Analysis
-
max time kernel
150s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 10:45
Behavioral task
behavioral1
Sample
7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
General
-
Target
7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe
-
Size
169KB
-
MD5
d002865618db61a4b2c7216615c0ed80
-
SHA1
aa6442723c8aac153b9dcdf6b9d0315ab1e703f6
-
SHA256
7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501
-
SHA512
20b224a316fd1af22280c02de25ddb2656a7e511fc679669a53b1452dc6b636493d05516964469fdaa90b9c127d66be34c4c8c5f4030100d429cd8c87592ac8c
-
SSDEEP
1536:HvQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7FK4O8A1o4XEc3YtxD8/Ai2L:HhOmTsF93UYfwC6GIoutX8Ki3c3YT8VU
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
Processes:
resource yara_rule behavioral2/memory/736-4-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3112-12-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1396-23-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4716-64-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1932-189-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1128-212-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2104-222-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4460-219-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4480-226-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3388-231-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2040-202-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4764-192-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2380-184-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3084-170-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3716-154-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4488-148-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4928-142-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1956-116-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3672-110-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4916-104-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2704-98-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1336-93-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2844-86-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/5004-80-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4864-58-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2144-40-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2120-39-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4688-29-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/116-242-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/904-243-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1552-246-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/644-266-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4544-275-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4924-279-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1536-288-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1676-295-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1392-303-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1084-309-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4904-320-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3012-345-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