Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
687d9f26cea69af9a91bfff8a45ae5d8_JaffaCakes118.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
687d9f26cea69af9a91bfff8a45ae5d8_JaffaCakes118.exe
-
Size
457KB
-
MD5
687d9f26cea69af9a91bfff8a45ae5d8
-
SHA1
ad99b34dff960946c4cf96857386cc0a21f98777
-
SHA256
a006b2a729dd3b4f3a43745280a48b6d4cc13a249be01b1c885abbf68bfa02d7
-
SHA512
6eb3361ed7c94713cba0b7e9974fdd328ba01933ae8a175ea33c268bb7e1620f64b56503c64c0852305d18e34032e039847e657338beddca88ded40434f49414
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1H6I+S:d7Tc9Wj16A3Stvx6I+S
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1396-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/632-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-334-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-346-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-358-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-362-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/632-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/908-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1088-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/904-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-381-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-385-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-422-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-439-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-470-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-486-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-498-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-523-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-527-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-558-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/904-571-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-670-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-764-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-835-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-935-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-975-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hhbbhn.exefflllrr.exepjvpp.exenbbbtt.exe5tthnh.exevvjdj.exe7xfrlfx.exenbnhbb.exedvjdd.exefffxrlf.exehbhbtt.exejddpj.exellxfxrl.exe9ttnnn.exe3ttnbb.exexrrrllf.exelrrrrrx.exe3nnhbb.exevvddp.exelrxlxxr.exehbhbnn.exe3nhbnn.exevddvj.exexlxxlrx.exehntthh.exe1dvdv.exevdjjd.exelffrrrr.exetnnthh.exeppvpd.exexrxxrxr.exebtnnnh.exe7ttnhh.exevvvjd.exenbhtnn.exejvvjd.exefxrlfxr.exebthbtb.exedvjdj.exerlfflff.exefxlrfrl.exennhbtb.exevpdvv.exexrxllfl.exexrfxxrx.exe9nnhth.exedvpjd.exedpdpj.exeflfrlfr.exenhhbnn.exe9jdvj.exejdjdv.exerffxxxr.exebttnbt.exedjdvp.exeddvvd.exehhnhbn.exebttnhb.exevjjdv.exellxlxrf.exelfflflf.exehnnbtn.exe9vjdj.exefrxxxxx.exepid process 