Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 11:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe
-
Size
200KB
-
MD5
6ac39b0def6b9df14375425cab153c98
-
SHA1
57000411802f2c94129d88b200517623358841b8
-
SHA256
d7efbe7f1a9d3961b36db0f71553dfe3a4674e895b08df2ae915202e30add5b3
-
SHA512
ad2eef46680b95d4050473a86a3cb2d5e8c5b087257ce34d32c3cc2a9737d3590b679ed571a966b8a0bbd0b17a38b24594208a0b55e72f551518de4ca8c264e9
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqyvU2r1vsKM4ltyjC:PhOm2sI93UufdC67cihvH1S/G
Malware Config
Signatures
-
Detect Blackmoon payload 51 IoCs
Processes:
resource yara_rule behavioral1/memory/1768-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-12-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2084-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-100-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2696-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-118-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/760-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1136-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/984-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-319-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-338-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-359-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-386-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-393-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-469-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-507-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/880-553-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2184-561-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-570-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2864-590-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-701-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1716-708-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-759-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1776-795-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-802-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2892-807-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1788-826-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3028-858-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-871-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/1820-909-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2956-956-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/1860-1042-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/616-1063-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1652-1074-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdjpd.exe5dvvd.exehbhnnn.exejvddd.exelfrrflr.exepjvdp.exeflrlfxr.exe1htthn.exe1nbbhh.exelfxfrxl.exefxxrrrf.exebbtthn.exejjddj.exe5xlxfff.exebnhbtt.exevpppd.exeffrfrrx.exebhhhbt.exe1hbhhn.exevpjpj.exellfxrfr.exehhbhtb.exejdpvp.exe3lffllr.exellflxxf.exe7bnhbh.exevvvvv.exe1lrxxxx.exe5tbbbb.exepvjdp.exe1lxfflx.exehtnnbb.exe3dpvp.exe1xllrfl.exexxxfrxf.exe3pppd.exefxrflrl.exenhtnhh.exejddpd.exe5ddjd.exellffffr.exettnhbh.exebthnbt.exevpdpj.exexrfrllx.exeffrxlrx.exe9thhtb.exehhttbt.exevvpvd.exe9fxxlfl.exefxffrrl.exehbnntt.exe7djjp.exevppvd.exellxfxfr.exefxrrxfl.exehhhhtt.exe9bhtth.exepdvvd.exepdvdj.exe7xlrxrx.exe7xrxfll.exe1tnttt.exe5tbbhn.exepid