Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 01:27
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
962acbabd7b14836ef06bdc44295b88f32794d4f1591b6a2a563052b99a09c64.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
962acbabd7b14836ef06bdc44295b88f32794d4f1591b6a2a563052b99a09c64.exe
-
Size
191KB
-
MD5
bb7cdaa20a6e113be40bc57512a4a677
-
SHA1
ee95945b7196643a4be012b28d592c1dc31ba171
-
SHA256
962acbabd7b14836ef06bdc44295b88f32794d4f1591b6a2a563052b99a09c64
-
SHA512
191fec7ce470cb407fec17240a27bd5f7c89e7f7b3a84d37ce23662ffd7bed422c60eab305ee691b3cb00dbc9acf402167356ed53013149c1841721c2b69e766
-
SSDEEP
3072:YhOmTsF93UYfwC6GIoutLmxHxae5yLpcgDE4JBuItR8pTsgnKbQFe3+OC:Ycm4FmowdHoSLEaTBftapTsyFeOL
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4368-8-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/5036-13-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1124-18-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4200-25-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1640-37-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/5056-31-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1384-6-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2820-49-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2460-51-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2572-58-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4928-62-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2276-72-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1704-80-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4060-78-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3728-110-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1412-115-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3344-144-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4632-149-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/5020-135-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1848-122-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4932-108-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2424-97-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2912-90-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4588-165-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3288-170-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2452-194-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2224-199-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/5072-216-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3444-219-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/772-225-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/872-231-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/364-244-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2484-246-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3668-258-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1988-265-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1744-272-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4060-276-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3284-293-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4768-307-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1708-313-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2868-326-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3140-333-