Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/06/2024, 17:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd0a688d80e752f758d1b8e7b640794c_JaffaCakes118.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target bd0a688d80e752f758d1b8e7b640794c_JaffaCakes118.exe
- Size 203KB
- Sample240618-vm5beawgnp
- SHA256 9879badfb3b0827c9a245417cb87f054bbe1f3993093ff15396c87b727ebd5f1
- MD5 bd0a688d80e752f758d1b8e7b640794c
- SHA1 64715a2f36aa565c172d1c96a557ef014f6ccdb6
- SHA512 b1c7fe2e3c39d46722a738a78df00acace5767af03011e67132c0fdbb262348e88e53cf7990576eed6ee1ef2bd3c14bbca1f25591cb4bff4807c81af41448903
- SSDEEP 1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqyEzOICBZHFS15NV70wiwm:PhOm2sI93UufdC67cihEzoY3NY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/8-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2804-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1324-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/788-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/708-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-370-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/948-384-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-397-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-398-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-417-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-421-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-423-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-447-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-477-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-481-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-495-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-523-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-558-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-618-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-644-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-675-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-685-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/692-763-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-767-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-892-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-896-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-912-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1428-946-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 8 fxxrlll.exe 920 nbbtbb.exe 664 hbtnnn.exe 4468 3pvpj.exe 3708 pjvpp.exe 4544 fxrfxlr.exe 2804 btbbbb.exe 4572 7tbbhb.exe 116 5vjdd.exe 4700 vjdvp.exe 1916 3rfxfff.exe 5088 lxxrfxl.exe 4136 1hhbnn.exe 2740 nhhbnn.exe 1160 hbthbb.exe 3948 1pvjv.exe 1996 xflxrlf.exe 1148 hhbtth.exe 1248 xlxrlfr.exe 5076 nbnhbt.exe 3740 jvjdd.exe 4904 bbnhbt.exe 4080 vvvpj.exe 3952 rlrlffr.exe 4020 9nbtbt.exe 3516 thhnbb.exe 1652 djppj.exe 3348 tnbtbn.exe 3656 ppvpp.exe 316 thhthh.exe 1324 3xrlrrl.exe 800 ffffxxr.exe 2272 rlrllxr.exe 5080 ntbtbb.exe 3472 9xrlxxr.exe 788 7flfllf.exe 3428 dvpjd.exe 1440 thtnnh.exe 3044 5hhbtn.exe 4396 vvvvj.exe 4860 fxrlxxr.exe 1328 5xffffx.exe 5052 ntbhbb.exe 4812 jvdvp.exe 4964 3ddvj.exe 2332 xffxllf.exe 4988 tntnhh.exe 4660 btbtnn.exe 2800 dvvpd.exe 5044 fxlfxfr.exe 3260 ttttnn.exe 3176 5dddp.exe 3156 dpvpp.exe 708 hbbnnn.exe 4876 hbbhbh.exe 3032 jdvpj.exe 920 xflfrrx.exe 2368 fxlfrrl.exe 4044 btthhb.exe 2340 xrfxxrx.exe 2300 rrxrrll.exe 3180 5nnhbt.exe 1596 vvvpj.exe 1708 7lxrlll.exe -
