Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 11:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe
-
Size
200KB
-
MD5
6ac39b0def6b9df14375425cab153c98
-
SHA1
57000411802f2c94129d88b200517623358841b8
-
SHA256
d7efbe7f1a9d3961b36db0f71553dfe3a4674e895b08df2ae915202e30add5b3
-
SHA512
ad2eef46680b95d4050473a86a3cb2d5e8c5b087257ce34d32c3cc2a9737d3590b679ed571a966b8a0bbd0b17a38b24594208a0b55e72f551518de4ca8c264e9
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqyvU2r1vsKM4ltyjC:PhOm2sI93UufdC67cihvH1S/G
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3420-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/532-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4304-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-355-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-368-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-387-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-392-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-424-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-436-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-441-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-456-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-466-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-525-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-541-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-549-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-599-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-629-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-671-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-711-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-721-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-733-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-793-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-922-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/952-971-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-1034-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-1038-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-1045-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7hnhnh.exedpdjd.exedvdvv.exe5xxrlll.exe3vpjj.exenhhhbt.exevvdvp.exevvddj.exe3flfffx.exentbtbt.exe7jvvd.exelxxrrrl.exedpddv.exexxlflfl.exe3ntnnn.exefxrrrrl.exe1tnhbt.exerrrlfxr.exejjjpp.exelflfxxx.exenhbtnh.exepdvvv.exexxxrffl.exe1nbbtb.exexrlrffl.exehhbtnh.exepddvv.exefxllflf.exehbbttt.exejjvpv.exelrfxxrl.exexxrrrff.exehbttnt.exedvdvp.exevjppp.exelllfllx.exenhnnnt.exennbbhb.exe1jjjj.exedpvdv.exe5lllllf.exe1xlflfr.exebbhbtt.exevppjd.exevdpdp.exefxxlffx.exe1rlfffx.exenhnhhh.exe5hbthh.exepvjdd.exepjvvd.exerrxrrff.exenhnttt.exe1nnnhh.exevdjjd.exepjppv.exe7fxrllf.exerxfrllf.exebtttnn.exehbbbbb.exedvvpd.exelxlfxxx.exe7xfxrrl.exehntttt.exepid process 3544 7hnhnh.exe 2296 dpdjd.exe 4156 dvdvv.exe 2036 