Analysis
-
max time kernel
81s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 06:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02966cde221edc545aa122f3c1319914_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
02966cde221edc545aa122f3c1319914_JaffaCakes118.exe
-
Size
125KB
-
MD5
02966cde221edc545aa122f3c1319914
-
SHA1
ac04aeb57a3431acaef3b8e26238956a5d64f9b9
-
SHA256
beea1bf635217a3dadfc2d9e513eae534c5694d33cf43ca4e2dc29e94d7a028c
-
SHA512
3a9898a6e8b50abe09711a304a6cf9201e4086342b16364a7a50fab11e7b29c9945042ebdc05fbf4213cee36d7bb4b1dd3dd7a5d0f5118df4703d71357394499
-
SSDEEP
3072:vhOm2sI93UufdC67ciIPvZd6fpoRFrDrz4briFQ8K+:vcm7ImGddXUZUf+3Si2+
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1932-0-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3928-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2468-14-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3996-26-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4272-28-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/316-35-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4264-42-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2216-49-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1180-57-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2288-67-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/904-69-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3836-79-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4348-86-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4816-91-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2764-96-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1684-101-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4204-113-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3312-117-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1280-127-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4512-145-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1332-149-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1644-155-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1464-166-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4748-175-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/640-185-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1948-190-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4280-203-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4640-207-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4440-214-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4840-218-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2308-222-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/336-230-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/336-234-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2544-238-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1008-242-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4556-246-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4892-254-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1400-261-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5104-265-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4528-271-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1824-279-