process 1944 jdjpd.exe 2084 5dvvd.exe 2756 hbhnnn.exe 2724 jvddd.exe 2636 lfrrflr.exe 2648 pjvdp.exe 2480 flrlfxr.exe 2596 1htthn.exe 2988 1nbbhh.exe 2696 lfxfrxl.exe 2776 fxxrrrf.exe 1556 bbtthn.exe 1888 jjddj.exe 760 5xlxfff.exe 1664 bnhbtt.exe 2452 vpppd.exe 1060 ffrfrrx.exe 1360 bhhhbt.exe 2344 1hbhhn.exe 2248 vpjpj.exe 2256 llfxrfr.exe 536 hhbhtb.exe 1408 jdpvp.exe 2892 3lffllr.exe 352 llflxxf.exe 992 7bnhbh.exe 1284 vvvvv.exe 1744 1lrxxxx.exe 1136 5tbbbb.exe 2560 pvjdp.exe 2316 1lxfflx.exe 984 htnnbb.exe 1868 3dpvp.exe 1876 1xllrfl.exe 1348 xxxfrxf.exe 1620 3pppd.exe 2084 fxrflrl.exe 2748 nhtnhh.exe 2872 jddpd.exe 1260 5ddjd.exe 2664 llffffr.exe 2520 ttnhbh.exe 2492 bthnbt.exe 3020 vpdpj.exe 2060 xrfrllx.exe 2464 ffrxlrx.exe 2708 9thhtb.exe 2840 hhttbt.exe 1604 vvpvd.exe 1916 9fxxlfl.exe 1968 fxffrrl.exe 284 hbnntt.exe 1200 7djjp.exe 2968 vppvd.exe 1340 llxfxfr.exe 1432 fxrrxfl.exe 2984 hhhhtt.exe 2020 9bhtth.exe 1056 pdvvd.exe 1624 pdvdj.exe 1256 7xlrxrx.exe 696 7xrxfll.exe 536 1tnttt.exe 2104 5tbbhn.exe -
Processes:
resource yara_rule behavioral1/memory/1768-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-12-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2084-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-100-0x0000000000230000-0x0000000000259000-memory.dmp upx behavioral1/memory/2696-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-118-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/760-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1136-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-345-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-359-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-366-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-379-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-386-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/284-425-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-432-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-469-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-500-0x00000000003C0000-0x00000000003E9000-memory.dmp upx behavioral1/memory/1736-514-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-527-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-554-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-561-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-571-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-590-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-609-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-682-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-708-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-733-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-746-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