5xxrlll.exe 5080 3vpjj.exe 2724 nhhhbt.exe 2224 vvdvp.exe 4716 vvddj.exe 4972 3flfffx.exe 3896 ntbtbt.exe 3528 7jvvd.exe 1112 lxxrrrl.exe 2828 dpddv.exe 4028 xxlflfl.exe 4432 3ntnnn.exe 3652 fxrrrrl.exe 2388 1tnhbt.exe 4936 rrrlfxr.exe 2212 jjjpp.exe 4740 lflfxxx.exe 2052 nhbtnh.exe 4308 pdvvv.exe 368 xxxrffl.exe 4056 1nbbtb.exe 4480 xrlrffl.exe 3516 hhbtnh.exe 1804 pddvv.exe 3476 fxllflf.exe 516 hbbttt.exe 2780 jjvpv.exe 3188 lrfxxrl.exe 532 xxrrrff.exe 4780 hbttnt.exe 4304 dvdvp.exe 2804 vjppp.exe 1820 lllfllx.exe 3544 nhnnnt.exe 2160 nnbbhb.exe 4156 1jjjj.exe 1040 dpvdv.exe 2916 5lllllf.exe 4452 1xlflfr.exe 380 bbhbtt.exe 2956 vppjd.exe 5028 vdpdp.exe 4528 fxxlffx.exe 544 1rlfffx.exe 4972 nhnhhh.exe 2364 5hbthh.exe 1592 pvjdd.exe 2832 pjvvd.exe 4512 rrxrrff.exe 1112 nhnttt.exe 2828 1nnnhh.exe 2484 vdjjd.exe 2308 pjppv.exe 2428 7fxrllf.exe 1752 rxfrllf.exe 1504 btttnn.exe 880 hbbbbb.exe 644 dvvpd.exe 1612 lxlfxxx.exe 5024 7xfxrrl.exe 4004 hntttt.exe -
Processes:
resource yara_rule behavioral2/memory/3420-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/532-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4304-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-368-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-387-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-392-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-424-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-436-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-441-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-456-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-466-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-485-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-525-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-541-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-549-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-558-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-568-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-575-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe7hnhnh.exedpdjd.exedvdvv.exe5xxrlll.exe3vpjj.exenhhhbt.exevvdvp.exevvddj.exe3flfffx.exentbtbt.exe7jvvd.exelxxrrrl.exedpddv.exexxlflfl.exe3ntnnn.exefxrrrrl.exe1tnhbt.exerrrlfxr.exejjjpp.exelflfxxx.exenhbtnh.exedescription pid process target process PID 3420 wrote to memory of 3544 3420 6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe 7hnhnh.exe PID 3420 wrote to memory of 3544 3420 6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe 7hnhnh.exe PID 3420 wrote to memory of 3544 3420 6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe 7hnhnh.exe PID 3544 wrote to memory of 2296 3544 7hnhnh.exe dpdjd.exe PID 3544 wrote to memory of 2296 3544 7hnhnh.exe dpdjd.exe PID 3544 wrote to memory of 2296 3544 7hnhnh.exe dpdjd.exe PID 2296 wrote to memory of 4156 2296 dpdjd.exe