resource yara_rule behavioral2/memory/8-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2804-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/800-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/788-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/708-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-370-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/948-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-397-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-398-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-417-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-421-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-423-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-439-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-443-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-447-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-466-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-473-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-477-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-481-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-495-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-523-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-539-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-558-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-562-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-618-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-622-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4556 wrote to memory of 8 4556 bd0a688d80e752f758d1b8e7b640794c_JaffaCakes118.exe 81 PID 4556 wrote to memory of 8 4556 bd0a688d80e752f758d1b8e7b640794c_JaffaCakes118.exe 81 PID 4556 wrote to memory of 8 4556 bd0a688d80e752f758d1b8e7b640794c_JaffaCakes118.exe 81 PID 8 wrote to memory of 920 8 fxxrlll.exe 82 PID 8 wrote to memory of 920 8 fxxrlll.exe 82 PID 8 wrote to memory of 920 8 fxxrlll.exe 82 PID 920 wrote to memory of 664 920 nbbtbb.exe 83 PID 920 wrote to memory of 664 920 nbbtbb.exe 83 PID 920 wrote to memory of 664 920 nbbtbb.exe 83 PID 664 wrote to memory of 4468 664 hbtnnn.exe 84 PID 664 wrote to memory of 4468 664 hbtnnn.exe 84 PID 664 wrote to memory of 4468 664 hbtnnn.exe 84 PID 4468 wrote to memory of 3708 4468 3pvpj.exe 85 PID 4468 wrote to memory of 3708 4468 3pvpj.exe 85 PID 4468 wrote to memory of 3708 4468 3pvpj.exe 85 PID 3708 wrote to memory of 4544 3708 pjvpp.exe 86 PID 3708 wrote to memory of 4544 3708 pjvpp.exe 86 PID 3708 wrote to memory of 4544 3708 pjvpp.exe 86 PID 4544 wrote to memory of 2804 4544 fxrfxlr.exe 87 PID 4544 wrote to memory of 2804 4544 fxrfxlr.exe 87 PID 4544 wrote to memory of 2804 4544 fxrfxlr.exe 87 PID 2804 wrote to memory of 4572 2804 btbbbb.exe 88 PID 2804 wrote to memory of 4572 2804 btbbbb.exe 88 PID 2804 wrote to