4068 hhbbhn.exe 1000 fflllrr.exe 2572 pjvpp.exe 3068 nbbbtt.exe 1436 5tthnh.exe 3824 vvjdj.exe 1340 7xfrlfx.exe 2240 nbnhbb.exe 1348 dvjdd.exe 1824 fffxrlf.exe 2180 hbhbtt.exe 3108 jddpj.exe 904 llxfxrl.exe 4028 9ttnnn.exe 3924 3ttnbb.exe 1720 xrrrllf.exe 2188 lrrrrrx.exe 4508 3nnhbb.exe 2280 vvddp.exe 1124 lrxlxxr.exe 4004 hbhbnn.exe 4604 3nhbnn.exe 4820 vddvj.exe 4768 xlxxlrx.exe 1088 hntthh.exe 4360 1dvdv.exe 3092 vdjjd.exe 4880 lffrrrr.exe 408 tnnthh.exe 4720 ppvpd.exe 4324 xrxxrxr.exe 2492 btnnnh.exe 1608 7ttnhh.exe 1168 vvvjd.exe 2284 nbhtnn.exe 4224 jvvjd.exe 392 fxrlfxr.exe 2616 bthbtb.exe 2044 dvjdj.exe 3452 rlfflff.exe 908 fxlrfrl.exe 3872 nnhbtb.exe 632 vpdvv.exe 684 xrxllfl.exe 1972 xrfxxrx.exe 1348 9nnhth.exe 1200 dvpjd.exe 3152 dpdpj.exe 3428 flfrlfr.exe 4580 nhhbnn.exe 2892 9jdvj.exe 2348 jdjdv.exe 1748 rffxxxr.exe 2128 bttnbt.exe 1556 djdvp.exe 1884 ddvvd.exe 1480 hhnhbn.exe 4600 bttnhb.exe 1008 vjjdv.exe 3668 llxlxrf.exe 4596 lfflflf.exe 4620 hnnbtn.exe 4248 9vjdj.exe 3076 frxxxxx.exe -
Processes:
resource yara_rule behavioral2/memory/1396-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-334-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-351-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-358-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-362-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1200-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/908-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/908-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1088-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-381-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
687d9f26cea69af9a91bfff8a45ae5d8_JaffaCakes118.exehhbbhn.exefflllrr.exepjvpp.exenbbbtt.exe5tthnh.exevvjdj.exe7xfrlfx.exenbnhbb.exedvjdd.exefffxrlf.exehbhbtt.exejddpj.exellxfxrl.exe9ttnnn.exe3ttnbb.exexrrrllf.exelrrrrrx.exe3nnhbb.exevvddp.exelrxlxxr.exehbhbnn.exedescription pid process target process PID 1396 wrote to memory of 4068 1396 687d9f26cea69af9a91bfff8a45ae5d8_JaffaCakes118.exe hhbbhn.exe PID 1396 wrote to memory of 4068 1396 687d9f26cea69af9a91bfff8a45ae5d8_JaffaCakes118.exe hhbbhn.exe PID 1396 wrote to memory of 4068 1396 687d9f26cea69af9a91bfff8a45ae5d8_JaffaCakes118.exe hhbbhn.exe PID 4068 wrote to memory of 1000 4068 hhbbhn.exe fflllrr.exe PID 4068 wrote to memory of 1000 4068 hhbbhn.exe fflllrr.exe PID 4068 wrote to memory of 1000 4068 hhbbhn.exe fflllrr.exe PID 1000 wrote to memory of 2572 1000 fflllrr.exe pjvpp.exe PID 1000 wrote to memory of 2572 1000 fflllrr.exe pjvpp.exe PID 1000 wrote to memory of 2572 1000 fflllrr.exe pjvpp.exe PID 2572 wrote to memory of 3068 2572 pjvpp.exe nbbbtt.exe PID 2572 wrote to memory of 3068 2572 pjvpp.exe nbbbtt.exe PID 2572 wrote to memory of 3068 2572 pjvpp.exe nbbbtt.exe PID 3068 wrote to memory of 