dvdvv.exe PID 2296 wrote to memory of 4156 2296 dpdjd.exe dvdvv.exe PID 2296 wrote to memory of 4156 2296 dpdjd.exe dvdvv.exe PID 4156 wrote to memory of 2036 4156 dvdvv.exe 5xxrlll.exe PID 4156 wrote to memory of 2036 4156 dvdvv.exe 5xxrlll.exe PID 4156 wrote to memory of 2036 4156 dvdvv.exe 5xxrlll.exe PID 2036 wrote to memory of 5080 2036 5xxrlll.exe 3vpjj.exe PID 2036 wrote to memory of 5080 2036 5xxrlll.exe 3vpjj.exe PID 2036 wrote to memory of 5080 2036 5xxrlll.exe 3vpjj.exe PID 5080 wrote to memory of 2724 5080 3vpjj.exe nhhhbt.exe PID 5080 wrote to memory of 2724 5080 3vpjj.exe nhhhbt.exe PID 5080 wrote to memory of 2724 5080 3vpjj.exe nhhhbt.exe PID 2724 wrote to memory of 2224 2724 nhhhbt.exe vvdvp.exe PID 2724 wrote to memory of 2224 2724 nhhhbt.exe vvdvp.exe PID 2724 wrote to memory of 2224 2724 nhhhbt.exe vvdvp.exe PID 2224 wrote to memory of 4716 2224 vvdvp.exe vvddj.exe PID 2224 wrote to memory of 4716 2224 vvdvp.exe vvddj.exe PID 2224 wrote to memory of 4716 2224 vvdvp.exe vvddj.exe PID 4716 wrote to memory of 4972 4716 vvddj.exe 3flfffx.exe PID 4716 wrote to memory of 4972 4716 vvddj.exe 3flfffx.exe PID 4716 wrote to memory of 4972 4716 vvddj.exe 3flfffx.exe PID 4972 wrote to memory of 3896 4972 3flfffx.exe ntbtbt.exe PID 4972 wrote to memory of 3896 4972 3flfffx.exe ntbtbt.exe PID 4972 wrote to memory of 3896 4972 3flfffx.exe ntbtbt.exe PID 3896 wrote to memory of 3528 3896 ntbtbt.exe 7jvvd.exe PID 3896 wrote to memory of 3528 3896 ntbtbt.exe 7jvvd.exe PID 3896 wrote to memory of 3528 3896 ntbtbt.exe 7jvvd.exe PID 3528 wrote to memory of 1112 3528 7jvvd.exe lxxrrrl.exe PID 3528 wrote to memory of 1112 3528 7jvvd.exe lxxrrrl.exe PID 3528 wrote to memory of 1112 3528 7jvvd.exe lxxrrrl.exe PID 1112 wrote to memory of 2828 1112 lxxrrrl.exe dpddv.exe PID 1112 wrote to memory of 2828 1112 lxxrrrl.exe dpddv.exe PID 1112 wrote to memory of 2828 1112 lxxrrrl.exe dpddv.exe PID 2828 wrote to memory of 4028 2828 dpddv.exe xxlflfl.exe PID 2828 wrote to memory of 4028 2828 dpddv.exe xxlflfl.exe PID 2828 wrote to memory of 4028 2828 dpddv.exe xxlflfl.exe PID 4028 wrote to memory of 4432 4028 xxlflfl.exe 3ntnnn.exe PID 4028 wrote to memory of 4432 4028 xxlflfl.exe 3ntnnn.exe PID 4028 wrote to memory of 4432 4028 xxlflfl.exe 3ntnnn.exe PID 4432 wrote to memory of 3652 4432 3ntnnn.exe fxrrrrl.exe PID 4432 wrote to memory of 3652 4432 3ntnnn.exe fxrrrrl.exe PID 4432 wrote to memory of 3652 4432 3ntnnn.exe fxrrrrl.exe PID 3652 wrote to memory of 2388 3652 fxrrrrl.exe 1tnhbt.exe PID 3652 wrote to memory of 2388 3652 fxrrrrl.exe 1tnhbt.exe PID 3652 wrote to memory of 2388 3652 fxrrrrl.exe 1tnhbt.exe PID 2388 wrote to memory of 4936 2388 1tnhbt.exe rrrlfxr.exe PID 2388 wrote to memory of 4936 2388 1tnhbt.exe rrrlfxr.exe PID 2388 wrote to memory of 4936 2388 1tnhbt.exe rrrlfxr.exe PID 4936 wrote to memory of 