Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 07:58
Behavioral task
behavioral1
Sample
24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exe
-
Size
82KB
-
MD5
25d6411f8b6fc578d193e6ff1a239d80
-
SHA1
a6f92b357a21fabb781ef1cf80d6005fdb4cce8d
-
SHA256
24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb
-
SHA512
1e66c73c41cf59e128da09bceb60f0089c99e00bc93c8a6267443bf60c84a8e796795f4156207589d5f59f0595163f191088b75389229abd374331ad4dcff343
-
SSDEEP
1536:CvQBeOGtrYS3srx93UBWfwC6Ggnouy8AelS7/7VIQH2i:ChOmTsF93UYfwC6GIoutAe07zVIq7
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2912-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3784-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-334-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-362-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-406-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-411-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-415-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-428-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-437-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-453-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-471-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-487-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-498-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-499-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-517-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-548-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-570-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-577-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-584-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-678-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/680-844-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-893-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-981-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-1018-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-1037-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-1389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-1462-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rllxllx.exelflrrrf.exenntnhh.exe1dvpj.exexrfflll.exelxlffxx.exetnhbtn.exedvdpd.exexfffxxr.exehbthbb.exe3nthtn.exepjdpd.exeddvpd.exerlxrrlf.exenhhtnh.exe7djdd.exeflllxxr.exexlxfxfx.exettbbhb.exepjdvp.exelflllff.exenhbbtn.exebtbbbb.exe5jvjd.exelxlfrrl.exefxffffx.exehhhbbt.exenhhbtt.exedddvj.exedvpjj.exexlfrfxl.exebtbtbb.exevdjjj.exejpvvp.exexrlllll.exerrfffff.exe3hhhbt.exevvjjv.exepppjp.exelxxxflx.exehnnnnn.exenththt.exepvppd.exellllfff.exe5xrxrxr.exe5pvvp.exeppvpp.exeffrrxfx.exe1nbtbh.exe9vddv.exe1pvpj.exexlxxxxr.exe7rfffff.exehhhhbh.exeppvdj.exeddjjj.exelfxxlrr.exefllfxfx.exebbhhhn.exethbhnt.exejjpjd.exedvddd.exeffrrllr.exebbbtbb.exepid process 3784 rllxllx.exe 1280 lflrrrf.exe 1388 nntnhh.exe 5104 1dvpj.exe 768 xrfflll.exe 2036 lxlffxx.exe 