Analysis
-
max time kernel
39s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 03:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exe
-
Size
211KB
-
MD5
044e98c2f9fb4c6966970e32ef11a6a3
-
SHA1
29d7fe446b8e57e0e9fb66ae05dafdfdbccc510a
-
SHA256
bcb5089a4953d599c0cc71b3b15b865ff83aa1aea71f69900e60420c67b5f012
-
SHA512
0183a413af5799f19f998abd05cfe6125037c370de025976d97afa82e8acd4c267d4a46f34b445bf110539c404b8c7662523c6dbd6faf96b27d5683b0ded0146
-
SSDEEP
3072:EhOm2sI93UufdC67ciyt3ujFf7TQsq5Va9h9Z:Ecm7ImGddXyt38TU5WZ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3368-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/884-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-873-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-904-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pdjpp.exe9fxrxxl.exenhttbb.exe3frlflf.exe7xrlfll.exevvvvv.exepjvjv.exelxfxrrr.exennhhhh.exevpvdv.exelxfffff.exethtttt.exepvddd.exetttttt.exebtnhnn.exedpjjp.exe3rlfxfr.exe5bhbtt.exepvjjp.exelfllfff.exetthhhn.exe5vjjp.exefxxrrll.exethnthh.exevdppj.exerffxfxl.exehthbtn.exeppppj.exe7xxrfxr.exebnbthb.exepvppd.exepvvvp.exe9bbnhh.exetnhthb.exedddvp.exe5ppvp.exe5ffrrlr.exefrffxff.exettbbnh.exepddvv.exe7dpvd.exerfrfxrr.exerllffxx.exethnhbb.exenbbbnn.exe9dppp.exepdvvj.exe7lrlffx.exelrrrlff.exe5bnhbb.exevdjdj.exelrflfxr.exefrfxfxf.exetthbhb.exethtttt.exedvpjd.exepvdjp.exelxxlxrl.exebtnhbb.exebnhbnn.exelfrrrrl.exebbthbb.exetthbtn.exejppjd.exepid process 3368 pdjpp.exe 3952 9fxrxxl.exe 3224 nhttbb.exe 1952 3frlflf.exe 2316 7xrlfll.exe 3036 vvvvv.exe 2464 pjvjv.exe 4488 lxfxrrr.exe 4888 nnhhhh.exe 3104 vpvdv.exe 2376 lxfffff.exe 2000 thtttt.exe 640 pvddd.exe 2420 tttttt.exe 1352 btnhnn.exe 3864 dpjjp.exe 3620 3rlfxfr.exe 2840 5bhbtt.exe 3284 pvjjp.exe 400 lfllfff.exe 2688 tthhhn.exe 1844 5vjjp.exe 1436 fxxrrll.exe 2184 thnthh.exe 3408 vdppj.exe 3440 rffxfxl.exe 2440 hthbtn.exe 4920 ppppj.exe 4308 7xxrfxr.exe 4536 bnbthb.exe 1812 pvppd.exe 2148 pvvvp.exe 3204 9bbnhh.exe 2592 tnhthb.exe 4896 dddvp.exe 4372 5ppvp.exe 812 5ffrrlr.exe 4276 frffxff.exe 4592 ttbbnh.exe 2028 pddvv.exe 2604 7dpvd.exe 3952 rfrfxrr.exe 1112 rllffxx.exe 4328 thnhbb.exe 4316 nbbbnn.exe 2464 9dppp.exe 2712 pdvvj.exe 1696 7lrlffx.exe 4636 lrrrlff.exe 208 5bnhbb.exe 2468 vdjdj.exe 1964 lrflfxr.exe 2644 frfxfxf.exe 4832 tthbhb.exe 1500 thtttt.exe 2420 dvpjd.exe 1352 pvdjp.exe 1908 lxxlxrl.exe 5048 btnhbb.exe 3620 bnhbnn.exe 1556 lfrrrrl.exe 3096 bbthbb.exe 1764 tthbtn.exe 4400 jppjd.exe -
Processes:
resource yara_rule behavioral2/memory/3368-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2712-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-465-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exepdjpp.exe9fxrxxl.exenhttbb.exe3frlflf.exe7xrlfll.exevvvvv.exepjvjv.exelxfxrrr.exennhhhh.exevpvdv.exelxfffff.exethtttt.exepvddd.exetttttt.exebtnhnn.exedpjjp.exe3rlfxfr.exe5bhbtt.exepvjjp.exelfllfff.exetthhhn.exedescription pid process target process PID 1516 wrote to memory of 3368 1516 044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exe pdjpp.exe PID 1516 wrote to memory of 3368 1516 044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exe pdjpp.exe PID 1516 wrote to memory of 3368 1516 044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exe pdjpp.exe PID 3368 wrote to memory of 3952 3368 pdjpp.exe 9fxrxxl.exe PID 3368 wrote to memory of 3952 3368 pdjpp.exe 9fxrxxl.exe PID 3368 wrote to memory of 3952 3368 pdjpp.exe 9fxrxxl.exe PID 3952 wrote to memory of 3224 3952 9fxrxxl.exe nhttbb.exe PID 3952 wrote to memory of 3224 3952 9fxrxxl.exe nhttbb.exe PID 3952 wrote to memory of 3224 3952 9fxrxxl.exe nhttbb.exe PID 3224 wrote to memory of 1952 3224 nhttbb.exe 3frlflf.exe PID 3224 wrote to memory of 1952 3224 nhttbb.exe 3frlflf.exe PID 3224 wrote to memory of 1952 3224 nhttbb.exe 3frlflf.exe PID 1952 wrote to memory of 2316 1952 3frlflf.exe 7xrlfll.exe PID 1952 wrote to memory of 2316 1952 3frlflf.exe 7xrlfll.exe PID 1952 wrote to memory of 2316 1952 3frlflf.exe 7xrlfll.exe PID 2316 wrote to memory of 3036 2316 7xrlfll.exe vvvvv.exe PID 2316 wrote to memory of 3036 2316 7xrlfll.exe vvvvv.exe PID 2316 wrote to memory of 3036 2316 7xrlfll.exe vvvvv.exe PID 3036 wrote to memory of 2464 3036 vvvvv.exe pjvjv.exe PID 3036 wrote to memory of 2464 3036 vvvvv.exe pjvjv.exe PID 3036 wrote to memory of 2464 3036 vvvvv.exe pjvjv.exe PID 2464 wrote to memory of 4488 2464 pjvjv.exe lxfxrrr.exe PID 2464 wrote to memory of 4488 2464 pjvjv.exe lxfxrrr.exe PID 2464 wrote to memory of 4488 2464 pjvjv.exe lxfxrrr.exe PID 4488 wrote to memory of 4888 4488 lxfxrrr.exe nnhhhh.exe PID 4488 wrote to memory of 4888 4488 lxfxrrr.exe nnhhhh.exe PID 4488 wrote to memory of 4888 4488 lxfxrrr.exe nnhhhh.exe PID 4888 wrote to memory of 3104 4888 nnhhhh.exe vpvdv.exe PID 4888 wrote to memory of 3104 4888 nnhhhh.exe vpvdv.exe PID 4888 wrote to memory of 3104 4888 nnhhhh.exe vpvdv.exe PID 3104 wrote to memory of 2376 3104 vpvdv.exe lxfffff.exe PID 3104 wrote to memory of 2376 3104 vpvdv.exe lxfffff.exe PID 3104 wrote to memory of 2376 3104 vpvdv.exe