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3700-338-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4432-384-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4060-425-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3360-429-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2768-433-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1864-436-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4992-468-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2668-480-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1984-490-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2128-498-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2128-501-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4764-508-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4312-519-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3044-541-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2912-575-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1848-582-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3272-611-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3968-627-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2252-629-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4424-791-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3932-879-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4116-902-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1384-0-0x0000000000400000-0x0000000000430000-memory.dmp UPX C:\rlfrlfx.exe UPX behavioral2/memory/4368-8-0x0000000000400000-0x0000000000430000-memory.dmp UPX \??\c:\xllllll.exe UPX behavioral2/memory/5036-13-0x0000000000400000-0x0000000000430000-memory.dmp UPX \??\c:\7btnnh.exe UPX behavioral2/memory/1124-18-0x0000000000400000-0x0000000000430000-memory.dmp UPX \??\c:\vpjdd.exe UPX behavioral2/memory/4200-25-0x0000000000400000-0x0000000000430000-memory.dmp UPX \??\c:\1jjdd.exe UPX \??\c:\rxxlxxx.exe UPX \??\c:\9frxrxr.exe UPX behavioral2/memory/2820-42-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/1640-37-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/5056-31-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/1384-6-0x0000000000400000-0x0000000000430000-memory.dmp UPX C:\rrrlfff.exe UPX behavioral2/memory/2820-49-0x0000000000400000-0x0000000000430000-memory.dmp UPX C:\tbnnnn.exe UPX behavioral2/memory/2460-51-0x0000000000400000-0x0000000000430000-memory.dmp UPX \??\c:\bnhbtn.exe UPX behavioral2/memory/2572-58-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/4928-62-0x0000000000400000-0x0000000000430000-memory.dmp UPX C:\1vdvp.exe UPX behavioral2/memory/2276-68-0x0000000000400000-0x0000000000430000-memory.dmp UPX C:\3ffxrrl.exe UPX behavioral2/memory/2276-72-0x0000000000400000-0x0000000000430000-memory.dmp UPX C:\vppvp.exe UPX behavioral2/memory/1704-80-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/4060-78-0x0000000000400000-0x0000000000430000-memory.dmp UPX C:\ffffxrr.exe UPX C:\ntbtnh.exe UPX C:\1bhbtt.exe UPX C:\jdpjj.exe UPX behavioral2/memory/3728-103-0x0000000000400000-0x0000000000430000-memory.dmp UPX C:\1xffrlx.exe UPX behavioral2/memory/3728-110-0x0000000000400000-0x0000000000430000-memory.dmp UPX \??\c:\hntthh.exe UPX behavioral2/memory/1412-115-0x0000000000400000-0x0000000000430000-memory.dmp UPX \??\c:\bbhhnh.exe UPX \??\c:\jpdjj.exe UPX \??