2516-361-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2928-366-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1948-394-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1576-401-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1184-407-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/736-413-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1952-430-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2632-431-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/208-433-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/5056-446-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1652-516-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1004-545-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3876-552-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3404-600-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/5020-646-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2936-662-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3796-665-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2312-699-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/380-833-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2764-921-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4164-946-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2532-966-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2724-1050-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvddd.exedvjdv.exe9flllrr.exehhtbbh.exebhhhnt.exe3vpvp.exejdjjd.exe1lrrlrr.exerrxxxfl.exe3ntnnh.exepdppp.exejpjjd.exelxffxff.exerllllll.exetbtthn.exedjjdv.exevpvvv.exexrxxrxx.exexrlrrxf.exentbbbb.exenhhhnn.exe9vddd.exedvpjv.exe9rxrrxx.exerlllflf.exehhtttt.exenbhtth.exeppddd.exe5pvjd.exelrlflll.exe9frrrxf.exebhbbtb.exepddjv.exeppppp.exexlrrrxx.exe9xrrrxr.exebhntbh.exejpjjv.exe3vpjv.exelrllrxx.exerrflflf.exebtbbtb.exetbnhhh.exevpjjj.exeddvvv.exennnhnn.exehbthhb.exedpppd.exexxffflf.exe5htnbb.exejpddd.exevjvvv.exellrxfxl.exennbbbh.exenthnhh.exejjpjj.exellrllxr.exe3lrrffl.exentntth.exe3ddjd.exerrffffx.exerrxlrlr.exebbbbbh.exejdppp.exepid process 2916 vvddd.exe 3112 dvjdv.exe 1396 9flllrr.exe 4688 hhtbbh.exe 4320 bhhhnt.exe 2120 3vpvp.exe 2144 jdjjd.exe 716 1lrrlrr.exe 4864 rrxxxfl.exe 4716 3ntnnh.exe 5024 pdppp.exe 2912 jpjjd.exe 5004 lxffxff.exe 2844 rllllll.exe 1336 tbtthn.exe 2704 djjdv.exe 4916 vpvvv.exe 3672 xrxxrxx.exe 1956 xrlrrxf.exe 3708 ntbbbb.exe 856 nhhhnn.exe 2764 9vddd.exe 760 dvpjv.exe 4928 9rxrrxx.exe 4488 rlllflf.exe 3716 hhtttt.exe 1188 nbhtth.exe 3012 ppddd.exe 3084 5pvjd.exe 3300 lrlflll.exe 1728 9frrrxf.exe 2380 bhbbtb.exe 1932 pddjv.exe 4764 ppppp.exe 2204 xlrrrxx.exe 4428 9xrrrxr.exe 2040 bhntbh.exe 1856 jpjjv.exe 2460 3vpjv.exe 1128 lrllrxx.exe 436 rrflflf.exe 4460 btbbtb.exe 2104 tbnhhh.exe 1184 vpjjj.exe 4480 ddvvv.exe 3388 nnnhnn.exe 4944 hbthhb.exe 116 dpppd.exe 904 xxffflf.exe 1552 5htnbb.exe 1572 jpddd.exe 4572 vjvvv.exe 4612 llrxfxl.exe 1412 nnbbbh.exe 756 nthnhh.exe 644 jjpjj.exe 4092 llrllxr.exe 4544 3lrrffl.exe 4924 ntntth.exe 3948 3ddjd.exe 1828 rrffffx.exe 1536 rrxlrlr.exe 676 bbbbbh.exe 1676 jdppp.exe -
Processes:
resource yara_rule behavioral2/memory/736-0-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/736-4-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\vvddd.exe upx C:\dvjdv.exe upx behavioral2/memory/3112-12-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\9flllrr.exe upx behavioral2/memory/1396-23-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\bhhhnt.exe upx \??\c:\3vpvp.exe upx \??\c:\jdjjd.exe upx \??\c:\1lrrlrr.exe upx C:\rrxxxfl.exe upx C:\3ntnnh.exe upx C:\pdppp.exe upx behavioral2/memory/4716-64-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\lxffxff.exe upx C:\rllllll.exe upx \??\c:\vpvvv.exe upx \??\c:\xrxxrxx.exe upx \??\c:\ntbbbb.exe upx \??\c:\nhhhnn.exe upx \??\c:\9vddd.exe upx \??\c:\9rxrrxx.exe upx \??\c:\hhtttt.exe upx C:\ppddd.exe upx behavioral2/memory/1932-189-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1128-212-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2104-222-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4460-219-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4480-226-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3388-231-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2040-202-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4764-192-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2380-184-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\bhbbtb.exe upx \??\c:\9frrrxf.exe upx behavioral2/memory/3084-170-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\lrlflll.exe upx \??\c:\5pvjd.exe upx behavioral2/memory/3716-154-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\nbhtth.exe upx behavioral2/memory/4488-148-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4928-142-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\rlllflf.exe upx \??\c:\dvpjv.exe upx behavioral2/memory/1956-116-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3672-110-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\xrlrrxf.exe upx behavioral2/memory/4916-104-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2704-98-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1336-93-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\djjdv.exe upx behavioral2/memory/2844-86-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\tbtthn.exe upx behavioral2/memory/5004-80-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\jpjjd.exe upx behavioral2/memory/4864-58-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2144-40-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2120-39-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4688-29-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\hhtbbh.exe upx behavioral2/memory/116-237-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/116-242-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/904-243-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exevvddd.exedvjdv.exe9flllrr.exehhtbbh.exebhhhnt.exe3vpvp.exejdjjd.exe1lrrlrr.exerrxxxfl.exe3ntnnh.exepdppp.exejpjjd.exelxffxff.exerllllll.exetbtthn.exedjjdv.exevpvvv.exexrxxrxx.exexrlrrxf.exentbbbb.exenhhhnn.exedescription pid process target process PID 736 wrote to memory of 2916 736 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe vvddd.exe PID 736 wrote to memory of 2916 736 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe vvddd.exe PID 736 wrote to memory of 2916 736 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe vvddd.exe PID 2916 wrote to memory of 3112 2916 vvddd.exe dvjdv.exe PID 2916 wrote to memory of 3112 2916 vvddd.exe dvjdv.exe PID 2916 wrote to memory of 3112 2916 vvddd.exe dvjdv.exe PID 3112 wrote to memory of 1396 3112 dvjdv.exe 9flllrr.exe PID 3112 wrote to memory of 1396 3112 dvjdv.exe 9flllrr.exe PID 3112 wrote to memory of 1396 3112 dvjdv.exe 9flllrr.exe PID 1396 wrote to memory of 4688 1396 9flllrr.exe hhtbbh.exe PID 1396 wrote to memory of 4688 1396 9flllrr.exe hhtbbh.exe PID 1396 wrote to memory of 4688 1396 9flllrr.exe hhtbbh.exe PID 4688 wrote to memory of 4320 4688 hhtbbh.exe bhhhnt.exe PID 4688 wrote to memory of 4320 4688 hhtbbh.exe bhhhnt.exe PID 4688 wrote to memory of 4320 4688 hhtbbh.exe bhhhnt.exe PID 4320 wrote to memory of 2120 4320 bhhhnt.exe 3vpvp.exe PID 4320 wrote to memory of 2120 4320 bhhhnt.exe 3vpvp.exe PID 4320 wrote to memory of 2120 4320 bhhhnt.exe 3vpvp.exe PID 2120 wrote to memory of 2144 2120 3vpvp.exe jdjjd.exe PID 2120 wrote to memory of 2144 2120 3vpvp.exe jdjjd.exe PID 2120 wrote to memory of 2144 2120 3vpvp.exe jdjjd.exe PID 2144 wrote to memory of 716 2144 jdjjd.exe 1lrrlrr.exe PID 2144 wrote to memory of 716 2144 jdjjd.exe 1lrrlrr.exe PID 2144 wrote to memory of 716 2144 jdjjd.exe 1lrrlrr.exe PID 716 wrote to memory of 4864 716 1lrrlrr.exe rrxxxfl.exe PID 716 wrote to memory of 4864 716 1lrrlrr.exe rrxxxfl.exe PID 716 wrote to memory of 4864 716 1lrrlrr.exe rrxxxfl.exe PID 4864 wrote to memory of 4716 4864 rrxxxfl.exe 3ntnnh.exe PID 4864 wrote to memory of 4716 4864 rrxxxfl.exe 3ntnnh.exe PID 4864 wrote to memory of 4716 4864 rrxxxfl.exe 3ntnnh.exe PID 4716 wrote to memory of 5024 4716 3ntnnh.exe pdppp.exe PID 4716 wrote to memory of 5024 4716 3ntnnh.exe pdppp.exe PID 4716 wrote to memory of 5024 4716 3ntnnh.exe pdppp.exe PID 5024 wrote to memory of 2912 5024 pdppp.exe jpjjd.exe PID 5024 wrote to memory of 2912 5024 pdppp.exe jpjjd.exe PID 5024 wrote to memory of 2912 5024 pdppp.exe jpjjd.exe PID 2912 wrote to memory of 5004 2912 jpjjd.exe lxffxff.exe PID 2912 wrote to memory of 5004 2912 jpjjd.exe lxffxff.exe PID 2912 wrote to memory of 5004 2912 jpjjd.exe lxffxff.exe PID 5004 wrote to memory of 2844 5004 lxffxff.exe rllllll.exe PID 5004 wrote to memory of 2844 5004 lxffxff.exe rllllll.exe PID 5004 wrote to memory of 2844 5004 lxffxff.exe rllllll.exe PID 2844 wrote to memory of 1336 2844 rllllll.exe jpjjp.exe PID 2844 wrote to memory of 1336 2844 rllllll.exe jpjjp.exe PID 2844 wrote to memory of 1336 2844 rllllll.exe jpjjp.exe PID 1336 wrote to memory of 2704 1336 tbtthn.exe djjdv.exe PID 1336 wrote to memory of 2704 1336 tbtthn.exe djjdv.exe PID 1336 wrote to memory of 2704 1336 tbtthn.exe djjdv.exe PID 2704 wrote to memory of 4916 2704 djjdv.exe vpvvv.exe PID 2704 wrote to memory of 4916 2704 djjdv.exe vpvvv.exe PID 2704 wrote to memory of 4916 2704 djjdv.exe vpvvv.exe PID 4916 wrote to memory of 3672 4916 vpvvv.exe xrxxrxx.exe PID 4916 wrote to memory of 3672 4916 vpvvv.exe xrxxrxx.exe PID 4916 wrote to memory of 3672 4916 vpvvv.exe xrxxrxx.exe PID 3672 wrote to memory of 1956 3672 xrxxrxx.exe xrlrrxf.exe PID 3672 wrote to memory of 1956 3672 xrxxrxx.exe xrlrrxf.exe PID 3672 wrote to memory of 1956 3672 xrxxrxx.exe