lxfffff.exe PID 2376 wrote to memory of 2000 2376 lxfffff.exe thtttt.exe PID 2376 wrote to memory of 2000 2376 lxfffff.exe thtttt.exe PID 2376 wrote to memory of 2000 2376 lxfffff.exe thtttt.exe PID 2000 wrote to memory of 640 2000 thtttt.exe pvddd.exe PID 2000 wrote to memory of 640 2000 thtttt.exe pvddd.exe PID 2000 wrote to memory of 640 2000 thtttt.exe pvddd.exe PID 640 wrote to memory of 2420 640 pvddd.exe tttttt.exe PID 640 wrote to memory of 2420 640 pvddd.exe tttttt.exe PID 640 wrote to memory of 2420 640 pvddd.exe tttttt.exe PID 2420 wrote to memory of 1352 2420 tttttt.exe btnhnn.exe PID 2420 wrote to memory of 1352 2420 tttttt.exe btnhnn.exe PID 2420 wrote to memory of 1352 2420 tttttt.exe btnhnn.exe PID 1352 wrote to memory of 3864 1352 btnhnn.exe dpjjp.exe PID 1352 wrote to memory of 3864 1352 btnhnn.exe dpjjp.exe PID 1352 wrote to memory of 3864 1352 btnhnn.exe dpjjp.exe PID 3864 wrote to memory of 3620 3864 dpjjp.exe 3rlfxfr.exe PID 3864 wrote to memory of 3620 3864 dpjjp.exe 3rlfxfr.exe PID 3864 wrote to memory of 3620 3864 dpjjp.exe 3rlfxfr.exe PID 3620 wrote to memory of 2840 3620 3rlfxfr.exe 5bhbtt.exe PID 3620 wrote to memory of 2840 3620 3rlfxfr.exe 5bhbtt.exe PID 3620 wrote to memory of 2840 3620 3rlfxfr.exe 5bhbtt.exe PID 2840 wrote to memory of 3284 2840 5bhbtt.exe pvjjp.exe PID 2840 wrote to memory of 3284 2840 5bhbtt.exe pvjjp.exe PID 2840 wrote to memory of 3284 2840 5bhbtt.exe pvjjp.exe PID 3284 wrote to memory of 400 3284 pvjjp.exe lfllfff.exe PID 3284 wrote to memory of 400 3284 pvjjp.exe lfllfff.exe PID 3284 wrote to memory of 400 3284 pvjjp.exe lfllfff.exe PID 400 wrote to memory of 2688 400 lfllfff.exe tthhhn.exe PID 400 wrote to memory of 2688 400 lfllfff.exe tthhhn.exe PID 400 wrote to memory of 2688 400 lfllfff.exe tthhhn.exe PID 2688 wrote to memory of 1844 2688 tthhhn.exe 5vjjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\044e98c2f9fb4c6966970e32ef11a6a3_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjpp.exec:\pdjpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9fxrxxl.exec:\9fxrxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhttbb.exec:\nhttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3frlflf.exec:\3frlflf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xrlfll.exec:\7xrlfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvvv.exec:\vvvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvjv.exec:\pjvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhhhh.exec:\nnhhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvdv.exec:\vpvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxfffff.exec:\lxfffff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thtttt.exec:\thtttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvddd.exec:\pvddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tttttt.exec:\tttttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnhnn.exec:\btnhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpjjp.exec:\dpjjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3rlfxfr.exec:\3rlfxfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5bhbtt.exec:\5bhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvjjp.exec:\pvjjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfllfff.exec:\lfllfff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tthhhn.exec:\tthhhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5vjjp.exec:\5vjjp.exe23⤵
- Executes dropped EXE
-
\??\c:\fxxrrll.exec:\fxxrrll.exe24⤵
- Executes dropped EXE
-
\??\c:\thnthh.exec:\thnthh.exe25⤵
- Executes dropped EXE
-
\??\c:\vdppj.exec:\vdppj.exe26⤵
- Executes dropped EXE
-
\??\c:\rffxfxl.exec:\rffxfxl.exe27⤵
- Executes dropped EXE
-
\??\c:\hthbtn.exec:\hthbtn.exe28⤵
- Executes dropped EXE
-
\??\c:\ppppj.exec:\ppppj.exe29⤵
- Executes dropped EXE
-
\??\c:\7xxrfxr.exec:\7xxrfxr.exe30⤵
- Executes dropped EXE
-
\??\c:\bnbthb.exec:\bnbthb.exe31⤵
- Executes dropped EXE
-
\??\c:\pvppd.exec:\pvppd.exe32⤵
- Executes dropped EXE
-
\??\c:\pvvvp.exec:\pvvvp.exe33⤵
- Executes dropped EXE
-
\??\c:\9bbnhh.exec:\9bbnhh.exe34⤵
- Executes dropped EXE
-
\??\c:\tnhthb.exec:\tnhthb.exe35⤵
- Executes dropped EXE
-
\??\c:\dddvp.exec:\dddvp.exe36⤵
- Executes dropped EXE
-
\??\c:\5ppvp.exec:\5ppvp.exe37⤵
- Executes dropped EXE
-
\??\c:\5ffrrlr.exec:\5ffrrlr.exe38⤵
- Executes dropped EXE
-
\??\c:\frffxff.exec:\frffxff.exe39⤵
- Executes dropped EXE
-
\??\c:\ttbbnh.exec:\ttbbnh.exe40⤵
- Executes dropped EXE
-
\??\c:\pddvv.exec:\pddvv.exe41⤵
- Executes dropped EXE
-
\??\c:\7dpvd.exec:\7dpvd.exe42⤵
- Executes dropped EXE
-
\??\c:\rfrfxrr.exec:\rfrfxrr.exe43⤵
- Executes dropped EXE
-
\??\c:\rllffxx.exec:\rllffxx.exe44⤵
- Executes dropped EXE
-
\??\c:\thnhbb.exec:\thnhbb.exe45⤵
- Executes dropped EXE
-
\??\c:\nbbbnn.exec:\nbbbnn.exe46⤵
- Executes dropped EXE
-
\??\c:\9dppp.exec:\9dppp.exe47⤵
- Executes dropped EXE
-
\??\c:\pdvvj.exec:\pdvvj.exe48⤵
- Executes dropped EXE
-
\??\c:\7lrlffx.exec:\7lrlffx.exe49⤵
- Executes dropped EXE
-
\??\c:\lrrrlff.exec:\lrrrlff.exe50⤵
- Executes dropped EXE
-
\??\c:\5bnhbb.exec:\5bnhbb.exe51⤵
- Executes dropped EXE