\c:\rlfxrrl.exe UPX \??\c:\1xxlllf.exe UPX \??\c:\1nnhbt.exe UPX behavioral2/memory/3344-144-0x0000000000400000-0x0000000000430000-memory.dmp UPX \??\c:\bnttnn.exe UPX behavioral2/memory/4632-149-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/5020-135-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/1848-122-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/4932-108-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/2424-97-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/2912-90-0x0000000000400000-0x0000000000430000-memory.dmp UPX C:\jjppd.exe UPX C:\dvvpj.exe UPX C:\rxfrfxl.exe UPX behavioral2/memory/4588-165-0x0000000000400000-0x0000000000430000-memory.dmp UPX C:\xffxrrl.exe UPX behavioral2/memory/3288-170-0x0000000000400000-0x0000000000430000-memory.dmp UPX C:\nhhbtt.exe UPX \??\c:\dppjd.exe UPX C:\xlfxrrf.exe UPX behavioral2/memory/2452-194-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/2224-199-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral2/memory/5072-216-0x0000000000400000-0x0000000000430000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
rlfrlfx.exexllllll.exe7btnnh.exevpjdd.exe1jjdd.exerxxlxxx.exe9frxrxr.exerrrlfff.exetbnnnn.exebnhbtn.exe1vdvp.exe3ffxrrl.exevppvp.exeffffxrr.exentbtnh.exe1bhbtt.exejdpjj.exe1xffrlx.exehntthh.exebbhhnh.exejpdjj.exerlfxrrl.exe1xxlllf.exe1nnhbt.exebnttnn.exejjppd.exedvvpj.exerxfrfxl.exexffxrrl.exenhhbtt.exedppjd.exexlfxrrf.exehtnnbt.exepdvpd.exepjjdd.exenttnhb.exehnhbth.exevpjpj.exefxrrlxr.exe3flfxxx.exenbbbtn.exenbbthb.exevdjjv.exerllfrrl.exenhthbb.exejjjvd.exejpvpd.exerlxxffr.exelffxfxx.exenhnhtn.exevjjjd.exejjvpj.exelflfxff.exehhhbtt.exejpppj.exexrrlfxf.exe9ffxllx.exehtnhbh.exedddjj.exe5xfrffx.exerrlfxrf.exebtnnbb.exe7vdjd.exepdddv.exepid process 4368 rlfrlfx.exe 5036 xllllll.exe 1124 7btnnh.exe 4200 vpjdd.exe 5056 1jjdd.exe 1640 rxxlxxx.exe 2820 9frxrxr.exe 2460 rrrlfff.exe 2572 tbnnnn.exe 4928 bnhbtn.exe 2276 1vdvp.exe 4060 3ffxrrl.exe 1704 vppvp.exe 4608 ffffxrr.exe 2912 ntbtnh.exe 2424 1bhbtt.exe 3728 jdpjj.exe 4932 1xffrlx.exe 1412 hntthh.exe 1848 bbhhnh.exe 5020 jpdjj.exe 376 rlfxrrl.exe 2108 1xxlllf.exe 3344 1nnhbt.exe 4632 bnttnn.exe 4304 jjppd.exe 4588 dvvpj.exe 3288 rxfrfxl.exe 1196 xffxrrl.exe 5016 nhhbtt.exe 1888 dppjd.exe 1660 xlfxrrf.exe 2452 htnnbt.exe 1872 pdvpd.exe 2224 pjjdd.exe 2928 nttnhb.exe 4372 hnhbth.exe 4908 vpjpj.exe 3100 fxrrlxr.exe 3408 3flfxxx.exe 5072 nbbbtn.exe 3444 nbbthb.exe 772 vdjjv.exe 872 rllfrrl.exe 1820 nhthbb.exe 4748 jjjvd.exe 4072 jpvpd.exe 364 rlxxffr.exe 2484 lffxfxx.exe 5008 nhnhtn.exe 2132 vjjjd.exe 2724 jjvpj.exe 3668 lflfxff.exe 2572 hhhbtt.exe 1988 jpppj.exe 1744 xrrlfxf.exe 4060 9ffxllx.exe 2792 htnhbh.exe 2292 dddjj.exe 2912 5xfrffx.exe 2552 rrlfxrf.exe 3284 btnnbb.exe 2432 7vdjd.exe 3124 pdddv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