xrlrrxf.exe PID 1956 wrote to memory of 3708 1956 xrlrrxf.exe ntbbbb.exe PID 1956 wrote to memory of 3708 1956 xrlrrxf.exe ntbbbb.exe PID 1956 wrote to memory of 3708 1956 xrlrrxf.exe ntbbbb.exe PID 3708 wrote to memory of 856 3708 ntbbbb.exe nhhhnn.exe PID 3708 wrote to memory of 856 3708 ntbbbb.exe nhhhnn.exe PID 3708 wrote to memory of 856 3708 ntbbbb.exe nhhhnn.exe PID 856 wrote to memory of 2764 856 nhhhnn.exe 9vddd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe"C:\Users\Admin\AppData\Local\Temp\7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\vvddd.exec:\vvddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\dvjdv.exec:\dvjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\9flllrr.exec:\9flllrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\hhtbbh.exec:\hhtbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\bhhhnt.exec:\bhhhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\3vpvp.exec:\3vpvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\jdjjd.exec:\jdjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\1lrrlrr.exec:\1lrrlrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\rrxxxfl.exec:\rrxxxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\3ntnnh.exec:\3ntnnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\pdppp.exec:\pdppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\jpjjd.exec:\jpjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\lxffxff.exec:\lxffxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\rllllll.exec:\rllllll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\tbtthn.exec:\tbtthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\djjdv.exec:\djjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\vpvvv.exec:\vpvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\xrxxrxx.exec:\xrxxrxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\xrlrrxf.exec:\xrlrrxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\ntbbbb.exec:\ntbbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\nhhhnn.exec:\nhhhnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\9vddd.exec:\9vddd.exe23⤵
- Executes dropped EXE
PID:2764 -
\??\c:\dvpjv.exec:\dvpjv.exe24⤵
- Executes dropped EXE
PID:760 -
\??\c:\9rxrrxx.exec:\9rxrrxx.exe25⤵
- Executes dropped EXE
PID:4928 -
\??\c:\rlllflf.exec:\rlllflf.exe26⤵
- Executes dropped EXE
PID:4488 -
\??\c:\hhtttt.exec:\hhtttt.exe27⤵
- Executes dropped EXE
PID:3716 -
\??\c:\nbhtth.exec:\nbhtth.exe28⤵
- Executes dropped EXE
PID:1188 -
\??\c:\ppddd.exec:\ppddd.exe29⤵
- Executes dropped EXE
PID:3012 -
\??\c:\5pvjd.exec:\5pvjd.exe30⤵
- Executes dropped EXE
PID:3084 -
\??\c:\lrlflll.exec:\lrlflll.exe31⤵
- Executes dropped EXE
PID:3300 -
\??\c:\9frrrxf.exec:\9frrrxf.exe32⤵
- Executes dropped EXE
PID:1728 -
\??\c:\bhbbtb.exec:\bhbbtb.exe33⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pddjv.exec:\pddjv.exe34⤵
- Executes dropped EXE
PID:1932 -
\??\c:\ppppp.exec:\ppppp.exe35⤵
- Executes dropped EXE
PID:4764 -
\??\c:\xlrrrxx.exec:\xlrrrxx.exe36⤵
- Executes dropped EXE
PID:2204 -
\??\c:\9xrrrxr.exec:\9xrrrxr.exe37⤵
- Executes dropped EXE
PID:4428 -
\??\c:\bhntbh.exec:\bhntbh.exe38⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jpjjv.exec:\jpjjv.exe39⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3vpjv.exec:\3vpjv.exe40⤵