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3560-293-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4404-317-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3664-327-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2412-335-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3720-342-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2640-366-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3088-370-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2004-384-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4488-394-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2544-415-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3528-440-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3528-444-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2920-472-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3304-486-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2196-510-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3088-538-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3088-542-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4764-606-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1576-625-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3824-672-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4784-730-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4448-801-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/452-873-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bnhbnh.exehnhtnn.exevdpjd.exenhbbhh.exe7ttntt.exethtnhn.exexxrrffr.exehhbthh.exenhttth.exepdvvv.exelrrllll.exehhtbtt.exepvdvv.exerffffff.exe9hnntn.exejdpdv.exerrrrxrr.exebthbhh.exejvppp.exedpjdd.exeffrlxlr.exeffxxlrr.exevvvvv.exerlllfxx.exeflxrrrl.exebthtnn.exedjjjv.exelfffrxx.exebtbbht.exe1hbttt.exe1ppjj.exellxllxx.exe3bbttt.exennhbbh.exepvjjj.exejjjjv.exexllfllf.exelflffff.exehhbbbb.exevvjjv.exevjvdd.exelllrrfx.exefxxrrxx.exe5nnhbb.exentbnnn.exeppjjd.exexxxlrrx.exebtbbhb.exehhhhbh.exejdpjp.exejvvpp.exerlxxxfl.exexxxxxxx.exetnnnhh.exetnnnnt.exevvppj.exejdjdv.exefrfllrr.exexfxlrrr.exennhbhh.exepddvd.exepjjdv.exelfrllll.exerxfffxf.exepid process 3928 bnhbnh.exe 2468 hnhtnn.exe 3996 vdpjd.exe 4272 nhbbhh.exe 316 7ttntt.exe 4264 thtnhn.exe 2216 xxrrffr.exe 4504 hhbthh.exe 1180 nhttth.exe 2288 pdvvv.exe 904 lrrllll.exe 3836 hhtbtt.exe 4348 pvdvv.exe 4816 rffffff.exe 2764 9hnntn.exe 1684 jdpdv.exe 4956 rrrrxrr.exe 4204 bthbhh.exe 3312 jvppp.exe 1480 dpjdd.exe 1280 ffrlxlr.exe 4396 ffxxlrr.exe 2028 vvvvv.exe 4512 rlllfxx.exe 1332 flxrrrl.exe 1644 bthtnn.exe 3244 djjjv.exe 1464 lfffrxx.exe 3732 btbbht.exe 4748 1hbttt.exe 640 1ppjj.exe 3936 llxllxx.exe 1948 3bbttt.exe 3600 nnhbbh.exe 1064 pvjjj.exe 2144 jjjjv.exe 4280 xllfllf.exe 4640 lflffff.exe 4440 hhbbbb.exe 4840 vvjjv.exe 2308 vjvdd.exe 4068 lllrrfx.exe 4676 fxxrrxx.exe 336 5nnhbb.exe 2544 ntbnnn.exe 1008 ppjjd.exe 4556 xxxlrrx.exe 412 btbbhb.exe 5100 hhhhbh.exe 4892 jdpjp.exe 5004 jvvpp.exe 1400 rlxxxfl.exe 5104 xxxxxxx.exe 4528 tnnnhh.exe 2748 tnnnnt.exe 1824 vvppj.exe 2260 jdjdv.exe 4484 frfllrr.exe 4348 xfxlrrr.exe 5060 nnhbhh.exe 3560 pddvd.exe 3184 pjjdv.exe 3712 lfrllll.exe 4956 rxfffxf.exe -
Processes:
resource yara_rule behavioral2/memory/1932-0-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3928-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2468-14-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3996-18-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3996-26-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4272-28-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/316-35-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2216-43-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4264-42-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2216-49-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1180-57-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2288-62-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2288-67-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/904-69-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3836-79-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4348-86-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4816-91-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2764-96-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1684-101-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4204-113-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3312-117-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1280-127-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4512-145-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1332-149-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1644-155-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1464-166-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4748-175-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/640-185-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1948-190-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4280-203-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4640-207-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4440-214-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4840-218-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2308-222-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4068-223-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/336-230-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/336-234-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2544-238-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1008-242-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4556-246-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4892-254-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1400-261-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5104-265-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4528-271-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2748-272-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1824-279-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3560-293-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4404-317-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3664-327-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2412-335-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3720-342-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3552-352-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4384-356-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2640-366-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3088-370-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2004-380-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2004-384-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4488-394-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1352-404-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2544-411-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2544-415-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3528-440-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3528-444-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2920-472-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
02966cde221edc545aa122f3c1319914_JaffaCakes118.exebnhbnh.exehnhtnn.exevdpjd.exenhbbhh.exe7ttntt.exethtnhn.exexxrrffr.exehhbthh.exenhttth.exepdvvv.exelrrllll.exehhtbtt.exepvdvv.exerffffff.exe9hnntn.exejdpdv.exerrrrxrr.exebthbhh.exejvppp.exedpjdd.exeffrlxlr.exedescription pid process target process PID 1932 wrote to memory of 3928 1932 02966cde221edc545aa122f3c1319914_JaffaCakes118.exe bnhbnh.exe PID 1932 wrote to memory of 3928 1932 02966cde221edc545aa122f3c1319914_JaffaCakes118.exe bnhbnh.exe PID 1932 wrote to memory of 3928 1932 02966cde221edc545aa122f3c1319914_JaffaCakes118.exe bnhbnh.exe PID 3928 wrote to memory of 2468 3928 bnhbnh.exe hnhtnn.exe PID 3928 wrote to memory of 2468 3928 bnhbnh.exe hnhtnn.exe PID 3928 wrote to memory of 2468 3928 bnhbnh.exe hnhtnn.exe PID 2468 wrote to memory of 3996 2468 hnhtnn.exe vdpjd.exe PID 2468 wrote to memory of 3996 2468 hnhtnn.exe vdpjd.exe PID 2468 wrote to memory of 3996 2468 hnhtnn.exe vdpjd.exe PID 3996 wrote to memory of 4272 3996 vdpjd.exe nhbbhh.exe PID 3996 wrote to memory of 4272 3996 vdpjd.exe nhbbhh.exe PID 3996 wrote to memory of 4272 3996 vdpjd.exe nhbbhh.exe PID 4272 wrote to memory of 316 4272 nhbbhh.exe 7ttntt.exe PID 4272 wrote to memory of 316 4272 nhbbhh.exe 7ttntt.exe PID 4272 wrote to memory of 316 4272 nhbbhh.exe 7ttntt.exe PID 316 wrote to memory of 4264 316 7ttntt.exe thtnhn.exe PID 316 wrote to memory of 4264 316 7ttntt.exe thtnhn.exe PID 316 wrote to memory of 4264 316 7ttntt.exe thtnhn.exe PID 4264 wrote to memory of 2216 4264 thtnhn.exe xxrrffr.exe PID 4264 wrote to memory of 2216 4264 thtnhn.exe xxrrffr.exe PID 4264 wrote to memory of 2216 4264 thtnhn.exe xxrrffr.exe PID 2216 wrote to memory of 4504 2216 xxrrffr.exe hhbthh.exe PID 2216 wrote to memory of 4504 2216 xxrrffr.exe hhbthh.exe PID 2216 wrote to memory of 4504 2216 xxrrffr.exe hhbthh.exe PID 4504 wrote to memory of 1180 4504 hhbthh.exe nhttth.exe PID 4504 wrote to memory of 1180 4504 hhbthh.exe nhttth.exe PID 4504 wrote to memory of 1180 4504 hhbthh.exe nhttth.exe PID 1180 wrote to memory of 2288 1180 nhttth.exe pdvvv.exe PID 1180 wrote to memory of 2288 1180 nhttth.exe pdvvv.exe PID 1180 wrote to memory of 2288 1180 nhttth.exe pdvvv.exe PID 2288 wrote to memory of 904 2288 pdvvv.exe lrrllll.exe PID 2288 wrote to memory of 904 2288 pdvvv.exe lrrllll.exe PID 2288 wrote to memory of 904 2288 pdvvv.exe lrrllll.exe PID 904 wrote to memory of 3836 904 lrrllll.exe hhtbtt.exe PID 904 wrote to