-
\??\c:\vdjdj.exec:\vdjdj.exe52⤵
- Executes dropped EXE
-
\??\c:\lrflfxr.exec:\lrflfxr.exe53⤵
- Executes dropped EXE
-
\??\c:\frfxfxf.exec:\frfxfxf.exe54⤵
- Executes dropped EXE
-
\??\c:\tthbhb.exec:\tthbhb.exe55⤵
- Executes dropped EXE
-
\??\c:\thtttt.exec:\thtttt.exe56⤵
- Executes dropped EXE
-
\??\c:\dvpjd.exec:\dvpjd.exe57⤵
- Executes dropped EXE
-
\??\c:\pvdjp.exec:\pvdjp.exe58⤵
- Executes dropped EXE
-
\??\c:\lxxlxrl.exec:\lxxlxrl.exe59⤵
- Executes dropped EXE
-
\??\c:\btnhbb.exec:\btnhbb.exe60⤵
- Executes dropped EXE
-
\??\c:\bnhbnn.exec:\bnhbnn.exe61⤵
- Executes dropped EXE
-
\??\c:\lfrrrrl.exec:\lfrrrrl.exe62⤵
- Executes dropped EXE
-
\??\c:\bbthbb.exec:\bbthbb.exe63⤵
- Executes dropped EXE
-
\??\c:\tthbtn.exec:\tthbtn.exe64⤵
- Executes dropped EXE
-
\??\c:\jppjd.exec:\jppjd.exe65⤵
- Executes dropped EXE
-
\??\c:\lfxrllf.exec:\lfxrllf.exe66⤵
-
\??\c:\hbhhhh.exec:\hbhhhh.exe67⤵
-
\??\c:\bhnhbn.exec:\bhnhbn.exe68⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe69⤵
-
\??\c:\5xrlxrl.exec:\5xrlxrl.exe70⤵
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe71⤵
-
\??\c:\bttbbb.exec:\bttbbb.exe72⤵
-
\??\c:\5lfxrlf.exec:\5lfxrlf.exe73⤵
-
\??\c:\fflrlfx.exec:\fflrlfx.exe74⤵
-
\??\c:\7bhtnh.exec:\7bhtnh.exe75⤵
-
\??\c:\7dvpp.exec:\7dvpp.exe76⤵
-
\??\c:\jjddv.exec:\jjddv.exe77⤵
-
\??\c:\llrrxrl.exec:\llrrxrl.exe78⤵
-
\??\c:\bbnnnt.exec:\bbnnnt.exe79⤵
-
\??\c:\7jjjd.exec:\7jjjd.exe80⤵
-
\??\c:\lrrrlfr.exec:\lrrrlfr.exe81⤵
-
\??\c:\7tttnt.exec:\7tttnt.exe82⤵
-
\??\c:\jpvpp.exec:\jpvpp.exe83⤵
-
\??\c:\rxrlfxr.exec:\rxrlfxr.exe84⤵
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe85⤵
-
\??\c:\7bbbbb.exec:\7bbbbb.exe86⤵
-
\??\c:\lxffrrl.exec:\lxffrrl.exe87⤵
-
\??\c:\fxflflf.exec:\fxflflf.exe88⤵
-
\??\c:\thnnhn.exec:\thnnhn.exe89⤵
-
\??\c:\djpjv.exec:\djpjv.exe90⤵
-
\??\c:\nnttnn.exec:\nnttnn.exe91⤵
-
\??\c:\bhtnhb.exec:\bhtnhb.exe92⤵
-
\??\c:\ppvjd.exec:\ppvjd.exe93⤵
-
\??\c:\rlxrfxl.exec:\rlxrfxl.exe94⤵
-
\??\c:\pdjdj.exec:\pdjdj.exe95⤵
-
\??\c:\jvjdv.exec:\jvjdv.exe96⤵
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe97⤵
-
\??\c:\9rxxrrr.exec:\9rxxrrr.exe98⤵
-
\??\c:\tnnnnn.exec:\tnnnnn.exe99⤵
-
\??\c:\nbhbtn.exec:\nbhbtn.exe100⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe101⤵
-
\??\c:\jjvjj.exec:\jjvjj.exe102⤵
-
\??\c:\fxxxllf.exec:\fxxxllf.exe103⤵
-
\??\c:\hbnhhh.exec:\hbnhhh.exe104⤵
-
\??\c:\3nnnhh.exec:\3nnnhh.exe105⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe106⤵
-
\??\c:\djpjd.exec:\djpjd.exe107⤵
-
\??\c:\rxlfrlf.exec:\rxlfrlf.exe108⤵
-