- Executes dropped EXE
PID:2460 -
\??\c:\lrllrxx.exec:\lrllrxx.exe41⤵
- Executes dropped EXE
PID:1128 -
\??\c:\rrflflf.exec:\rrflflf.exe42⤵
- Executes dropped EXE
PID:436 -
\??\c:\btbbtb.exec:\btbbtb.exe43⤵
- Executes dropped EXE
PID:4460 -
\??\c:\tbnhhh.exec:\tbnhhh.exe44⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vpjjj.exec:\vpjjj.exe45⤵
- Executes dropped EXE
PID:1184 -
\??\c:\ddvvv.exec:\ddvvv.exe46⤵
- Executes dropped EXE
PID:4480 -
\??\c:\nnnhnn.exec:\nnnhnn.exe47⤵
- Executes dropped EXE
PID:3388 -
\??\c:\hbthhb.exec:\hbthhb.exe48⤵
- Executes dropped EXE
PID:4944 -
\??\c:\dpppd.exec:\dpppd.exe49⤵
- Executes dropped EXE
PID:116 -
\??\c:\xxffflf.exec:\xxffflf.exe50⤵
- Executes dropped EXE
PID:904 -
\??\c:\5htnbb.exec:\5htnbb.exe51⤵
- Executes dropped EXE
PID:1552 -
\??\c:\jpddd.exec:\jpddd.exe52⤵
- Executes dropped EXE
PID:1572 -
\??\c:\vjvvv.exec:\vjvvv.exe53⤵
- Executes dropped EXE
PID:4572 -
\??\c:\llrxfxl.exec:\llrxfxl.exe54⤵
- Executes dropped EXE
PID:4612 -
\??\c:\nnbbbh.exec:\nnbbbh.exe55⤵
- Executes dropped EXE
PID:1412 -
\??\c:\nthnhh.exec:\nthnhh.exe56⤵
- Executes dropped EXE
PID:756 -
\??\c:\jjpjj.exec:\jjpjj.exe57⤵
- Executes dropped EXE
PID:644 -
\??\c:\llrllxr.exec:\llrllxr.exe58⤵
- Executes dropped EXE
PID:4092 -
\??\c:\3lrrffl.exec:\3lrrffl.exe59⤵
- Executes dropped EXE
PID:4544 -
\??\c:\ntntth.exec:\ntntth.exe60⤵
- Executes dropped EXE
PID:4924 -
\??\c:\3ddjd.exec:\3ddjd.exe61⤵
- Executes dropped EXE
PID:3948 -
\??\c:\rrffffx.exec:\rrffffx.exe62⤵
- Executes dropped EXE
PID:1828 -
\??\c:\rrxlrlr.exec:\rrxlrlr.exe63⤵
- Executes dropped EXE
PID:1536 -
\??\c:\bbbbbh.exec:\bbbbbh.exe64⤵
- Executes dropped EXE
PID:676 -
\??\c:\jdppp.exec:\jdppp.exe65⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jpjjp.exec:\jpjjp.exe66⤵PID:1336
-
\??\c:\lxrlflr.exec:\lxrlflr.exe67⤵PID:4056
-
\??\c:\hhtbhn.exec:\hhtbhn.exe68⤵PID:1392
-
\??\c:\dvjjj.exec:\dvjjj.exe69⤵PID:1084
-
\??\c:\jpjpp.exec:\jpjpp.exe70⤵PID:4448
-
\??\c:\fxfffll.exec:\fxfffll.exe71⤵PID:5012
-
\??\c:\htbhbh.exec:\htbhbh.exe72⤵PID:2368
-
\??\c:\hbhhbh.exec:\hbhhbh.exe73⤵PID:4904
-
\??\c:\dvjdd.exec:\dvjdd.exe74⤵PID:1268
-
\??\c:\rrlrrxx.exec:\rrlrrxx.exe75⤵PID:4404
-
\??\c:\tnhhbh.exec:\tnhhbh.exe76⤵PID:5020
-
\??\c:\pppjj.exec:\pppjj.exe77⤵PID:4468
-
\??\c:\djppv.exec:\djppv.exe78⤵PID:1824
-
\??\c:\llfxxxl.exec:\llfxxxl.exe79⤵PID:3220
-
\??\c:\ttnnnt.exec:\ttnnnt.exe80⤵PID:3012
-
\??\c:\3tttnt.exec:\3tttnt.exe81⤵PID:2936
-
\??\c:\7pddd.exec:\7pddd.exe82⤵PID:4180
-
\??\c:\jvppj.exec:\jvppj.exe83⤵PID:4016
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe84⤵PID:4932
-
\??\c:\nnbbtb.exec:\nnbbtb.exe85⤵PID:2516
-
\??\c:\3xxxxff.exec:\3xxxxff.exe86⤵PID:2928
-
\??\c:\flrrrxx.exec:\flrrrxx.exe87⤵PID:1756
-
\??\c:\thhhhh.exec:\thhhhh.exe88⤵PID:5036
-
\??\c:\vjvdd.exec:\vjvdd.exe89⤵PID:1476
-
\??\c:\djjpv.exec:\djjpv.exe90⤵PID:3448
-
\??\c:\3xfllrx.exec:\3xfllrx.exe91⤵PID:1128
-
\??\c:\bbhhnh.exec:\bbhhnh.exe92⤵PID:740
-
\??\c:\vdppj.exec:\vdppj.exe93⤵PID:2220
-
\??\c:\1lllfll.exec:\1lllfll.exe94⤵PID:4524
-
\??\c:\llxrrrr.exec:\llxrrrr.exe95⤵PID:1948
-
\??\c:\9vdvv.exec:\9vdvv.exe96⤵PID:1944
-
\??\c:\pjvpp.exec:\pjvpp.exe97⤵PID:2740
-
\??\c:\rrxrrxx.exec:\rrxrrxx.exe98⤵PID:1576