memory of 3836 904 lrrllll.exe hhtbtt.exe PID 904 wrote to memory of 3836 904 lrrllll.exe hhtbtt.exe PID 3836 wrote to memory of 4348 3836 hhtbtt.exe pvdvv.exe PID 3836 wrote to memory of 4348 3836 hhtbtt.exe pvdvv.exe PID 3836 wrote to memory of 4348 3836 hhtbtt.exe pvdvv.exe PID 4348 wrote to memory of 4816 4348 pvdvv.exe rffffff.exe PID 4348 wrote to memory of 4816 4348 pvdvv.exe rffffff.exe PID 4348 wrote to memory of 4816 4348 pvdvv.exe rffffff.exe PID 4816 wrote to memory of 2764 4816 rffffff.exe 9hnntn.exe PID 4816 wrote to memory of 2764 4816 rffffff.exe 9hnntn.exe PID 4816 wrote to memory of 2764 4816 rffffff.exe 9hnntn.exe PID 2764 wrote to memory of 1684 2764 9hnntn.exe jdpdv.exe PID 2764 wrote to memory of 1684 2764 9hnntn.exe jdpdv.exe PID 2764 wrote to memory of 1684 2764 9hnntn.exe jdpdv.exe PID 1684 wrote to memory of 4956 1684 jdpdv.exe rrrrxrr.exe PID 1684 wrote to memory of 4956 1684 jdpdv.exe rrrrxrr.exe PID 1684 wrote to memory of 4956 1684 jdpdv.exe rrrrxrr.exe PID 4956 wrote to memory of 4204 4956 rrrrxrr.exe bthbhh.exe PID 4956 wrote to memory of 4204 4956 rrrrxrr.exe bthbhh.exe PID 4956 wrote to memory of 4204 4956 rrrrxrr.exe bthbhh.exe PID 4204 wrote to memory of 3312 4204 bthbhh.exe jvppp.exe PID 4204 wrote to memory of 3312 4204 bthbhh.exe jvppp.exe PID 4204 wrote to memory of 3312 4204 bthbhh.exe jvppp.exe PID 3312 wrote to memory of 1480 3312 jvppp.exe dpjdd.exe PID 3312 wrote to memory of 1480 3312 jvppp.exe dpjdd.exe PID 3312 wrote to memory of 1480 3312 jvppp.exe dpjdd.exe PID 1480 wrote to memory of 1280 1480 dpjdd.exe ffrlxlr.exe PID 1480 wrote to memory of 1280 1480 dpjdd.exe ffrlxlr.exe PID 1480 wrote to memory of 1280 1480 dpjdd.exe ffrlxlr.exe PID 1280 wrote to memory of 4396 1280 ffrlxlr.exe ffxxlrr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02966cde221edc545aa122f3c1319914_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02966cde221edc545aa122f3c1319914_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhbnh.exec:\bnhbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnhtnn.exec:\hnhtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdpjd.exec:\vdpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbbhh.exec:\nhbbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7ttntt.exec:\7ttntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thtnhn.exec:\thtnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrrffr.exec:\xxrrffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbthh.exec:\hhbthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhttth.exec:\nhttth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdvvv.exec:\pdvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrrllll.exec:\lrrllll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhtbtt.exec:\hhtbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvdvv.exec:\pvdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rffffff.exec:\rffffff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9hnntn.exec:\9hnntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdpdv.exec:\jdpdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrrrxrr.exec:\rrrrxrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bthbhh.exec:\bthbhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvppp.exec:\jvppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpjdd.exec:\dpjdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrlxlr.exec:\ffrlxlr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxxlrr.exec:\ffxxlrr.exe23⤵