2212 4936 rrrlfxr.exe jjjpp.exe PID 4936 wrote to memory of 2212 4936 rrrlfxr.exe jjjpp.exe PID 4936 wrote to memory of 2212 4936 rrrlfxr.exe jjjpp.exe PID 2212 wrote to memory of 4740 2212 jjjpp.exe lflfxxx.exe PID 2212 wrote to memory of 4740 2212 jjjpp.exe lflfxxx.exe PID 2212 wrote to memory of 4740 2212 jjjpp.exe lflfxxx.exe PID 4740 wrote to memory of 2052 4740 lflfxxx.exe nhbtnh.exe PID 4740 wrote to memory of 2052 4740 lflfxxx.exe nhbtnh.exe PID 4740 wrote to memory of 2052 4740 lflfxxx.exe nhbtnh.exe PID 2052 wrote to memory of 4308 2052 nhbtnh.exe pdvvv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6ac39b0def6b9df14375425cab153c98_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\7hnhnh.exec:\7hnhnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpdjd.exec:\dpdjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdvv.exec:\dvdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xxrlll.exec:\5xxrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3vpjj.exec:\3vpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhhbt.exec:\nhhhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvdvp.exec:\vvdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvddj.exec:\vvddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3flfffx.exec:\3flfffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntbtbt.exec:\ntbtbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7jvvd.exec:\7jvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpddv.exec:\dpddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxlflfl.exec:\xxlflfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3ntnnn.exec:\3ntnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrrrrl.exec:\fxrrrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1tnhbt.exec:\1tnhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjjpp.exec:\jjjpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lflfxxx.exec:\lflfxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbtnh.exec:\nhbtnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdvvv.exec:\pdvvv.exe23⤵
- Executes dropped EXE
-
\??\c:\xxxrffl.exec:\xxxrffl.exe24⤵
- Executes dropped EXE
-
\??\c:\1nbbtb.exec:\1nbbtb.exe25⤵
- Executes dropped EXE
-
\??\c:\xrlrffl.exec:\xrlrffl.exe26⤵
- Executes dropped EXE
-
\??\c:\hhbtnh.exec:\hhbtnh.exe27⤵
- Executes dropped EXE
-
\??\c:\pddvv.exec:\pddvv.exe28⤵
- Executes dropped EXE
-
\??\c:\fxllflf.exec:\fxllflf.exe29⤵
- Executes dropped EXE
-
\??\c:\hbbttt.exec:\hbbttt.exe30⤵
- Executes dropped EXE
-
\??\c:\jjvpv.exec:\jjvpv.exe31⤵
- Executes dropped EXE
-
\??\c:\lrfxxrl.exec:\lrfxxrl.exe32⤵
- Executes dropped EXE
-
\??\c:\xxrrrff.exec:\xxrrrff.exe33⤵
- Executes dropped EXE
-
\??\c:\hbttnt.exec:\hbttnt.exe34⤵
- Executes dropped EXE
-
\??\c:\dvdvp.exec:\dvdvp.exe35⤵
- Executes dropped EXE
-
\??\c:\vjppp.exec:\vjppp.exe36⤵
- Executes dropped EXE
-