-
\??\c:\tthbbt.exec:\tthbbt.exe99⤵PID:1184
-
\??\c:\ntnnbh.exec:\ntnnbh.exe100⤵PID:3388
-
\??\c:\5jvvd.exec:\5jvvd.exe101⤵PID:736
-
\??\c:\dvddv.exec:\dvddv.exe102⤵PID:1892
-
\??\c:\3lfflrf.exec:\3lfflrf.exe103⤵PID:876
-
\??\c:\nnhhhh.exec:\nnhhhh.exe104⤵PID:1952
-
\??\c:\7pvdd.exec:\7pvdd.exe105⤵PID:2632
-
\??\c:\pjvpp.exec:\pjvpp.exe106⤵PID:208
-
\??\c:\lrxrllr.exec:\lrxrllr.exe107⤵PID:3656
-
\??\c:\hntnnt.exec:\hntnnt.exe108⤵PID:2592
-
\??\c:\jdjjp.exec:\jdjjp.exe109⤵PID:756
-
\??\c:\xllfxfx.exec:\xllfxfx.exe110⤵PID:5056
-
\??\c:\fxlrrxf.exec:\fxlrrxf.exe111⤵PID:4092
-
\??\c:\bbnnht.exec:\bbnnht.exe112⤵PID:1616
-
\??\c:\1jddj.exec:\1jddj.exe113⤵PID:1240
-
\??\c:\dpdvv.exec:\dpdvv.exe114⤵PID:3776
-
\??\c:\rrxrrll.exec:\rrxrrll.exe115⤵PID:4012
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe116⤵PID:3184
-
\??\c:\7nbhbh.exec:\7nbhbh.exe117⤵PID:676
-
\??\c:\ddddj.exec:\ddddj.exe118⤵PID:2704
-
\??\c:\llxfrlf.exec:\llxfrlf.exe119⤵PID:4704
-
\??\c:\1tbnnt.exec:\1tbnnt.exe120⤵PID:3548
-
\??\c:\bbnnnb.exec:\bbnnnb.exe121⤵PID:604
-
\??\c:\5jpjd.exec:\5jpjd.exe122⤵PID:2588
-
\??\c:\dppvv.exec:\dppvv.exe123⤵PID:856
-
\??\c:\fffrlfx.exec:\fffrlfx.exe124⤵PID:4508
-
\??\c:\bbtttt.exec:\bbtttt.exe125⤵PID:760
-
\??\c:\btnntt.exec:\btnntt.exe126⤵PID:316
-
\??\c:\vdpvv.exec:\vdpvv.exe127⤵PID:952
-
\??\c:\9fllfll.exec:\9fllfll.exe128⤵PID:4468
-
\??\c:\tnbbtt.exec:\tnbbtt.exe129⤵PID:1824
-
\??\c:\3bnhtt.exec:\3bnhtt.exe130⤵PID:3220
-
\??\c:\pjvpp.exec:\pjvpp.exe131⤵PID:4784
-
\??\c:\9vddv.exec:\9vddv.exe132⤵PID:1652
-
\??\c:\rrxflll.exec:\rrxflll.exe133⤵PID:3256
-
\??\c:\3bhhhn.exec:\3bhhhn.exe134⤵PID:2280
-
\??\c:\hhnttb.exec:\hhnttb.exe135⤵PID:3552
-
\??\c:\7pppp.exec:\7pppp.exe136⤵PID:2688
-
\??\c:\vpvpp.exec:\vpvpp.exe137⤵PID:2204
-
\??\c:\1rffrxr.exec:\1rffrxr.exe138⤵PID:1816
-
\??\c:\rrrxflr.exec:\rrrxflr.exe139⤵PID:1620
-
\??\c:\ttbbbb.exec:\ttbbbb.exe140⤵PID:3532
-
\??\c:\nhbbtb.exec:\nhbbtb.exe141⤵PID:1004
-
\??\c:\pvppp.exec:\pvppp.exe142⤵PID:4484
-
\??\c:\llrrrrr.exec:\llrrrrr.exe143⤵PID:3876
-
\??\c:\3httbh.exec:\3httbh.exe144⤵PID:1128
-
\??\c:\7djpp.exec:\7djpp.exe145⤵PID:2232
-
\??\c:\vvvpp.exec:\vvvpp.exe146⤵PID:1908
-
\??\c:\rxllfrf.exec:\rxllfrf.exe147⤵PID:4460
-
\??\c:\bbtttt.exec:\bbtttt.exe148⤵PID:1772
-
\??\c:\ppdvv.exec:\ppdvv.exe149⤵PID:4820
-
\??\c:\rlrxlrx.exec:\rlrxlrx.exe150⤵PID:4892
-
\??\c:\nhbbnn.exec:\nhbbnn.exe151⤵PID:3536
-
\??\c:\dvpjd.exec:\dvpjd.exe152⤵PID:2468
-
\??\c:\xxrxrrx.exec:\xxrxrrx.exe153⤵PID:1248
-
\??\c:\rrfffll.exec:\rrfffll.exe154⤵PID:4624
-
\??\c:\bbnnnn.exec:\bbnnnn.exe155⤵PID:1552
-
\??\c:\5nbttb.exec:\5nbttb.exe156⤵PID:2632
-
\??\c:\ddvvd.exec:\ddvvd.exe157⤵PID:3840
-
\??\c:\7pddv.exec:\7pddv.exe158⤵PID:1412
-
\??\c:\llrllff.exec:\llrllff.exe159⤵PID:3404
-
\??\c:\thnttb.exec:\thnttb.exe160⤵PID:4208
-
\??\c:\nnbnbh.exec:\nnbnbh.exe161⤵PID:5024
-
\??\c:\ddjjj.exec:\ddjjj.exe162⤵PID:4980
-
\??\c:\jddvp.exec:\jddvp.exe163⤵PID:4748
-
\??\c:\lrffrxl.exec:\lrffrxl.exe164⤵PID:2256
-
\??\c:\btnnnb.exec:\btnnnb.exe165⤵PID:696
-
\??\c:\hhhnnn.exec:\hhhnnn.exe166⤵PID:3288
-
\??\c:\ddjjj.exec:\ddjjj.exe167⤵PID:4952
-
\??\c:\xffffxl.exec:\xffffxl.exe168⤵PID:2052
-
\??\c:\nnbbbh.exec:\nnbbbh.exe169⤵PID:4532
-
\??\c:\nnnhhh.exec:\nnnhhh.exe170⤵PID:4628
