Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
05/06/2024, 19:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
99150fdcd3e88cf74df43f193c4d9d64_JaffaCakes118.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
- Target 99150fdcd3e88cf74df43f193c4d9d64_JaffaCakes118.exe
- Size 215KB
- Sample240605-ymrxvsgh55
- SHA256 5fbce6f9317d220d8a0fed9441af4095e47af9aeb9a347a4b55ed7ee9fcb1cc8
- MD5 99150fdcd3e88cf74df43f193c4d9d64
- SHA1 524664c64403a0c83b52c8d49f1ea095796ad9a6
- SHA512 1c52a74c11fb62e9e62daa9b7c56bb4489072f43536f9c04d8880ad8e997e3566bcbd74c0fe299c65eac3ef94640ebd195f6a8651b5f1691e9330f8263bb7621
- SSDEEP 1536:evQBeOGtrYSSsrc93UBIfdC67m6AJiqzgLrTKBk3IU39TeYmKJ:ehOm2sI93UufdC67ciRLPvx3teYmo
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/388-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1508-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-847-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-903-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-1062-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-1332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 888 7frlllr.exe 1664 bnttnh.exe 908 dpddv.exe 4848 pdjjp.exe 552 fxrlrrx.exe 1524 9jvvv.exe 3316 hhbbnb.exe 4024 9vjjp.exe 3236 rllrflx.exe 2536 hhnnnt.exe 3992 rlrrrfl.exe 1804 nhbbtb.exe 3216 dvdjj.exe 4912 rrllrrr.exe 3784 hbhhbh.exe 4008 hbthht.exe 3228 vpppj.exe 760 xrfxrxx.exe 4424 lxffxxx.exe 4332 djdjj.exe 3744 rrxxflr.exe 1428 5lxlrrr.exe 2040 5thhhh.exe 3472 fflfffr.exe 1044 pppvp.exe 4396 jppdj.exe 3016 fxxfflf.exe 4536 xxlllll.exe 2704 tbbbnt.exe 4784 dpdjp.exe 4676 5jvvv.exe 3716 lfrxfxf.exe 2628 htbbbb.exe 872 btbbhn.exe 1508 9djvd.exe 3568 9rflrxr.exe 4764 7flrxxf.exe 400 tttttn.exe 4524 3bhhbn.exe 4364 ppvdv.exe 5040 vjvvv.exe 452 rfrrrrr.exe 3712 5bhhtb.exe 912 pppvd.exe 864 7djvp.exe 3700 rlflrxf.exe 1620 1flrrlr.exe 4892 bthhhn.exe 3508 bthhht.exe 5052 jjjjp.exe 4024 rxxrlfx.exe 5076 xflllfl.exe 4624 htttnn.exe 320 nhbbbb.exe 2532 djpjp.exe 2192 rxffxfr.exe 1204 3ntttt.exe 1752 thttnn.exe 2436 vdvpp.exe 4912 3vddv.exe 3784 flrrxfl.exe 5048 1hbbtt.exe 2668 hnbtbh.exe 3524 dppdd.exe -
resource yara_rule behavioral2/memory/388-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/888-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/688-517-0x0000000000400000-0x000000000042A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 388 wrote to memory of 888 388 99150fdcd3e88cf74df43f193c4d9d64_JaffaCakes118.exe 83 PID 388 wrote to memory of 888 388 99150fdcd3e88cf74df43f193c4d9d64_JaffaCakes118.exe 83 PID 388 wrote to memory of 888 388 99150fdcd3e88cf74df43f193c4d9d64_JaffaCakes118.exe 83 PID 888 wrote to memory of 1664 888 7frlllr.exe 84 PID 888 wrote to memory of 1664 888 7frlllr.exe 84 PID 888 wrote to memory of 1664 888 7frlllr.exe 84 PID 1664 wrote to memory of 908 1664 bnttnh.exe 85 PID 1664 wrote to memory of 908 1664 bnttnh.exe 85 PID 1664 wrote to memory of 908 1664 bnttnh.exe 85 PID 908 wrote to memory of 4848 908 dpddv.exe 86 PID 908 wrote to memory of 4848 908 dpddv.exe 86 PID 908 wrote to memory of 4848 908 dpddv.exe 86 PID 4848 wrote to memory of 552 4848 pdjjp.exe 87 PID 4848 wrote to memory of 552 4848 pdjjp.exe 87 PID 4848 wrote to memory of 552 4848 pdjjp.exe 87 PID 552 wrote