Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 10:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8ab8c325911da170ce169ff860545e6bf86fbfd597ce25602d4f07fbe708bb91.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8ab8c325911da170ce169ff860545e6bf86fbfd597ce25602d4f07fbe708bb91.exe
-
Size
483KB
-
MD5
165f392544dcb2af92b2d3423136e070
-
SHA1
368ec5636fd5285c56b521fd5d0959dc21b746b2
-
SHA256
8ab8c325911da170ce169ff860545e6bf86fbfd597ce25602d4f07fbe708bb91
-
SHA512
b02febb689f2d4411eaf8cb9b715995bf4939a3c7c5a78b736fa26f0bf026e2d8d44da04710c58df0c7d2990dec0360d8970b7990545951229b01ea39f720526
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjhtSizjZ:q7Tc2NYHUrAwqzcP
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1616-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/692-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-654-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-880-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-994-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lxfxrrl.exetbhbtn.exe1tnnnn.exe3ttnhh.exe9rrrrfx.exejjddv.exerrlffff.exepjjdv.exetttnhh.exefrxrrxr.exevdjdd.exehbbbtt.exe7flfflf.exebnbttn.exenbhhhh.exelxfxrll.exenbtnhb.exelxfrrfl.exejpjvj.exexrfxxrl.exe3jddj.exellrxfll.exehhttbb.exepdddv.exe9ttnhh.exe1jjvp.exettbttt.exe7bthbb.exeflllfxx.exepjjdv.exellfxlll.exehnnbtt.exexxxfxrf.exethnhbt.exenhnhbt.exejjpjd.exe3xxrlfx.exehhthnb.exevvpjj.exexrrlffx.exetntttt.exe9flxrrl.exetnbbbb.exeddjjd.exexxrlfff.exedjpjj.exefxfxrrr.exefxxxrrf.exetnbttb.exepddvp.exeflrrrrr.exevppjd.exe1jjdv.exeflfxffx.exenhnhhb.exevppjd.exe3flfxfl.exexxfxrll.exebbhbbh.exejvddj.exeffrlfll.exettnntt.exehnbttt.exepvvvp.exepid process 2400 lxfxrrl.exe 1952 tbhbtn.exe 4352 1tnnnn.exe 2380 3ttnhh.exe 1704 9rrrrfx.exe 2868 jjddv.exe 692 rrlffff.exe 2180 pjjdv.exe 1112 tttnhh.exe 1988 frxrrxr.exe 2608 vdjdd.exe 1668 hbbbtt.exe 388 7flfflf.exe 4668 bnbttn.exe 3552 nbhhhh.exe 3328 lxfxrll.exe 1932 nbtnhb.exe 4320 lxfrrfl.exe 1732 jpjvj.exe 1120 xrfxxrl.exe 2336 3jddj.exe 2736 llrxfll.exe 1640 hhttbb.exe 1664 pdddv.exe 2312 9ttnhh.exe 2200 1jjvp.exe 880 ttbttt.exe 2412 7bthbb.exe 2544 flllfxx.exe 4704 pjjdv.exe 3284 llfxlll.exe 4620 hnnbtt.exe 392 xxxfxrf.exe 1444 thnhbt.exe 3748 nhnhbt.exe 4720 jjpjd.exe 1608 3xxrlfx.exe 2400 hhthnb.exe 4916 vvpjj.exe 1916 xrrlffx.exe 1476 tntttt.exe 3964 9flxrrl.exe 4216 tnbbbb.exe 1764 ddjjd.exe 3288 xxrlfff.exe 4156 djpjj.exe 2428 fxfxrrr.exe 4872 fxxxrrf.exe 1428 tnbttb.exe 2708 pddvp.exe 3840 flrrrrr.exe 3448 vppjd.exe 1180 1jjdv.exe 3640 flfxffx.exe 444 nhnhhb.exe 4668 vppjd.exe 3552 3flfxfl.exe 1760 xxfxrll.exe 3364 bbhbbh.exe 1932 jvddj.exe 2496 ffrlfll.exe 640 ttnntt.exe 1672 hnbttt.exe 1756 pvvvp.exe -