1436 3068 nbbbtt.exe 5tthnh.exe PID 3068 wrote to memory of 1436 3068 nbbbtt.exe 5tthnh.exe PID 3068 wrote to memory of 1436 3068 nbbbtt.exe 5tthnh.exe PID 1436 wrote to memory of 3824 1436 5tthnh.exe vvjdj.exe PID 1436 wrote to memory of 3824 1436 5tthnh.exe vvjdj.exe PID 1436 wrote to memory of 3824 1436 5tthnh.exe vvjdj.exe PID 3824 wrote to memory of 1340 3824 vvjdj.exe 7xfrlfx.exe PID 3824 wrote to memory of 1340 3824 vvjdj.exe 7xfrlfx.exe PID 3824 wrote to memory of 1340 3824 vvjdj.exe 7xfrlfx.exe PID 1340 wrote to memory of 2240 1340 7xfrlfx.exe nbnhbb.exe PID 1340 wrote to memory of 2240 1340 7xfrlfx.exe nbnhbb.exe PID 1340 wrote to memory of 2240 1340 7xfrlfx.exe nbnhbb.exe PID 2240 wrote to memory of 1348 2240 nbnhbb.exe 9nnhth.exe PID 2240 wrote to memory of 1348 2240 nbnhbb.exe 9nnhth.exe PID 2240 wrote to memory of 1348 2240 nbnhbb.exe 9nnhth.exe PID 1348 wrote to memory of 1824 1348 dvjdd.exe fffxrlf.exe PID 1348 wrote to memory of 1824 1348 dvjdd.exe fffxrlf.exe PID 1348 wrote to memory of 1824 1348 dvjdd.exe fffxrlf.exe PID 1824 wrote to memory of 2180 1824 fffxrlf.exe hbhbtt.exe PID 1824 wrote to memory of 2180 1824 fffxrlf.exe hbhbtt.exe PID 1824 wrote to memory of 2180 1824 fffxrlf.exe hbhbtt.exe PID 2180 wrote to memory of 3108 2180 hbhbtt.exe jddpj.exe PID 2180 wrote to memory of 3108 2180 hbhbtt.exe jddpj.exe PID 2180 wrote to memory of 3108 2180 hbhbtt.exe jddpj.exe PID 3108 wrote to memory of 904 3108 jddpj.exe llxfxrl.exe PID 3108 wrote to memory of 904 3108 jddpj.exe llxfxrl.exe PID 3108 wrote to memory of 904 3108 jddpj.exe llxfxrl.exe PID 904 wrote to memory of 4028 904 llxfxrl.exe 9ttnnn.exe PID 904 wrote to memory of 4028 904 llxfxrl.exe 9ttnnn.exe PID 904 wrote to memory of 4028 904 llxfxrl.exe 9ttnnn.exe PID 4028 wrote to memory of 3924 4028 9ttnnn.exe 3ttnbb.exe PID 4028 wrote to memory of 3924 4028 9ttnnn.exe 3ttnbb.exe PID 4028 wrote to memory of 3924 4028 9ttnnn.exe 3ttnbb.exe PID 3924 wrote to memory of 1720 3924 3ttnbb.exe xrrrllf.exe PID 3924 wrote to memory of 1720 3924 3ttnbb.exe xrrrllf.exe PID 3924 wrote to memory of 1720 3924 3ttnbb.exe xrrrllf.exe PID 1720 wrote to memory of 2188 1720 xrrrllf.exe lrrrrrx.exe PID 1720 wrote to memory of 2188 1720 xrrrllf.exe lrrrrrx.exe PID 1720 wrote to memory of 2188 1720 xrrrllf.exe lrrrrrx.exe PID 2188 wrote to memory of 4508 2188 lrrrrrx.exe 3nnhbb.exe PID 2188 wrote to memory of 4508 2188 lrrrrrx.exe 3nnhbb.exe PID 2188 wrote to memory of 4508 2188 lrrrrrx.exe 3nnhbb.exe PID 4508 wrote to memory of 2280 4508 3nnhbb.exe vvddp.exe PID 4508 wrote to memory of 2280 4508 3nnhbb.exe vvddp.exe PID 4508 wrote to memory of 2280 4508 3nnhbb.exe vvddp.exe PID 2280 wrote to memory of 1124 2280 vvddp.exe lrxlxxr.exe PID 2280 wrote to memory of 1124 2280 vvddp.exe lrxlxxr.exe PID 2280 wrote to