- Executes dropped EXE
-
\??\c:\vvvvv.exec:\vvvvv.exe24⤵
- Executes dropped EXE
-
\??\c:\rlllfxx.exec:\rlllfxx.exe25⤵
- Executes dropped EXE
-
\??\c:\flxrrrl.exec:\flxrrrl.exe26⤵
- Executes dropped EXE
-
\??\c:\bthtnn.exec:\bthtnn.exe27⤵
- Executes dropped EXE
-
\??\c:\djjjv.exec:\djjjv.exe28⤵
- Executes dropped EXE
-
\??\c:\lfffrxx.exec:\lfffrxx.exe29⤵
- Executes dropped EXE
-
\??\c:\btbbht.exec:\btbbht.exe30⤵
- Executes dropped EXE
-
\??\c:\1hbttt.exec:\1hbttt.exe31⤵
- Executes dropped EXE
-
\??\c:\1ppjj.exec:\1ppjj.exe32⤵
- Executes dropped EXE
-
\??\c:\llxllxx.exec:\llxllxx.exe33⤵
- Executes dropped EXE
-
\??\c:\3bbttt.exec:\3bbttt.exe34⤵
- Executes dropped EXE
-
\??\c:\nnhbbh.exec:\nnhbbh.exe35⤵
- Executes dropped EXE
-
\??\c:\pvjjj.exec:\pvjjj.exe36⤵
- Executes dropped EXE
-
\??\c:\jjjjv.exec:\jjjjv.exe37⤵
- Executes dropped EXE
-
\??\c:\xllfllf.exec:\xllfllf.exe38⤵
- Executes dropped EXE
-
\??\c:\lflffff.exec:\lflffff.exe39⤵
- Executes dropped EXE
-
\??\c:\hhbbbb.exec:\hhbbbb.exe40⤵
- Executes dropped EXE
-
\??\c:\vvjjv.exec:\vvjjv.exe41⤵
- Executes dropped EXE
-
\??\c:\vjvdd.exec:\vjvdd.exe42⤵
- Executes dropped EXE
-
\??\c:\lllrrfx.exec:\lllrrfx.exe43⤵
- Executes dropped EXE
-
\??\c:\fxxrrxx.exec:\fxxrrxx.exe44⤵
- Executes dropped EXE
-
\??\c:\5nnhbb.exec:\5nnhbb.exe45⤵
- Executes dropped EXE
-
\??\c:\ntbnnn.exec:\ntbnnn.exe46⤵
- Executes dropped EXE
-
\??\c:\ppjjd.exec:\ppjjd.exe47⤵
- Executes dropped EXE
-
\??\c:\xxxlrrx.exec:\xxxlrrx.exe48⤵
- Executes dropped EXE
-
\??\c:\btbbhb.exec:\btbbhb.exe49⤵
- Executes dropped EXE
-
\??\c:\hhhhbh.exec:\hhhhbh.exe50⤵
- Executes dropped EXE
-
\??\c:\jdpjp.exec:\jdpjp.exe51⤵
- Executes dropped EXE
-
\??\c:\jvvpp.exec:\jvvpp.exe52⤵
- Executes dropped EXE
-
\??\c:\rlxxxfl.exec:\rlxxxfl.exe53⤵
- Executes dropped EXE
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe54⤵
- Executes dropped EXE
-
\??\c:\tnnnhh.exec:\tnnnhh.exe55⤵
- Executes dropped EXE
-
\??\c:\tnnnnt.exec:\tnnnnt.exe56⤵
- Executes dropped EXE
-
\??\c:\vvppj.exec:\vvppj.exe57⤵
- Executes dropped EXE
-
\??\c:\jdjdv.exec:\jdjdv.exe58⤵
- Executes dropped EXE
-
\??\c:\frfllrr.exec:\frfllrr.exe59⤵
- Executes dropped EXE
-
\??\c:\xfxlrrr.exec:\xfxlrrr.exe60⤵
- Executes dropped EXE
-
\??\c:\nnhbhh.exec:\nnhbhh.exe61⤵
- Executes dropped EXE
-
\??\c:\pddvd.exec:\pddvd.exe62⤵
- Executes dropped EXE
-
\??\c:\pjjdv.exec:\pjjdv.exe63⤵
- Executes dropped EXE
-
\??\c:\lfrllll.exec:\lfrllll.exe64⤵
- Executes dropped EXE
-
\??\c:\rxfffxf.exec:\rxfffxf.exe65⤵
- Executes dropped EXE
-
\??\c:\bnttnt.exec:\bnttnt.exe66⤵
-
\??\c:\tntnbb.exec:\tntnbb.exe67⤵
-
\??\c:\jpppp.exec:\jpppp.exe68⤵
-
\??\c:\vjjjd.exec:\vjjjd.exe69⤵
-
\??\c:\llrlffx.exec:\llrlffx.exe70⤵
-
\??\c:\tntttt.exec:\tntttt.exe71⤵
-
\??\c:\nhhbbb.exec:\nhhbbb.exe72⤵
-
\??\c:\ppppp.exec:\ppppp.exe73⤵
-
\??\c:\vvpjv.exec:\vvpjv.exe74⤵
-
\??\c:\7lxrrrx.exec:\7lxrrrx.exe75⤵
-
\??\c:\rlrlllx.exec:\rlrlllx.exe76⤵