-760-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-785-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-795-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-858-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-878-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-910-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-917-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exejdjpd.exe5dvvd.exehbhnnn.exejvddd.exelfrrflr.exepjvdp.exeflrlfxr.exe1htthn.exe1nbbhh.exelfxfrxl.exefxxrrrf.exebbtthn.exejjddj.exe5xlxfff.exebnhbtt.exedescription pid process target process PID 1768 wrote to memory of 1944 1768 6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe jdjpd.exe PID 1768 wrote to memory of 1944 1768 6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe jdjpd.exe PID 1768 wrote to memory of 1944 1768 6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe jdjpd.exe PID 1768 wrote to memory of 1944 1768 6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe jdjpd.exe PID 1944 wrote to memory of 2084 1944 jdjpd.exe 5dvvd.exe PID 1944 wrote to memory of 2084 1944 jdjpd.exe 5dvvd.exe PID 1944 wrote to memory of 2084 1944 jdjpd.exe 5dvvd.exe PID 1944 wrote to memory of 2084 1944 jdjpd.exe 5dvvd.exe PID 2084 wrote to memory of 2756 2084 5dvvd.exe hbhnnn.exe PID 2084 wrote to memory of 2756 2084 5dvvd.exe hbhnnn.exe PID 2084 wrote to memory of 2756 2084 5dvvd.exe hbhnnn.exe PID 2084 wrote to memory of 2756 2084 5dvvd.exe hbhnnn.exe PID 2756 wrote to memory of 2724 2756 hbhnnn.exe jvddd.exe PID 2756 wrote to memory of 2724 2756 hbhnnn.exe jvddd.exe PID 2756 wrote to memory of 2724 2756 hbhnnn.exe jvddd.exe PID 2756 wrote to memory of 2724 2756 hbhnnn.exe jvddd.exe PID 2724 wrote to memory of 2636 2724 jvddd.exe lfrrflr.exe PID 2724 wrote to memory of 2636 2724 jvddd.exe lfrrflr.exe PID 2724 wrote to memory of 2636 2724 jvddd.exe lfrrflr.exe PID 2724 wrote to memory of 2636 2724 jvddd.exe lfrrflr.exe PID 2636 wrote to memory of 2648 2636 lfrrflr.exe pjvdp.exe PID 2636 wrote to memory of 2648 2636 lfrrflr.exe pjvdp.exe PID 2636 wrote to memory of 2648 2636 lfrrflr.exe pjvdp.exe PID 2636 wrote to memory of 2648 2636 lfrrflr.exe pjvdp.exe PID 2648 wrote to memory of 2480 2648 pjvdp.exe flrlfxr.exe PID 2648 wrote to memory of 2480 2648 pjvdp.exe flrlfxr.exe PID 2648 wrote to memory of 2480 2648 pjvdp.exe flrlfxr.exe PID 2648 wrote to memory of 2480 2648 pjvdp.exe flrlfxr.exe PID 2480 wrote to memory of 2596 2480 flrlfxr.exe 1htthn.exe PID 2480 wrote to memory of 2596 2480 flrlfxr.exe 1htthn.exe PID 2480 wrote to memory of 2596 2480 flrlfxr.exe 1htthn.exe PID 2480 wrote to memory of 2596 2480 flrlfxr.exe 1htthn.exe PID 2596 wrote to memory of 2988 2596 1htthn.exe 1nbbhh.exe PID 2596 wrote to memory of 2988 2596 1htthn.exe 1nbbhh.exe PID 2596 wrote to memory of 2988 2596 1htthn.exe 1nbbhh.exe PID 2596 wrote to memory of 2988 2596 1htthn.exe 1nbbhh.exe PID 2988 wrote to memory of 2696 2988 1nbbhh.exe lfxfrxl.exe PID 2988 wrote to memory of 2696 2988 