Processes:
resource yara_rule behavioral2/memory/1616-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/692-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-482-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8ab8c325911da170ce169ff860545e6bf86fbfd597ce25602d4f07fbe708bb91.exelxfxrrl.exetbhbtn.exe1tnnnn.exe3ttnhh.exe9rrrrfx.exejjddv.exerrlffff.exepjjdv.exetttnhh.exefrxrrxr.exevdjdd.exehbbbtt.exe7flfflf.exebnbttn.exenbhhhh.exelxfxrll.exenbtnhb.exelxfrrfl.exejpjvj.exexrfxxrl.exe3jddj.exedescription pid process target process PID 1616 wrote to memory of 2400 1616 8ab8c325911da170ce169ff860545e6bf86fbfd597ce25602d4f07fbe708bb91.exe lxfxrrl.exe PID 1616 wrote to memory of 2400 1616 8ab8c325911da170ce169ff860545e6bf86fbfd597ce25602d4f07fbe708bb91.exe lxfxrrl.exe PID 1616 wrote to memory of 2400 1616 8ab8c325911da170ce169ff860545e6bf86fbfd597ce25602d4f07fbe708bb91.exe lxfxrrl.exe PID 2400 wrote to memory of 1952 2400 lxfxrrl.exe tbhbtn.exe PID 2400 wrote to memory of 1952 2400 lxfxrrl.exe tbhbtn.exe PID 2400 wrote to memory of 1952 2400 lxfxrrl.exe tbhbtn.exe PID 1952 wrote to memory of 4352 1952 tbhbtn.exe 1tnnnn.exe PID 1952 wrote to memory of 4352 1952 tbhbtn.exe 1tnnnn.exe PID 1952 wrote to memory of 4352 1952 tbhbtn.exe 1tnnnn.exe PID 4352 wrote to memory of 2380 4352 1tnnnn.exe 3ttnhh.exe PID 4352 wrote to memory of 2380 4352 1tnnnn.exe 3ttnhh.exe PID 4352 wrote to memory of 2380 4352 1tnnnn.exe 3ttnhh.exe PID 2380 wrote to memory of 1704 2380 3ttnhh.exe 9rrrrfx.exe PID 2380 wrote to memory of 1704 2380 3ttnhh.exe 9rrrrfx.exe PID 2380 wrote to memory of 1704 2380 3ttnhh.exe 9rrrrfx.exe PID 1704 wrote to memory of 2868 1704 9rrrrfx.exe jjddv.exe PID 1704 wrote to memory of 2868 1704 9rrrrfx.exe jjddv.exe PID 1704 wrote to memory of 2868 1704 9rrrrfx.exe jjddv.exe PID 2868 wrote to memory of 692 2868 jjddv.exe rrlffff.exe PID 2868 wrote to memory of 692 2868 jjddv.exe rrlffff.exe PID 2868 wrote to memory of 692 2868 jjddv.exe rrlffff.exe PID 692 wrote to memory of 2180 692 rrlffff.exe pjjdv.exe PID 692 wrote to memory of 2180 692 rrlffff.exe pjjdv.exe PID 692 wrote to memory of 2180 692 rrlffff.exe pjjdv.exe PID 2180 wrote to memory of 1112 2180 pjjdv.exe tttnhh.exe PID 2180 wrote to memory of 1112 2180 pjjdv.exe