Analysis
-
max time kernel
19s -
max time network
19s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 00:54
Behavioral task
behavioral1
Sample
040595063bc3dab0a5f45266365469b3_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
040595063bc3dab0a5f45266365469b3_JaffaCakes118.exe
-
Size
69KB
-
MD5
040595063bc3dab0a5f45266365469b3
-
SHA1
7c369a426d3448de17da5edfc5142dffe118791f
-
SHA256
3c4692334a07ef091543fb47e7cdc2e671f177571eccadad3c9adb2bba095130
-
SHA512
7b65d182f9064a1542bf8f96f904739901bf52ae9f04471df6131c7ec5a532c1c09115865f1e5c6d708c82aa9f197c050c0296c6e52ce512bee7260b70f8c629
-
SSDEEP
1536:JvQBeOGtrYS3srx93UBWfwC6Ggnouy8WFRxZOQ+p98:JhOmTsF93UYfwC6GIoutWFfp+v8
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/116-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2824-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3184-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3772-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1924-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3952-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3908-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1312-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4204-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1020-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1088-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1260-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1472-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3396-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1628-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1088-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-502-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1180-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3928-650-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-800-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-911-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-940-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ffrrrxx.exe3hnntt.exejvjvp.exerlxllxr.exe1fxffrr.exe1ntnnh.exenhbthh.exejvvpj.exefllxlfr.exehtbtnn.exebbtnnn.exe7djjv.exerrrlxlf.exebhntnb.exebbtnhb.exepvvpd.exelxffflx.exenntbhh.exeppdpj.exevppvp.exeflrrlll.exenbbbtt.exe7bhbnt.exepjddv.exe3vvjj.exe5xrlxrl.exelfrflfl.exe7tbtnn.exe5vdvj.exerfxrfff.exexrllffx.exehtttnn.exetttttt.exepdjdp.exe1vddv.exexrrrllf.exexllrrrr.exethnbhh.exeppjdv.exe9jjdp.exelfrrrxr.exe1tbnhn.exehhnntt.exejdvpj.exe3ddpd.exepddpj.exexllfxxr.exe3hnntt.exehtnbth.exe7tbtnn.exedjjjj.exedjjdp.exefrrlffr.exefrfxfff.exehtnnnt.exebnhhbb.exejdppv.exe3fllllf.exelfxfxxx.exebbhhnn.exebhhbnn.exehhbtnn.exevpppp.exerxxrlfx.exepid process 540 ffrrrxx.exe 3708 3hnntt.exe 1776 jvjvp.exe 4908 