrlffr.exec:\rfrlffr.exe207⤵PID:1008
-
\??\c:\9tbthh.exec:\9tbthh.exe208⤵PID:4964
-
\??\c:\nhttnn.exec:\nhttnn.exe209⤵PID:3992
-
\??\c:\pdjdv.exec:\pdjdv.exe210⤵PID:5040
-
\??\c:\xxxxlll.exec:\xxxxlll.exe211⤵PID:3972
-
\??\c:\1ffxrfr.exec:\1ffxrfr.exe212⤵PID:4768
-
\??\c:\ttbnhb.exec:\ttbnhb.exe213⤵PID:2068
-
\??\c:\pvjdv.exec:\pvjdv.exe214⤵PID:2060
-
\??\c:\3vvpj.exec:\3vvpj.exe215⤵PID:4460
-
\??\c:\3xxrffr.exec:\3xxrffr.exe216⤵PID:4828
-
\??\c:\lflrlrx.exec:\lflrlrx.exe217⤵PID:312
-
\??\c:\nhbttt.exec:\nhbttt.exe218⤵PID:5056
-
\??\c:\9jpjd.exec:\9jpjd.exe219⤵PID:3408
-
\??\c:\vvvpj.exec:\vvvpj.exe220⤵PID:3172
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe221⤵PID:2528
-
\??\c:\9lxrrrl.exec:\9lxrrrl.exe222⤵PID:60
-
\??\c:\tnnnhn.exec:\tnnnhn.exe223⤵PID:4536
-
\??\c:\hbhhbb.exec:\hbhhbb.exe224⤵PID:2888
-
\??\c:\pjjdv.exec:\pjjdv.exe225⤵PID:1404
-
\??\c:\xrllxxr.exec:\xrllxxr.exe226⤵PID:3940
-
\??\c:\1fxlfxl.exec:\1fxlfxl.exe227⤵PID:2380
-
\??\c:\hthbbt.exec:\hthbbt.exe228⤵PID:1976
-
\??\c:\thnhtn.exec:\thnhtn.exe229⤵PID:4236
-
\??\c:\pppjd.exec:\pppjd.exe230⤵PID:1180
-
\??\c:\1rxrrlf.exec:\1rxrrlf.exe231⤵PID:2016
-
\??\c:\rfxrffx.exec:\rfxrffx.exe232⤵PID:4792
-
\??\c:\nbhhtt.exec:\nbhhtt.exe233⤵PID:2940
-
\??\c:\jdvpd.exec:\jdvpd.exe234⤵PID:2316
-
\??\c:\rlxlrlf.exec:\rlxlrlf.exe235⤵PID:4048
-
\??\c:\3hnhbh.exec:\3hnhbh.exe236⤵PID:4712
-
\??\c:\tnbnbb.exec:\tnbnbb.exe237⤵PID:2728
-
\??\c:\pvpjd.exec:\pvpjd.exe238⤵PID:2780
-
\??\c:\jpvjd.exec:\jpvjd.exe239⤵PID:4476
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe240⤵PID:4740
-
\??\c:\fllfxxr.exec:\fllfxxr.exe241⤵PID:4308
-