to memory of 1524 552 fxrlrrx.exe 88 PID 552 wrote to memory of 1524 552 fxrlrrx.exe 88 PID 552 wrote to memory of 1524 552 fxrlrrx.exe 88 PID 1524 wrote to memory of 3316 1524 9jvvv.exe 89 PID 1524 wrote to memory of 3316 1524 9jvvv.exe 89 PID 1524 wrote to memory of 3316 1524 9jvvv.exe 89 PID 3316 wrote to memory of 4024 3316 hhbbnb.exe 90 PID 3316 wrote to memory of 4024 3316 hhbbnb.exe 90 PID 3316 wrote to memory of 4024 3316 hhbbnb.exe 90 PID 4024 wrote to memory of 3236 4024 9vjjp.exe 91 PID 4024 wrote to memory of 3236 4024 9vjjp.exe 91 PID 4024 wrote to memory of 3236 4024 9vjjp.exe 91 PID 3236 wrote to memory of 2536 3236 rllrflx.exe 93 PID 3236 wrote to memory of 2536 3236 rllrflx.exe 93 PID 3236 wrote to memory of 2536 3236 rllrflx.exe 93 PID 2536 wrote to memory of 3992 2536 hhnnnt.exe 94 PID 2536 wrote to memory of 3992 2536 hhnnnt.exe 94 PID 2536 wrote to memory of 3992 2536 hhnnnt.exe 94 PID 3992 wrote to memory of 1804 3992 rlrrrfl.exe 96 PID 3992 wrote to memory of 1804 3992 rlrrrfl.exe 96 PID 3992 wrote to memory of 1804 3992 rlrrrfl.exe 96 PID 1804 wrote to memory of 3216 1804 nhbbtb.exe 97 PID 1804 wrote to memory of 3216 1804 nhbbtb.exe 97 PID 1804 wrote to memory of 3216 1804 nhbbtb.exe 97 PID 3216 wrote to memory of 4912 3216 dvdjj.exe 98 PID 3216 wrote to memory of 4912 3216 dvdjj.exe 98 PID 3216 wrote to memory of 4912 3216 dvdjj.exe 98 PID 4912 wrote to memory of 3784 4912 rrllrrr.exe 99 PID 4912 wrote to memory of 3784 4912 rrllrrr.exe 99 PID 4912 wrote to memory of 3784 4912 rrllrrr.exe 99 PID 3784 wrote to memory of 4008 3784 hbhhbh.exe 100 PID 3784 wrote to memory of 4008 3784 hbhhbh.exe 100 PID 3784 wrote to memory of 4008 3784 hbhhbh.exe 100 PID 4008 wrote to memory of 3228 4008 hbthht.exe 101 PID 4008 wrote to memory of 3228 4008 hbthht.exe 101 PID 4008 wrote to memory of 3228 4008 hbthht.exe 101 PID 3228 wrote to memory of 760 3228 vpppj.exe 102 PID 3228 wrote to memory of 760 3228 vpppj.exe 102 PID 3228 wrote to memory of 760 3228 vpppj.exe 102 PID 760 wrote to memory of 4424 760 xrfxrxx.exe 103 PID 760 wrote to memory of 4424 760 xrfxrxx.exe 103 PID 760 wrote to memory of 4424 760 xrfxrxx.exe 103 PID 4424 wrote to memory of 4332 4424 lxffxxx.exe 104 PID 4424 wrote to memory of 4332 4424 lxffxxx.exe 104 PID 4424 wrote to memory of 4332 4424 lxffxxx.exe 104 PID 4332 wrote to memory of 3744 4332 djdjj.exe 105 PID 4332 wrote to memory of 3744 4332 djdjj.exe 105 PID 4332 wrote to memory of 3744 4332 djdjj.exe 105 PID 3744 wrote to memory of 1428 3744 rrxxflr.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\99150fdcd3e88cf74df43f193c4d9d64_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\99150fdcd3e88cf74df43f193c4d9d64_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\7frlllr.exec:\7frlllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\bnttnh.exec:\bnttnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\dpddv.exec:\dpddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\pdjjp.exec:\pdjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\9jvvv.exec:\9jvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\hhbbnb.exec:\hhbbnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\9vjjp.exec:\9vjjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\rllrflx.exec