\??\c:\lllfllx.exec:\lllfllx.exe37⤵
- Executes dropped EXE
-
\??\c:\nhnnnt.exec:\nhnnnt.exe38⤵
- Executes dropped EXE
-
\??\c:\nnbbhb.exec:\nnbbhb.exe39⤵
- Executes dropped EXE
-
\??\c:\1jjjj.exec:\1jjjj.exe40⤵
- Executes dropped EXE
-
\??\c:\dpvdv.exec:\dpvdv.exe41⤵
- Executes dropped EXE
-
\??\c:\5lllllf.exec:\5lllllf.exe42⤵
- Executes dropped EXE
-
\??\c:\1xlflfr.exec:\1xlflfr.exe43⤵
- Executes dropped EXE
-
\??\c:\bbhbtt.exec:\bbhbtt.exe44⤵
- Executes dropped EXE
-
\??\c:\vppjd.exec:\vppjd.exe45⤵
- Executes dropped EXE
-
\??\c:\vdpdp.exec:\vdpdp.exe46⤵
- Executes dropped EXE
-
\??\c:\fxxlffx.exec:\fxxlffx.exe47⤵
- Executes dropped EXE
-
\??\c:\1rlfffx.exec:\1rlfffx.exe48⤵
- Executes dropped EXE
-
\??\c:\nhnhhh.exec:\nhnhhh.exe49⤵
- Executes dropped EXE
-
\??\c:\5hbthh.exec:\5hbthh.exe50⤵
- Executes dropped EXE
-
\??\c:\pvjdd.exec:\pvjdd.exe51⤵
- Executes dropped EXE
-
\??\c:\pjvvd.exec:\pjvvd.exe52⤵
- Executes dropped EXE
-
\??\c:\rrxrrff.exec:\rrxrrff.exe53⤵
- Executes dropped EXE
-
\??\c:\nhnttt.exec:\nhnttt.exe54⤵
- Executes dropped EXE
-
\??\c:\1nnnhh.exec:\1nnnhh.exe55⤵
- Executes dropped EXE
-
\??\c:\vdjjd.exec:\vdjjd.exe56⤵
- Executes dropped EXE
-
\??\c:\pjppv.exec:\pjppv.exe57⤵
- Executes dropped EXE
-
\??\c:\7fxrllf.exec:\7fxrllf.exe58⤵
- Executes dropped EXE
-
\??\c:\rxfrllf.exec:\rxfrllf.exe59⤵
- Executes dropped EXE
-
\??\c:\btttnn.exec:\btttnn.exe60⤵
- Executes dropped EXE
-
\??\c:\hbbbbb.exec:\hbbbbb.exe61⤵
- Executes dropped EXE
-
\??\c:\dvvpd.exec:\dvvpd.exe62⤵
- Executes dropped EXE
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe63⤵
- Executes dropped EXE
-
\??\c:\7xfxrrl.exec:\7xfxrrl.exe64⤵
- Executes dropped EXE
-
\??\c:\hntttt.exec:\hntttt.exe65⤵
- Executes dropped EXE
-
\??\c:\7djjd.exec:\7djjd.exe66⤵
-
\??\c:\djjdd.exec:\djjdd.exe67⤵
-
\??\c:\fffxlrx.exec:\fffxlrx.exe68⤵
-
\??\c:\5xffxxf.exec:\5xffxxf.exe69⤵
-
\??\c:\hhhbtt.exec:\hhhbtt.exe70⤵
-
\??\c:\3nbttn.exec:\3nbttn.exe71⤵
-
\??\c:\jvppj.exec:\jvppj.exe72⤵
-
\??\c:\9rxrllf.exec:\9rxrllf.exe73⤵
-
\??\c:\frllxxr.exec:\frllxxr.exe74⤵
-
\??\c:\nhntnt.exec:\nhntnt.exe75⤵
-
\??\c:\hbhbtt.exec:\hbhbtt.exe76⤵
-
\??\c:\1djdd.exec:\1djdd.exe77⤵
-
\??\c:\1rllfll.exec:\1rllfll.exe78⤵
-
\??\c:\fflllxr.exec:\fflllxr.exe79⤵
-
\??\c:\ntbbtt.exec:\ntbbtt.exe80⤵
-
\??\c:\nhtntb.exec:\nhtntb.exe81⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe82⤵
-
\??\c:\3pvpp.exec:\3pvpp.exe83⤵
-
\??\c:\frffrrx.exec:\frffrrx.exe84⤵
-
\??\c:\lfrlffx.exec:\lfrlffx.exe85⤵
-
\??\c:\thbttn.exec:\thbttn.exe86⤵
-
\??\c:\5jpjd.exec:\5jpjd.exe87⤵
-
\??\c:\vpdjd.exec:\vpdjd.exe88⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe89⤵
-
\??\c:\xlrllfx.exec:\xlrllfx.exe90⤵
-
\??\c:\3nhhbh.exec:\3nhhbh.exe91⤵
-
\??\c:\jvdpj.exec:\jvdpj.exe92⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe93⤵
-
\??\c:\xflffff.exec:\xflffff.exe94⤵
-