rlxllxr.exe 3392 1fxffrr.exe 1064 1ntnnh.exe 1204 nhbthh.exe 2916 jvvpj.exe 4064 fllxlfr.exe 2824 htbtnn.exe 3184 bbtnnn.exe 4056 7djjv.exe 2748 rrrlxlf.exe 1820 bhntnb.exe 4560 bbtnhb.exe 1436 pvvpd.exe 3772 lxffflx.exe 5044 nntbhh.exe 1260 ppdpj.exe 4040 vppvp.exe 1924 flrrlll.exe 2268 nbbbtt.exe 3952 7bhbnt.exe 2512 pjddv.exe 3908 3vvjj.exe 3236 5xrlxrl.exe 2796 lfrflfl.exe 1312 7tbtnn.exe 5108 5vdvj.exe 2764 rfxrfff.exe 4944 xrllffx.exe 4464 htttnn.exe 2744 tttttt.exe 1164 pdjdp.exe 4204 1vddv.exe 3228 xrrrllf.exe 3552 xllrrrr.exe 2296 thnbhh.exe 4780 ppjdv.exe 5016 9jjdp.exe 4420 lfrrrxr.exe 2644 1tbnhn.exe 4596 hhnntt.exe 4324 jdvpj.exe 808 3ddpd.exe 1020 pddpj.exe 4312 xllfxxr.exe 2832 3hnntt.exe 2252 htnbth.exe 4828 7tbtnn.exe 4432 djjjj.exe 2692 djjdp.exe 3052 frrlffr.exe 1224 frfxfff.exe 2868 htnnnt.exe 3884 bnhhbb.exe 2752 jdppv.exe 4000 3fllllf.exe 4444 lfxfxxx.exe 3256 bbhhnn.exe 1100 bhhbnn.exe 4056 hhbtnn.exe 2576 vpppp.exe 4884 rxxrlfx.exe -
Processes:
resource yara_rule behavioral2/memory/116-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffrrrxx.exe upx behavioral2/memory/116-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/540-9-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3hnntt.exe upx C:\jvjvp.exe upx behavioral2/memory/1776-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3708-15-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlxllxr.exe upx behavioral2/memory/1776-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4908-21-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1fxffrr.exe upx \??\c:\1ntnnh.exe upx behavioral2/memory/1064-33-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhbthh.exe upx behavioral2/memory/1204-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3392-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvvpj.exe upx C:\fllxlfr.exe upx C:\htbtnn.exe upx behavioral2/memory/4064-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2824-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbtnnn.exe upx C:\7djjv.exe upx behavioral2/memory/3184-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4056-61-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrrlxlf.exe upx C:\bhntnb.exe upx behavioral2/memory/1820-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2748-70-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbtnhb.exe upx behavioral2/memory/1820-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvvpd.exe upx C:\lxffflx.exe upx behavioral2/memory/3772-88-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nntbhh.exe upx behavioral2/memory/5044-91-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ppdpj.exe upx behavioral2/memory/1260-95-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vppvp.exe