\??\c:\frrrllr.exec:\frrrllr.exe109⤵
-
\??\c:\nbtnhh.exec:\nbtnhh.exe110⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe111⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe112⤵
-
\??\c:\xrrrfll.exec:\xrrrfll.exe113⤵
-
\??\c:\9rxrllf.exec:\9rxrllf.exe114⤵
-
\??\c:\tnbttt.exec:\tnbttt.exe115⤵
-
\??\c:\7vdvj.exec:\7vdvj.exe116⤵
-
\??\c:\rfxfrrl.exec:\rfxfrrl.exe117⤵
-
\??\c:\5lxllfx.exec:\5lxllfx.exe118⤵
-
\??\c:\thnnbb.exec:\thnnbb.exe119⤵
-
\??\c:\thhbnt.exec:\thhbnt.exe120⤵
-
\??\c:\dppdv.exec:\dppdv.exe121⤵
-
\??\c:\rxrfrlf.exec:\rxrfrlf.exe122⤵
-
\??\c:\fllxrlf.exec:\fllxrlf.exe123⤵
-
\??\c:\btthbt.exec:\btthbt.exe124⤵
-
\??\c:\nnnnbh.exec:\nnnnbh.exe125⤵
-
\??\c:\vvddv.exec:\vvddv.exe126⤵
-
\??\c:\xllfrlr.exec:\xllfrlr.exe127⤵
-
\??\c:\rffxllx.exec:\rffxllx.exe128⤵
-
\??\c:\tnnhbt.exec:\tnnhbt.exe129⤵
-
\??\c:\1vdvp.exec:\1vdvp.exe130⤵
-
\??\c:\5rfxrrl.exec:\5rfxrrl.exe131⤵
-
\??\c:\llxrxxf.exec:\llxrxxf.exe132⤵
-
\??\c:\1htnhb.exec:\1htnhb.exe133⤵
-
\??\c:\1vpjd.exec:\1vpjd.exe134⤵
-
\??\c:\pddvp.exec:\pddvp.exe135⤵
-
\??\c:\lfrrllx.exec:\lfrrllx.exe136⤵
-
\??\c:\hbnnnn.exec:\hbnnnn.exe137⤵
-
\??\c:\bttntn.exec:\bttntn.exe138⤵
-
\??\c:\1vjdd.exec:\1vjdd.exe139⤵
-
\??\c:\rxfxrlx.exec:\rxfxrlx.exe140⤵
-
\??\c:\xrxlflf.exec:\xrxlflf.exe141⤵
-
\??\c:\hbbhbb.exec:\hbbhbb.exe142⤵
-
\??\c:\dpdvj.exec:\dpdvj.exe143⤵
-
\??\c:\ppvpd.exec:\ppvpd.exe144⤵
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe145⤵
-
\??\c:\bnnhbt.exec:\bnnhbt.exe146⤵
-
\??\c:\btbttt.exec:\btbttt.exe147⤵
-
\??\c:\pjjdp.exec:\pjjdp.exe148⤵
-
\??\c:\pjjdj.exec:\pjjdj.exe149⤵
-
\??\c:\lrxrlll.exec:\lrxrlll.exe150⤵
-
\??\c:\nhbhbh.exec:\nhbhbh.exe151⤵
-
\??\c:\bbbnbt.exec:\bbbnbt.exe152⤵
-
\??\c:\pppjd.exec:\pppjd.exe153⤵
-
\??\c:\ppjdv.exec:\ppjdv.exe154⤵
-
\??\c:\xrrlxxl.exec:\xrrlxxl.exe155⤵
-
\??\c:\hbhbtn.exec:\hbhbtn.exe156⤵
-
\??\c:\bnbnhh.exec:\bnbnhh.exe157⤵
-
\??\c:\pdjjv.exec:\pdjjv.exe158⤵
-
\??\c:\fxxlrrf.exec:\fxxlrrf.exe159⤵
-
\??\c:\xxflfll.exec:\xxflfll.exe160⤵
-
\??\c:\7hbttn.exec:\7hbttn.exe161⤵
-
\??\c:\jdvvp.exec:\jdvvp.exe162⤵
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe163⤵
-
\??\c:\rlxrllr.exec:\rlxrllr.exe164⤵
-
\??\c:\tthbbb.exec:\tthbbb.exe165⤵
-
\??\c:\pdvpj.exec:\pdvpj.exe166⤵
-
\??\c:\pjjdp.exec:\pjjdp.exe167⤵
-
\??\c:\ffrrflf.exec:\ffrrflf.exe168⤵
-
\??\c:\tntbhb.exec:\tntbhb.exe169⤵
-
\??\c:\3ttnbt.exec:\3ttnbt.exe170⤵
-
\??\c:\nhnhtn.exec:\nhnhtn.exe171⤵
-
\??\c:\djvjd.exec:\djvjd.exe172⤵
-
\??\c:\xrfllrr.exec:\xrfllrr.exe173⤵
-
\??\c:\xfxrrrl.exec:\xfxrrrl.exe174⤵
-