tttnhh.exe PID 2180 wrote to memory of 1112 2180 pjjdv.exe tttnhh.exe PID 1112 wrote to memory of 1988 1112 tttnhh.exe frxrrxr.exe PID 1112 wrote to memory of 1988 1112 tttnhh.exe frxrrxr.exe PID 1112 wrote to memory of 1988 1112 tttnhh.exe frxrrxr.exe PID 1988 wrote to memory of 2608 1988 frxrrxr.exe vdjdd.exe PID 1988 wrote to memory of 2608 1988 frxrrxr.exe vdjdd.exe PID 1988 wrote to memory of 2608 1988 frxrrxr.exe vdjdd.exe PID 2608 wrote to memory of 1668 2608 vdjdd.exe hbbbtt.exe PID 2608 wrote to memory of 1668 2608 vdjdd.exe hbbbtt.exe PID 2608 wrote to memory of 1668 2608 vdjdd.exe hbbbtt.exe PID 1668 wrote to memory of 388 1668 hbbbtt.exe 7flfflf.exe PID 1668 wrote to memory of 388 1668 hbbbtt.exe 7flfflf.exe PID 1668 wrote to memory of 388 1668 hbbbtt.exe 7flfflf.exe PID 388 wrote to memory of 4668 388 7flfflf.exe bnbttn.exe PID 388 wrote to memory of 4668 388 7flfflf.exe bnbttn.exe PID 388 wrote to memory of 4668 388 7flfflf.exe bnbttn.exe PID 4668 wrote to memory of 3552 4668 bnbttn.exe nbhhhh.exe PID 4668 wrote to memory of 3552 4668 bnbttn.exe nbhhhh.exe PID 4668 wrote to memory of 3552 4668 bnbttn.exe nbhhhh.exe PID 3552 wrote to memory of 3328 3552 nbhhhh.exe lxfxrll.exe PID 3552 wrote to memory of 3328 3552 nbhhhh.exe lxfxrll.exe PID 3552 wrote to memory of 3328 3552 nbhhhh.exe lxfxrll.exe PID 3328 wrote to memory of 1932 3328 lxfxrll.exe nbtnhb.exe PID 3328 wrote to memory of 1932 3328 lxfxrll.exe nbtnhb.exe PID 3328 wrote to memory of 1932 3328 lxfxrll.exe nbtnhb.exe PID 1932 wrote to memory of 4320 1932 nbtnhb.exe lxfrrfl.exe PID 1932 wrote to memory of 4320 1932 nbtnhb.exe lxfrrfl.exe PID 1932 wrote to memory of 4320 1932 nbtnhb.exe lxfrrfl.exe PID 4320 wrote to memory of 1732 4320 lxfrrfl.exe jpjvj.exe PID 4320 wrote to memory of 1732 4320 lxfrrfl.exe jpjvj.exe PID 4320 wrote to memory of 1732 4320 lxfrrfl.exe jpjvj.exe PID 1732 wrote to memory of 1120 1732 jpjvj.exe xrfxxrl.exe PID 1732 wrote to memory of 1120 1732 jpjvj.exe xrfxxrl.exe PID 1732 wrote to memory of 1120 1732 jpjvj.exe xrfxxrl.exe PID 1120 wrote to memory of 2336 1120 xrfxxrl.exe 3jddj.exe PID 1120 wrote to memory of 2336 1120 xrfxxrl.exe 3jddj.exe PID 1120 wrote to memory of 2336 1120 xrfxxrl.exe 3jddj.exe PID 2336 wrote to memory of 2736 2336 3jddj.exe llrxfll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ab8c325911da170ce169ff860545e6bf86fbfd597ce25602d4f07fbe708bb91.exe"C:\Users\Admin\AppData\Local\Temp\8ab8c325911da170ce169ff860545e6bf86fbfd597ce25602d4f07fbe708bb91.