1nbbhh.exe lfxfrxl.exe PID 2988 wrote to memory of 2696 2988 1nbbhh.exe lfxfrxl.exe PID 2988 wrote to memory of 2696 2988 1nbbhh.exe lfxfrxl.exe PID 2696 wrote to memory of 2776 2696 lfxfrxl.exe fxxrrrf.exe PID 2696 wrote to memory of 2776 2696 lfxfrxl.exe fxxrrrf.exe PID 2696 wrote to memory of 2776 2696 lfxfrxl.exe fxxrrrf.exe PID 2696 wrote to memory of 2776 2696 lfxfrxl.exe fxxrrrf.exe PID 2776 wrote to memory of 1556 2776 fxxrrrf.exe bbtthn.exe PID 2776 wrote to memory of 1556 2776 fxxrrrf.exe bbtthn.exe PID 2776 wrote to memory of 1556 2776 fxxrrrf.exe bbtthn.exe PID 2776 wrote to memory of 1556 2776 fxxrrrf.exe bbtthn.exe PID 1556 wrote to memory of 1888 1556 bbtthn.exe jjddj.exe PID 1556 wrote to memory of 1888 1556 bbtthn.exe jjddj.exe PID 1556 wrote to memory of 1888 1556 bbtthn.exe jjddj.exe PID 1556 wrote to memory of 1888 1556 bbtthn.exe jjddj.exe PID 1888 wrote to memory of 760 1888 jjddj.exe 5xlxfff.exe PID 1888 wrote to memory of 760 1888 jjddj.exe 5xlxfff.exe PID 1888 wrote to memory of 760 1888 jjddj.exe 5xlxfff.exe PID 1888 wrote to memory of 760 1888 jjddj.exe 5xlxfff.exe PID 760 wrote to memory of 1664 760 5xlxfff.exe bnhbtt.exe PID 760 wrote to memory of 1664 760 5xlxfff.exe bnhbtt.exe PID 760 wrote to memory of 1664 760 5xlxfff.exe bnhbtt.exe PID 760 wrote to memory of 1664 760 5xlxfff.exe bnhbtt.exe PID 1664 wrote to memory of 2452 1664 bnhbtt.exe vpppd.exe PID 1664 wrote to memory of 2452 1664 bnhbtt.exe vpppd.exe PID 1664 wrote to memory of 2452 1664 bnhbtt.exe vpppd.exe PID 1664 wrote to memory of 2452 1664 bnhbtt.exe vpppd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjpd.exec:\jdjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5dvvd.exec:\5dvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhnnn.exec:\hbhnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvddd.exec:\jvddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrrflr.exec:\lfrrflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvdp.exec:\pjvdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flrlfxr.exec:\flrlfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1htthn.exec:\1htthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1nbbhh.exec:\1nbbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxxrrrf.exec:\fxxrrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbtthn.exec:\bbtthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjddj.exec:\jjddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xlxfff.exec:\5xlxfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhbtt.exec:\bnhbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpppd.exec:\vpppd.exe17⤵
- Executes dropped EXE
-
\??\c:\ffrfrrx.exec:\ffrfrrx.exe18⤵
- Executes dropped EXE
-
\??\c:\bhhhbt.exec:\bhhhbt.exe19⤵
- Executes dropped EXE
-
\??\c:\1hbhhn.exec:\1hbhhn.exe20⤵
- Executes dropped EXE
-
\??\c:\vpjpj.exec:\vpjpj.exe21⤵
- Executes dropped EXE
-
\??\c:\llfxrfr.exec:\llfxrfr.exe22⤵
- Executes dropped EXE
-
\??\c:\hhbhtb.exec:\hhbhtb.exe23⤵
- Executes dropped EXE
-
\??\c:\jdpvp.exec:\jdpvp.exe24⤵