\??\c:\hnhhbh.exec:\hnhhbh.exe95⤵
-
\??\c:\nhnnbb.exec:\nhnnbb.exe96⤵
-
\??\c:\ppjdp.exec:\ppjdp.exe97⤵
-
\??\c:\jjdjj.exec:\jjdjj.exe98⤵
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe99⤵
-
\??\c:\hhhbtn.exec:\hhhbtn.exe100⤵
-
\??\c:\pjdvp.exec:\pjdvp.exe101⤵
-
\??\c:\5lrlffx.exec:\5lrlffx.exe102⤵
-
\??\c:\rxfflfx.exec:\rxfflfx.exe103⤵
-
\??\c:\bbbbtb.exec:\bbbbtb.exe104⤵
-
\??\c:\9hbttt.exec:\9hbttt.exe105⤵
-
\??\c:\9vpjp.exec:\9vpjp.exe106⤵
-
\??\c:\llxxxxl.exec:\llxxxxl.exe107⤵
-
\??\c:\rrffxll.exec:\rrffxll.exe108⤵
-
\??\c:\bnbtbh.exec:\bnbtbh.exe109⤵
-
\??\c:\9jjjd.exec:\9jjjd.exe110⤵
-
\??\c:\vjdvj.exec:\vjdvj.exe111⤵
-
\??\c:\3lrrlll.exec:\3lrrlll.exe112⤵
-
\??\c:\fxrlflf.exec:\fxrlflf.exe113⤵
-
\??\c:\9tbbtb.exec:\9tbbtb.exe114⤵
-
\??\c:\7ntnhh.exec:\7ntnhh.exe115⤵
-
\??\c:\jdpjd.exec:\jdpjd.exe116⤵
-
\??\c:\9rlxrrl.exec:\9rlxrrl.exe117⤵
-
\??\c:\fffxrll.exec:\fffxrll.exe118⤵
-
\??\c:\bhnnnn.exec:\bhnnnn.exe119⤵
-
\??\c:\3bbbtb.exec:\3bbbtb.exe120⤵
-
\??\c:\pjjpj.exec:\pjjpj.exe121⤵
-
\??\c:\vpppj.exec:\vpppj.exe122⤵
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe123⤵
-
\??\c:\bttbbb.exec:\bttbbb.exe124⤵
-
\??\c:\nbhbtt.exec:\nbhbtt.exe125⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe126⤵
-
\??\c:\jpdvv.exec:\jpdvv.exe127⤵
-
\??\c:\xfrlflf.exec:\xfrlflf.exe128⤵
-
\??\c:\3rxrxxx.exec:\3rxrxxx.exe129⤵
-
\??\c:\5nhhbh.exec:\5nhhbh.exe130⤵
-
\??\c:\7thnhh.exec:\7thnhh.exe131⤵
-
\??\c:\vpddj.exec:\vpddj.exe132⤵
-
\??\c:\vdjdp.exec:\vdjdp.exe133⤵
-
\??\c:\7lffxxx.exec:\7lffxxx.exe134⤵
-
\??\c:\xxlllfl.exec:\xxlllfl.exe135⤵
-
\??\c:\bbthbb.exec:\bbthbb.exe136⤵
-
\??\c:\7vdvd.exec:\7vdvd.exe137⤵
-
\??\c:\vvvjd.exec:\vvvjd.exe138⤵
-
\??\c:\7rrlffx.exec:\7rrlffx.exe139⤵
-
\??\c:\nhhbbt.exec:\nhhbbt.exe140⤵
-
\??\c:\3ppjj.exec:\3ppjj.exe141⤵
-
\??\c:\fxrllll.exec:\fxrllll.exe142⤵
-
\??\c:\1xlfxfx.exec:\1xlfxfx.exe143⤵
-
\??\c:\btnhtt.exec:\btnhtt.exe144⤵
-
\??\c:\djjdv.exec:\djjdv.exe145⤵
-
\??\c:\9jddd.exec:\9jddd.exe146⤵
-
\??\c:\7rlfxxx.exec:\7rlfxxx.exe147⤵
-
\??\c:\bbhthh.exec:\bbhthh.exe148⤵
-
\??\c:\thbhbb.exec:\thbhbb.exe149⤵
-
\??\c:\dpvpv.exec:\dpvpv.exe150⤵
-
\??\c:\9vppj.exec:\9vppj.exe151⤵
-
\??\c:\rfllffx.exec:\rfllffx.exe152⤵
-
\??\c:\rllrlll.exec:\rllrlll.exe153⤵
-
\??\c:\tbnnhh.exec:\tbnnhh.exe154⤵
-
\??\c:\nhnnnn.exec:\nhnnnn.exe155⤵
-
\??\c:\vvdvd.exec:\vvdvd.exe156⤵
-
\??\c:\9pvpj.exec:\9pvpj.exe157⤵
-
\??\c:\xrxrllf.exec:\xrxrllf.exe158⤵
-
\??\c:\5nhbbb.exec:\5nhbbb.exe159⤵
-
\??\c:\3vvpj.exec:\3vvpj.exe160⤵
-
\??\c:\lfffxlf.exec:\lfffxlf.exe161⤵
-
\??\c:\fxllrrr.exec:\fxllrrr.exe162⤵
-
\??\c:\bttnhb.exec:\bttnhb.exe163⤵
-
\??\c:\frflxff.exec:\frflxff.exe164⤵
-
\??\c:\bttbtb.exec:\bttbtb.exe165⤵
-
\??\c:\lxxxrll.exec:\lxxxrll.exe166⤵
-
\??\c:\nhnnhh.exec:\nhnnhh.exe167⤵
-
\??\c:\bttbbb.exec:\bttbbb.exe168⤵
-
\??\c:\lfflfxr.exec:\lfflfxr.exe169⤵
-
\??\c:\btthbt.exec:\btthbt.exe170⤵