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\tbhbtn.exec:\tbhbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\1tnnnn.exec:\1tnnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\3ttnhh.exec:\3ttnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\9rrrrfx.exec:\9rrrrfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\jjddv.exec:\jjddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\rrlffff.exec:\rrlffff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\pjjdv.exec:\pjjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\tttnhh.exec:\tttnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\frxrrxr.exec:\frxrrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\vdjdd.exec:\vdjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\hbbbtt.exec:\hbbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\7flfflf.exec:\7flfflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\bnbttn.exec:\bnbttn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\nbhhhh.exec:\nbhhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\lxfxrll.exec:\lxfxrll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\nbtnhb.exec:\nbtnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\lxfrrfl.exec:\lxfrrfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\jpjvj.exec:\jpjvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\xrfxxrl.exec:\xrfxxrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\3jddj.exec:\3jddj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\llrxfll.exec:\llrxfll.exe23⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hhttbb.exec:\hhttbb.exe24⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pdddv.exec:\pdddv.exe25⤵
- Executes dropped EXE
PID:1664 -
\??\c:\9ttnhh.exec:\9ttnhh.exe26⤵
- Executes dropped EXE
PID:2312 -
\??\c:\1jjvp.exec:\1jjvp.exe27⤵
- Executes dropped EXE
PID:2200 -
\??\c:\ttbttt.exec:\ttbttt.exe28⤵
- Executes dropped EXE
PID:880 -
\??\c:\7bthbb.exec:\7bthbb.exe29⤵
- Executes dropped EXE
PID:2412 -
\??\c:\flllfxx.exec:\flllfxx.exe30⤵
- Executes dropped EXE
PID:2544 -
\??\c:\pjjdv.exec:\pjjdv.exe31⤵
- Executes dropped EXE
PID:4704 -
\??\c:\llfxlll.exec:\llfxlll.exe32⤵
- Executes dropped EXE
PID:3284 -
\??\c:\hnnbtt.exec:\hnnbtt.exe33⤵
- Executes dropped EXE
PID:4620 -
\??\c:\xxxfxrf.exec:\xxxfxrf.exe34⤵
- Executes dropped EXE
PID:392 -
\??\c:\thnhbt.exec:\thnhbt.exe35⤵
- Executes dropped EXE
PID:1444 -
\??\c:\nhnhbt.exec:\nhnhbt.exe36⤵
- Executes dropped EXE
PID:3748 -