memory of 1124 2280 vvddp.exe lrxlxxr.exe PID 1124 wrote to memory of 4004 1124 lrxlxxr.exe hbhbnn.exe PID 1124 wrote to memory of 4004 1124 lrxlxxr.exe hbhbnn.exe PID 1124 wrote to memory of 4004 1124 lrxlxxr.exe hbhbnn.exe PID 4004 wrote to memory of 4604 4004 hbhbnn.exe 3nhbnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\687d9f26cea69af9a91bfff8a45ae5d8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\687d9f26cea69af9a91bfff8a45ae5d8_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbbhn.exec:\hhbbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fflllrr.exec:\fflllrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvpp.exec:\pjvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbbtt.exec:\nbbbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5tthnh.exec:\5tthnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjdj.exec:\vvjdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xfrlfx.exec:\7xfrlfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbnhbb.exec:\nbnhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvjdd.exec:\dvjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fffxrlf.exec:\fffxrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhbtt.exec:\hbhbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jddpj.exec:\jddpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llxfxrl.exec:\llxfxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9ttnnn.exec:\9ttnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3ttnbb.exec:\3ttnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrrllf.exec:\xrrrllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrrrrrx.exec:\lrrrrrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3nnhbb.exec:\3nnhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvddp.exec:\vvddp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrxlxxr.exec:\lrxlxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhbnn.exec:\hbhbnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3nhbnn.exec:\3nhbnn.exe23⤵
- Executes dropped EXE
-
\??\c:\vddvj.exec:\vddvj.exe24⤵
- Executes dropped EXE
-
\??\c:\xlxxlrx.exec:\xlxxlrx.exe25⤵
- Executes dropped EXE
-
\??\c:\hntthh.exec:\hntthh.exe26⤵
- Executes dropped EXE
-
\??\c:\1dvdv.exec:\1dvdv.exe27⤵
- Executes dropped EXE
-
\??\c:\vdjjd.exec:\vdjjd.exe28⤵
- Executes dropped EXE
-
\??\c:\lffrrrr.exec:\lffrrrr.exe29⤵
- Executes dropped EXE
-
\??\c:\tnnthh.exec:\tnnthh.exe30⤵
- Executes dropped EXE
-
\??\c:\ppvpd.exec:\ppvpd.exe31⤵
- Executes dropped EXE
-
\??\c:\xrxxrxr.exec:\xrxxrxr.exe32⤵
- Executes dropped EXE
-
\??\c:\btnnnh.exec:\btnnnh.exe33⤵
- Executes dropped EXE
-
\??\c:\7ttnhh.exec:\7ttnhh.exe34⤵
- Executes dropped EXE
-
\??\c:\vvvjd.exec:\vvvjd.exe35⤵
- Executes dropped EXE
-
\??\c:\rrllfll.exec:\rrllfll.exe36⤵
-
\??\c:\nbhtnn.exec:\nbhtnn.exe37⤵
- Executes dropped EXE