upx behavioral2/memory/4040-101-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\flrrlll.exe upx C:\nbbbtt.exe upx behavioral2/memory/1924-109-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7bhbnt.exe upx behavioral2/memory/3952-115-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjddv.exe upx behavioral2/memory/3952-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3vvjj.exe upx behavioral2/memory/2512-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3908-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5xrlxrl.exe upx behavioral2/memory/3236-131-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfrflfl.exe upx C:\7tbtnn.exe upx behavioral2/memory/1312-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2796-138-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5vdvj.exe upx C:\rfxrfff.exe upx C:\xrllffx.exe upx C:\htttnn.exe upx behavioral2/memory/4204-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3228-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3552-169-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
040595063bc3dab0a5f45266365469b3_JaffaCakes118.exeffrrrxx.exe3hnntt.exejvjvp.exerlxllxr.exe1fxffrr.exe1ntnnh.exenhbthh.exejvvpj.exefllxlfr.exehtbtnn.exebbtnnn.exe7djjv.exerrrlxlf.exebhntnb.exebbtnhb.exepvvpd.exelxffflx.exenntbhh.exeppdpj.exevppvp.exeflrrlll.exedescription pid process target process PID 116 wrote to memory of 540 116 040595063bc3dab0a5f45266365469b3_JaffaCakes118.exe ffrrrxx.exe PID 116 wrote to memory of 540 116 040595063bc3dab0a5f45266365469b3_JaffaCakes118.exe ffrrrxx.exe PID 116 wrote to memory of 540 116 040595063bc3dab0a5f45266365469b3_JaffaCakes118.exe ffrrrxx.exe PID 540 wrote to memory of 3708 540 ffrrrxx.exe 3hnntt.exe PID 540 wrote to memory of 3708 540 ffrrrxx.exe 3hnntt.exe PID 540 wrote to memory of 3708 540 ffrrrxx.exe 3hnntt.exe PID 3708 wrote to memory of 1776 3708 3hnntt.exe jvjvp.exe PID 3708 wrote to memory of 1776 3708 3hnntt.exe jvjvp.exe PID 3708 wrote to memory of 1776 3708 3hnntt.exe jvjvp.exe PID 1776 wrote to memory of 4908 1776 jvjvp.exe rlxllxr.exe PID 1776 wrote to memory of 4908 1776 jvjvp.exe rlxllxr.exe PID 1776 wrote to memory of 4908 1776 jvjvp.exe rlxllxr.exe PID 4908 wrote to memory of 3392 4908 rlxllxr.exe 1fxffrr.exe PID 4908 wrote to memory of 3392 4908 rlxllxr.exe 1fxffrr.exe PID 4908 wrote to memory of 3392 4908 rlxllxr.exe 1fxffrr.exe PID 3392 wrote to memory of 1064 3392 1fxffrr.exe 1ntnnh.exe PID 3392 wrote to memory of 1064 3392 1fxffrr.exe 1ntnnh.exe PID 3392 wrote to memory of 1064 3392 1fxffrr.exe 1ntnnh.exe PID 1064 wrote to memory of 1204 1064 1ntnnh.exe nhbthh.exe PID 1064 wrote to memory of 1204 1064 1ntnnh.exe nhbthh.exe PID 1064 