392 tnhbtn.exe 3944 dvdpd.exe 4480 xfffxxr.exe 1796 hbthbb.exe 1068 3nthtn.exe 1112 pjdpd.exe 3440 ddvpd.exe 3080 rlxrrlf.exe 4784 nhhtnh.exe 4908 7djdd.exe 4064 flllxxr.exe 1804 xlxfxfx.exe 2176 ttbbhb.exe 2104 pjdvp.exe 3248 lflllff.exe 4808 nhbbtn.exe 1920 btbbbb.exe 400 5jvjd.exe 824 lxlfrrl.exe 3336 fxffffx.exe 1972 hhhbbt.exe 2964 nhhbtt.exe 4316 dddvj.exe 3588 dvpjj.exe 4708 xlfrfxl.exe 4484 btbtbb.exe 820 vdjjj.exe 1444 jpvvp.exe 220 xrlllll.exe 2392 rrfffff.exe 440 3hhhbt.exe 4204 vvjjv.exe 4388 pppjp.exe 1320 lxxxflx.exe 3592 hnnnnn.exe 4224 nththt.exe 4508 pvppd.exe 4496 llllfff.exe 2684 5xrxrxr.exe 4636 5pvvp.exe 4196 ppvpp.exe 1612 ffrrxfx.exe 4320 1nbtbh.exe 680 9vddv.exe 3664 1pvpj.exe 2868 xlxxxxr.exe 1172 7rfffff.exe 3036 hhhhbh.exe 452 ppvdj.exe 1700 ddjjj.exe 4108 lfxxlrr.exe 2468 fllfxfx.exe 1000 bbhhhn.exe 4984 thbhnt.exe 5032 jjpjd.exe 2556 dvddd.exe 3396 ffrrllr.exe 2928 bbbtbb.exe -
Processes:
resource yara_rule behavioral2/memory/2912-0-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\rllxllx.exe upx behavioral2/memory/2912-6-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\lflrrrf.exe upx behavioral2/memory/3784-11-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\nntnhh.exe upx behavioral2/memory/1280-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-24-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\1dvpj.exe upx C:\xrfflll.exe upx behavioral2/memory/5104-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-37-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\lxlffxx.exe upx C:\tnhbtn.exe upx behavioral2/memory/392-44-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\dvdpd.exe upx behavioral2/memory/3944-50-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\xfffxxr.exe upx behavioral2/memory/4480-59-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\hbthbb.exe upx behavioral2/memory/1796-62-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\3nthtn.exe upx C:\pjdpd.exe upx behavioral2/memory/1112-73-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\ddvpd.exe upx C:\rlxrrlf.exe upx behavioral2/memory/3440-82-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\nhhtnh.exe upx behavioral2/memory/3080-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-94-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\7djdd.exe upx C:\flllxxr.exe upx C:\xlxfxfx.exe upx behavioral2/memory/4064-104-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\ttbbhb.exe upx behavioral2/memory/1804-111-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\pjdvp.exe upx C:\lflllff.exe upx behavioral2/memory/3248-127-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\nhbbtn.exe upx behavioral2/memory/4808-128-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\btbbbb.exe upx C:\5jvjd.exe upx behavioral2/memory/400-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-146-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\fxffffx.exe upx behavioral2/memory/824-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-154-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\hhhbbt.exe upx behavioral2/memory/3336-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-163-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\nhhbtt.exe upx C:\dddvj.exe upx \??