- Executes dropped EXE
-
\??\c:\3lffllr.exec:\3lffllr.exe25⤵
- Executes dropped EXE
-
\??\c:\llflxxf.exec:\llflxxf.exe26⤵
- Executes dropped EXE
-
\??\c:\7bnhbh.exec:\7bnhbh.exe27⤵
- Executes dropped EXE
-
\??\c:\vvvvv.exec:\vvvvv.exe28⤵
- Executes dropped EXE
-
\??\c:\1lrxxxx.exec:\1lrxxxx.exe29⤵
- Executes dropped EXE
-
\??\c:\5tbbbb.exec:\5tbbbb.exe30⤵
- Executes dropped EXE
-
\??\c:\pvjdp.exec:\pvjdp.exe31⤵
- Executes dropped EXE
-
\??\c:\1lxfflx.exec:\1lxfflx.exe32⤵
- Executes dropped EXE
-
\??\c:\htnnbb.exec:\htnnbb.exe33⤵
- Executes dropped EXE
-
\??\c:\3dpvp.exec:\3dpvp.exe34⤵
- Executes dropped EXE
-
\??\c:\1xllrfl.exec:\1xllrfl.exe35⤵
- Executes dropped EXE
-
\??\c:\xxxfrxf.exec:\xxxfrxf.exe36⤵
- Executes dropped EXE
-
\??\c:\bthhbb.exec:\bthhbb.exe37⤵
-
\??\c:\3pppd.exec:\3pppd.exe38⤵
- Executes dropped EXE
-
\??\c:\fxrflrl.exec:\fxrflrl.exe39⤵
- Executes dropped EXE
-
\??\c:\nhtnhh.exec:\nhtnhh.exe40⤵
- Executes dropped EXE
-
\??\c:\jddpd.exec:\jddpd.exe41⤵
- Executes dropped EXE
-
\??\c:\5ddjd.exec:\5ddjd.exe42⤵
- Executes dropped EXE
-
\??\c:\llffffr.exec:\llffffr.exe43⤵
- Executes dropped EXE
-
\??\c:\ttnhbh.exec:\ttnhbh.exe44⤵
- Executes dropped EXE
-
\??\c:\bthnbt.exec:\bthnbt.exe45⤵
- Executes dropped EXE
-
\??\c:\vpdpj.exec:\vpdpj.exe46⤵
- Executes dropped EXE
-
\??\c:\xrfrllx.exec:\xrfrllx.exe47⤵
- Executes dropped EXE
-
\??\c:\ffrxlrx.exec:\ffrxlrx.exe48⤵
- Executes dropped EXE
-
\??\c:\9thhtb.exec:\9thhtb.exe49⤵
- Executes dropped EXE
-
\??\c:\hhttbt.exec:\hhttbt.exe50⤵
- Executes dropped EXE
-
\??\c:\vvpvd.exec:\vvpvd.exe51⤵
- Executes dropped EXE
-
\??\c:\9fxxlfl.exec:\9fxxlfl.exe52⤵
- Executes dropped EXE
-
\??\c:\fxffrrl.exec:\fxffrrl.exe53⤵
- Executes dropped EXE
-
\??\c:\hbnntt.exec:\hbnntt.exe54⤵
- Executes dropped EXE
-
\??\c:\7djjp.exec:\7djjp.exe55⤵
- Executes dropped EXE
-
\??\c:\vppvd.exec:\vppvd.exe56⤵
- Executes dropped EXE
-
\??\c:\llxfxfr.exec:\llxfxfr.exe57⤵
- Executes dropped EXE
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe58⤵
- Executes dropped EXE
-
\??\c:\hhhhtt.exec:\hhhhtt.exe59⤵
- Executes dropped EXE
-
\??\c:\9bhtth.exec:\9bhtth.exe60⤵
- Executes dropped EXE
-
\??\c:\pdvvd.exec:\pdvvd.exe61⤵
- Executes dropped EXE
-
\??\c:\pdvdj.exec:\pdvdj.exe62⤵
- Executes dropped EXE
-
\??\c:\7xlrxrx.exec:\7xlrxrx.exe63⤵
- Executes dropped EXE
-
\??\c:\7xrxfll.exec:\7xrxfll.exe64⤵
- Executes dropped EXE
-
\??\c:\1tnttt.exec:\1tnttt.exe65⤵
- Executes dropped EXE
-
\??\c:\5tbbhn.exec:\5tbbhn.exe66⤵
- Executes dropped EXE
-
\??\c:\7jddp.exec:\7jddp.exe67⤵
-
\??\c:\dvppv.exec:\dvppv.exe68⤵
-
\??\c:\fxlfrxf.exec:\fxlfrxf.exe69⤵
-
\??\c:\nnhnnb.exec:\nnhnnb.exe70⤵
-
\??\c:\5hntnh.exec:\5hntnh.exe71⤵
-
\??\c:\vvvdj.exec:\vvvdj.exe72⤵
-
\??\c:\jppdd.exec:\jppdd.exe73⤵
-
\??\c:\xrfflll.exec:\xrfflll.exe74⤵
-
\??\c:\1tnnbt.exec:\1tnnbt.exe75⤵
-
\??\c:\9nnbhh.exec:\9nnbhh.exe76⤵
-
\??\c:\xrxxlrx.exec:\xrxxlrx.exe77⤵
-
\??\c:\9rlrxfr.exec:\9rlrxfr.exe78⤵
-
\??\c:\tnbhbb.exec:\tnbhbb.exe79⤵
-
\??\c:\hbtnhh.exec:\hbtnhh.exe80⤵
-