\??\c:\jjpjd.exec:\jjpjd.exe37⤵
- Executes dropped EXE
PID:4720 -
\??\c:\3xxrlfx.exec:\3xxrlfx.exe38⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hhthnb.exec:\hhthnb.exe39⤵
- Executes dropped EXE
PID:2400 -
\??\c:\vvpjj.exec:\vvpjj.exe40⤵
- Executes dropped EXE
PID:4916 -
\??\c:\xrrlffx.exec:\xrrlffx.exe41⤵
- Executes dropped EXE
PID:1916 -
\??\c:\tntttt.exec:\tntttt.exe42⤵
- Executes dropped EXE
PID:1476 -
\??\c:\9flxrrl.exec:\9flxrrl.exe43⤵
- Executes dropped EXE
PID:3964 -
\??\c:\tnbbbb.exec:\tnbbbb.exe44⤵
- Executes dropped EXE
PID:4216 -
\??\c:\ddjjd.exec:\ddjjd.exe45⤵
- Executes dropped EXE
PID:1764 -
\??\c:\xxrlfff.exec:\xxrlfff.exe46⤵
- Executes dropped EXE
PID:3288 -
\??\c:\djpjj.exec:\djpjj.exe47⤵
- Executes dropped EXE
PID:4156 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe48⤵
- Executes dropped EXE
PID:2428 -
\??\c:\fxxxrrf.exec:\fxxxrrf.exe49⤵
- Executes dropped EXE
PID:4872 -
\??\c:\tnbttb.exec:\tnbttb.exe50⤵
- Executes dropped EXE
PID:1428 -
\??\c:\pddvp.exec:\pddvp.exe51⤵
- Executes dropped EXE
PID:2708 -
\??\c:\flrrrrr.exec:\flrrrrr.exe52⤵
- Executes dropped EXE
PID:3840 -
\??\c:\vppjd.exec:\vppjd.exe53⤵
- Executes dropped EXE
PID:3448 -
\??\c:\1jjdv.exec:\1jjdv.exe54⤵
- Executes dropped EXE
PID:1180 -
\??\c:\flfxffx.exec:\flfxffx.exe55⤵
- Executes dropped EXE
PID:3640 -
\??\c:\nhnhhb.exec:\nhnhhb.exe56⤵
- Executes dropped EXE
PID:444 -
\??\c:\vppjd.exec:\vppjd.exe57⤵
- Executes dropped EXE
PID:4668 -
\??\c:\3flfxfl.exec:\3flfxfl.exe58⤵
- Executes dropped EXE
PID:3552 -
\??\c:\xxfxrll.exec:\xxfxrll.exe59⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bbhbbh.exec:\bbhbbh.exe60⤵
- Executes dropped EXE
PID:3364 -
\??\c:\jvddj.exec:\jvddj.exe61⤵
- Executes dropped EXE
PID:1932 -
\??\c:\ffrlfll.exec:\ffrlfll.exe62⤵
- Executes dropped EXE
PID:2496 -
\??\c:\ttnntt.exec:\ttnntt.exe63⤵
- Executes dropped EXE
PID:640 -
\??\c:\hnbttt.exec:\hnbttt.exe64⤵
- Executes dropped EXE
PID:1672 -
\??\c:\pvvvp.exec:\pvvvp.exe65⤵
- Executes dropped EXE
PID:1756 -
\??\c:\3lfxxxx.exec:\3lfxxxx.exe66⤵PID:4984
-
\??\c:\xxfxllr.exec:\xxfxllr.exe67⤵PID:2120
-
\??\c:\3vjjd.exec:\3vjjd.exe68⤵PID:1640
-
\??\c:\dvdvp.exec:\dvdvp.exe69⤵PID:5076
-
\??\c:\rlrlfff.exec:\rlrlfff.exe70⤵PID:4760
-
\??\c:\bnbbhh.exec:\bnbbhh.exe71⤵PID:1092
-
\??\c:\jddjj.exec:\jddjj.exe72⤵PID:1188
-
\??\c:\vvjjj.exec:\vvjjj.exe73⤵PID:5084
-
\??\c:\xfrlffr.exec:\xfrlffr.exe74⤵PID:2792
-
\??\c:\btbtnn.exec:\btbtnn.exe75⤵PID:3560
-
\??\c:\nhtnbb.exec:\nhtnbb.exe76⤵PID:548
-