\c:\lxlfrrl.exe upx behavioral2/memory/4316-169-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\dvpjj.exe upx C:\xlfrfxl.exe upx behavioral2/memory/3588-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-182-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\btbtbb.exe upx behavioral2/memory/820-192-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exerllxllx.exelflrrrf.exenntnhh.exe1dvpj.exexrfflll.exelxlffxx.exetnhbtn.exedvdpd.exexfffxxr.exehbthbb.exe3nthtn.exepjdpd.exeddvpd.exerlxrrlf.exenhhtnh.exe7djdd.exeflllxxr.exexlxfxfx.exettbbhb.exepjdvp.exelflllff.exedescription pid process target process PID 2912 wrote to memory of 3784 2912 24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exe rllxllx.exe PID 2912 wrote to memory of 3784 2912 24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exe rllxllx.exe PID 2912 wrote to memory of 3784 2912 24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exe rllxllx.exe PID 3784 wrote to memory of 1280 3784 rllxllx.exe lflrrrf.exe PID 3784 wrote to memory of 1280 3784 rllxllx.exe lflrrrf.exe PID 3784 wrote to memory of 1280 3784 rllxllx.exe lflrrrf.exe PID 1280 wrote to memory of 1388 1280 lflrrrf.exe nntnhh.exe PID 1280 wrote to memory of 1388 1280 lflrrrf.exe nntnhh.exe PID 1280 wrote to memory of 1388 1280 lflrrrf.exe nntnhh.exe PID 1388 wrote to memory of 5104 1388 nntnhh.exe 1dvpj.exe PID 1388 wrote to memory of 5104 1388 nntnhh.exe 1dvpj.exe PID 1388 wrote to memory of 5104 1388 nntnhh.exe 1dvpj.exe PID 5104 wrote to memory of 768 5104 1dvpj.exe xrfflll.exe PID 5104 wrote to memory of 768 5104 1dvpj.exe xrfflll.exe PID 5104 wrote to memory of 768 5104 1dvpj.exe xrfflll.exe PID 768 wrote to memory of 2036 768 xrfflll.exe lxlffxx.exe PID 768 wrote to memory of 2036 768 xrfflll.exe lxlffxx.exe PID 768 wrote to memory of 2036 768 xrfflll.exe lxlffxx.exe PID 2036 wrote to memory of 392 2036 lxlffxx.exe tnhbtn.exe PID 2036 wrote to memory of 392 2036 lxlffxx.exe tnhbtn.exe PID 2036 wrote to memory of 392 2036 lxlffxx.exe tnhbtn.exe PID 392 wrote to memory of 3944 392 tnhbtn.exe dvdpd.exe PID 392 wrote to memory of 3944 392 tnhbtn.exe dvdpd.exe PID 392 wrote to memory of 3944 392 tnhbtn.exe dvdpd.exe PID 3944 wrote to memory of 4480 3944 dvdpd.exe xfffxxr.exe PID 3944 wrote to memory of 4480 3944 dvdpd.exe xfffxxr.exe PID 3944 wrote to memory of 4480 3944 dvdpd.exe xfffxxr.exe PID 4480 wrote to memory of 1796 4480 xfffxxr.exe hbthbb.exe PID 4480 wrote to memory of 1796 4480 xfffxxr.exe hbthbb.exe PID 4480 wrote to memory of 1796 4480 xfffxxr.exe hbthbb.exe