:\rllrflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\hhnnnt.exec:\hhnnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\rlrrrfl.exec:\rlrrrfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\nhbbtb.exec:\nhbbtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\dvdjj.exec:\dvdjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\rrllrrr.exec:\rrllrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\hbhhbh.exec:\hbhhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\hbthht.exec:\hbthht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\vpppj.exec:\vpppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\xrfxrxx.exec:\xrfxrxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\lxffxxx.exec:\lxffxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\djdjj.exec:\djdjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\rrxxflr.exec:\rrxxflr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\5lxlrrr.exec:\5lxlrrr.exe23⤵
- Executes dropped EXE
PID:1428 -
\??\c:\5thhhh.exec:\5thhhh.exe24⤵
- Executes dropped EXE
PID:2040 -
\??\c:\fflfffr.exec:\fflfffr.exe25⤵
- Executes dropped EXE
PID:3472 -
\??\c:\pppvp.exec:\pppvp.exe26⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jppdj.exec:\jppdj.exe27⤵
- Executes dropped EXE
PID:4396 -
\??\c:\fxxfflf.exec:\fxxfflf.exe28⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xxlllll.exec:\xxlllll.exe29⤵
- Executes dropped EXE
PID:4536 -
\??\c:\tbbbnt.exec:\tbbbnt.exe30⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dpdjp.exec:\dpdjp.exe31⤵
- Executes dropped EXE
PID:4784 -
\??\c:\5jvvv.exec:\5jvvv.exe32⤵
- Executes dropped EXE
PID:4676 -
\??\c:\lfrxfxf.exec:\lfrxfxf.exe33⤵
- Executes dropped EXE
PID:3716 -
\??\c:\htbbbb.exec:\htbbbb.exe34⤵
- Executes dropped EXE
PID:2628 -
\??\c:\btbbhn.exec:\btbbhn.exe35⤵
- Executes dropped EXE
PID:872 -
\??\c:\9djvd.exec:\9djvd.exe36⤵
- Executes dropped EXE
PID:1508 -
\??\c:\9rflrxr.exec:\9rflrxr.exe37⤵
- Executes dropped EXE
PID:3568 -
\??\c:\7flrxxf.exec:\7flrxxf.exe38⤵
- Executes dropped EXE
PID:4764 -
\??\c:\tttttn.exec:\tttttn.exe39⤵
- Executes dropped EXE
PID:400 -
\??\c:\3bhhbn.exec:\3bhhbn.exe40⤵
- Executes dropped EXE
PID:4524 -
\??\c:\ppvdv.exec:\ppvdv.exe41⤵
- Executes dropped EXE
PID:4364 -
\??\c:\vjvvv.exec:\vjvvv.exe42⤵
- Executes dropped EXE
PID:5040 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe43⤵
- Executes dropped EXE
PID:452 -
\??\c:\5bhhtb.exec:\5bhhtb.exe44⤵
- Executes dropped EXE
PID:3712 -
\??\c:\pppvd.exec:\pppvd.exe45⤵
- Executes dropped EXE
PID:912 -
\??\c:\7djvp.exec:\7djvp.exe46⤵
- Executes dropped EXE
PID:864 -
\??\c:\rlflrxf.exec:\rlflrxf.exe47⤵
- Executes dropped EXE
PID:3700 -
\??\c:\1flrrlr.exec:\1flrrlr.exe48⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bthhhn.exec:\bthhhn.exe49⤵
- Executes dropped EXE
PID:4892 -
\??\c:\bthhht.exec:\bthhht.exe50⤵
- Executes dropped EXE
PID:3508 -
\??\c:\jjjjp.exec:\jjjjp.exe51⤵
- Executes dropped EXE
PID:5052 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe52⤵
- Executes dropped EXE
PID:4024 -
\??\c:\xflllfl.exec:\xflllfl.exe53⤵
- Executes dropped EXE
PID:5076 -
\??\c:\htttnn.exec:\htttnn.exe54⤵
- Executes dropped EXE
PID:4624 -
\??\c:\nhbbbb.exec:\nhbbbb.exe55⤵
- Executes dropped EXE
PID:320 -