wrote to memory of 1204 1064 1ntnnh.exe nhbthh.exe PID 1204 wrote to memory of 2916 1204 nhbthh.exe jvvpj.exe PID 1204 wrote to memory of 2916 1204 nhbthh.exe jvvpj.exe PID 1204 wrote to memory of 2916 1204 nhbthh.exe jvvpj.exe PID 2916 wrote to memory of 4064 2916 jvvpj.exe fllxlfr.exe PID 2916 wrote to memory of 4064 2916 jvvpj.exe fllxlfr.exe PID 2916 wrote to memory of 4064 2916 jvvpj.exe fllxlfr.exe PID 4064 wrote to memory of 2824 4064 fllxlfr.exe htbtnn.exe PID 4064 wrote to memory of 2824 4064 fllxlfr.exe htbtnn.exe PID 4064 wrote to memory of 2824 4064 fllxlfr.exe htbtnn.exe PID 2824 wrote to memory of 3184 2824 htbtnn.exe bbtnnn.exe PID 2824 wrote to memory of 3184 2824 htbtnn.exe bbtnnn.exe PID 2824 wrote to memory of 3184 2824 htbtnn.exe bbtnnn.exe PID 3184 wrote to memory of 4056 3184 bbtnnn.exe 7djjv.exe PID 3184 wrote to memory of 4056 3184 bbtnnn.exe 7djjv.exe PID 3184 wrote to memory of 4056 3184 bbtnnn.exe 7djjv.exe PID 4056 wrote to memory of 2748 4056 7djjv.exe rrrlxlf.exe PID 4056 wrote to memory of 2748 4056 7djjv.exe rrrlxlf.exe PID 4056 wrote to memory of 2748 4056 7djjv.exe rrrlxlf.exe PID 2748 wrote to memory of 1820 2748 rrrlxlf.exe bhntnb.exe PID 2748 wrote to memory of 1820 2748 rrrlxlf.exe bhntnb.exe PID 2748 wrote to memory of 1820 2748 rrrlxlf.exe bhntnb.exe PID 1820 wrote to memory of 4560 1820 bhntnb.exe bbtnhb.exe PID 1820 wrote to memory of 4560 1820 bhntnb.exe bbtnhb.exe PID 1820 wrote to memory of 4560 1820 bhntnb.exe bbtnhb.exe PID 4560 wrote to memory of 1436 4560 bbtnhb.exe pvvpd.exe PID 4560 wrote to memory of 1436 4560 bbtnhb.exe pvvpd.exe PID 4560 wrote to memory of 1436 4560 bbtnhb.exe pvvpd.exe PID 1436 wrote to memory of 3772 1436 pvvpd.exe lxffflx.exe PID 1436 wrote to memory of 3772 1436 pvvpd.exe lxffflx.exe PID 1436 wrote to memory of 3772 1436 pvvpd.exe lxffflx.exe PID 3772 wrote to memory of 5044 3772 lxffflx.exe nntbhh.exe PID 3772 wrote to memory of 5044 3772 lxffflx.exe nntbhh.exe PID 3772 wrote to memory of 5044 3772 lxffflx.exe nntbhh.exe PID 5044 wrote to memory of 1260 5044 nntbhh.exe ppdpj.exe PID 5044 wrote to memory of 1260 5044 nntbhh.exe ppdpj.exe PID 5044 wrote to memory of 1260 5044 nntbhh.exe ppdpj.exe PID 1260 wrote to memory of 4040 1260 ppdpj.exe vppvp.exe PID 1260 wrote to memory of 4040 1260 ppdpj.exe vppvp.exe PID 1260 wrote to memory of 4040 1260 ppdpj.exe vppvp.exe PID 4040 wrote to memory of 1924 4040 vppvp.exe flrrlll.exe PID 4040 wrote to memory of 1924 4040 vppvp.exe flrrlll.exe PID 4040 wrote to memory of 1924 4040 vppvp.exe flrrlll.exe PID 1924 wrote to memory of 2268 1924 flrrlll.exe