\??\c:\hntnhh.exec:\hntnhh.exe175⤵
-
\??\c:\hbbtnh.exec:\hbbtnh.exe176⤵
-
\??\c:\jdvpj.exec:\jdvpj.exe177⤵
-
\??\c:\xrlfxrf.exec:\xrlfxrf.exe178⤵
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe179⤵
-
\??\c:\7nnhbb.exec:\7nnhbb.exe180⤵
-
\??\c:\djjdv.exec:\djjdv.exe181⤵
-
\??\c:\vjdpj.exec:\vjdpj.exe182⤵
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe183⤵
-
\??\c:\frrfxrl.exec:\frrfxrl.exe184⤵
-
\??\c:\bbnthn.exec:\bbnthn.exe185⤵
-
\??\c:\nhbbtt.exec:\nhbbtt.exe186⤵
-
\??\c:\7djdj.exec:\7djdj.exe187⤵
-
\??\c:\xffxlfx.exec:\xffxlfx.exe188⤵
-
\??\c:\xrllfxx.exec:\xrllfxx.exe189⤵
-
\??\c:\tbhhbt.exec:\tbhhbt.exe190⤵
-
\??\c:\9hbthh.exec:\9hbthh.exe191⤵
-
\??\c:\vjdvp.exec:\vjdvp.exe192⤵
-
\??\c:\7fllfxl.exec:\7fllfxl.exe193⤵
-
\??\c:\5xrrlfx.exec:\5xrrlfx.exe194⤵
-
\??\c:\bbbbbt.exec:\bbbbbt.exe195⤵
-
\??\c:\dvdvj.exec:\dvdvj.exe196⤵
-
\??\c:\9llxrxr.exec:\9llxrxr.exe197⤵
-
\??\c:\fxlxrfr.exec:\fxlxrfr.exe198⤵
-
\??\c:\tnhhbb.exec:\tnhhbb.exe199⤵
-
\??\c:\9hbthh.exec:\9hbthh.exe200⤵
-
\??\c:\ppppd.exec:\ppppd.exe201⤵
-
\??\c:\9lfxllf.exec:\9lfxllf.exe202⤵
-
\??\c:\xfxrllx.exec:\xfxrllx.exe203⤵
-
\??\c:\tnhbbt.exec:\tnhbbt.exe204⤵
-
\??\c:\jvvjd.exec:\jvvjd.exe205⤵
-
\??\c:\vpjdv.exec:\vpjdv.exe206⤵
-
\??\c:\3rrlffx.exec:\3rrlffx.exe207⤵
-
\??\c:\rxrrllf.exec:\rxrrllf.exe208⤵
-
\??\c:\bttnhb.exec:\bttnhb.exe209⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe210⤵
-
\??\c:\vpvjv.exec:\vpvjv.exe211⤵
-
\??\c:\rlfrrrx.exec:\rlfrrrx.exe212⤵
-
\??\c:\nthnhb.exec:\nthnhb.exe213⤵
-
\??\c:\hthbtt.exec:\hthbtt.exe214⤵
-
\??\c:\ddjvv.exec:\ddjvv.exe215⤵
-
\??\c:\vddjv.exec:\vddjv.exe216⤵
-
\??\c:\xlfxffx.exec:\xlfxffx.exe217⤵
-
\??\c:\xrllxfx.exec:\xrllxfx.exe218⤵
-
\??\c:\tnnhbt.exec:\tnnhbt.exe219⤵
-
\??\c:\pjpdv.exec:\pjpdv.exe220⤵
-
\??\c:\jpdvp.exec:\jpdvp.exe221⤵
-
\??\c:\rlllxxf.exec:\rlllxxf.exe222⤵
-
\??\c:\btnhtt.exec:\btnhtt.exe223⤵
-
\??\c:\dppjd.exec:\dppjd.exe224⤵
-
\??\c:\djvvv.exec:\djvvv.exe225⤵
-
\??\c:\fxffxxx.exec:\fxffxxx.exe226⤵
-
\??\c:\nhtttt.exec:\nhtttt.exe227⤵
-
\??\c:\ntbbtt.exec:\ntbbtt.exe228⤵
-
\??\c:\jpddv.exec:\jpddv.exe229⤵
-
\??\c:\fxffxxr.exec:\fxffxxr.exe230⤵
-
\??\c:\rrxfflr.exec:\rrxfflr.exe231⤵
-
\??\c:\htntnh.exec:\htntnh.exe232⤵
-
\??\c:\bthnbn.exec:\bthnbn.exe233⤵
-
\??\c:\vjppp.exec:\vjppp.exe234⤵
-
\??\c:\pjvdd.exec:\pjvdd.exe235⤵
-
\??\c:\7llxllf.exec:\7llxllf.exe236⤵
-
\??\c:\nnhhhn.exec:\nnhhhn.exe237⤵
-
\??\c:\nntbth.exec:\nntbth.exe238⤵
-
\??\c:\pjvjj.exec:\pjvjj.exe239⤵
-
\??\c:\ppvpp.exec:\ppvpp.exe240⤵
-
\??\c:\xflxrxx.exec:\xflxrxx.exe241⤵