\??\c:\jdvjd.exec:\jdvjd.exe77⤵PID:4620
-
\??\c:\lfxrrlr.exec:\lfxrrlr.exe78⤵PID:4456
-
\??\c:\3ttnhh.exec:\3ttnhh.exe79⤵PID:4460
-
\??\c:\bttnth.exec:\bttnth.exe80⤵PID:5112
-
\??\c:\ppppj.exec:\ppppj.exe81⤵PID:3128
-
\??\c:\fxlfffr.exec:\fxlfffr.exe82⤵PID:1548
-
\??\c:\5jvpp.exec:\5jvpp.exe83⤵PID:1832
-
\??\c:\fxflrrx.exec:\fxflrrx.exe84⤵PID:1724
-
\??\c:\nhnhbb.exec:\nhnhbb.exe85⤵PID:4416
-
\??\c:\ddvvv.exec:\ddvvv.exe86⤵PID:1704
-
\??\c:\1xfrrrl.exec:\1xfrrrl.exe87⤵PID:4836
-
\??\c:\hthbbt.exec:\hthbbt.exe88⤵PID:2696
-
\??\c:\thnhbb.exec:\thnhbb.exe89⤵PID:3880
-
\??\c:\dvvpj.exec:\dvvpj.exe90⤵PID:2056
-
\??\c:\hntbtn.exec:\hntbtn.exe91⤵PID:2476
-
\??\c:\jvjdv.exec:\jvjdv.exe92⤵PID:3344
-
\??\c:\xxxrffx.exec:\xxxrffx.exe93⤵PID:1988
-
\??\c:\nbttnh.exec:\nbttnh.exe94⤵PID:2672
-
\??\c:\pdvpj.exec:\pdvpj.exe95⤵PID:652
-
\??\c:\lrfxrlr.exec:\lrfxrlr.exe96⤵PID:1880
-
\??\c:\tnnhtt.exec:\tnnhtt.exe97⤵PID:5052
-
\??\c:\thttnn.exec:\thttnn.exe98⤵PID:4628
-
\??\c:\ddjjd.exec:\ddjjd.exe99⤵PID:1944
-
\??\c:\rlxfrrl.exec:\rlxfrrl.exe100⤵PID:1080
-
\??\c:\hbhbhh.exec:\hbhbhh.exe101⤵PID:4640
-
\??\c:\hhhnhh.exec:\hhhnhh.exe102⤵PID:2040
-
\??\c:\djjdv.exec:\djjdv.exe103⤵PID:1932
-
\??\c:\rrxrlxf.exec:\rrxrlxf.exe104⤵PID:4104
-
\??\c:\nnhbbb.exec:\nnhbbb.exe105⤵PID:4496
-
\??\c:\pvdvv.exec:\pvdvv.exe106⤵PID:3400
-
\??\c:\xxfxrrf.exec:\xxfxrrf.exe107⤵PID:2424
-
\??\c:\lxxrllf.exec:\lxxrllf.exe108⤵PID:2120
-
\??\c:\thhbnn.exec:\thhbnn.exe109⤵PID:1684
-
\??\c:\pvpdd.exec:\pvpdd.exe110⤵PID:2508
-
\??\c:\lfflrxl.exec:\lfflrxl.exe111⤵PID:3948
-
\??\c:\bbnnbb.exec:\bbnnbb.exe112⤵PID:5040
-
\??\c:\jpjjd.exec:\jpjjd.exe113⤵PID:1828
-
\??\c:\pjpjp.exec:\pjpjp.exe114⤵PID:2544
-
\??\c:\frlxrrl.exec:\frlxrrl.exe115⤵PID:1492
-
\??\c:\nbhbbb.exec:\nbhbbb.exe116⤵PID:3132
-
\??\c:\vjvvp.exec:\vjvvp.exe117⤵PID:3748
-
\??\c:\ffrfxxr.exec:\ffrfxxr.exe118⤵PID:2304
-
\??\c:\btttnt.exec:\btttnt.exe119⤵PID:1132
-
\??\c:\vpppd.exec:\vpppd.exe120⤵PID:1056
-
\??\c:\llfrlxl.exec:\llfrlxl.exe121⤵PID:1888
-
\??\c:\3tbbnn.exec:\3tbbnn.exe122⤵PID:4088
-
\??\c:\dpvpp.exec:\dpvpp.exe123⤵PID:1476
-
\??\c:\1rrlfxr.exec:\1rrlfxr.exe124⤵PID:3672
-
\??\c:\lxfxrll.exec:\lxfxrll.exe125⤵PID:3860
-
\??\c:\tnnhhh.exec:\tnnhhh.exe126⤵PID:2112
-
\??\c:\dpdvj.exec:\dpdvj.exe127⤵PID:3628
-
\??\c:\djjjj.exec:\djjjj.exe128⤵PID:5048
-
\??\c:\xffxrlf.exec:\xffxrlf.exe129⤵PID:1680
-
\??\c:\tthbhh.exec:\tthbhh.exe130⤵PID:1112
-
\??\c:\5vdvp.exec:\5vdvp.exe131⤵PID:5096
-
\??\c:\dvvdv.exec:\dvvdv.exe132⤵PID:5116
-