962acbabd7b14836ef06bdc44295b88f32794d4f1591b6a2a563052b99a09c64.exerlfrlfx.exexllllll.exe7btnnh.exevpjdd.exe1jjdd.exerxxlxxx.exe9frxrxr.exerrrlfff.exetbnnnn.exebnhbtn.exe1vdvp.exe3ffxrrl.exevppvp.exeffffxrr.exentbtnh.exe1bhbtt.exejdpjj.exe1xffrlx.exehntthh.exebbhhnh.exejpdjj.exedescription pid process target process PID 1384 wrote to memory of 4368 1384 962acbabd7b14836ef06bdc44295b88f32794d4f1591b6a2a563052b99a09c64.exe rlfrlfx.exe PID 1384 wrote to memory of 4368 1384 962acbabd7b14836ef06bdc44295b88f32794d4f1591b6a2a563052b99a09c64.exe rlfrlfx.exe PID 1384 wrote to memory of 4368 1384 962acbabd7b14836ef06bdc44295b88f32794d4f1591b6a2a563052b99a09c64.exe rlfrlfx.exe PID 4368 wrote to memory of 5036 4368 rlfrlfx.exe xllllll.exe PID 4368 wrote to memory of 5036 4368 rlfrlfx.exe xllllll.exe PID 4368 wrote to memory of 5036 4368 rlfrlfx.exe xllllll.exe PID 5036 wrote to memory of 1124 5036 xllllll.exe 7btnnh.exe PID 5036 wrote to memory of 1124 5036 xllllll.exe 7btnnh.exe PID 5036 wrote to memory of 1124 5036 xllllll.exe 7btnnh.exe PID 1124 wrote to memory of 4200 1124 7btnnh.exe vpjdd.exe PID 1124 wrote to memory of 4200 1124 7btnnh.exe vpjdd.exe PID 1124 wrote to memory of 4200 1124 7btnnh.exe vpjdd.exe PID 4200 wrote to memory of 5056 4200 vpjdd.exe 1jjdd.exe PID 4200 wrote to memory of 5056 4200 vpjdd.exe 1jjdd.exe PID 4200 wrote to memory of 5056 4200 vpjdd.exe 1jjdd.exe PID 5056 wrote to memory of 1640 5056 1jjdd.exe rxxlxxx.exe PID 5056 wrote to memory of 1640 5056 1jjdd.exe rxxlxxx.exe PID 5056 wrote to memory of 1640 5056 1jjdd.exe rxxlxxx.exe PID 1640 wrote to memory of 2820 1640 rxxlxxx.exe 9frxrxr.exe PID 1640 wrote to memory of 2820 1640 rxxlxxx.exe 9frxrxr.exe PID 1640 wrote to memory of 2820 1640 rxxlxxx.exe 9frxrxr.exe PID 2820 wrote to memory of 2460 2820 9frxrxr.exe rrrlfff.exe PID 2820 wrote to memory of 2460 2820 9frxrxr.exe rrrlfff.exe PID 2820 wrote to memory of 2460 2820 9frxrxr.exe rrrlfff.exe PID 2460 wrote to memory of 2572 2460 rrrlfff.exe tbnnnn.exe PID 2460 wrote to memory of 2572 2460 rrrlfff.exe tbnnnn.exe PID 2460 wrote to memory of 2572 2460 rrrlfff.exe tbnnnn.exe PID 2572 wrote to memory of 4928 2572 tbnnnn.exe bnhbtn.exe PID 2572 wrote to memory of 4928 2572 tbnnnn.exe bnhbtn.exe PID 2572 wrote to memory of 4928 2572 tbnnnn.exe bnhbtn.exe PID 4928 wrote to memory of 2276 4928 bnhbtn.exe 1vdvp.exe PID 4928 wrote to memory of 2276 4928 bnhbtn.exe 1vdvp.exe PID 4928 wrote to memory of 2276 4928 bnhbtn.exe 1vdvp.exe PID 2276 wrote to memory of 4060 2276 1vdvp.exe 3ffxrrl.exe PID 2276 wrote to memory of 4060 2276 1vdvp.exe 3ffxrrl.exe PID 2276 wrote to memory of 4060 2276 1vdvp.exe 3ffxrrl.exe PID 4060 wrote to memory of 1704 4060 3ffxrrl.exe vppvp.exe PID 4060 wrote to memory of 1704 4060 3ffxrrl.exe vppvp.exe PID 4060 wrote to memory of 1704 4060 3ffxrrl.exe vppvp.exe PID 1704 wrote to memory of 4608 1704 vppvp.exe ffffxrr.exe PID 1704 wrote to memory of 4608 1704 vppvp.exe ffffxrr.exe PID 1704 wrote to memory of 4608 1704 vppvp.exe ffffxrr.exe PID 4608 wrote to memory of 2912 4608 ffffxrr.exe ntbtnh.exe PID 4608 wrote to memory of 2912 4608 ffffxrr.exe ntbtnh.exe PID 4608 wrote to memory of 2912 4608 ffffxrr.exe ntbtnh.exe PID 2912 wrote to memory of 2424 2912 ntbtnh.exe 1bhbtt.exe PID 2912 wrote to memory of 2424 2912 ntbtnh.exe 1bhbtt.exe PID 2912 wrote to memory of 2424 2912 ntbtnh.exe 1bhbtt.exe PID 2424 wrote to memory of 3728 2424 1bhbtt.exe jdpjj.exe PID 2424 wrote to memory of 3728 2424 1bhbtt.exe jdpjj.exe PID 2424 wrote to memory of 3728 2424 1bhbtt.exe jdpjj.exe PID 3728 wrote to memory of 4932 3728 jdpjj.exe 1xffrlx.exe PID 3728 wrote to memory of 4932 3728 jdpjj.exe 1xffrlx.exe PID 3728 wrote to memory of 4932 3728 jdpjj.exe 1xffrlx.exe PID 4932 wrote to memory of 1412 4932 