PID 1796 wrote to memory of 1068 1796 hbthbb.exe 3nthtn.exe PID 1796 wrote to memory of 1068 1796 hbthbb.exe 3nthtn.exe PID 1796 wrote to memory of 1068 1796 hbthbb.exe 3nthtn.exe PID 1068 wrote to memory of 1112 1068 3nthtn.exe pjdpd.exe PID 1068 wrote to memory of 1112 1068 3nthtn.exe pjdpd.exe PID 1068 wrote to memory of 1112 1068 3nthtn.exe pjdpd.exe PID 1112 wrote to memory of 3440 1112 pjdpd.exe ddvpd.exe PID 1112 wrote to memory of 3440 1112 pjdpd.exe ddvpd.exe PID 1112 wrote to memory of 3440 1112 pjdpd.exe ddvpd.exe PID 3440 wrote to memory of 3080 3440 ddvpd.exe rlxrrlf.exe PID 3440 wrote to memory of 3080 3440 ddvpd.exe rlxrrlf.exe PID 3440 wrote to memory of 3080 3440 ddvpd.exe rlxrrlf.exe PID 3080 wrote to memory of 4784 3080 rlxrrlf.exe nhhtnh.exe PID 3080 wrote to memory of 4784 3080 rlxrrlf.exe nhhtnh.exe PID 3080 wrote to memory of 4784 3080 rlxrrlf.exe nhhtnh.exe PID 4784 wrote to memory of 4908 4784 nhhtnh.exe 7djdd.exe PID 4784 wrote to memory of 4908 4784 nhhtnh.exe 7djdd.exe PID 4784 wrote to memory of 4908 4784 nhhtnh.exe 7djdd.exe PID 4908 wrote to memory of 4064 4908 7djdd.exe flllxxr.exe PID 4908 wrote to memory of 4064 4908 7djdd.exe flllxxr.exe PID 4908 wrote to memory of 4064 4908 7djdd.exe flllxxr.exe PID 4064 wrote to memory of 1804 4064 flllxxr.exe xlxfxfx.exe PID 4064 wrote to memory of 1804 4064 flllxxr.exe xlxfxfx.exe PID 4064 wrote to memory of 1804 4064 flllxxr.exe xlxfxfx.exe PID 1804 wrote to memory of 2176 1804 xlxfxfx.exe ttbbhb.exe PID 1804 wrote to memory of 2176 1804 xlxfxfx.exe ttbbhb.exe PID 1804 wrote to memory of 2176 1804 xlxfxfx.exe ttbbhb.exe PID 2176 wrote to memory of 2104 2176 ttbbhb.exe pjdvp.exe PID 2176 wrote to memory of 2104 2176 ttbbhb.exe pjdvp.exe PID 2176 wrote to memory of 2104 2176 ttbbhb.exe pjdvp.exe PID 2104 wrote to memory of 3248 2104 pjdvp.exe lflllff.exe PID 2104 wrote to memory of 3248 2104 pjdvp.exe lflllff.exe PID 2104 wrote to memory of 3248 2104 pjdvp.exe lflllff.exe PID 3248 wrote to memory of 4808 3248 lflllff.exe nhbbtn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exe"C:\Users\Admin\AppData\Local\Temp\24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\rllxllx.exec:\rllxllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\lflrrrf.exec:\lflrrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\nntnhh.exec:\nntnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\1dvpj.exec:\1dvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\xrfflll.exec:\xrfflll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\lxlffxx.exec:\lxlffxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\tnhbtn.exec:\tnhbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\dvdpd.exec:\dvdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\xfffxxr.exec:\xfffxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\hbthbb.exec:\hbthbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\3nthtn.exec:\3nthtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\pjdpd.exec:\pjdpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\ddvpd.exec:\ddvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\rlxrrlf.exec:\rlxrrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\nhhtnh.exec:\nhhtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\7djdd.exec:\7djdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\flllxxr.exec:\flllxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\xlxfxfx.exec:\xlxfxfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\ttbbhb.exec:\ttbbhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\pjdvp.exec:\pjdvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\lflllff.exec:\lflllff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\nhbbtn.exec:\nhbbtn.exe23⤵
- Executes dropped EXE
PID:4808 -
\??\c:\btbbbb.exec:\btbbbb.exe24⤵
- Executes dropped EXE
PID:1920 -
\??\c:\5jvjd.exec:\5jvjd.exe25⤵
- Executes dropped EXE
PID:400 -
\??\c:\lxlfrrl.exec:\lxlfrrl.exe26⤵
- Executes dropped EXE
PID:824 -
\??\c:\fxffffx.exec:\fxffffx.exe27⤵
- Executes dropped EXE
PID:3336 -
\??\c:\hhhbbt.exec:\hhhbbt.exe28⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nhhbtt.exec:\nhhbtt.exe29⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dddvj.exec:\dddvj.exe30⤵
- Executes dropped EXE
PID:4316 -
\??\c:\dvpjj.exec:\dvpjj.exe31⤵
- Executes dropped EXE
PID:3588 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe32⤵
- Executes dropped EXE
PID:4708 -
\??\c:\btbtbb.exec:\btbtbb.exe33⤵
- Executes dropped EXE
PID:4484 -
\??\c:\vdjjj.exec:\vdjjj.exe34⤵
- Executes dropped EXE
PID:820 -
\??\c:\jpvvp.exec:\jpvvp.exe35⤵
- Executes dropped EXE
PID:1444 -
\??\c:\xrlllll.exec:\xrlllll.exe36⤵
- Executes dropped EXE
PID:220 -
\??\c:\rrfffff.exec:\rrfffff.exe37⤵
- Executes dropped EXE
PID:2392 -
\??\c:\3hhhbt.exec:\3hhhbt.exe38⤵
- Executes dropped EXE
PID:440 -
\??\c:\vvjjv.exec:\vvjjv.exe39⤵
- Executes dropped EXE
PID:4204 -
\??\c:\pppjp.exec:\pppjp.exe40⤵
- Executes dropped EXE
PID:4388 -
\??\c:\lxxxflx.exec:\lxxxflx.exe41⤵
- Executes dropped EXE
PID:1320 -
\??\c:\hnnnnn.exec:\hnnnnn.exe42⤵
- Executes dropped EXE
PID:3592 -
\??\c:\nththt.exec:\nththt.exe43⤵
- Executes dropped EXE
PID:4224 -
\??\c:\pvppd.exec:\pvppd.exe44⤵
- Executes dropped EXE
PID:4508 -
\??\c:\llllfff.exec:\llllfff.exe45⤵
- Executes dropped EXE
PID:4496 -
\??\c:\5xrxrxr.exec:\5xrxrxr.exe46⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5pvvp.exec:\5pvvp.exe47⤵
- Executes dropped EXE
PID:4636 -
\??\c:\ppvpp.exec:\ppvpp.exe48⤵
- Executes dropped EXE
PID:4196 -
\??\c:\ffrrxfx.exec:\ffrrxfx.exe49⤵
- Executes dropped EXE
PID:1612 -
\??\c:\1nbtbh.exec:\1nbtbh.exe50⤵
- Executes dropped EXE
PID:4320 -
\??\c:\9vddv.exec:\9vddv.exe51⤵
- Executes dropped EXE
PID:680 -
\??\c:\1pvpj.exec:\1pvpj.exe52⤵
- Executes dropped EXE
PID:3664 -
\??\c:\xlxxxxr.exec:\xlxxxxr.exe53⤵
- Executes dropped EXE
PID:2868 -