\??\c:\xlrfxxf.exec:\xlrfxxf.exe133⤵PID:4632
-
\??\c:\htbtnn.exec:\htbtnn.exe134⤵PID:932
-
\??\c:\htbhbh.exec:\htbhbh.exe135⤵PID:2392
-
\??\c:\dvpjp.exec:\dvpjp.exe136⤵PID:4648
-
\??\c:\fxfflfl.exec:\fxfflfl.exe137⤵PID:4488
-
\??\c:\hntnnn.exec:\hntnnn.exe138⤵PID:3308
-
\??\c:\ttbhbt.exec:\ttbhbt.exe139⤵PID:4828
-
\??\c:\jpvpj.exec:\jpvpj.exe140⤵PID:3872
-
\??\c:\7vpjj.exec:\7vpjj.exe141⤵PID:3488
-
\??\c:\frfxrlf.exec:\frfxrlf.exe142⤵PID:3408
-
\??\c:\1tbbbh.exec:\1tbbbh.exe143⤵PID:1368
-
\??\c:\bnnhbt.exec:\bnnhbt.exe144⤵PID:3460
-
\??\c:\vpppj.exec:\vpppj.exe145⤵PID:1756
-
\??\c:\xlrllff.exec:\xlrllff.exe146⤵PID:4732
-
\??\c:\rflfffl.exec:\rflfffl.exe147⤵PID:2664
-
\??\c:\1nnntt.exec:\1nnntt.exe148⤵PID:2424
-
\??\c:\9pvdv.exec:\9pvdv.exe149⤵PID:5076
-
\??\c:\ddjvv.exec:\ddjvv.exe150⤵PID:4568
-
\??\c:\lxrrlff.exec:\lxrrlff.exe151⤵PID:3712
-
\??\c:\nttbbb.exec:\nttbbb.exe152⤵PID:1000
-
\??\c:\vpvpj.exec:\vpvpj.exe153⤵PID:4820
-
\??\c:\dvpjj.exec:\dvpjj.exe154⤵PID:1444
-
\??\c:\frxxrxr.exec:\frxxrxr.exe155⤵PID:4472
-
\??\c:\hnbbtn.exec:\hnbbtn.exe156⤵PID:5112
-
\??\c:\5vvjd.exec:\5vvjd.exe157⤵PID:4252
-
\??\c:\vdvpj.exec:\vdvpj.exe158⤵PID:1132
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe159⤵PID:1916
-
\??\c:\btthbb.exec:\btthbb.exe160⤵PID:1860
-
\??\c:\3tnhbb.exec:\3tnhbb.exe161⤵PID:3708
-
\??\c:\vddvp.exec:\vddvp.exe162⤵PID:1704
-
\??\c:\rrxfflf.exec:\rrxfflf.exe163⤵PID:3784
-
\??\c:\llllfrl.exec:\llllfrl.exe164⤵PID:4700
-
\??\c:\btthbb.exec:\btthbb.exe165⤵PID:1744
-
\??\c:\7vvpp.exec:\7vvpp.exe166⤵PID:1644
-
\??\c:\vjvpp.exec:\vjvpp.exe167⤵PID:4904
-
\??\c:\xxxxrxx.exec:\xxxxrxx.exe168⤵PID:3140
-
\??\c:\tnnhhh.exec:\tnnhhh.exe169⤵PID:2224
-
\??\c:\dvjjd.exec:\dvjjd.exe170⤵PID:3056
-
\??\c:\vpvpj.exec:\vpvpj.exe171⤵PID:3764
-
\??\c:\ffrfffx.exec:\ffrfffx.exe172⤵PID:1668
-
\??\c:\nhhhbb.exec:\nhhhbb.exe173⤵PID:1540
-
\??\c:\3ddvp.exec:\3ddvp.exe174⤵PID:5064
-
\??\c:\flrfxrl.exec:\flrfxrl.exe175⤵PID:4044
-
\??\c:\rllfrrl.exec:\rllfrrl.exe176⤵PID:336
-
\??\c:\9bhbtt.exec:\9bhbtt.exe177⤵PID:4436
-
\??\c:\1vdpp.exec:\1vdpp.exe178⤵PID:3368
-
\??\c:\7lrlffx.exec:\7lrlffx.exe179⤵PID:3328
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe180⤵PID:4592
-
\??\c:\9bhbtt.exec:\9bhbtt.exe181⤵PID:2336
-
\??\c:\1dvvp.exec:\1dvvp.exe182⤵PID:3460
-
\??\c:\xlfxxxr.exec:\xlfxxxr.exe183⤵PID:5072
-
\??\c:\fxllxrl.exec:\fxllxrl.exe184⤵PID:1956
-
\??\c:\bnbhbt.exec:\bnbhbt.exe185⤵PID:2472
-
\??\c:\pjdvv.exec:\pjdvv.exe186⤵PID:1388
-
\??\c:\3rxrllf.exec:\3rxrllf.exe187⤵PID:4920