1xffrlx.exe hntthh.exe PID 4932 wrote to memory of 1412 4932 1xffrlx.exe hntthh.exe PID 4932 wrote to memory of 1412 4932 1xffrlx.exe hntthh.exe PID 1412 wrote to memory of 1848 1412 hntthh.exe bbhhnh.exe PID 1412 wrote to memory of 1848 1412 hntthh.exe bbhhnh.exe PID 1412 wrote to memory of 1848 1412 hntthh.exe bbhhnh.exe PID 1848 wrote to memory of 5020 1848 bbhhnh.exe jpdjj.exe PID 1848 wrote to memory of 5020 1848 bbhhnh.exe jpdjj.exe PID 1848 wrote to memory of 5020 1848 bbhhnh.exe jpdjj.exe PID 5020 wrote to memory of 376 5020 jpdjj.exe rlfxrrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\962acbabd7b14836ef06bdc44295b88f32794d4f1591b6a2a563052b99a09c64.exe"C:\Users\Admin\AppData\Local\Temp\962acbabd7b14836ef06bdc44295b88f32794d4f1591b6a2a563052b99a09c64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\rlfrlfx.exec:\rlfrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\xllllll.exec:\xllllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\7btnnh.exec:\7btnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\vpjdd.exec:\vpjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\1jjdd.exec:\1jjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\rxxlxxx.exec:\rxxlxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\9frxrxr.exec:\9frxrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\rrrlfff.exec:\rrrlfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\tbnnnn.exec:\tbnnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\bnhbtn.exec:\bnhbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\1vdvp.exec:\1vdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\3ffxrrl.exec:\3ffxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\vppvp.exec:\vppvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\ffffxrr.exec:\ffffxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\ntbtnh.exec:\ntbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\1bhbtt.exec:\1bhbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\jdpjj.exec:\jdpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\1xffrlx.exec:\1xffrlx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\hntthh.exec:\hntthh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\bbhhnh.exec:\bbhhnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\jpdjj.exec:\jpdjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe23⤵
- Executes dropped EXE
PID:376 -
\??\c:\1xxlllf.exec:\1xxlllf.exe24⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1nnhbt.exec:\1nnhbt.exe25⤵
- Executes dropped EXE
PID:3344 -
\??\c:\bnttnn.exec:\bnttnn.exe26⤵
- Executes dropped EXE
PID:4632 -
\??\c:\jjppd.exec:\jjppd.exe27⤵
- Executes dropped EXE
PID:4304 -
\??\c:\dvvpj.exec:\dvvpj.exe28⤵
- Executes dropped EXE
PID:4588 -
\??\c:\rxfrfxl.exec:\rxfrfxl.exe29⤵
- Executes dropped EXE
PID:3288 -
\??\c:\xffxrrl.exec:\xffxrrl.exe30⤵
- Executes dropped EXE
PID:1196 -
\??\c:\nhhbtt.exec:\nhhbtt.exe31⤵
- Executes dropped EXE
PID:5016 -
\??\c:\dppjd.exec:\dppjd.exe32⤵
- Executes dropped EXE
PID:1888 -
\??\c:\xlfxrrf.exec:\xlfxrrf.exe33⤵
- Executes dropped EXE
PID:1660 -
\??\c:\htnnbt.exec:\htnnbt.exe34⤵
- Executes dropped EXE
PID:2452 -
\??\c:\pdvpd.exec:\pdvpd.exe35⤵
- Executes dropped EXE
PID:1872 -
\??\c:\pjjdd.exec:\pjjdd.exe36⤵
- Executes dropped EXE
PID:2224 -
\??\c:\nttnhb.exec:\nttnhb.exe37⤵
- Executes dropped EXE