\??\c:\5pvvv.exec:\5pvvv.exe81⤵
-
\??\c:\jdvdp.exec:\jdvdp.exe82⤵
-
\??\c:\fxxxflr.exec:\fxxxflr.exe83⤵
-
\??\c:\7tnbhn.exec:\7tnbhn.exe84⤵
-
\??\c:\nhbbnn.exec:\nhbbnn.exe85⤵
-
\??\c:\jdpdv.exec:\jdpdv.exe86⤵
-
\??\c:\jvjpv.exec:\jvjpv.exe87⤵
-
\??\c:\rlffllx.exec:\rlffllx.exe88⤵
-
\??\c:\fxrxllr.exec:\fxrxllr.exe89⤵
-
\??\c:\thbhbb.exec:\thbhbb.exe90⤵
-
\??\c:\tnbhtb.exec:\tnbhtb.exe91⤵
-
\??\c:\ddvpp.exec:\ddvpp.exe92⤵
-
\??\c:\pjvdv.exec:\pjvdv.exe93⤵
-
\??\c:\xrllffr.exec:\xrllffr.exe94⤵
-
\??\c:\tnttnh.exec:\tnttnh.exe95⤵
-
\??\c:\nbnnbb.exec:\nbnnbb.exe96⤵
-
\??\c:\jdpdj.exec:\jdpdj.exe97⤵
-
\??\c:\vjdjp.exec:\vjdjp.exe98⤵
-
\??\c:\xrrfrxl.exec:\xrrfrxl.exe99⤵
-
\??\c:\xxrxlrx.exec:\xxrxlrx.exe100⤵
-
\??\c:\nnbhth.exec:\nnbhth.exe101⤵
-
\??\c:\nbnhnn.exec:\nbnhnn.exe102⤵
-
\??\c:\jvddj.exec:\jvddj.exe103⤵
-
\??\c:\jvpvv.exec:\jvpvv.exe104⤵
-
\??\c:\xrffllr.exec:\xrffllr.exe105⤵
-
\??\c:\9tnttb.exec:\9tnttb.exe106⤵
-
\??\c:\9vvvv.exec:\9vvvv.exe107⤵
-
\??\c:\jjdvd.exec:\jjdvd.exe108⤵
-
\??\c:\7lfrlfx.exec:\7lfrlfx.exe109⤵
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe110⤵
-
\??\c:\lxrlllr.exec:\lxrlllr.exe111⤵
-
\??\c:\nntthn.exec:\nntthn.exe112⤵
-
\??\c:\dvjpv.exec:\dvjpv.exe113⤵
-
\??\c:\5pjjp.exec:\5pjjp.exe114⤵
-
\??\c:\rlffrxf.exec:\rlffrxf.exe115⤵
-
\??\c:\fxflllr.exec:\fxflllr.exe116⤵
-
\??\c:\nbbtbh.exec:\nbbtbh.exe117⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe118⤵
-
\??\c:\1ddjv.exec:\1ddjv.exe119⤵
-
\??\c:\xrlxflr.exec:\xrlxflr.exe120⤵
-
\??\c:\rfrxllx.exec:\rfrxllx.exe121⤵
-
\??\c:\bbhnhn.exec:\bbhnhn.exe122⤵
-
\??\c:\5tnnth.exec:\5tnnth.exe123⤵
-
\??\c:\3vppv.exec:\3vppv.exe124⤵
-
\??\c:\fxlxffl.exec:\fxlxffl.exe125⤵
-
\??\c:\lfxfrxf.exec:\lfxfrxf.exe126⤵
-
\??\c:\1bnthh.exec:\1bnthh.exe127⤵
-
\??\c:\hhbhnh.exec:\hhbhnh.exe128⤵
-
\??\c:\jjdvj.exec:\jjdvj.exe129⤵
-
\??\c:\jjjpp.exec:\jjjpp.exe130⤵
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe131⤵
-
\??\c:\tnbbhb.exec:\tnbbhb.exe132⤵
-
\??\c:\hbbnth.exec:\hbbnth.exe133⤵
-
\??\c:\dvpvd.exec:\dvpvd.exe134⤵
-
\??\c:\lfrrflr.exec:\lfrrflr.exe135⤵
-
\??\c:\xrlrfxf.exec:\xrlrfxf.exe136⤵
-
\??\c:\bthhht.exec:\bthhht.exe137⤵
-
\??\c:\hbnntn.exec:\hbnntn.exe138⤵
-
\??\c:\vdjvj.exec:\vdjvj.exe139⤵
-
\??\c:\ddvvj.exec:\ddvvj.exe140⤵
-
\??\c:\5lflrrr.exec:\5lflrrr.exe141⤵
-
\??\c:\xrxfxxf.exec:\xrxfxxf.exe142⤵
-
\??\c:\nhthtb.exec:\nhthtb.exe143⤵
-
\??\c:\5dddv.exec:\5dddv.exe144⤵
-
\??\c:\3dvvd.exec:\3dvvd.exe145⤵
-
\??\c:\lfllxxx.exec:\lfllxxx.exe146⤵
-
\??\c:\5frflrx.exec:\5frflrx.exe147⤵
-
\??\c:\bnnnth.exec:\bnnnth.exe148⤵
-
\??\c:\ddvvj.exec:\ddvvj.exe149⤵
-
\??\c:\9vjpd.exec:\9vjpd.exe150⤵
-
\??\c:\5rllrrx.exec:\5rllrrx.exe151⤵
-
\??\c:\1hthhh.exec:\1hthhh.exe152⤵
-
\??\c:\tthbhh.exec:\tthbhh.exe153⤵
-
\??\c:\pdpvd.exec:\pdpvd.exe154⤵
-
\??\c:\7pjpp.exec:\7pjpp.exe155⤵
-
\??\c:\lxfllfl.exec:\lxfllfl.exe156⤵
-
\??\c:\9bhbbn.exec:\9bhbbn.exe157⤵
-
\??\c:\hbbbhb.exec:\hbbbhb.exe158⤵
-
\??\c:\ddpvp.exec:\ddpvp.exe159⤵
-
\??\c:\ppjjd.exec:\ppjjd.exe160⤵
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe161⤵