\??\c:\7rfffff.exec:\7rfffff.exe54⤵
- Executes dropped EXE
PID:1172 -
\??\c:\hhhhbh.exec:\hhhhbh.exe55⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ppvdj.exec:\ppvdj.exe56⤵
- Executes dropped EXE
PID:452 -
\??\c:\ddjjj.exec:\ddjjj.exe57⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lfxxlrr.exec:\lfxxlrr.exe58⤵
- Executes dropped EXE
PID:4108 -
\??\c:\fllfxfx.exec:\fllfxfx.exe59⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bbhhhn.exec:\bbhhhn.exe60⤵
- Executes dropped EXE
PID:1000 -
\??\c:\thbhnt.exec:\thbhnt.exe61⤵
- Executes dropped EXE
PID:4984 -
\??\c:\jjpjd.exec:\jjpjd.exe62⤵
- Executes dropped EXE
PID:5032 -
\??\c:\dvddd.exec:\dvddd.exe63⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ffrrllr.exec:\ffrrllr.exe64⤵
- Executes dropped EXE
PID:3396 -
\??\c:\bbbtbb.exec:\bbbtbb.exe65⤵
- Executes dropped EXE
PID:2928 -
\??\c:\nnttnt.exec:\nnttnt.exe66⤵PID:1804
-
\??\c:\1ddvv.exec:\1ddvv.exe67⤵PID:2760
-
\??\c:\vvdjj.exec:\vvdjj.exe68⤵PID:2104
-
\??\c:\rxlrxlr.exec:\rxlrxlr.exe69⤵PID:1932
-
\??\c:\tthhtt.exec:\tthhtt.exe70⤵PID:4076
-
\??\c:\nnttbh.exec:\nnttbh.exe71⤵PID:1276
-
\??\c:\djjdv.exec:\djjdv.exe72⤵PID:4216
-
\??\c:\rfrfrxr.exec:\rfrfrxr.exe73⤵PID:4440
-
\??\c:\fxflllr.exec:\fxflllr.exe74⤵PID:2996
-
\??\c:\thnhhh.exec:\thnhhh.exe75⤵PID:4972
-
\??\c:\nbhnhh.exec:\nbhnhh.exe76⤵PID:592
-
\??\c:\3vjdd.exec:\3vjdd.exe77⤵PID:4048
-
\??\c:\7pddp.exec:\7pddp.exe78⤵PID:4072
-
\??\c:\nntnnn.exec:\nntnnn.exe79⤵PID:4024
-
\??\c:\bnbbth.exec:\bnbbth.exe80⤵PID:3720
-
\??\c:\jvjjd.exec:\jvjjd.exe81⤵PID:3644
-
\??\c:\lrflfff.exec:\lrflfff.exe82⤵PID:4472
-
\??\c:\ffrrrxx.exec:\ffrrrxx.exe83⤵PID:1264
-
\??\c:\htbnnn.exec:\htbnnn.exe84⤵PID:4160
-
\??\c:\7nbhbb.exec:\7nbhbb.exe85⤵PID:4484
-
\??\c:\vvdvd.exec:\vvdvd.exe86⤵PID:3364
-
\??\c:\ddpjj.exec:\ddpjj.exe87⤵PID:5048
-
\??\c:\thhbbt.exec:\thhbbt.exe88⤵PID:2112
-
\??\c:\nnbbbh.exec:\nnbbbh.exe89⤵PID:4100
-
\??\c:\pddvp.exec:\pddvp.exe90⤵PID:4524
-
\??\c:\lxfffff.exec:\lxfffff.exe91⤵PID:3608
-
\??\c:\xxxxxxf.exec:\xxxxxxf.exe92⤵PID:3912
-
\??\c:\nnhhhb.exec:\nnhhhb.exe93⤵PID:888
-
\??\c:\jpvdd.exec:\jpvdd.exe94⤵PID:2728
-
\??\c:\rxrrrlr.exec:\rxrrrlr.exe95⤵PID:2352
-
\??\c:\5bbttt.exec:\5bbttt.exe96⤵PID:1596
-
\??\c:\hnhhnn.exec:\hnhhnn.exe97⤵PID:1136
-
\??\c:\jpjjd.exec:\jpjjd.exe98⤵PID:2992
-
\??\c:\lxllxff.exec:\lxllxff.exe99⤵PID:3916
-
\??\c:\fffffll.exec:\fffffll.exe100⤵PID:2036
-
\??\c:\bhnbbb.exec:\bhnbbb.exe101⤵PID:5116
-
\??\c:\1hbbbb.exec:\1hbbbb.exe102⤵PID:2988
-
\??\c:\ppvdp.exec:\ppvdp.exe103⤵PID:3904
-
\??\c:\ddvvv.exec:\ddvvv.exe104⤵PID:4436
-
\??\c:\rlxxrxx.exec:\rlxxrxx.exe105⤵PID:1384
-
\??\c:\fllllll.exec:\fllllll.exe106⤵PID:1728
-
\??\c:\ttbbbh.exec:\ttbbbh.exe107⤵PID:2196
-
\??\c:\1vppp.exec:\1vppp.exe108⤵PID:1700
-
\??\c:\pjjvp.exec:\pjjvp.exe109⤵PID:2692
-
\??\c:\lxlffff.exec:\lxlffff.exe110⤵PID:4656
-
\??\c:\xlrflxx.exec:\xlrflxx.exe111⤵PID:1000
-
\??\c:\tbhntn.exec:\tbhntn.exe112⤵PID:4880