nbbbtt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\040595063bc3dab0a5f45266365469b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\040595063bc3dab0a5f45266365469b3_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrrrxx.exec:\ffrrrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3hnntt.exec:\3hnntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvjvp.exec:\jvjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxllxr.exec:\rlxllxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1fxffrr.exec:\1fxffrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1ntnnh.exec:\1ntnnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbthh.exec:\nhbthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvvpj.exec:\jvvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fllxlfr.exec:\fllxlfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htbtnn.exec:\htbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbtnnn.exec:\bbtnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7djjv.exec:\7djjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrrlxlf.exec:\rrrlxlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhntnb.exec:\bhntnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbtnhb.exec:\bbtnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvvpd.exec:\pvvpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxffflx.exec:\lxffflx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nntbhh.exec:\nntbhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppdpj.exec:\ppdpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vppvp.exec:\vppvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flrrlll.exec:\flrrlll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbbtt.exec:\nbbbtt.exe23⤵
- Executes dropped EXE
-
\??\c:\7bhbnt.exec:\7bhbnt.exe24⤵
- Executes dropped EXE
-
\??\c:\pjddv.exec:\pjddv.exe25⤵
- Executes dropped EXE
-
\??\c:\3vvjj.exec:\3vvjj.exe26⤵
- Executes dropped EXE
-
\??\c:\5xrlxrl.exec:\5xrlxrl.exe27⤵
- Executes dropped EXE
-
\??\c:\lfrflfl.exec:\lfrflfl.exe28⤵
- Executes dropped EXE
-
\??\c:\7tbtnn.exec:\7tbtnn.exe29⤵
- Executes dropped EXE
-
\??\c:\5vdvj.exec:\5vdvj.exe30⤵
- Executes dropped EXE
-
\??\c:\rfxrfff.exec:\rfxrfff.exe31⤵
- Executes dropped EXE
-
\??\c:\xrllffx.exec:\xrllffx.exe32⤵
- Executes dropped EXE
-
\??\c:\htttnn.exec:\htttnn.exe33⤵
- Executes dropped EXE
-
\??\c:\tttttt.exec:\tttttt.exe34⤵
- Executes dropped EXE
-
\??\c:\pdjdp.exec:\pdjdp.exe35⤵
- Executes dropped EXE
-
\??\c:\1vddv.exec:\1vddv.exe36⤵
- Executes dropped EXE
-
\??\c:\xrrrllf.exec:\xrrrllf.exe37⤵
- Executes dropped EXE
-
\??\c:\xllrrrr.exec:\xllrrrr.exe38⤵
- Executes dropped EXE
-
\??\c:\thnbhh.exec:\thnbhh.exe39⤵
- Executes dropped EXE
-
\??\c:\ppjdv.exec:\ppjdv.exe40⤵
- Executes dropped EXE
-
\??\c:\9jjdp.exec:\9jjdp.exe41⤵
- Executes dropped EXE
-
\??\c:\lfrrrxr.exec:\lfrrrxr.exe42⤵