PID:2928 -
\??\c:\hnhbth.exec:\hnhbth.exe38⤵
- Executes dropped EXE
PID:4372 -
\??\c:\vpjpj.exec:\vpjpj.exe39⤵
- Executes dropped EXE
PID:4908 -
\??\c:\fxrrlxr.exec:\fxrrlxr.exe40⤵
- Executes dropped EXE
PID:3100 -
\??\c:\3flfxxx.exec:\3flfxxx.exe41⤵
- Executes dropped EXE
PID:3408 -
\??\c:\nbbbtn.exec:\nbbbtn.exe42⤵
- Executes dropped EXE
PID:5072 -
\??\c:\nbbthb.exec:\nbbthb.exe43⤵
- Executes dropped EXE
PID:3444 -
\??\c:\vjpjj.exec:\vjpjj.exe44⤵PID:4420
-
\??\c:\vdjjv.exec:\vdjjv.exe45⤵
- Executes dropped EXE
PID:772 -
\??\c:\rllfrrl.exec:\rllfrrl.exe46⤵
- Executes dropped EXE
PID:872 -
\??\c:\nhthbb.exec:\nhthbb.exe47⤵
- Executes dropped EXE
PID:1820 -
\??\c:\jjjvd.exec:\jjjvd.exe48⤵
- Executes dropped EXE
PID:4748 -
\??\c:\jpvpd.exec:\jpvpd.exe49⤵
- Executes dropped EXE
PID:4072 -
\??\c:\rlxxffr.exec:\rlxxffr.exe50⤵
- Executes dropped EXE
PID:364 -
\??\c:\lffxfxx.exec:\lffxfxx.exe51⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nhnhtn.exec:\nhnhtn.exe52⤵
- Executes dropped EXE
PID:5008 -
\??\c:\vjjjd.exec:\vjjjd.exe53⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jjvpj.exec:\jjvpj.exe54⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lflfxff.exec:\lflfxff.exe55⤵
- Executes dropped EXE
PID:3668 -
\??\c:\hhhbtt.exec:\hhhbtt.exe56⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jpppj.exec:\jpppj.exe57⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xrrlfxf.exec:\xrrlfxf.exe58⤵
- Executes dropped EXE
PID:1744 -
\??\c:\9ffxllx.exec:\9ffxllx.exe59⤵
- Executes dropped EXE
PID:4060 -
\??\c:\htnhbh.exec:\htnhbh.exe60⤵
- Executes dropped EXE
PID:2792 -
\??\c:\dddjj.exec:\dddjj.exe61⤵
- Executes dropped EXE
PID:2292 -
\??\c:\5xfrffx.exec:\5xfrffx.exe62⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rrlfxrf.exec:\rrlfxrf.exe63⤵
- Executes dropped EXE
PID:2552 -
\??\c:\btnnbb.exec:\btnnbb.exe64⤵
- Executes dropped EXE
PID:3284 -
\??\c:\7vdjd.exec:\7vdjd.exe65⤵
- Executes dropped EXE
PID:2432 -
\??\c:\pdddv.exec:\pdddv.exe66⤵
- Executes dropped EXE
PID:3124 -
\??\c:\frrlxrl.exec:\frrlxrl.exe67⤵PID:3104
-
\??\c:\htbbbh.exec:\htbbbh.exe68⤵PID:3316
-
\??\c:\7hbthb.exec:\7hbthb.exe69⤵PID:4768
-
\??\c:\jvvpj.exec:\jvvpj.exe70⤵PID:1708
-
\??\c:\vpvvd.exec:\vpvvd.exe71⤵PID:1120
-
\??\c:\llrlxxr.exec:\llrlxxr.exe72⤵PID:2812
-
\??\c:\nbnhbt.exec:\nbnhbt.exe73⤵PID:1944
-
\??\c:\jvjdd.exec:\jvjdd.exe74⤵PID:3656
-
\??\c:\pjvvj.exec:\pjvvj.exe75⤵PID:2868
-
\??\c:\ffrrxff.exec:\ffrrxff.exe76⤵PID:3140
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe77⤵PID:4676
-
\??\c:\hhnnnt.exec:\hhnnnt.exe78⤵PID:3700
-
\??\c:\nthnnh.exec:\nthnnh.exe79⤵PID:4316
-
\??\c:\pvjjp.exec:\pvjjp.exe80⤵PID:1948
-
\??\c:\rxffxxx.exec:\rxffxxx.exe81⤵PID:4988
-
\??\c:\lxfrlrr.exec:\lxfrlrr.exe82⤵PID:860
-
\??\c:\ntnnnn.exec:\ntnnnn.exe83⤵PID:4120
-
\??\c:\ppjdd.exec:\ppjdd.exe84⤵PID:1144
-
\??\c:\jpvvp.exec:\jpvvp.exe85⤵PID:1076
-
\??\c:\5frlrrr.exec:\5frlrrr.exe86⤵PID:924
-
\??\c:\htttnn.exec:\htttnn.exe87⤵PID:2448
-
\??\c:\hntttt.exec:\hntttt.exe88⤵PID:1568
-
\??\c:\vvjjj.exec:\vvjjj.exe89⤵PID:4864
-
\??\c:\jdjpj.exec:\jdjpj.exe90⤵PID:4552
-
\??\c:\9xrrrxx.exec:\9xrrrxx.exe91⤵PID:5028
-
\??\c:\btbbtt.exec:\btbbtt.exe92⤵PID:4436
-
\??\c:\dvppj.exec:\dvppj.exe93⤵PID:4432
-
\??\c:\vdddd.exec:\vdddd.exe94⤵PID:4596
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe95⤵PID:2504