\??\c:\djpjp.exec:\djpjp.exe56⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rxffxfr.exec:\rxffxfr.exe57⤵
- Executes dropped EXE
PID:2192 -
\??\c:\3ntttt.exec:\3ntttt.exe58⤵
- Executes dropped EXE
PID:1204 -
\??\c:\thttnn.exec:\thttnn.exe59⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vdvpp.exec:\vdvpp.exe60⤵
- Executes dropped EXE
PID:2436 -
\??\c:\3vddv.exec:\3vddv.exe61⤵
- Executes dropped EXE
PID:4912 -
\??\c:\flrrxfl.exec:\flrrxfl.exe62⤵
- Executes dropped EXE
PID:3784 -
\??\c:\1hbbtt.exec:\1hbbtt.exe63⤵
- Executes dropped EXE
PID:5048 -
\??\c:\hnbtbh.exec:\hnbtbh.exe64⤵
- Executes dropped EXE
PID:2668 -
\??\c:\dppdd.exec:\dppdd.exe65⤵
- Executes dropped EXE
PID:3524 -
\??\c:\ppppp.exec:\ppppp.exe66⤵PID:1900
-
\??\c:\bnttbb.exec:\bnttbb.exe67⤵PID:1584
-
\??\c:\vpppj.exec:\vpppj.exe68⤵PID:4048
-
\??\c:\ppjpd.exec:\ppjpd.exe69⤵PID:4424
-
\??\c:\fflllrx.exec:\fflllrx.exe70⤵PID:3012
-
\??\c:\ntthnb.exec:\ntthnb.exe71⤵PID:1236
-
\??\c:\nhnntb.exec:\nhnntb.exe72⤵PID:2504
-
\??\c:\pvddp.exec:\pvddp.exe73⤵PID:1608
-
\??\c:\xrllllr.exec:\xrllllr.exe74⤵PID:4860
-
\??\c:\rlffxfx.exec:\rlffxfx.exe75⤵PID:1924
-
\??\c:\thnnnb.exec:\thnnnb.exe76⤵PID:1136
-
\??\c:\hbhhbb.exec:\hbhhbb.exe77⤵PID:2784
-
\??\c:\pvdjj.exec:\pvdjj.exe78⤵PID:4488
-
\??\c:\vdpvv.exec:\vdpvv.exe79⤵PID:4016
-
\??\c:\flxfxff.exec:\flxfxff.exe80⤵PID:2660
-
\??\c:\bbhhhn.exec:\bbhhhn.exe81⤵PID:4252
-
\??\c:\tnbntb.exec:\tnbntb.exe82⤵PID:1060
-
\??\c:\9jvvv.exec:\9jvvv.exe83⤵PID:4120
-
\??\c:\xlrxxlf.exec:\xlrxxlf.exe84⤵PID:4756
-
\??\c:\bbthhn.exec:\bbthhn.exe85⤵PID:4988
-
\??\c:\hnbtth.exec:\hnbtth.exe86⤵PID:2724
-
\??\c:\dpdjd.exec:\dpdjd.exe87⤵PID:2628
-
\??\c:\ddjjp.exec:\ddjjp.exe88⤵PID:1048
-
\??\c:\ffrrrxx.exec:\ffrrrxx.exe89⤵PID:1508
-
\??\c:\bbthtb.exec:\bbthtb.exe90⤵PID:3568
-
\??\c:\hthhhn.exec:\hthhhn.exe91⤵PID:1240
-
\??\c:\jdddd.exec:\jdddd.exe92⤵PID:400
-
\??\c:\jjppj.exec:\jjppj.exe93⤵PID:4524
-
\??\c:\xxllrll.exec:\xxllrll.exe94⤵PID:4364
-
\??\c:\xlxfxff.exec:\xlxfxff.exe95⤵PID:3872
-
\??\c:\hhtbbh.exec:\hhtbbh.exe96⤵PID:2560
-
\??\c:\bbhnnn.exec:\bbhnnn.exe97⤵PID:508
-
\??\c:\vvddv.exec:\vvddv.exe98⤵PID:3592
-
\??\c:\pdpvd.exec:\pdpvd.exe99⤵PID:1696
-
\??\c:\rxrxxfl.exec:\rxrxxfl.exe100⤵PID:5064
-
\??\c:\lxfxffl.exec:\lxfxffl.exe101⤵PID:4840
-
\??\c:\hbnntt.exec:\hbnntt.exe102⤵PID:2576
-
\??\c:\nnntbh.exec:\nnntbh.exe103⤵PID:4852
-
\??\c:\dpppj.exec:\dpppj.exe104⤵PID:4944
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe105⤵PID:2700
-
\??\c:\9lrxxfl.exec:\9lrxxfl.exe106⤵PID:4408
-
\??\c:\tntttb.exec:\tntttb.exe107⤵PID:1632
-
\??\c:\1tbtnt.exec:\1tbtnt.exe108⤵PID:2236
-
\??\c:\dpvdd.exec:\dpvdd.exe109⤵PID:4736
-
\??\c:\rffxxrr.exec:\rffxxrr.exe110⤵PID:1372
-
\??\c:\hhbttn.exec:\hhbttn.exe111⤵PID:1204
-
\??\c:\bbhhnt.exec:\bbhhnt.exe112⤵PID:4292
-
\??\c:\ddppj.exec:\ddppj.exe113⤵PID:2716
-
\??\c:\dvddv.exec:\dvddv.exe114⤵PID:4912
-
\??\c:\lllllrx.exec:\lllllrx.exe115⤵PID:3784
-
\??\c:\nbtbbh.exec:\nbtbbh.exe116⤵PID:5048
-
\??\c:\dvddd.exec:\dvddd.exe117⤵PID:3884
-
\??\c:\vvddd.exec:\vvddd.exe118⤵PID:2260
-
\??\c:\7xxffll.exec:\7xxffll.exe119⤵PID:2204
-
\??\c:\bbntbh.exec:\bbntbh.exe120⤵PID:1584
-
\??\c:\thtnhb.exec:\thtnhb.exe121⤵PID:3292
-
\??\c:\jjvvd.exec:\jjvvd.exe122⤵PID:1980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-