- Executes dropped EXE
-
\??\c:\1tbnhn.exec:\1tbnhn.exe43⤵
- Executes dropped EXE
-
\??\c:\hhnntt.exec:\hhnntt.exe44⤵
- Executes dropped EXE
-
\??\c:\jdvpj.exec:\jdvpj.exe45⤵
- Executes dropped EXE
-
\??\c:\3ddpd.exec:\3ddpd.exe46⤵
- Executes dropped EXE
-
\??\c:\pddpj.exec:\pddpj.exe47⤵
- Executes dropped EXE
-
\??\c:\xllfxxr.exec:\xllfxxr.exe48⤵
- Executes dropped EXE
-
\??\c:\3hnntt.exec:\3hnntt.exe49⤵
- Executes dropped EXE
-
\??\c:\htnbth.exec:\htnbth.exe50⤵
- Executes dropped EXE
-
\??\c:\7tbtnn.exec:\7tbtnn.exe51⤵
- Executes dropped EXE
-
\??\c:\djjjj.exec:\djjjj.exe52⤵
- Executes dropped EXE
-
\??\c:\djjdp.exec:\djjdp.exe53⤵
- Executes dropped EXE
-
\??\c:\frrlffr.exec:\frrlffr.exe54⤵
- Executes dropped EXE
-
\??\c:\frfxfff.exec:\frfxfff.exe55⤵
- Executes dropped EXE
-
\??\c:\htnnnt.exec:\htnnnt.exe56⤵
- Executes dropped EXE
-
\??\c:\bnhhbb.exec:\bnhhbb.exe57⤵
- Executes dropped EXE
-
\??\c:\jdppv.exec:\jdppv.exe58⤵
- Executes dropped EXE
-
\??\c:\3fllllf.exec:\3fllllf.exe59⤵
- Executes dropped EXE
-
\??\c:\lfxfxxx.exec:\lfxfxxx.exe60⤵
- Executes dropped EXE
-
\??\c:\bbhhnn.exec:\bbhhnn.exe61⤵
- Executes dropped EXE
-
\??\c:\bhhbnn.exec:\bhhbnn.exe62⤵
- Executes dropped EXE
-
\??\c:\hhbtnn.exec:\hhbtnn.exe63⤵
- Executes dropped EXE
-
\??\c:\vpppp.exec:\vpppp.exe64⤵
- Executes dropped EXE
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe65⤵
- Executes dropped EXE
-
\??\c:\lrrlffx.exec:\lrrlffx.exe66⤵
-
\??\c:\btbtbb.exec:\btbtbb.exe67⤵
-
\??\c:\7tbbtt.exec:\7tbbtt.exe68⤵
-
\??\c:\ddpdd.exec:\ddpdd.exe69⤵
-
\??\c:\xrrlllr.exec:\xrrlllr.exe70⤵
-
\??\c:\fxffxxr.exec:\fxffxxr.exe71⤵
-
\??\c:\tttnhh.exec:\tttnhh.exe72⤵
-
\??\c:\nhtnbb.exec:\nhtnbb.exe73⤵
-
\??\c:\pvdjj.exec:\pvdjj.exe74⤵
-
\??\c:\ddddv.exec:\ddddv.exe75⤵
-
\??\c:\9llxrlf.exec:\9llxrlf.exe76⤵
-
\??\c:\tntthn.exec:\tntthn.exe77⤵
-
\??\c:\5htnhb.exec:\5htnhb.exe78⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe79⤵
-
\??\c:\jvpjv.exec:\jvpjv.exe80⤵
-
\??\c:\xfffxxx.exec:\xfffxxx.exe81⤵
-
\??\c:\9rrxrrl.exec:\9rrxrrl.exe82⤵
-
\??\c:\hbhhbt.exec:\hbhhbt.exe83⤵
-
\??\c:\ppvpd.exec:\ppvpd.exe84⤵
-
\??\c:\djvpd.exec:\djvpd.exe85⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe86⤵
-
\??\c:\rlrlffx.exec:\rlrlffx.exe87⤵
-
\??\c:\bnbthh.exec:\bnbthh.exe88⤵
-
\??\c:\dvdvj.exec:\dvdvj.exe89⤵
-
\??\c:\nnnhnn.exec:\nnnhnn.exe90⤵
-
\??\c:\vvpjv.exec:\vvpjv.exe91⤵
-
\??\c:\xrfxrrr.exec:\xrfxrrr.exe92⤵
-
\??\c:\9bbtnn.exec:\9bbtnn.exe93⤵
-
\??\c:\bbnhnn.exec:\bbnhnn.exe94⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe95⤵
-
\??\c:\frllllf.exec:\frllllf.exe96⤵
-
\??\c:\frxffll.exec:\frxffll.exe97⤵
-
\??\c:\tnhbtt.exec:\tnhbtt.exe98⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe99⤵