-
\??\c:\jvvjd.exec:\jvvjd.exe38⤵
- Executes dropped EXE
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe39⤵
- Executes dropped EXE
-
\??\c:\bthbtb.exec:\bthbtb.exe40⤵
- Executes dropped EXE
-
\??\c:\dvjdj.exec:\dvjdj.exe41⤵
- Executes dropped EXE
-
\??\c:\rlfflff.exec:\rlfflff.exe42⤵
- Executes dropped EXE
-
\??\c:\fxlrfrl.exec:\fxlrfrl.exe43⤵
- Executes dropped EXE
-
\??\c:\nnhbtb.exec:\nnhbtb.exe44⤵
- Executes dropped EXE
-
\??\c:\vpdvv.exec:\vpdvv.exe45⤵
- Executes dropped EXE
-
\??\c:\xrxllfl.exec:\xrxllfl.exe46⤵
- Executes dropped EXE
-
\??\c:\xrfxxrx.exec:\xrfxxrx.exe47⤵
- Executes dropped EXE
-
\??\c:\9nnhth.exec:\9nnhth.exe48⤵
- Executes dropped EXE
-
\??\c:\dvpjd.exec:\dvpjd.exe49⤵
- Executes dropped EXE
-
\??\c:\dpdpj.exec:\dpdpj.exe50⤵
- Executes dropped EXE
-
\??\c:\flfrlfr.exec:\flfrlfr.exe51⤵
- Executes dropped EXE
-
\??\c:\nhhbnn.exec:\nhhbnn.exe52⤵
- Executes dropped EXE
-
\??\c:\9jdvj.exec:\9jdvj.exe53⤵
- Executes dropped EXE
-
\??\c:\jdjdv.exec:\jdjdv.exe54⤵
- Executes dropped EXE
-
\??\c:\rffxxxr.exec:\rffxxxr.exe55⤵
- Executes dropped EXE
-
\??\c:\bttnbt.exec:\bttnbt.exe56⤵
- Executes dropped EXE
-
\??\c:\djdvp.exec:\djdvp.exe57⤵
- Executes dropped EXE
-
\??\c:\ddvvd.exec:\ddvvd.exe58⤵
- Executes dropped EXE
-
\??\c:\hhnhbn.exec:\hhnhbn.exe59⤵
- Executes dropped EXE
-
\??\c:\bttnhb.exec:\bttnhb.exe60⤵
- Executes dropped EXE
-
\??\c:\vjjdv.exec:\vjjdv.exe61⤵
- Executes dropped EXE
-
\??\c:\llxlxrf.exec:\llxlxrf.exe62⤵
- Executes dropped EXE
-
\??\c:\lfflflf.exec:\lfflflf.exe63⤵
- Executes dropped EXE
-
\??\c:\hnnbtn.exec:\hnnbtn.exe64⤵
- Executes dropped EXE
-
\??\c:\9vjdj.exec:\9vjdj.exe65⤵
- Executes dropped EXE
-
\??\c:\frxxxxx.exec:\frxxxxx.exe66⤵
- Executes dropped EXE
-
\??\c:\3rrllfx.exec:\3rrllfx.exe67⤵
-
\??\c:\httnhn.exec:\httnhn.exe68⤵
-
\??\c:\vpjdv.exec:\vpjdv.exe69⤵
-
\??\c:\dvdvd.exec:\dvdvd.exe70⤵
-
\??\c:\ffrrrxf.exec:\ffrrrxf.exe71⤵
-
\??\c:\hbnhhh.exec:\hbnhhh.exe72⤵
-
\??\c:\pvvdv.exec:\pvvdv.exe73⤵
-
\??\c:\jddjd.exec:\jddjd.exe74⤵
-
\??\c:\frlfxrl.exec:\frlfxrl.exe75⤵
-
\??\c:\hhhbtt.exec:\hhhbtt.exe76⤵
-
\??\c:\bhbnth.exec:\bhbnth.exe77⤵
-
\??\c:\1vdvv.exec:\1vdvv.exe78⤵
-
\??\c:\7rrlffr.exec:\7rrlffr.exe79⤵
-
\??\c:\tnnhbb.exec:\tnnhbb.exe80⤵
-
\??\c:\hnhbtt.exec:\hnhbtt.exe81⤵
-
\??\c:\pppjj.exec:\pppjj.exe82⤵
-
\??\c:\rffxlxx.exec:\rffxlxx.exe83⤵
-
\??\c:\1xlxlfx.exec:\1xlxlfx.exe84⤵
-
\??\c:\hhhthb.exec:\hhhthb.exe85⤵
-
\??\c:\dpjvd.exec:\dpjvd.exe86⤵
-
\??\c:\lxxlfrf.exec:\lxxlfrf.exe87⤵
-
\??\c:\hbhbtt.exec:\hbhbtt.exe88⤵
-
\??\c:\1dvvj.exec:\1dvvj.exe89⤵
-
\??\c:\pjdpj.exec:\pjdpj.exe90⤵
-
\??\c:\rflfrlf.exec:\rflfrlf.exe91⤵
-
\??\c:\thtthh.exec:\thtthh.exe92⤵
-
\??\c:\1jjdd.exec:\1jjdd.exe93⤵
-
\??\c:\bhhthb.exec:\bhhthb.exe94⤵
-
\??\c:\jvjvd.exec:\jvjvd.exe95⤵
-
\??\c:\ddddv.exec:\ddddv.exe96⤵
-