-
\??\c:\9rlfffx.exec:\9rlfffx.exe171⤵
-
\??\c:\lffxxrl.exec:\lffxxrl.exe172⤵
-
\??\c:\5tbtbb.exec:\5tbtbb.exe173⤵
-
\??\c:\jvjdv.exec:\jvjdv.exe174⤵
-
\??\c:\dvddv.exec:\dvddv.exe175⤵
-
\??\c:\tttnhb.exec:\tttnhb.exe176⤵
-
\??\c:\hbnhhh.exec:\hbnhhh.exe177⤵
-
\??\c:\jjpjj.exec:\jjpjj.exe178⤵
-
\??\c:\vjdvv.exec:\vjdvv.exe179⤵
-
\??\c:\fffxrrr.exec:\fffxrrr.exe180⤵
-
\??\c:\flxrrrl.exec:\flxrrrl.exe181⤵
-
\??\c:\hnbbbt.exec:\hnbbbt.exe182⤵
-
\??\c:\nhnntt.exec:\nhnntt.exe183⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe184⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe185⤵
-
\??\c:\xlllfff.exec:\xlllfff.exe186⤵
-
\??\c:\nhbbtt.exec:\nhbbtt.exe187⤵
-
\??\c:\thhbtt.exec:\thhbtt.exe188⤵
-
\??\c:\9hhbtt.exec:\9hhbtt.exe189⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe190⤵
-
\??\c:\5xllflf.exec:\5xllflf.exe191⤵
-
\??\c:\7fllffx.exec:\7fllffx.exe192⤵
-
\??\c:\nhnnhh.exec:\nhnnhh.exe193⤵
-
\??\c:\nhnttb.exec:\nhnttb.exe194⤵
-
\??\c:\dddvj.exec:\dddvj.exe195⤵
-
\??\c:\pvjjj.exec:\pvjjj.exe196⤵
-
\??\c:\ffxrllf.exec:\ffxrllf.exe197⤵
-
\??\c:\xrrrlll.exec:\xrrrlll.exe198⤵
-
\??\c:\bthhht.exec:\bthhht.exe199⤵
-
\??\c:\hbnntt.exec:\hbnntt.exe200⤵
-
\??\c:\ppppj.exec:\ppppj.exe201⤵
-
\??\c:\jpvpv.exec:\jpvpv.exe202⤵
-
\??\c:\flfxxrl.exec:\flfxxrl.exe203⤵
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe204⤵
-
\??\c:\3ttbbh.exec:\3ttbbh.exe205⤵
-
\??\c:\5hhbbt.exec:\5hhbbt.exe206⤵
-
\??\c:\7vddj.exec:\7vddj.exe207⤵
-
\??\c:\xrfxlfl.exec:\xrfxlfl.exe208⤵
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe209⤵
-
\??\c:\bnnthn.exec:\bnnthn.exe210⤵
-
\??\c:\3vdvd.exec:\3vdvd.exe211⤵
-
\??\c:\pdddp.exec:\pdddp.exe212⤵
-
\??\c:\1xxxxfx.exec:\1xxxxfx.exe213⤵
-
\??\c:\nnttnn.exec:\nnttnn.exe214⤵
-
\??\c:\1hhbbb.exec:\1hhbbb.exe215⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe216⤵
-
\??\c:\1rxrrrr.exec:\1rxrrrr.exe217⤵
-
\??\c:\9nhhnh.exec:\9nhhnh.exe218⤵
-
\??\c:\nntnhh.exec:\nntnhh.exe219⤵
-
\??\c:\jjppv.exec:\jjppv.exe220⤵
-
\??\c:\rlrxrxx.exec:\rlrxrxx.exe221⤵
-
\??\c:\7dpjp.exec:\7dpjp.exe222⤵
-
\??\c:\fxfffxl.exec:\fxfffxl.exe223⤵
-
\??\c:\dvvvd.exec:\dvvvd.exe224⤵
-
\??\c:\ttttnt.exec:\ttttnt.exe225⤵
-
\??\c:\1xxrffx.exec:\1xxrffx.exe226⤵
-
\??\c:\rfrlffx.exec:\rfrlffx.exe227⤵
-
\??\c:\hbhntt.exec:\hbhntt.exe228⤵
-
\??\c:\7dddp.exec:\7dddp.exe229⤵
-
\??\c:\hbhbtt.exec:\hbhbtt.exe230⤵
-
\??\c:\nhtnnt.exec:\nhtnnt.exe231⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe232⤵
-
\??\c:\rllfxrl.exec:\rllfxrl.exe233⤵
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe234⤵
-
\??\c:\thtnhh.exec:\thtnhh.exe235⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe236⤵
-
\??\c:\ppvvp.exec:\ppvvp.exe237⤵
-
\??\c:\7lrlfff.exec:\7lrlfff.exe238⤵
-
\??\c:\nbbhbb.exec:\nbbhbb.exe239⤵
-
\??\c:\7tbttt.exec:\7tbttt.exe240⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe241⤵