-
\??\c:\7hhbtt.exec:\7hhbtt.exe113⤵PID:2660
-
\??\c:\3jppj.exec:\3jppj.exe114⤵PID:2556
-
\??\c:\rlxlffx.exec:\rlxlffx.exe115⤵PID:3744
-
\??\c:\flxflrr.exec:\flxflrr.exe116⤵PID:2176
-
\??\c:\3ttttb.exec:\3ttttb.exe117⤵PID:1804
-
\??\c:\bbbbtb.exec:\bbbbtb.exe118⤵PID:536
-
\??\c:\5pvjd.exec:\5pvjd.exe119⤵PID:2104
-
\??\c:\rrffflx.exec:\rrffflx.exe120⤵PID:4968
-
\??\c:\llrllrx.exec:\llrllrx.exe121⤵PID:4856
-
\??\c:\bbhnnb.exec:\bbhnnb.exe122⤵PID:868
-
\??\c:\jjppj.exec:\jjppj.exe123⤵PID:1836
-
\??\c:\vvdvv.exec:\vvdvv.exe124⤵PID:4940
-
\??\c:\rfxrrrl.exec:\rfxrrrl.exe125⤵PID:3336
-
\??\c:\tnbntt.exec:\tnbntt.exe126⤵PID:3124
-
\??\c:\hbnthh.exec:\hbnthh.exe127⤵PID:756
-
\??\c:\7vvdd.exec:\7vvdd.exe128⤵PID:4072
-
\??\c:\rfxrxxf.exec:\rfxrxxf.exe129⤵PID:3700
-
\??\c:\rlrxxxx.exec:\rlrxxxx.exe130⤵PID:3588
-
\??\c:\vpjpp.exec:\vpjpp.exe131⤵PID:4992
-
\??\c:\ppjdj.exec:\ppjdj.exe132⤵PID:1364
-
\??\c:\7lrrrxx.exec:\7lrrrxx.exe133⤵PID:4712
-
\??\c:\hhnnhn.exec:\hhnnhn.exe134⤵PID:1444
-
\??\c:\5nthbh.exec:\5nthbh.exe135⤵PID:5048
-
\??\c:\pdpdd.exec:\pdpdd.exe136⤵PID:4204
-
\??\c:\1jjjp.exec:\1jjjp.exe137⤵PID:5056
-
\??\c:\7fxrlrl.exec:\7fxrlrl.exe138⤵PID:1028
-
\??\c:\xrrffxx.exec:\xrrffxx.exe139⤵PID:4168
-
\??\c:\1tbtnn.exec:\1tbtnn.exe140⤵PID:3008
-
\??\c:\nhtnnt.exec:\nhtnnt.exe141⤵PID:2824
-
\??\c:\btnbbb.exec:\btnbbb.exe142⤵PID:4312
-
\??\c:\5jvvp.exec:\5jvvp.exe143⤵PID:4220
-
\??\c:\rlxxrrx.exec:\rlxxrrx.exe144⤵PID:3448
-
\??\c:\lfxfffl.exec:\lfxfffl.exe145⤵PID:2200
-
\??\c:\1fxrlrx.exec:\1fxrlrx.exe146⤵PID:3940
-
\??\c:\1hhnnt.exec:\1hhnnt.exe147⤵PID:2532
-
\??\c:\dvvvv.exec:\dvvvv.exe148⤵PID:3612
-
\??\c:\rrrrfll.exec:\rrrrfll.exe149⤵PID:5068
-
\??\c:\xlffxff.exec:\xlffxff.exe150⤵PID:1068
-
\??\c:\tnttnt.exec:\tnttnt.exe151⤵PID:1176
-
\??\c:\ddpjp.exec:\ddpjp.exe152⤵PID:4124
-
\??\c:\xxllrrl.exec:\xxllrrl.exe153⤵PID:1648
-
\??\c:\1hnnnt.exec:\1hnnnt.exe154⤵PID:3444
-
\??\c:\vdjpj.exec:\vdjpj.exe155⤵PID:3080
-
\??\c:\1vjpj.exec:\1vjpj.exe156⤵PID:4796
-
\??\c:\ppdvj.exec:\ppdvj.exe157⤵PID:4640
-
\??\c:\3xllrrr.exec:\3xllrrr.exe158⤵PID:2796
-
\??\c:\nbbthb.exec:\nbbthb.exe159⤵PID:2528
-
\??\c:\jjddd.exec:\jjddd.exe160⤵PID:2120
-
\??\c:\hnbbtt.exec:\hnbbtt.exe161⤵PID:4136
-
\??\c:\dvvvv.exec:\dvvvv.exe162⤵PID:684
-
\??\c:\9xxrxxx.exec:\9xxrxxx.exe163⤵PID:2596
-
\??\c:\bbtnhn.exec:\bbtnhn.exe164⤵PID:536
-
\??\c:\jjvvd.exec:\jjvvd.exe165⤵PID:2104
-
\??\c:\fffxrrx.exec:\fffxrrx.exe166⤵PID:4452
-
\??\c:\1xfflrx.exec:\1xfflrx.exe167⤵PID:4856
-
\??\c:\7djjj.exec:\7djjj.exe168⤵PID:3656
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe169⤵PID:1836
-
\??\c:\xfrrxxf.exec:\xfrrxxf.exe170⤵PID:5016
-
\??\c:\nbnhhh.exec:\nbnhhh.exe171⤵PID:2740
-
\??\c:\9jvvd.exec:\9jvvd.exe172⤵PID:4408
-
\??\c:\1dppj.exec:\1dppj.exe173⤵PID:4892
-
\??\c:\9lrlflr.exec:\9lrlflr.exe174⤵PID:2872
-
\??\c:\xflrrrr.exec:\xflrrrr.exe175⤵PID:3644
-
\??\c:\hhtttb.exec:\hhtttb.exe176⤵PID:1408