-
\??\c:\bbnttb.exec:\bbnttb.exe77⤵
-
\??\c:\ppvdj.exec:\ppvdj.exe78⤵
-
\??\c:\9pdvv.exec:\9pdvv.exe79⤵
-
\??\c:\rxxxxff.exec:\rxxxxff.exe80⤵
-
\??\c:\lxxxrxr.exec:\lxxxrxr.exe81⤵
-
\??\c:\ttbbnb.exec:\ttbbnb.exe82⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe83⤵
-
\??\c:\7frlfll.exec:\7frlfll.exe84⤵
-
\??\c:\hhhhhn.exec:\hhhhhn.exe85⤵
-
\??\c:\jpdpv.exec:\jpdpv.exe86⤵
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe87⤵
-
\??\c:\7nbbbh.exec:\7nbbbh.exe88⤵
-
\??\c:\9djjj.exec:\9djjj.exe89⤵
-
\??\c:\lfffxrl.exec:\lfffxrl.exe90⤵
-
\??\c:\hhtbnn.exec:\hhtbnn.exe91⤵
-
\??\c:\ddpvj.exec:\ddpvj.exe92⤵
-
\??\c:\3lllfll.exec:\3lllfll.exe93⤵
-
\??\c:\9tbbtt.exec:\9tbbtt.exe94⤵
-
\??\c:\vjvvp.exec:\vjvvp.exe95⤵
-
\??\c:\ttnbtb.exec:\ttnbtb.exe96⤵
-
\??\c:\hhtttt.exec:\hhtttt.exe97⤵
-
\??\c:\jjpjd.exec:\jjpjd.exe98⤵
-
\??\c:\rfllfll.exec:\rfllfll.exe99⤵
-
\??\c:\1nnbtt.exec:\1nnbtt.exe100⤵
-
\??\c:\1vjdd.exec:\1vjdd.exe101⤵
-
\??\c:\fflfrrr.exec:\fflfrrr.exe102⤵
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe103⤵
-
\??\c:\htbhht.exec:\htbhht.exe104⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe105⤵
-
\??\c:\xrfxrrf.exec:\xrfxrrf.exe106⤵
-
\??\c:\rrfrrff.exec:\rrfrrff.exe107⤵
-
\??\c:\btnttt.exec:\btnttt.exe108⤵
-
\??\c:\3jpjd.exec:\3jpjd.exe109⤵
-
\??\c:\rlllfll.exec:\rlllfll.exe110⤵
-
\??\c:\bnbbbb.exec:\bnbbbb.exe111⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe112⤵
-
\??\c:\djppj.exec:\djppj.exe113⤵
-
\??\c:\hhtnhh.exec:\hhtnhh.exe114⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe115⤵
-
\??\c:\nhhnhn.exec:\nhhnhn.exe116⤵
-
\??\c:\ddpjd.exec:\ddpjd.exe117⤵
-
\??\c:\rlxxxff.exec:\rlxxxff.exe118⤵
-
\??\c:\lfxrrxx.exec:\lfxrrxx.exe119⤵
-
\??\c:\3ntnhh.exec:\3ntnhh.exe120⤵
-
\??\c:\tnnnnn.exec:\tnnnnn.exe121⤵
-
\??\c:\vvppj.exec:\vvppj.exe122⤵
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe123⤵
-
\??\c:\fflllll.exec:\fflllll.exe124⤵
-
\??\c:\bttbtb.exec:\bttbtb.exe125⤵
-
\??\c:\tttthh.exec:\tttthh.exe126⤵
-
\??\c:\jjvvp.exec:\jjvvp.exe127⤵
-
\??\c:\9xfxflr.exec:\9xfxflr.exe128⤵
-
\??\c:\lxllfrl.exec:\lxllfrl.exe129⤵
-
\??\c:\nhhhbt.exec:\nhhhbt.exe130⤵
-
\??\c:\ttttnt.exec:\ttttnt.exe131⤵
-
\??\c:\3pddp.exec:\3pddp.exe132⤵
-
\??\c:\rllfxrl.exec:\rllfxrl.exe133⤵
-
\??\c:\lfffxxl.exec:\lfffxxl.exe134⤵
-
\??\c:\nbhhhh.exec:\nbhhhh.exe135⤵
-
\??\c:\ppppp.exec:\ppppp.exe136⤵
-
\??\c:\dvvvj.exec:\dvvvj.exe137⤵
-
\??\c:\lrffxxx.exec:\lrffxxx.exe138⤵
-
\??\c:\hbbttn.exec:\hbbttn.exe139⤵
-
\??\c:\bhtnth.exec:\bhtnth.exe140⤵
-
\??\c:\djjjj.exec:\djjjj.exe141⤵
-
\??\c:\xffrlfx.exec:\xffrlfx.exe142⤵
-
\??\c:\lflxrxx.exec:\lflxrxx.exe143⤵
-
\??\c:\nntttt.exec:\nntttt.exe144⤵
-
\??\c:\bnhtnn.exec:\bnhtnn.exe145⤵
-
\??\c:\jpjjv.exec:\jpjjv.exe146⤵
-
\??\c:\lflfrll.exec:\lflfrll.exe147⤵
-
\??\c:\fxfflrr.exec:\fxfflrr.exe148⤵
-
\??\c:\9hhbnn.exec:\9hhbnn.exe149⤵
-
\??\c:\vppjv.exec:\vppjv.exe150⤵
-
\??\c:\5vddv.exec:\5vddv.exe151⤵
-
\??\c:\rfrlxxr.exec:\rfrlxxr.exe152⤵
-
\??\c:\nbhbtt.exec:\nbhbtt.exe153⤵
-
\??\c:\btbbnh.exec:\btbbnh.exe154⤵
-
\??\c:\5ddpj.exec:\5ddpj.exe155⤵
-
\??\c:\rrrlffl.exec:\rrrlffl.exe156⤵
-
\??\c:\bbbbnt.exec:\bbbbnt.exe157⤵
-
\??\c:\nhbbbh.exec:\nhbbbh.exe158⤵
-
\??\c:\vjddv.exec:\vjddv.exe159⤵