-
\??\c:\9rrlfxx.exec:\9rrlfxx.exe96⤵PID:1124
-
\??\c:\bbhbbb.exec:\bbhbbb.exe97⤵PID:1820
-
\??\c:\djjjj.exec:\djjjj.exe98⤵PID:4400
-
\??\c:\dvddv.exec:\dvddv.exe99⤵PID:3988
-
\??\c:\fxxrxfx.exec:\fxxrxfx.exe100⤵PID:2484
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe101⤵PID:2132
-
\??\c:\5thbbb.exec:\5thbbb.exe102⤵PID:3668
-
\??\c:\3nnnnn.exec:\3nnnnn.exe103⤵PID:2228
-
\??\c:\dvdvp.exec:\dvdvp.exe104⤵PID:1988
-
\??\c:\ppddv.exec:\ppddv.exe105⤵PID:876
-
\??\c:\lflffff.exec:\lflffff.exe106⤵PID:4060
-
\??\c:\tnnnnb.exec:\tnnnnb.exe107⤵PID:3360
-
\??\c:\bbnnhn.exec:\bbnnhn.exe108⤵PID:2768
-
\??\c:\ppppp.exec:\ppppp.exe109⤵PID:1864
-
\??\c:\ddvvj.exec:\ddvvj.exe110⤵PID:4932
-
\??\c:\9rllffx.exec:\9rllffx.exe111⤵PID:1412
-
\??\c:\nbbhhh.exec:\nbbhhh.exe112⤵PID:4832
-
\??\c:\pvvpj.exec:\pvvpj.exe113⤵PID:3680
-
\??\c:\dpvjj.exec:\dpvjj.exe114⤵PID:4092
-
\??\c:\lfllllf.exec:\lfllllf.exe115⤵PID:1244
-
\??\c:\fffxrrr.exec:\fffxrrr.exe116⤵PID:1676
-
\??\c:\nhtbtb.exec:\nhtbtb.exe117⤵PID:540
-
\??\c:\bnnnhh.exec:\bnnnhh.exe118⤵PID:4720
-
\??\c:\3vddd.exec:\3vddd.exe119⤵PID:4992
-
\??\c:\xflrlrr.exec:\xflrlrr.exe120⤵PID:4632
-
\??\c:\3rffxxx.exec:\3rffxxx.exe121⤵PID:3172
-
\??\c:\ttbbtt.exec:\ttbbtt.exe122⤵PID:2668
-
\??\c:\pdddd.exec:\pdddd.exe123⤵PID:3200
-
\??\c:\lrfxrll.exec:\lrfxrll.exe124⤵PID:3036
-
\??\c:\bbtbtb.exec:\bbtbtb.exe125⤵PID:1984
-
\??\c:\htbtnh.exec:\htbtnh.exe126⤵PID:4988
-
\??\c:\pppvp.exec:\pppvp.exe127⤵PID:2900
-
\??\c:\vdvjv.exec:\vdvjv.exe128⤵PID:2128
-
\??\c:\9flllrx.exec:\9flllrx.exe129⤵PID:1144
-
\??\c:\rxxrrrr.exec:\rxxrrrr.exe130⤵PID:4764
-
\??\c:\thnhhn.exec:\thnhhn.exe131⤵PID:2928
-
\??\c:\bttthn.exec:\bttthn.exe132⤵PID:1568
-
\??\c:\vddvj.exec:\vddvj.exe133⤵PID:4636
-
\??\c:\3rlfxxr.exec:\3rlfxxr.exe134⤵PID:4312
-
\??\c:\rfrrlrl.exec:\rfrrlrl.exe135⤵PID:2416
-
\??\c:\nnbbhn.exec:\nnbbhn.exe136⤵PID:4404
-
\??\c:\1tbbtt.exec:\1tbbtt.exe137⤵PID:2308
-
\??\c:\9djpv.exec:\9djpv.exe138⤵PID:664
-
\??\c:\pjpjv.exec:\pjpjv.exe139⤵PID:3708
-
\??\c:\xrrrlll.exec:\xrrrlll.exe140⤵PID:3044
-
\??\c:\hbhnnn.exec:\hbhnnn.exe141⤵PID:3432
-
\??\c:\hnbbhn.exec:\hnbbhn.exe142⤵PID:4940
-
\??\c:\9pvvv.exec:\9pvvv.exe143⤵PID:3520
-
\??\c:\xlrrxxx.exec:\xlrrxxx.exe144⤵PID:2460
-
\??\c:\hnhhtt.exec:\hnhhtt.exe145⤵PID:3428
-
\??\c:\bthnhn.exec:\bthnhn.exe146⤵PID:4928
-
\??\c:\pjvvj.exec:\pjvvj.exe147⤵PID:2196
-
\??\c:\fffffff.exec:\fffffff.exe148⤵PID:2400
-
\??\c:\5hbhnn.exec:\5hbhnn.exe149⤵PID:1304
-
\??\c:\ntbbtt.exec:\ntbbtt.exe150⤵PID:4780
-
\??\c:\vdpvv.exec:\vdpvv.exe151⤵PID:2912
-
\??\c:\nhtnbb.exec:\nhtnbb.exe152⤵PID:2768
-
\??\c:\thnbbb.exec:\thnbbb.exe153⤵PID:4760
-
\??\c:\fllxlfx.exec:\fllxlfx.exe154⤵PID:1848
-
\??\c:\bbhnhh.exec:\bbhnhh.exe155⤵PID:2036
-
\??\c:\pdjdd.exec:\pdjdd.exe156⤵PID:4916
-
\??\c:\7xffxfx.exec:\7xffxfx.exe157⤵PID:3680
-
\??\c:\llffxxx.exec:\llffxxx.exe158⤵PID:4092
-
\??\c:\tnhhnt.exec:\tnhhnt.exe159⤵PID:5004
-
\??\c:\jjppv.exec:\jjppv.exe160⤵PID:1200
-
\??\c:\pdjjj.exec:\pdjjj.exe161⤵PID:2692
-
\??\c:\xrrlfff.exec:\xrrlfff.exe162⤵PID:3272
-
\??\c:\hnbbtb.exec:\hnbbtb.exe163⤵PID:4992
-
\??\c:\thbttt.exec:\thbttt.exe164⤵PID:1424
-
\??\c:\vvjjv.exec:\vvjjv.exe165⤵PID:2868
-
\??\c:\fflfrrx.exec:\fflfrrx.exe166⤵PID:3288
-
\??\c:\xxxxlrr.exec:\xxxxlrr.exe167⤵PID:3968
-
\??\c:\thnttt.exec:\thnttt.exe168⤵PID:2252