-
\??\c:\rlrxxfl.exec:\rlrxxfl.exe162⤵
-
\??\c:\bthhhh.exec:\bthhhh.exe163⤵
-
\??\c:\hbhtnh.exec:\hbhtnh.exe164⤵
-
\??\c:\5ppjv.exec:\5ppjv.exe165⤵
-
\??\c:\pjdjp.exec:\pjdjp.exe166⤵
-
\??\c:\1fflrxf.exec:\1fflrxf.exe167⤵
-
\??\c:\3nbtbb.exec:\3nbtbb.exe168⤵
-
\??\c:\tnhhth.exec:\tnhhth.exe169⤵
-
\??\c:\dvdjj.exec:\dvdjj.exe170⤵
-
\??\c:\1dpjj.exec:\1dpjj.exe171⤵
-
\??\c:\3rrrflr.exec:\3rrrflr.exe172⤵
-
\??\c:\7fffrlx.exec:\7fffrlx.exe173⤵
-
\??\c:\nhbbth.exec:\nhbbth.exe174⤵
-
\??\c:\nbnthn.exec:\nbnthn.exe175⤵
-
\??\c:\jdppp.exec:\jdppp.exe176⤵
-
\??\c:\lfrfrxl.exec:\lfrfrxl.exe177⤵
-
\??\c:\lfrxfxf.exec:\lfrxfxf.exe178⤵
-
\??\c:\hbhhtb.exec:\hbhhtb.exe179⤵
-
\??\c:\1tnnhn.exec:\1tnnhn.exe180⤵
-
\??\c:\dvjpv.exec:\dvjpv.exe181⤵
-
\??\c:\vpvdj.exec:\vpvdj.exe182⤵
-
\??\c:\7rlllll.exec:\7rlllll.exe183⤵
-
\??\c:\7thhnt.exec:\7thhnt.exe184⤵
-
\??\c:\tnhbhh.exec:\tnhbhh.exe185⤵
-
\??\c:\vjppp.exec:\vjppp.exe186⤵
-
\??\c:\dpvdd.exec:\dpvdd.exe187⤵
-
\??\c:\xlfxfxf.exec:\xlfxfxf.exe188⤵
-
\??\c:\1rrxfff.exec:\1rrxfff.exe189⤵
-
\??\c:\httttt.exec:\httttt.exe190⤵
-
\??\c:\7hnbbb.exec:\7hnbbb.exe191⤵
-
\??\c:\jvjvv.exec:\jvjvv.exe192⤵
-
\??\c:\vdpdj.exec:\vdpdj.exe193⤵
-
\??\c:\7lrffxx.exec:\7lrffxx.exe194⤵
-
\??\c:\fflxrfr.exec:\fflxrfr.exe195⤵
-
\??\c:\btnthn.exec:\btnthn.exe196⤵
-
\??\c:\7hthhn.exec:\7hthhn.exe197⤵
-
\??\c:\5dppd.exec:\5dppd.exe198⤵
-
\??\c:\xxrlrxf.exec:\xxrlrxf.exe199⤵
-
\??\c:\3lxfflr.exec:\3lxfflr.exe200⤵
-
\??\c:\xrlrrxf.exec:\xrlrrxf.exe201⤵
-
\??\c:\bttthb.exec:\bttthb.exe202⤵
-
\??\c:\bthhbb.exec:\bthhbb.exe203⤵
-
\??\c:\dvpdv.exec:\dvpdv.exe204⤵
-
\??\c:\1vvjv.exec:\1vvjv.exe205⤵
-
\??\c:\9flrrrr.exec:\9flrrrr.exe206⤵
-
\??\c:\hbbhnn.exec:\hbbhnn.exe207⤵
-
\??\c:\bthnth.exec:\bthnth.exe208⤵
-
\??\c:\hbtnbn.exec:\hbtnbn.exe209⤵
-
\??\c:\vpvdj.exec:\vpvdj.exe210⤵
-
\??\c:\ffrrffl.exec:\ffrrffl.exe211⤵
-
\??\c:\frxxfff.exec:\frxxfff.exe212⤵
-
\??\c:\9tnhtb.exec:\9tnhtb.exe213⤵
-
\??\c:\bbnttb.exec:\bbnttb.exe214⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe215⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe216⤵
-
\??\c:\lflxxfl.exec:\lflxxfl.exe217⤵
-
\??\c:\5ffflrx.exec:\5ffflrx.exe218⤵
-
\??\c:\bntbnn.exec:\bntbnn.exe219⤵
-
\??\c:\thnthb.exec:\thnthb.exe220⤵
-
\??\c:\jjdjd.exec:\jjdjd.exe221⤵
-
\??\c:\vjppj.exec:\vjppj.exe222⤵
-
\??\c:\5rrxrrx.exec:\5rrxrrx.exe223⤵
-
\??\c:\3xlrrxx.exec:\3xlrrxx.exe224⤵
-
\??\c:\tnntbh.exec:\tnntbh.exe225⤵
-
\??\c:\bbnnbb.exec:\bbnnbb.exe226⤵
-
\??\c:\dpjdj.exec:\dpjdj.exe227⤵
-
\??\c:\1pvdj.exec:\1pvdj.exe228⤵
-
\??\c:\1rrlxfl.exec:\1rrlxfl.exe229⤵
-
\??\c:\lrrfxlx.exec:\lrrfxlx.exe230⤵
-
\??\c:\hbhbht.exec:\hbhbht.exe231⤵
-
\??\c:\9htbnn.exec:\9htbnn.exe232⤵
-
\??\c:\jvvvd.exec:\jvvvd.exe233⤵
-
\??\c:\jjpdj.exec:\jjpdj.exe234⤵
-
\??\c:\xrrfllf.exec:\xrrfllf.exe235⤵
-
\??\c:\rlffrxx.exec:\rlffrxx.exe236⤵
-
\??\c:\7bnnnh.exec:\7bnnnh.exe237⤵
-
\??\c:\9bttbb.exec:\9bttbb.exe238⤵
-
\??\c:\5pjvd.exec:\5pjvd.exe239⤵
-
\??\c:\xfxfxfr.exec:\xfxfxfr.exe240⤵
-
\??\c:\lfxxfrf.exec:\lfxxfrf.exe241⤵