-
\??\c:\7rxxrxx.exec:\7rxxrxx.exe171⤵PID:4928
-
\??\c:\5rxflrr.exec:\5rxflrr.exe172⤵PID:5020
-
\??\c:\rllrrxx.exec:\rllrrxx.exe173⤵PID:1916
-
\??\c:\ddjdd.exec:\ddjdd.exe174⤵PID:1116
-
\??\c:\xrxlllf.exec:\xrxlllf.exe175⤵PID:4260
-
\??\c:\lfxffff.exec:\lfxffff.exe176⤵PID:3012
-
\??\c:\hhtttt.exec:\hhtttt.exe177⤵PID:2936
-
\??\c:\5jjjj.exec:\5jjjj.exe178⤵PID:3796
-
\??\c:\pvppv.exec:\pvppv.exe179⤵PID:3344
-
\??\c:\xrffxff.exec:\xrffxff.exe180⤵PID:2496
-
\??\c:\xrfffff.exec:\xrfffff.exe181⤵PID:4764
-
\??\c:\1ntttt.exec:\1ntttt.exe182⤵PID:2700
-
\??\c:\bbbbth.exec:\bbbbth.exe183⤵PID:3924
-
\??\c:\fflxxff.exec:\fflxxff.exe184⤵PID:3632
-
\??\c:\lrffffr.exec:\lrffffr.exe185⤵PID:3364
-
\??\c:\nbnhhh.exec:\nbnhhh.exe186⤵PID:4396
-
\??\c:\dvddd.exec:\dvddd.exe187⤵PID:3648
-
\??\c:\ntbhhb.exec:\ntbhhb.exe188⤵PID:2312
-
\??\c:\lffflrr.exec:\lffflrr.exe189⤵PID:4636
-
\??\c:\tntnnn.exec:\tntnnn.exe190⤵PID:448
-
\??\c:\vvdjp.exec:\vvdjp.exe191⤵PID:4616
-
\??\c:\fxrrrfl.exec:\fxrrrfl.exe192⤵PID:1884
-
\??\c:\btbtnn.exec:\btbtnn.exe193⤵PID:2484
-
\??\c:\bbtttb.exec:\bbtttb.exe194⤵PID:4288
-
\??\c:\ddjjp.exec:\ddjjp.exe195⤵PID:3756
-
\??\c:\rffllrx.exec:\rffllrx.exe196⤵PID:4480
-
\??\c:\rlflflr.exec:\rlflflr.exe197⤵PID:1576
-
\??\c:\jdvvj.exec:\jdvvj.exe198⤵PID:736
-
\??\c:\llrrlxx.exec:\llrrlxx.exe199⤵PID:752
-
\??\c:\fxllflr.exec:\fxllflr.exe200⤵PID:1836
-
\??\c:\1httnt.exec:\1httnt.exe201⤵PID:1820
-
\??\c:\jdvvd.exec:\jdvvd.exe202⤵PID:2636
-
\??\c:\5lllfll.exec:\5lllfll.exe203⤵PID:1408
-
\??\c:\llxrrxx.exec:\llxrrxx.exe204⤵PID:3520
-
\??\c:\jpdjd.exec:\jpdjd.exe205⤵PID:644
-
\??\c:\xxlfxxr.exec:\xxlfxxr.exe206⤵PID:2724
-
\??\c:\btbbtn.exec:\btbbtn.exe207⤵PID:832
-
\??\c:\vvjdv.exec:\vvjdv.exe208⤵PID:4012
-
\??\c:\vdjjv.exec:\vdjjv.exe209⤵PID:3372
-
\??\c:\tthnnt.exec:\tthnnt.exe210⤵PID:3184
-
\??\c:\llxfrxl.exec:\llxfrxl.exe211⤵PID:2256
-
\??\c:\1rffllx.exec:\1rffllx.exe212⤵PID:3900
-
\??\c:\hhbttb.exec:\hhbttb.exe213⤵PID:5076
-
\??\c:\jdpdv.exec:\jdpdv.exe214⤵PID:604
-
\??\c:\lfffrxx.exec:\lfffrxx.exe215⤵PID:3248
-
\??\c:\jpjpp.exec:\jpjpp.exe216⤵PID:592
-
\??\c:\jppvv.exec:\jppvv.exe217⤵PID:3020
-
\??\c:\rxxrrrf.exec:\rxxrrrf.exe218⤵PID:3904
-
\??\c:\vpddj.exec:\vpddj.exe219⤵PID:316
-
\??\c:\pjpjj.exec:\pjpjj.exe220⤵PID:5020
-
\??\c:\xlxxrxr.exec:\xlxxrxr.exe221⤵PID:1916
-
\??\c:\nhnbbh.exec:\nhnbbh.exe222⤵PID:1244
-
\??\c:\dpvvd.exec:\dpvvd.exe223⤵PID:4260
-
\??\c:\5ttnhh.exec:\5ttnhh.exe224⤵PID:1728
-
\??\c:\vvvvd.exec:\vvvvd.exe225⤵PID:2892
-
\??\c:\ppppp.exec:\ppppp.exe226⤵PID:2216
-
\??\c:\xxllxfr.exec:\xxllxfr.exe227⤵PID:3344
-
\??\c:\flrrrrr.exec:\flrrrrr.exe228⤵PID:2496
-
\??\c:\hhbbnn.exec:\hhbbnn.exe229⤵PID:5072
-
\??\c:\ddddv.exec:\ddddv.exe230⤵PID:4776
-
\??\c:\vvvdd.exec:\vvvdd.exe231⤵PID:872
-
\??\c:\xrfffff.exec:\xrfffff.exe232⤵PID:2600
-
\??\c:\5xrlllx.exec:\5xrlllx.exe233⤵PID:380
-
\??\c:\nhtntn.exec:\nhtntn.exe234⤵PID:3084
-
\??\c:\ppvvj.exec:\ppvvj.exe235⤵PID:392
-
\??\c:\xffrrxx.exec:\xffrrxx.exe236⤵PID:1512
-
\??\c:\bbhbbb.exec:\bbhbbb.exe237⤵PID:448
-
\??\c:\bhbhbh.exec:\bhbhbh.exe238⤵PID:4816
-
\??\c:\pjpvv.exec:\pjpvv.exe239⤵PID:1884
-
\??\c:\5flrrrx.exec:\5flrrrx.exe240⤵PID:2484
-
\??\c:\xxxfflr.exec:\xxxfflr.exe241⤵PID:4288
-
\??\c:\5tbbhn.exec:\5tbbhn.exe242⤵PID:3756