-
\??\c:\xrxrffx.exec:\xrxrffx.exe100⤵
-
\??\c:\9nbbth.exec:\9nbbth.exe101⤵
-
\??\c:\nhnnhb.exec:\nhnnhb.exe102⤵
-
\??\c:\ddvpp.exec:\ddvpp.exe103⤵
-
\??\c:\lfxfxxf.exec:\lfxfxxf.exe104⤵
-
\??\c:\llllllf.exec:\llllllf.exe105⤵
-
\??\c:\vddvj.exec:\vddvj.exe106⤵
-
\??\c:\lrxlfxl.exec:\lrxlfxl.exe107⤵
-
\??\c:\tnbtbb.exec:\tnbtbb.exe108⤵
-
\??\c:\1hnhth.exec:\1hnhth.exe109⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe110⤵
-
\??\c:\vpddd.exec:\vpddd.exe111⤵
-
\??\c:\7nhhbb.exec:\7nhhbb.exe112⤵
-
\??\c:\1nhbbb.exec:\1nhbbb.exe113⤵
-
\??\c:\vjvdp.exec:\vjvdp.exe114⤵
-
\??\c:\rfxrfxr.exec:\rfxrfxr.exe115⤵
-
\??\c:\lfrlrrl.exec:\lfrlrrl.exe116⤵
-
\??\c:\1ntntt.exec:\1ntntt.exe117⤵
-
\??\c:\tbthbt.exec:\tbthbt.exe118⤵
-
\??\c:\pvddv.exec:\pvddv.exe119⤵
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe120⤵
-
\??\c:\7bnhtn.exec:\7bnhtn.exe121⤵
-
\??\c:\dddvp.exec:\dddvp.exe122⤵
-
\??\c:\9djjv.exec:\9djjv.exe123⤵
-
\??\c:\lflfffl.exec:\lflfffl.exe124⤵
-
\??\c:\xrrxxfx.exec:\xrrxxfx.exe125⤵
-
\??\c:\vdvjv.exec:\vdvjv.exe126⤵
-
\??\c:\xxrlrrr.exec:\xxrlrrr.exe127⤵
-
\??\c:\9jpjp.exec:\9jpjp.exe128⤵
-
\??\c:\rflfrlx.exec:\rflfrlx.exe129⤵
-
\??\c:\jdjvp.exec:\jdjvp.exe130⤵
-
\??\c:\3pvpd.exec:\3pvpd.exe131⤵
-
\??\c:\flrrrrl.exec:\flrrrrl.exe132⤵
-
\??\c:\llxxrfx.exec:\llxxrfx.exe133⤵
-
\??\c:\nhtntt.exec:\nhtntt.exe134⤵
-
\??\c:\jvjjv.exec:\jvjjv.exe135⤵
-
\??\c:\pdvjv.exec:\pdvjv.exe136⤵
-
\??\c:\fxrrlff.exec:\fxrrlff.exe137⤵
-
\??\c:\hnnhbt.exec:\hnnhbt.exe138⤵
-
\??\c:\nbbthn.exec:\nbbthn.exe139⤵
-
\??\c:\5pdvp.exec:\5pdvp.exe140⤵
-
\??\c:\5dddv.exec:\5dddv.exe141⤵
-
\??\c:\xxxrlll.exec:\xxxrlll.exe142⤵
-
\??\c:\hnnhtn.exec:\hnnhtn.exe143⤵
-
\??\c:\nbtnhh.exec:\nbtnhh.exe144⤵
-
\??\c:\dvjvj.exec:\dvjvj.exe145⤵
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe146⤵
-
\??\c:\xlllxxl.exec:\xlllxxl.exe147⤵
-
\??\c:\9ttbtn.exec:\9ttbtn.exe148⤵
-
\??\c:\bhbttt.exec:\bhbttt.exe149⤵
-
\??\c:\vvjjd.exec:\vvjjd.exe150⤵
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe151⤵
-
\??\c:\rlllffx.exec:\rlllffx.exe152⤵
-
\??\c:\nnhbtb.exec:\nnhbtb.exe153⤵
-
\??\c:\hnbhtt.exec:\hnbhtt.exe154⤵
-
\??\c:\vppdj.exec:\vppdj.exe155⤵
-
\??\c:\lrrrlfr.exec:\lrrrlfr.exe156⤵
-
\??\c:\xflxrrl.exec:\xflxrrl.exe157⤵
-
\??\c:\thnhnb.exec:\thnhnb.exe158⤵
-
\??\c:\btnthb.exec:\btnthb.exe159⤵
-
\??\c:\pjddv.exec:\pjddv.exe160⤵
-
\??\c:\9vpjv.exec:\9vpjv.exe161⤵
-
\??\c:\7lfxlxr.exec:\7lfxlxr.exe162⤵
-
\??\c:\nttnnn.exec:\nttnnn.exe163⤵
-
\??\c:\bhnbtt.exec:\bhnbtt.exe164⤵
-
\??\c:\vdddv.exec:\vdddv.exe165⤵
-
\??\c:\5pdvd.exec:\5pdvd.exe166⤵
-
\??\c:\xlxrllx.exec:\xlxrllx.exe167⤵
-
\??\c:\htbbtt.exec:\htbbtt.exe168⤵
-
\??\c:\bhtbbh.exec:\bhtbbh.exe169⤵
-
\??\c:\jppdv.exec:\jppdv.exe170⤵
-