-
\??\c:\dpjpj.exec:\dpjpj.exe177⤵PID:3424
-
\??\c:\pvvvp.exec:\pvvvp.exe178⤵PID:116
-
\??\c:\lllllrr.exec:\lllllrr.exe179⤵PID:3620
-
\??\c:\nhnttb.exec:\nhnttb.exe180⤵PID:2440
-
\??\c:\pjvpp.exec:\pjvpp.exe181⤵PID:4392
-
\??\c:\9pvvv.exec:\9pvvv.exe182⤵PID:3572
-
\??\c:\xxrxrxf.exec:\xxrxrxf.exe183⤵PID:5056
-
\??\c:\tnbntn.exec:\tnbntn.exe184⤵PID:1028
-
\??\c:\lfrrffx.exec:\lfrrffx.exe185⤵PID:4996
-
\??\c:\vvpdv.exec:\vvpdv.exe186⤵PID:1560
-
\??\c:\pjpjd.exec:\pjpjd.exe187⤵PID:5100
-
\??\c:\llffxff.exec:\llffxff.exe188⤵PID:1136
-
\??\c:\9htttt.exec:\9htttt.exe189⤵PID:2992
-
\??\c:\3nnnhn.exec:\3nnnhn.exe190⤵PID:3916
-
\??\c:\pvvpd.exec:\pvvpd.exe191⤵PID:512
-
\??\c:\3ffxfrf.exec:\3ffxfrf.exe192⤵PID:1236
-
\??\c:\3frxrxf.exec:\3frxrxf.exe193⤵PID:2816
-
\??\c:\tnbbbb.exec:\tnbbbb.exe194⤵PID:3904
-
\??\c:\3jdvp.exec:\3jdvp.exe195⤵PID:1600
-
\??\c:\pvvvj.exec:\pvvvj.exe196⤵PID:3820
-
\??\c:\frrlffx.exec:\frrlffx.exe197⤵PID:1112
-
\??\c:\5rrxxxf.exec:\5rrxxxf.exe198⤵PID:4108
-
\??\c:\hhhhtb.exec:\hhhhtb.exe199⤵PID:2888
-
\??\c:\bbnnbb.exec:\bbnnbb.exe200⤵PID:1864
-
\??\c:\vdddd.exec:\vdddd.exe201⤵PID:4932
-
\??\c:\5ppdp.exec:\5ppdp.exe202⤵PID:4580
-
\??\c:\1lrllll.exec:\1lrllll.exe203⤵PID:2368
-
\??\c:\3ffrrrx.exec:\3ffrrrx.exe204⤵PID:4064
-
\??\c:\9bntbh.exec:\9bntbh.exe205⤵PID:4944
-
\??\c:\nhtbtt.exec:\nhtbtt.exe206⤵PID:3356
-
\??\c:\dddjj.exec:\dddjj.exe207⤵PID:2760
-
\??\c:\pdjjp.exec:\pdjjp.exe208⤵PID:2704
-
\??\c:\xfflflf.exec:\xfflflf.exe209⤵PID:540
-
\??\c:\xrrflfl.exec:\xrrflfl.exe210⤵PID:1284
-
\??\c:\5nnhhb.exec:\5nnhhb.exe211⤵PID:4076
-
\??\c:\7bbbnh.exec:\7bbbnh.exe212⤵PID:4968
-
\??\c:\5pjjd.exec:\5pjjd.exe213⤵PID:4216
-
\??\c:\xrffrll.exec:\xrffrll.exe214⤵PID:4440
-
\??\c:\1llfffx.exec:\1llfffx.exe215⤵PID:2172
-
\??\c:\tnhtth.exec:\tnhtth.exe216⤵PID:4676
-
\??\c:\nbhhbb.exec:\nbhhbb.exe217⤵PID:3764
-
\??\c:\jvpjp.exec:\jvpjp.exe218⤵PID:3160
-
\??\c:\fxlfrlr.exec:\fxlfrlr.exe219⤵PID:516
-
\??\c:\lfxrlff.exec:\lfxrlff.exe220⤵PID:3720
-
\??\c:\hnnhbb.exec:\hnnhbb.exe221⤵PID:3588
-
\??\c:\3nhbnn.exec:\3nhbnn.exe222⤵PID:5044
-
\??\c:\vvdvv.exec:\vvdvv.exe223⤵PID:3016
-
\??\c:\flrlrll.exec:\flrlrll.exe224⤵PID:3104
-
\??\c:\flrrrll.exec:\flrrrll.exe225⤵PID:1524
-
\??\c:\bttbbb.exec:\bttbbb.exe226⤵PID:4296
-
\??\c:\9nbthh.exec:\9nbthh.exe227⤵PID:920
-
\??\c:\pvjdv.exec:\pvjdv.exe228⤵PID:972
-
\??\c:\vpvpv.exec:\vpvpv.exe229⤵PID:1168
-
\??\c:\rrrlxxx.exec:\rrrlxxx.exe230⤵PID:1280
-
\??\c:\9bnttt.exec:\9bnttt.exe231⤵PID:1812
-
\??\c:\dddvv.exec:\dddvv.exe232⤵PID:4976
-
\??\c:\vdppj.exec:\vdppj.exe233⤵PID:4564
-
\??\c:\jdpdj.exec:\jdpdj.exe234⤵PID:752
-
\??\c:\rflllll.exec:\rflllll.exe235⤵PID:4312
-
\??\c:\bbhhhh.exec:\bbhhhh.exe236⤵PID:4220
-
\??\c:\7jpvp.exec:\7jpvp.exe237⤵PID:3012
-
\??\c:\pjpjv.exec:\pjpjv.exe238⤵PID:680
-
\??\c:\7rxxrxx.exec:\7rxxrxx.exe239⤵PID:3940
-
\??\c:\3xlfxrl.exec:\3xlfxrl.exe240⤵PID:2532
-
\??\c:\thhbtn.exec:\thhbtn.exe241⤵PID:3340
-