-
\??\c:\pddvp.exec:\pddvp.exe169⤵PID:1888
-
\??\c:\1rrrlll.exec:\1rrrlll.exe170⤵PID:1320
-
\??\c:\7lrxlxr.exec:\7lrxlxr.exe171⤵PID:2452
-
\??\c:\1bbhnn.exec:\1bbhnn.exe172⤵PID:3048
-
\??\c:\ttntbb.exec:\ttntbb.exe173⤵PID:3828
-
\??\c:\7dpvv.exec:\7dpvv.exe174⤵PID:1156
-
\??\c:\xxfxxfx.exec:\xxfxxfx.exe175⤵PID:4372
-
\??\c:\xrfffll.exec:\xrfffll.exe176⤵PID:1596
-
\??\c:\bbbbbb.exec:\bbbbbb.exe177⤵PID:4636
-
\??\c:\bhttnn.exec:\bhttnn.exe178⤵PID:4772
-
\??\c:\vjpvp.exec:\vjpvp.exe179⤵PID:912
-
\??\c:\lffxrrl.exec:\lffxrrl.exe180⤵PID:3648
-
\??\c:\llxxllr.exec:\llxxllr.exe181⤵PID:4596
-
\??\c:\5ttttt.exec:\5ttttt.exe182⤵PID:4044
-
\??\c:\thnntt.exec:\thnntt.exe183⤵PID:4748
-
\??\c:\vjvdv.exec:\vjvdv.exe184⤵PID:4036
-
\??\c:\ddvdv.exec:\ddvdv.exe185⤵PID:364
-
\??\c:\ffrffff.exec:\ffrffff.exe186⤵PID:2832
-
\??\c:\llxlrlx.exec:\llxlrlx.exe187⤵PID:2820
-
\??\c:\hbbhhn.exec:\hbbhhn.exe188⤵PID:5060
-
\??\c:\5nbtbh.exec:\5nbtbh.exe189⤵PID:3752
-
\??\c:\dvvvv.exec:\dvvvv.exe190⤵PID:3640
-
\??\c:\jpjjj.exec:\jpjjj.exe191⤵PID:3764
-
\??\c:\1xlllrf.exec:\1xlllrf.exe192⤵PID:1840
-
\??\c:\ttnnnt.exec:\ttnnnt.exe193⤵PID:4856
-
\??\c:\nhnnhn.exec:\nhnnhn.exe194⤵PID:2940
-
\??\c:\pjdpj.exec:\pjdpj.exe195⤵PID:220
-
\??\c:\dpvpp.exec:\dpvpp.exe196⤵PID:4760
-
\??\c:\5rxxlrr.exec:\5rxxlrr.exe197⤵PID:2672
-
\??\c:\hbhnnt.exec:\hbhnnt.exe198⤵PID:2036
-
\??\c:\btbtth.exec:\btbtth.exe199⤵PID:3896
-
\??\c:\vvppj.exec:\vvppj.exe200⤵PID:4600
-
\??\c:\ppvvd.exec:\ppvvd.exe201⤵PID:3636
-
\??\c:\rrxfrrf.exec:\rrxfrrf.exe202⤵PID:4720
-
\??\c:\hbtnhh.exec:\hbtnhh.exe203⤵PID:4920
-
\??\c:\ntnnhh.exec:\ntnnhh.exe204⤵PID:4304
-
\??\c:\5pvjd.exec:\5pvjd.exe205⤵PID:3384
-
\??\c:\dvdpp.exec:\dvdpp.exe206⤵PID:2668
-
\??\c:\llxxflx.exec:\llxxflx.exe207⤵PID:2980
-
\??\c:\btthht.exec:\btthht.exe208⤵PID:944
-
\??\c:\hbtttb.exec:\hbtttb.exe209⤵PID:1880
-
\??\c:\dvjpd.exec:\dvjpd.exe210⤵PID:4204
-
\??\c:\dvvvv.exec:\dvvvv.exe211⤵PID:2212
-
\??\c:\flxxxrr.exec:\flxxxrr.exe212⤵PID:4516
-
\??\c:\llllffx.exec:\llllffx.exe213⤵PID:3692
-
\??\c:\5bnntn.exec:\5bnntn.exe214⤵PID:2224
-
\??\c:\bbnnnn.exec:\bbnnnn.exe215⤵PID:3184
-
\??\c:\pjppp.exec:\pjppp.exe216⤵PID:1156
-
\??\c:\dpdvd.exec:\dpdvd.exe217⤵PID:2916
-
\??\c:\fxffffx.exec:\fxffffx.exe218⤵PID:4312
-
\??\c:\rfxlxff.exec:\rfxlxff.exe219⤵PID:5028
-
\??\c:\htthtb.exec:\htthtb.exe220⤵PID:4424
-
\??\c:\dpvvp.exec:\dpvvp.exe221⤵PID:3368
-
\??\c:\pjppp.exec:\pjppp.exe222⤵PID:4688
-
\??\c:\pjpjj.exec:\pjpjj.exe223⤵PID:2504
-
\??\c:\ffrrlrf.exec:\ffrrlrf.exe224⤵PID:1124
-
\??\c:\ttthbb.exec:\ttthbb.exe225⤵PID:4660
-
\??\c:\nnnnnh.exec:\nnnnnh.exe226⤵PID:4380
-
\??\c:\jdddv.exec:\jdddv.exe227⤵PID:1716
-
\??\c:\jdpjj.exec:\jdpjj.exe228⤵PID:4568
-
\??\c:\jjjdp.exec:\jjjdp.exe229⤵PID:3136
-
\??\c:\ffllxrx.exec:\ffllxrx.exe230⤵PID:2860
-
\??\c:\3htthn.exec:\3htthn.exe231⤵PID:4584
-
\??\c:\bthnnt.exec:\bthnnt.exe232⤵PID:2228
-
\??\c:\vddjj.exec:\vddjj.exe233⤵PID:4300
-
\??\c:\jjpdj.exec:\jjpdj.exe234⤵PID:1988
-
\??\c:\lrxfxfr.exec:\lrxfxfr.exe235⤵PID:2324
-
\??\c:\fxxxfxx.exec:\fxxxfxx.exe236⤵PID:1808
-
\??\c:\hbbbbh.exec:\hbbbbh.exe237⤵PID:2432
-
\??\c:\bhtbtb.exec:\bhtbtb.exe238⤵PID:748
-
\??\c:\3vdvv.exec:\3vdvv.exe239⤵PID:4504
-
\??\c:\pjppj.exec:\pjppj.exe240⤵PID:1412
-
\??\c:\9llffff.exec:\9llffff.exe241⤵PID:4224
-
\??\c:\bbbhhh.exec:\bbbhhh.exe242⤵PID:632