-
\??\c:\lxxrfxr.exec:\lxxrfxr.exe160⤵
-
\??\c:\xrflllf.exec:\xrflllf.exe161⤵
-
\??\c:\bbbbbb.exec:\bbbbbb.exe162⤵
-
\??\c:\vpdvj.exec:\vpdvj.exe163⤵
-
\??\c:\dpdvj.exec:\dpdvj.exe164⤵
-
\??\c:\1xfxrrr.exec:\1xfxrrr.exe165⤵
-
\??\c:\flxxxxx.exec:\flxxxxx.exe166⤵
-
\??\c:\hbnnhn.exec:\hbnnhn.exe167⤵
-
\??\c:\bnhbnn.exec:\bnhbnn.exe168⤵
-
\??\c:\djjvp.exec:\djjvp.exe169⤵
-
\??\c:\ddddd.exec:\ddddd.exe170⤵
-
\??\c:\rlrlfll.exec:\rlrlfll.exe171⤵
-
\??\c:\hhnttt.exec:\hhnttt.exe172⤵
-
\??\c:\tbbbbt.exec:\tbbbbt.exe173⤵
-
\??\c:\jpppd.exec:\jpppd.exe174⤵
-
\??\c:\xxrfxfx.exec:\xxrfxfx.exe175⤵
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe176⤵
-
\??\c:\9htttn.exec:\9htttn.exe177⤵
-
\??\c:\vddjp.exec:\vddjp.exe178⤵
-
\??\c:\pjddv.exec:\pjddv.exe179⤵
-
\??\c:\fxffrrr.exec:\fxffrrr.exe180⤵
-
\??\c:\xxlllrx.exec:\xxlllrx.exe181⤵
-
\??\c:\hbbbbb.exec:\hbbbbb.exe182⤵
-
\??\c:\7jddp.exec:\7jddp.exe183⤵
-
\??\c:\vpppv.exec:\vpppv.exe184⤵
-
\??\c:\rrxxrxl.exec:\rrxxrxl.exe185⤵
-
\??\c:\7xffxrl.exec:\7xffxrl.exe186⤵
-
\??\c:\btnhnb.exec:\btnhnb.exe187⤵
-
\??\c:\djjjv.exec:\djjjv.exe188⤵
-
\??\c:\jvvpp.exec:\jvvpp.exe189⤵
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe190⤵
-
\??\c:\bbhntt.exec:\bbhntt.exe191⤵
-
\??\c:\5jjvp.exec:\5jjvp.exe192⤵
-
\??\c:\ppdvp.exec:\ppdvp.exe193⤵
-
\??\c:\rxxrrrl.exec:\rxxrrrl.exe194⤵
-
\??\c:\flxxrrl.exec:\flxxrrl.exe195⤵
-
\??\c:\tntbbb.exec:\tntbbb.exe196⤵
-
\??\c:\hhhtnb.exec:\hhhtnb.exe197⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe198⤵
-
\??\c:\1vppd.exec:\1vppd.exe199⤵
-
\??\c:\rlxxrxx.exec:\rlxxrxx.exe200⤵
-
\??\c:\bhhnnn.exec:\bhhnnn.exe201⤵
-
\??\c:\tbnhnn.exec:\tbnhnn.exe202⤵
-
\??\c:\jpvvp.exec:\jpvvp.exe203⤵
-
\??\c:\1pvvp.exec:\1pvvp.exe204⤵
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe205⤵
-
\??\c:\3xxlffx.exec:\3xxlffx.exe206⤵
-
\??\c:\tnbttb.exec:\tnbttb.exe207⤵
-
\??\c:\pdjvp.exec:\pdjvp.exe208⤵
-
\??\c:\xrlxlfx.exec:\xrlxlfx.exe209⤵
-
\??\c:\lfllrlr.exec:\lfllrlr.exe210⤵
-
\??\c:\3thhhh.exec:\3thhhh.exe211⤵
-
\??\c:\nhnhbt.exec:\nhnhbt.exe212⤵
-
\??\c:\jddvj.exec:\jddvj.exe213⤵
-
\??\c:\3jvvp.exec:\3jvvp.exe214⤵
-
\??\c:\rlfflll.exec:\rlfflll.exe215⤵
-
\??\c:\3bbbtn.exec:\3bbbtn.exe216⤵
-
\??\c:\nnhhnt.exec:\nnhhnt.exe217⤵
-
\??\c:\pdjvj.exec:\pdjvj.exe218⤵
-
\??\c:\dvppd.exec:\dvppd.exe219⤵
-
\??\c:\rxfxrxx.exec:\rxfxrxx.exe220⤵
-
\??\c:\bnttnt.exec:\bnttnt.exe221⤵
-
\??\c:\bbhhht.exec:\bbhhht.exe222⤵
-
\??\c:\ddjjj.exec:\ddjjj.exe223⤵
-
\??\c:\vpvdd.exec:\vpvdd.exe224⤵
-
\??\c:\xfrrlrr.exec:\xfrrlrr.exe225⤵
-
\??\c:\fxrrrxf.exec:\fxrrrxf.exe226⤵
-
\??\c:\httbbb.exec:\httbbb.exe227⤵
-
\??\c:\ppvvv.exec:\ppvvv.exe228⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe229⤵
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe230⤵
-
\??\c:\xrflllr.exec:\xrflllr.exe231⤵
-
\??\c:\bttnnn.exec:\bttnnn.exe232⤵
-
\??\c:\ddpdv.exec:\ddpdv.exe233⤵
-
\??\c:\dppjj.exec:\dppjj.exe234⤵
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe235⤵
-
\??\c:\nttnnh.exec:\nttnnh.exe236⤵
-
\??\c:\nbbbhh.exec:\nbbbhh.exe237⤵
-
\??\c:\jpdpd.exec:\jpdpd.exe238⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe239⤵
-
\??\c:\xxrlfff.exec:\xxrlfff.exe240⤵
-
\??\c:\nbbtnn.exec:\nbbtnn.exe241⤵