memory of 4572 2804 btbbbb.exe 88 PID 4572 wrote to memory of 116 4572 7tbbhb.exe 89 PID 4572 wrote to memory of 116 4572 7tbbhb.exe 89 PID 4572 wrote to memory of 116 4572 7tbbhb.exe 89 PID 116 wrote to memory of 4700 116 5vjdd.exe 90 PID 116 wrote to memory of 4700 116 5vjdd.exe 90 PID 116 wrote to memory of 4700 116 5vjdd.exe 90 PID 4700 wrote to memory of 1916 4700 vjdvp.exe 91 PID 4700 wrote to memory of 1916 4700 vjdvp.exe 91 PID 4700 wrote to memory of 1916 4700 vjdvp.exe 91 PID 1916 wrote to memory of 5088 1916 3rfxfff.exe 92 PID 1916 wrote to memory of 5088 1916 3rfxfff.exe 92 PID 1916 wrote to memory of 5088 1916 3rfxfff.exe 92 PID 5088 wrote to memory of 4136 5088 lxxrfxl.exe 93 PID 5088 wrote to memory of 4136 5088 lxxrfxl.exe 93 PID 5088 wrote to memory of 4136 5088 lxxrfxl.exe 93 PID 4136 wrote to memory of 2740 4136 1hhbnn.exe 94 PID 4136 wrote to memory of 2740 4136 1hhbnn.exe 94 PID 4136 wrote to memory of 2740 4136 1hhbnn.exe 94 PID 2740 wrote to memory of 1160 2740 nhhbnn.exe 95 PID 2740 wrote to memory of 1160 2740 nhhbnn.exe 95 PID 2740 wrote to memory of 1160 2740 nhhbnn.exe 95 PID 1160 wrote to memory of 3948 1160 hbthbb.exe 96 PID 1160 wrote to memory of 3948 1160 hbthbb.exe 96 PID 1160 wrote to memory of 3948 1160 hbthbb.exe 96 PID 3948 wrote to memory of 1996 3948 1pvjv.exe 97 PID 3948 wrote to memory of 1996 3948 1pvjv.exe 97 PID 3948 wrote to memory of 1996 3948 1pvjv.exe 97 PID 1996 wrote to memory of 1148 1996 xflxrlf.exe 98 PID 1996 wrote to memory of 1148 1996 xflxrlf.exe 98 PID 1996 wrote to memory of 1148 1996 xflxrlf.exe 98 PID 1148 wrote to memory of 1248 1148 hhbtth.exe 99 PID 1148 wrote to memory of 1248 1148 hhbtth.exe 99 PID 1148 wrote to memory of 1248 1148 hhbtth.exe 99 PID 1248 wrote to memory of 5076 1248 xlxrlfr.exe 100 PID 1248 wrote to memory of 5076 1248 xlxrlfr.exe 100 PID 1248 wrote to memory of 5076 1248 xlxrlfr.exe 100 PID 5076 wrote to memory of 3740 5076 nbnhbt.exe 101 PID 5076 wrote to memory of 3740 5076 nbnhbt.exe 101 PID 5076 wrote to memory of 3740 5076 nbnhbt.exe 101 PID 3740 wrote to memory of 4904 3740 jvjdd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd0a688d80e752f758d1b8e7b640794c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd0a688d80e752f758d1b8e7b640794c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\fxxrlll.exec:\fxxrlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\nbbtbb.exec:\nbbtbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\hbtnnn.exec:\hbtnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\3pvpj.exec:\3pvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\pjvpp.exec:\pjvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\fxrfxlr.exec:\fxrfxlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\btbbbb.exec:\btbbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\7tbbhb.exec:\7tbbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\5vjdd.exec:\5vjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\vjdvp.exec:\vjdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\3rfxfff.exec:\3rfxfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\lxxrfxl.exec:\lxxrfxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\1hhbnn.exec:\1hhbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\nhhbnn.exec:\nhhbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\hbthbb.exec:\hbthbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\1pvjv.exec:\1pvjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\xflxrlf.exec:\xflxrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\hhbtth.exec:\hhbtth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\xlxrlfr.exec:\xlxrlfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\nbnhbt.exec:\nbnhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\jvjdd.exec:\jvjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\bbnhbt.exec:\bbnhbt.exe23⤵
- Executes dropped EXE
PID:4904 -
\??\c:\vvvpj.exec:\vvvpj.exe24⤵
- Executes dropped EXE
PID:4080 -
\??\c:\rlrlffr.exec:\rlrlffr.exe25⤵
- Executes dropped EXE
PID:3952 -
\??\c:\9nbtbt.exec:\9nbtbt.exe26⤵
- Executes dropped EXE
PID:4020 -
\??\c:\thhnbb.exec:\thhnbb.exe27⤵
- Executes dropped EXE
PID:3516 -
\??\c:\djppj.exec:\djppj.exe28⤵
- Executes dropped EXE
PID:1652 -
\??\c:\tnbtbn.exec:\tnbtbn.exe29⤵
- Executes dropped EXE
PID:3348 -
\??\c:\ppvpp.exec:\ppvpp.exe30⤵
- Executes dropped EXE
PID:3656 -
\??\c:\thhthh.exec:\thhthh.exe31⤵
- Executes dropped EXE
PID:316 -
\??\c:\3xrlrrl.exec:\3xrlrrl.exe32⤵
- Executes dropped EXE
PID:1324 -
\??\c:\ffffxxr.exec:\ffffxxr.exe33⤵
- Executes dropped EXE
PID:800 -
\??\c:\rlrllxr.exec:\rlrllxr.exe34⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ntbtbb.exec:\ntbtbb.exe35⤵
- Executes dropped EXE
PID:5080 -
\??\c:\9xrlxxr.exec:\9xrlxxr.exe36⤵
- Executes dropped EXE
PID:3472 -
\??\c:\7flfllf.exec:\7flfllf.exe37⤵
- Executes dropped EXE
PID:788 -
\??\c:\dvpjd.exec:\dvpjd.exe38⤵
- Executes dropped EXE
PID:3428 -
\??\c:\thtnnh.exec:\thtnnh.exe39⤵
- Executes dropped EXE
PID:1440 -
\??\c:\5hhbtn.exec:\5hhbtn.exe40⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vvvvj.exec:\vvvvj.exe41⤵
- Executes dropped EXE
PID:4396 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe42⤵
- Executes dropped EXE
PID:4860 -
\??\c:\5xffffx.exec:\5xffffx.exe43⤵
- Executes dropped EXE
PID:1328 -
\??\c:\ntbhbb.exec:\ntbhbb.exe44⤵
- Executes dropped EXE
PID:5052 -
\??\c:\jvdvp.exec:\jvdvp.exe45⤵
- Executes dropped EXE
PID:4812 -
\??\c:\3ddvj.exec:\3ddvj.exe46⤵
- Executes dropped EXE
PID:4964 -
\??\c:\xffxllf.exec:\xffxllf.exe47⤵
- Executes dropped EXE
PID:2332 -
\??\c:\tntnhh.exec:\tntnhh.exe48⤵
- Executes dropped EXE
PID:4988 -
\??\c:\btbtnn.exec:\btbtnn.exe49⤵
- Executes dropped EXE
PID:4660 -
\??\c:\dvvpd.exec:\dvvpd.exe50⤵
- Executes dropped EXE
PID:2800 -
\??\c:\fxlfxfr.exec:\fxlfxfr.exe51⤵
- Executes dropped EXE
PID:5044 -
\??\c:\ttttnn.exec:\ttttnn.exe52⤵
- Executes dropped EXE
PID:3260 -
\??\c:\5dddp.exec:\5dddp.exe53⤵
- Executes dropped EXE
PID:3176 -
\??\c:\dpvpp.exec:\dpvpp.exe54⤵
- Executes dropped EXE
PID:3156 -
\??\c:\7lrrfxr.exec:\7lrrfxr.exe55⤵PID:1488
-
\??\c:\hbbnnn.exec:\hbbnnn.exe56⤵
- Executes dropped EXE
PID:708 -
\??\c:\hbbhbh.exec:\hbbhbh.exe57⤵
- Executes dropped EXE
PID:4876 -
\??\c:\jdvpj.exec:\jdvpj.exe58⤵
- Executes dropped EXE