-
\??\c:\llxxffl.exec:\llxxffl.exe188⤵PID:4924
-
\??\c:\bbhhnn.exec:\bbhhnn.exe189⤵PID:1092
-
\??\c:\9pdjv.exec:\9pdjv.exe190⤵PID:3948
-
\??\c:\lxfxfrr.exec:\lxfxfrr.exe191⤵PID:2140
-
\??\c:\bnbbnn.exec:\bnbbnn.exe192⤵PID:4464
-
\??\c:\tnnhbn.exec:\tnnhbn.exe193⤵PID:3760
-
\??\c:\pjvpv.exec:\pjvpv.exe194⤵PID:2316
-
\??\c:\lrllxrl.exec:\lrllxrl.exe195⤵PID:1616
-
\??\c:\thnhbt.exec:\thnhbt.exe196⤵PID:1952
-
\??\c:\vvpjp.exec:\vvpjp.exe197⤵PID:2400
-
\??\c:\ppjdd.exec:\ppjdd.exe198⤵PID:4652
-
\??\c:\fxlfrlr.exec:\fxlfrlr.exe199⤵PID:664
-
\??\c:\hbtnhh.exec:\hbtnhh.exe200⤵PID:3216
-
\??\c:\pjjpd.exec:\pjjpd.exe201⤵PID:3964
-
\??\c:\rflfxlf.exec:\rflfxlf.exe202⤵PID:3060
-
\??\c:\htbbtn.exec:\htbbtn.exe203⤵PID:2516
-
\??\c:\pddjv.exec:\pddjv.exe204⤵PID:4024
-
\??\c:\nbhbtt.exec:\nbhbtt.exe205⤵PID:4700
-
\??\c:\nnnhbt.exec:\nnnhbt.exe206⤵PID:1744
-
\??\c:\dvvjj.exec:\dvvjj.exe207⤵PID:1392
-
\??\c:\xrrlxrl.exec:\xrrlxrl.exe208⤵PID:4904
-
\??\c:\lrfxrll.exec:\lrfxrll.exe209⤵PID:2672
-
\??\c:\nbhtnh.exec:\nbhtnh.exe210⤵PID:3840
-
\??\c:\dvppj.exec:\dvppj.exe211⤵PID:4912
-
\??\c:\7pvpj.exec:\7pvpj.exe212⤵PID:3764
-
\??\c:\rfxffrf.exec:\rfxffrf.exe213⤵PID:4412
-
\??\c:\bbbtnn.exec:\bbbtnn.exe214⤵PID:1540
-
\??\c:\bbbthn.exec:\bbbthn.exe215⤵PID:5064
-
\??\c:\djvpj.exec:\djvpj.exe216⤵PID:3104
-
\??\c:\rlrrffx.exec:\rlrrffx.exe217⤵PID:336
-
\??\c:\xffxrfx.exec:\xffxrfx.exe218⤵PID:4000
-
\??\c:\5hthbh.exec:\5hthbh.exe219⤵PID:3368
-
\??\c:\nhthbh.exec:\nhthbh.exe220⤵PID:5012
-
\??\c:\vvpjd.exec:\vvpjd.exe221⤵PID:868
-
\??\c:\xlrrxxr.exec:\xlrrxxr.exe222⤵PID:4108
-
\??\c:\xrffllr.exec:\xrffllr.exe223⤵PID:2740
-
\??\c:\nhhbtt.exec:\nhhbtt.exe224⤵PID:4580
-
\??\c:\hnnhbb.exec:\hnnhbb.exe225⤵PID:1924
-
\??\c:\dvjdd.exec:\dvjdd.exe226⤵PID:1640
-
\??\c:\lxfflff.exec:\lxfflff.exe227⤵PID:1844
-
\??\c:\rfrllll.exec:\rfrllll.exe228⤵PID:60
-
\??\c:\ttthnn.exec:\ttthnn.exe229⤵PID:1448
-
\??\c:\1djpj.exec:\1djpj.exe230⤵PID:3384
-
\??\c:\dpvpp.exec:\dpvpp.exe231⤵PID:2232
-
\??\c:\7xxrlrl.exec:\7xxrlrl.exe232⤵PID:1268
-
\??\c:\ffxrlfl.exec:\ffxrlfl.exe233⤵PID:3496
-
\??\c:\thnhbt.exec:\thnhbt.exe234⤵PID:844
-
\??\c:\jddvp.exec:\jddvp.exe235⤵PID:4460
-
\??\c:\djdvd.exec:\djdvd.exe236⤵PID:4472
-
\??\c:\1xrlfxr.exec:\1xrlfxr.exe237⤵PID:3788
-
\??\c:\thhhhh.exec:\thhhhh.exe238⤵PID:1888
-
\??\c:\ppvvv.exec:\ppvvv.exe239⤵PID:1916
-
\??\c:\pjjjp.exec:\pjjjp.exe240⤵PID:3864
-
\??\c:\9xrfxxr.exec:\9xrfxxr.exe241⤵PID:1476
-
\??\c:\ttnhbh.exec:\ttnhbh.exe242⤵PID:4248