\??\c:\jdpjj.exec:\jdpjj.exe171⤵
-
\??\c:\xrxrrlf.exec:\xrxrrlf.exe172⤵
-
\??\c:\xxxrrrx.exec:\xxxrrrx.exe173⤵
-
\??\c:\ttttnn.exec:\ttttnn.exe174⤵
-
\??\c:\dvpjv.exec:\dvpjv.exe175⤵
-
\??\c:\9vvvp.exec:\9vvvp.exe176⤵
-
\??\c:\xlfxlfr.exec:\xlfxlfr.exe177⤵
-
\??\c:\rfxfxll.exec:\rfxfxll.exe178⤵
-
\??\c:\nnnbbt.exec:\nnnbbt.exe179⤵
-
\??\c:\ntttnn.exec:\ntttnn.exe180⤵
-
\??\c:\pdddd.exec:\pdddd.exe181⤵
-
\??\c:\7jjdd.exec:\7jjdd.exe182⤵
-
\??\c:\frrrllf.exec:\frrrllf.exe183⤵
-
\??\c:\3xrlrlr.exec:\3xrlrlr.exe184⤵
-
\??\c:\nnttnt.exec:\nnttnt.exe185⤵
-
\??\c:\bttnnn.exec:\bttnnn.exe186⤵
-
\??\c:\5pdvj.exec:\5pdvj.exe187⤵
-
\??\c:\5llfrlx.exec:\5llfrlx.exe188⤵
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe189⤵
-
\??\c:\btnhbt.exec:\btnhbt.exe190⤵
-
\??\c:\jvjdj.exec:\jvjdj.exe191⤵
-
\??\c:\pdpjd.exec:\pdpjd.exe192⤵
-
\??\c:\1rxrllf.exec:\1rxrllf.exe193⤵
-
\??\c:\3llfxrl.exec:\3llfxrl.exe194⤵
-
\??\c:\3tbbbt.exec:\3tbbbt.exe195⤵
-
\??\c:\ddvpv.exec:\ddvpv.exe196⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe197⤵
-
\??\c:\rfxlrlx.exec:\rfxlrlx.exe198⤵
-
\??\c:\rflfxxr.exec:\rflfxxr.exe199⤵
-
\??\c:\bbtnbb.exec:\bbtnbb.exe200⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe201⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe202⤵
-
\??\c:\flfrfxf.exec:\flfrfxf.exe203⤵
-
\??\c:\nhbbnh.exec:\nhbbnh.exe204⤵
-
\??\c:\ttnnbb.exec:\ttnnbb.exe205⤵
-
\??\c:\jddvv.exec:\jddvv.exe206⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe207⤵
-
\??\c:\5lfxlfl.exec:\5lfxlfl.exe208⤵
-
\??\c:\5bbtnb.exec:\5bbtnb.exe209⤵
-
\??\c:\nhnhnn.exec:\nhnhnn.exe210⤵
-
\??\c:\dpppj.exec:\dpppj.exe211⤵
-
\??\c:\jjjjj.exec:\jjjjj.exe212⤵
-
\??\c:\xlllfff.exec:\xlllfff.exe213⤵
-
\??\c:\lrrlffx.exec:\lrrlffx.exe214⤵
-
\??\c:\tttnnn.exec:\tttnnn.exe215⤵
-
\??\c:\9nbtbb.exec:\9nbtbb.exe216⤵
-
\??\c:\htbtht.exec:\htbtht.exe217⤵
-
\??\c:\9dvpp.exec:\9dvpp.exe218⤵
-
\??\c:\rffxxxl.exec:\rffxxxl.exe219⤵
-
\??\c:\1rffxxr.exec:\1rffxxr.exe220⤵
-
\??\c:\1nhnhh.exec:\1nhnhh.exe221⤵
-
\??\c:\hbhbhh.exec:\hbhbhh.exe222⤵
-
\??\c:\pvdvd.exec:\pvdvd.exe223⤵
-
\??\c:\jjpdp.exec:\jjpdp.exe224⤵
-
\??\c:\ffffffx.exec:\ffffffx.exe225⤵
-
\??\c:\1rfxxrr.exec:\1rfxxrr.exe226⤵
-
\??\c:\tnhnht.exec:\tnhnht.exe227⤵
-
\??\c:\hnthnh.exec:\hnthnh.exe228⤵
-
\??\c:\djdvj.exec:\djdvj.exe229⤵
-
\??\c:\vvvvv.exec:\vvvvv.exe230⤵
-
\??\c:\xllfxrr.exec:\xllfxrr.exe231⤵
-
\??\c:\hbnhbt.exec:\hbnhbt.exe232⤵
-
\??\c:\djpjv.exec:\djpjv.exe233⤵
-
\??\c:\ppvjv.exec:\ppvjv.exe234⤵
-
\??\c:\pjdpv.exec:\pjdpv.exe235⤵
-
\??\c:\frxlrlf.exec:\frxlrlf.exe236⤵
-
\??\c:\fffxrrf.exec:\fffxrrf.exe237⤵
-
\??\c:\1hhbnh.exec:\1hhbnh.exe238⤵
-
\??\c:\hhnbnb.exec:\hhnbnb.exe239⤵
-
\??\c:\vjjdj.exec:\vjjdj.exe240⤵
-
\??\c:\3ddpv.exec:\3ddpv.exe241⤵