\??\c:\bbhttn.exec:\bbhttn.exe97⤵
-
\??\c:\3lfxllf.exec:\3lfxllf.exe98⤵
-
\??\c:\thhthn.exec:\thhthn.exe99⤵
-
\??\c:\rlffflx.exec:\rlffflx.exe100⤵
-
\??\c:\pppjd.exec:\pppjd.exe101⤵
-
\??\c:\nhhnhb.exec:\nhhnhb.exe102⤵
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe103⤵
-
\??\c:\btttnh.exec:\btttnh.exe104⤵
-
\??\c:\3jpdp.exec:\3jpdp.exe105⤵
-
\??\c:\ffxrxlf.exec:\ffxrxlf.exe106⤵
-
\??\c:\nnnhtn.exec:\nnnhtn.exe107⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe108⤵
-
\??\c:\rffrlfr.exec:\rffrlfr.exe109⤵
-
\??\c:\pvdvd.exec:\pvdvd.exe110⤵
-
\??\c:\3tbnbb.exec:\3tbnbb.exe111⤵
-
\??\c:\fxlflfx.exec:\fxlflfx.exe112⤵
-
\??\c:\bntnhb.exec:\bntnhb.exe113⤵
-
\??\c:\5llfxxl.exec:\5llfxxl.exe114⤵
-
\??\c:\hhhtnh.exec:\hhhtnh.exe115⤵
-
\??\c:\9jjdd.exec:\9jjdd.exe116⤵
-
\??\c:\fxfrlfx.exec:\fxfrlfx.exe117⤵
-
\??\c:\lffrlfr.exec:\lffrlfr.exe118⤵
-
\??\c:\tttnhb.exec:\tttnhb.exe119⤵
-
\??\c:\pvjvp.exec:\pvjvp.exe120⤵
-
\??\c:\fxfrllf.exec:\fxfrllf.exe121⤵
-
\??\c:\9ttnnn.exec:\9ttnnn.exe122⤵
-
\??\c:\dvjdp.exec:\dvjdp.exe123⤵
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe124⤵
-
\??\c:\1nbtbt.exec:\1nbtbt.exe125⤵
-
\??\c:\3pjdj.exec:\3pjdj.exe126⤵
-
\??\c:\vddpj.exec:\vddpj.exe127⤵
-
\??\c:\xrflflx.exec:\xrflflx.exe128⤵
-
\??\c:\thbhnb.exec:\thbhnb.exe129⤵
-
\??\c:\jdpdv.exec:\jdpdv.exe130⤵
-
\??\c:\3flfxrr.exec:\3flfxrr.exe131⤵
-
\??\c:\xxrrlll.exec:\xxrrlll.exe132⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe133⤵
-
\??\c:\vvpvd.exec:\vvpvd.exe134⤵
-
\??\c:\xlfxrlr.exec:\xlfxrlr.exe135⤵
-
\??\c:\tnbttt.exec:\tnbttt.exe136⤵
-
\??\c:\pdjpv.exec:\pdjpv.exe137⤵
-
\??\c:\rlrxrrr.exec:\rlrxrrr.exe138⤵
-
\??\c:\lllfxxx.exec:\lllfxxx.exe139⤵
-
\??\c:\1thnnt.exec:\1thnnt.exe140⤵
-
\??\c:\1vjjp.exec:\1vjjp.exe141⤵
-
\??\c:\xlrlxll.exec:\xlrlxll.exe142⤵
-
\??\c:\xxfllfx.exec:\xxfllfx.exe143⤵
-
\??\c:\bbthnn.exec:\bbthnn.exe144⤵
-
\??\c:\jvddd.exec:\jvddd.exe145⤵
-
\??\c:\lllfxfx.exec:\lllfxfx.exe146⤵
-
\??\c:\nbbttb.exec:\nbbttb.exe147⤵
-
\??\c:\nhnnbb.exec:\nhnnbb.exe148⤵
-
\??\c:\vdvpv.exec:\vdvpv.exe149⤵
-
\??\c:\1fxlrfr.exec:\1fxlrfr.exe150⤵
-
\??\c:\htbhht.exec:\htbhht.exe151⤵
-
\??\c:\vpjjv.exec:\vpjjv.exe152⤵
-
\??\c:\5xxllxr.exec:\5xxllxr.exe153⤵
-
\??\c:\hthhnn.exec:\hthhnn.exe154⤵
-
\??\c:\tbttbn.exec:\tbttbn.exe155⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe156⤵
-
\??\c:\xrfxlrr.exec:\xrfxlrr.exe157⤵
-
\??\c:\ntnhnn.exec:\ntnhnn.exe158⤵
-
\??\c:\9vdvv.exec:\9vdvv.exe159⤵
-
\??\c:\lxllrxf.exec:\lxllrxf.exe160⤵
-
\??\c:\rrxxfll.exec:\rrxxfll.exe161⤵
-
\??\c:\thntbh.exec:\thntbh.exe162⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe163⤵
-
\??\c:\flrxrfl.exec:\flrxrfl.exe164⤵
-
\??\c:\hbhbhh.exec:\hbhbhh.exe165⤵
-
\??\c:\1ddvp.exec:\1ddvp.exe166⤵
-
\??\c:\fxlrlrr.exec:\fxlrlrr.exe167⤵
-
\??\c:\5xfrffr.exec:\5xfrffr.exe168⤵
-
\??\c:\nnhnnb.exec:\nnhnnb.exe169⤵