PID:3032 -
\??\c:\xflfrrx.exec:\xflfrrx.exe59⤵
- Executes dropped EXE
PID:920 -
\??\c:\fxlfrrl.exec:\fxlfrrl.exe60⤵
- Executes dropped EXE
PID:2368 -
\??\c:\btthhb.exec:\btthhb.exe61⤵
- Executes dropped EXE
PID:4044 -
\??\c:\xrfxxrx.exec:\xrfxxrx.exe62⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rrxrrll.exec:\rrxrrll.exe63⤵
- Executes dropped EXE
PID:2300 -
\??\c:\5nnhbt.exec:\5nnhbt.exe64⤵
- Executes dropped EXE
PID:3180 -
\??\c:\vvvpj.exec:\vvvpj.exe65⤵
- Executes dropped EXE
PID:1596 -
\??\c:\7lxrlll.exec:\7lxrlll.exe66⤵
- Executes dropped EXE
PID:1708 -
\??\c:\9bnhbt.exec:\9bnhbt.exe67⤵PID:2824
-
\??\c:\dppjj.exec:\dppjj.exe68⤵PID:4700
-
\??\c:\pvjdv.exec:\pvjdv.exe69⤵PID:1916
-
\??\c:\rrrlrrl.exec:\rrrlrrl.exe70⤵PID:2732
-
\??\c:\rrfflfx.exec:\rrfflfx.exe71⤵PID:3944
-
\??\c:\nhhhbb.exec:\nhhhbb.exe72⤵PID:692
-
\??\c:\5btthb.exec:\5btthb.exe73⤵PID:4936
-
\??\c:\pdjdv.exec:\pdjdv.exe74⤵PID:2796
-
\??\c:\lrrlffx.exec:\lrrlffx.exe75⤵PID:4764
-
\??\c:\llrllff.exec:\llrllff.exe76⤵PID:4056
-
\??\c:\nhhhbb.exec:\nhhhbb.exe77⤵PID:3844
-
\??\c:\hhnnnn.exec:\hhnnnn.exe78⤵PID:4768
-
\??\c:\7djdj.exec:\7djdj.exe79⤵PID:516
-
\??\c:\dvppv.exec:\dvppv.exe80⤵PID:3704
-
\??\c:\lxflxxf.exec:\lxflxxf.exe81⤵PID:3604
-
\??\c:\btnhnn.exec:\btnhnn.exe82⤵PID:3964
-
\??\c:\vjvpj.exec:\vjvpj.exe83⤵PID:3592
-
\??\c:\5jjdp.exec:\5jjdp.exe84⤵PID:4532
-
\??\c:\llfxlfr.exec:\llfxlfr.exe85⤵PID:3132
-
\??\c:\tntnnh.exec:\tntnnh.exe86⤵PID:2232
-
\??\c:\vddvj.exec:\vddvj.exe87⤵PID:4300
-
\??\c:\9dpjp.exec:\9dpjp.exe88⤵PID:1288
-
\??\c:\rlllxxl.exec:\rlllxxl.exe89⤵PID:4200
-
\??\c:\ttbttt.exec:\ttbttt.exe90⤵PID:3064
-
\??\c:\hhtnbb.exec:\hhtnbb.exe91⤵PID:948
-
\??\c:\ddjjj.exec:\ddjjj.exe92⤵PID:4516
-
\??\c:\7lfrlfr.exec:\7lfrlfr.exe93⤵PID:872
-
\??\c:\xflllll.exec:\xflllll.exe94⤵PID:1652
-
\??\c:\hbnntt.exec:\hbnntt.exe95⤵PID:4840
-
\??\c:\vpvpd.exec:\vpvpd.exe96⤵PID:4460
-
\??\c:\fxrlrrx.exec:\fxrlrrx.exe97⤵PID:1912
-
\??\c:\rlflfxx.exec:\rlflfxx.exe98⤵PID:316
-
\??\c:\hhntbb.exec:\hhntbb.exe99⤵PID:3116
-
\??\c:\pjjdj.exec:\pjjdj.exe100⤵PID:4436
-
\??\c:\pjpdv.exec:\pjpdv.exe101⤵PID:2164
-
\??\c:\rllfxxr.exec:\rllfxxr.exe102⤵PID:2040
-
\??\c:\tbnnhh.exec:\tbnnhh.exe103⤵PID:3540
-
\??\c:\hntnhh.exec:\hntnhh.exe104⤵PID:1112
-
\??\c:\lffxrll.exec:\lffxrll.exe105⤵PID:788
-
\??\c:\lrfrlfx.exec:\lrfrlfx.exe106⤵PID:3428
-
\??\c:\tnntnh.exec:\tnntnh.exe107⤵PID:1440
-
\??\c:\vdpdj.exec:\vdpdj.exe108⤵PID:3044
-
\??\c:\5dddp.exec:\5dddp.exe109⤵PID:4396
-
\??\c:\rrrrlff.exec:\rrrrlff.exe110⤵PID:3444
-
\??\c:\bbnhhh.exec:\bbnhhh.exe111⤵PID:4284
-
\??\c:\jdvjv.exec:\jdvjv.exe112⤵PID:4716
-
\??\c:\dvppd.exec:\dvppd.exe113⤵PID:4812
-
\??\c:\fffxfff.exec:\fffxfff.exe114⤵PID:1064
-
\??\c:\rlrlllf.exec:\rlrlllf.exe115⤵PID:1568
-
\??\c:\hbtnhb.exec:\hbtnhb.exe116⤵PID:4988
-
\??\c:\vpjdd.exec:\vpjdd.exe117⤵PID:3864
-
\??\c:\xfrrlff.exec:\xfrrlff.exe118⤵PID:4752
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe119⤵PID:1692
-
\??\c:\thnhbb.exec:\thnhbb.exe120⤵PID:3128
-
\??\c:\djvvp.exec:\djvvp.exe121⤵PID:1784
-
\??\c:\rlfxfxl.exec:\rlfxfxl.exe122⤵PID:4360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-