-
\??\c:\djpvp.exec:\djpvp.exe170⤵
-
\??\c:\rxfrlrl.exec:\rxfrlrl.exe171⤵
-
\??\c:\nbthbn.exec:\nbthbn.exe172⤵
-
\??\c:\jvddj.exec:\jvddj.exe173⤵
-
\??\c:\vjvpj.exec:\vjvpj.exe174⤵
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe175⤵
-
\??\c:\thhbnh.exec:\thhbnh.exe176⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe177⤵
-
\??\c:\xxxrfff.exec:\xxxrfff.exe178⤵
-
\??\c:\hbbnhn.exec:\hbbnhn.exe179⤵
-
\??\c:\1vvjp.exec:\1vvjp.exe180⤵
-
\??\c:\1fxlrrl.exec:\1fxlrrl.exe181⤵
-
\??\c:\tnhbnn.exec:\tnhbnn.exe182⤵
-
\??\c:\bttnhb.exec:\bttnhb.exe183⤵
-
\??\c:\lxfrfxl.exec:\lxfrfxl.exe184⤵
-
\??\c:\hhtnnb.exec:\hhtnnb.exe185⤵
-
\??\c:\dddvj.exec:\dddvj.exe186⤵
-
\??\c:\fllffxr.exec:\fllffxr.exe187⤵
-
\??\c:\xrlxrlr.exec:\xrlxrlr.exe188⤵
-
\??\c:\thntnh.exec:\thntnh.exe189⤵
-
\??\c:\7pjdj.exec:\7pjdj.exe190⤵
-
\??\c:\1xrrffx.exec:\1xrrffx.exe191⤵
-
\??\c:\3hhbnn.exec:\3hhbnn.exe192⤵
-
\??\c:\vpvjd.exec:\vpvjd.exe193⤵
-
\??\c:\lxxrfxf.exec:\lxxrfxf.exe194⤵
-
\??\c:\lffxrrr.exec:\lffxrrr.exe195⤵
-
\??\c:\nhnntt.exec:\nhnntt.exe196⤵
-
\??\c:\jdvdv.exec:\jdvdv.exe197⤵
-
\??\c:\3lfxxll.exec:\3lfxxll.exe198⤵
-
\??\c:\ttnnhh.exec:\ttnnhh.exe199⤵
-
\??\c:\jjpvv.exec:\jjpvv.exe200⤵
-
\??\c:\frfxfxl.exec:\frfxfxl.exe201⤵
-
\??\c:\thbtnh.exec:\thbtnh.exe202⤵
-
\??\c:\7ttnnn.exec:\7ttnnn.exe203⤵
-
\??\c:\dpjjp.exec:\dpjjp.exe204⤵
-
\??\c:\rlllfff.exec:\rlllfff.exe205⤵
-
\??\c:\ffllfff.exec:\ffllfff.exe206⤵
-
\??\c:\tntnnn.exec:\tntnnn.exe207⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe208⤵
-
\??\c:\ppddd.exec:\ppddd.exe209⤵
-
\??\c:\frlrlxr.exec:\frlrlxr.exe210⤵
-
\??\c:\7htnnn.exec:\7htnnn.exe211⤵
-
\??\c:\tbhbbb.exec:\tbhbbb.exe212⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe213⤵
-
\??\c:\xflfrfx.exec:\xflfrfx.exe214⤵
-
\??\c:\flxrllr.exec:\flxrllr.exe215⤵
-
\??\c:\1nnhbt.exec:\1nnhbt.exe216⤵
-
\??\c:\vpddp.exec:\vpddp.exe217⤵
-
\??\c:\rfrxxff.exec:\rfrxxff.exe218⤵
-
\??\c:\hhbnht.exec:\hhbnht.exe219⤵
-
\??\c:\jvddv.exec:\jvddv.exe220⤵
-
\??\c:\fllllrr.exec:\fllllrr.exe221⤵
-
\??\c:\lxlflff.exec:\lxlflff.exe222⤵
-
\??\c:\1tnbht.exec:\1tnbht.exe223⤵
-
\??\c:\pvjpd.exec:\pvjpd.exe224⤵
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe225⤵
-
\??\c:\bthbhh.exec:\bthbhh.exe226⤵
-
\??\c:\5nbntt.exec:\5nbntt.exe227⤵
-
\??\c:\ddddj.exec:\ddddj.exe228⤵
-
\??\c:\7rrlflx.exec:\7rrlflx.exe229⤵
-
\??\c:\lllllll.exec:\lllllll.exe230⤵
-
\??\c:\nhnhhh.exec:\nhnhhh.exe231⤵
-
\??\c:\jjvdj.exec:\jjvdj.exe232⤵
-
\??\c:\flrxrrr.exec:\flrxrrr.exe233⤵
-
\??\c:\rflxrrr.exec:\rflxrrr.exe234⤵
-
\??\c:\bthhbh.exec:\bthhbh.exe235⤵
-
\??\c:\ppvvd.exec:\ppvvd.exe236⤵
-
\??\c:\pdpjd.exec:\pdpjd.exe237⤵
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe238⤵
-
\??\c:\bbntnb.exec:\bbntnb.exe239⤵
-
\??\c:\vpjvj.exec:\vpjvj.exe240⤵
-
\??\c:\lxxrlll.exec:\lxxrlll.exe241⤵