Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 04:46
Behavioral task
behavioral1
Sample
aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe
-
Size
199KB
-
MD5
0570e42fa1f7b3c2a975a6f655d36540
-
SHA1
d59eea9971b2da630695ff7101b3645d9415fb21
-
SHA256
aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067
-
SHA512
034ff9d562021c738e1e0aaa4d95afdba36ee8421854e2185a9339b6ae086292f1a2d6843029237b7c81199b0f5603748785eca466249d755706067aa83bbe03
-
SSDEEP
3072:ZhOmTsF93UYfwC6GIoutFza6BhOmTsUm82xpi8rY9AABa1JePQKN1hJClv:Zcm4FmowdHoSha6Bcm4JddW7Y6XJCl
Malware Config
Signatures
-
Detect Blackmoon payload 59 IoCs
Processes:
resource yara_rule behavioral2/memory/5340-5-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3280-13-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2688-21-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/664-19-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2688-26-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2760-34-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/992-40-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3320-47-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2368-54-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3156-62-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/5748-69-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/5748-63-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4664-77-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3312-76-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4664-83-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/5184-91-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/5620-97-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1604-98-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1604-104-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/376-124-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/628-138-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2340-145-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4952-133-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4320-156-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/6016-158-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/944-182-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/6116-189-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4020-195-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2756-209-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1900-204-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4136-175-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4136-174-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3456-218-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1632-224-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3288-228-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/5496-168-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3740-117-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2512-112-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2668-233-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3588-236-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/5464-245-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/5632-242-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2860-249-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/5056-253-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4128-254-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4128-258-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/5600-262-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1784-263-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2216-268-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1784-267-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/808-278-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2216-275-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2364-282-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/960-292-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/884-287-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3892-297-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1896-302-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1016-307-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1240-312-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1pjvv.exelxxxfxl.exenthbnn.exe5nnbbt.exexlrllfl.exe9frfrlx.exebnthth.exepvpvp.exe5rlxrlr.exebtnbnh.exedjvpd.exelrrlfxl.exetbhhhh.exepppjv.exe3pdpj.exehtthhb.exennnhtt.exejpjdp.exetnhbth.exebnttnn.exedpdpd.exelxrxlxr.exetbhbnn.exevpdpj.exexfrlrlx.exe9lllrrx.exentthbb.exe3dddp.exerlrxfrf.exehbtnnh.exepvdpj.exedjpjv.exe1flxrll.exebhnhtn.exepjpjd.exe9xxrfxr.exelflfxfx.exennthhh.exelxfxrlf.exetttnbt.exedjdvj.exevpjdp.exexlrfxxl.exelffrlxx.exe7hbthb.exedjdvp.exexlrlxrl.exenhthtt.exevjpjv.exexxlrrrl.exelrlrlll.exenbbnhb.exejdpjp.exe3jjdp.exefrlxlxf.exe5tnhnn.exehbnhbt.exedjpjd.exelfrrxrx.exexlxrfxl.exentnhtt.exenbtnbn.exe9vjjd.exelfrffrf.exepid process 3280 1pjvv.exe 664 lxxxfxl.exe 2688 nthbnn.exe 2760 5nnbbt.exe 992 xlrllfl.exe 3320 9frfrlx.exe 2368 bnthth.exe 3156 pvpvp.exe 5748 5rlxrlr.exe 3312 btnbnh.exe 4664 djvpd.exe 5184 lrrlfxl.exe 5620 tbhhhh.exe 1604 pppjv.exe 2512 3pdpj.exe 3740 htthhb.exe 376 nnnhtt.exe 4952 jpjdp.exe 628 tnhbth.exe 2340 bnttnn.exe 4320 dpdpd.exe 6016 lxrxlxr.exe 5496 tbhbnn.exe 4136 vpdpj.exe 944 xfrlrlx.exe 6116 9lllrrx.exe 4020 ntthbb.exe 1900 3dddp.exe 2756 rlrxfrf.exe 3456 hbtnnh.exe 1632 pvdpj.exe 3288 djpjv.exe 2668 1flxrll.exe 3588 bhnhtn.exe 5632 pjpjd.exe 5464 9xxrfxr.exe 2860 lflfxfx.exe 5056 nnthhh.exe 4128 lxfxrlf.exe 5600 tttnbt.exe 1784 djdvj.exe 2216 vpjdp.exe 808 xlrfxxl.exe 2364 lffrlxx.exe 884 7hbthb.exe 960 djdvp.exe 3892 xlrlxrl.exe 1896 nhthtt.exe 1016 vjpjv.exe 1240 xxlrrrl.exe 3112 lrlrlll.exe 4660 nbbnhb.exe 2080 jdpjp.exe 2528 3jjdp.exe 5656 frlxlxf.exe 3716 5tnhnn.exe 2460 hbnhbt.exe 1824 djpjd.exe 2876 lfrrxrx.exe 4528 xlxrfxl.exe 3280 ntnhtt.exe 2628 nbtnbn.exe 3784 9vjjd.exe 4736 lfrffrf.exe -
Processes:
resource yara_rule behavioral2/memory/5340-0-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/5340-5-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\1pjvv.exe upx behavioral2/memory/3280-13-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\lxxxfxl.exe upx behavioral2/memory/664-14-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3280-8-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2688-21-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\nthbnn.exe upx behavioral2/memory/664-19-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\5nnbbt.exe upx behavioral2/memory/2760-28-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2688-26-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\xlrllfl.exe upx behavioral2/memory/2760-34-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/992-35-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\9frfrlx.exe upx behavioral2/memory/992-40-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3320-42-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\bnthth.exe upx behavioral2/memory/3320-47-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2368-49-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\pvpvp.exe upx behavioral2/memory/3156-56-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2368-54-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\5rlxrlr.exe upx behavioral2/memory/3156-62-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\btnbnh.exe upx behavioral2/memory/5748-69-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3312-70-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/5748-63-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\djvpd.exe upx behavioral2/memory/4664-77-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3312-76-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/5184-84-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4664-83-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\lrrlfxl.exe upx C:\tbhhhh.exe upx behavioral2/memory/5184-91-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\pppjv.exe upx behavioral2/memory/5620-97-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/1604-98-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\3pdpj.exe upx behavioral2/memory/2512-105-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/1604-104-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\htthhb.exe upx \??\c:\nnnhtt.exe upx \??\c:\jpjdp.exe upx behavioral2/memory/376-124-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\bnttnn.exe upx behavioral2/memory/628-138-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2340-140-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\dpdpd.exe upx behavioral2/memory/2340-145-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4320-146-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4952-133-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/628-131-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\lxrxlxr.exe upx \??\c:\tnhbth.exe upx behavioral2/memory/6016-152-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4320-156-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/6016-158-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\tbhbnn.exe upx C:\vpdpj.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe1pjvv.exelxxxfxl.exenthbnn.exe5nnbbt.exexlrllfl.exe9frfrlx.exebnthth.exepvpvp.exe5rlxrlr.exebtnbnh.exedjvpd.exelrrlfxl.exetbhhhh.exepppjv.exe3pdpj.exehtthhb.exennnhtt.exejpjdp.exetnhbth.exebnttnn.exedpdpd.exedescription pid process target process PID 5340 wrote to memory of 3280 5340 aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe 1pjvv.exe PID 5340 wrote to memory of 3280 5340 aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe 1pjvv.exe PID 5340 wrote to memory of 3280 5340 aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe 1pjvv.exe PID 3280 wrote to memory of 664 3280 1pjvv.exe lxxxfxl.exe PID 3280 wrote to memory of 664 3280 1pjvv.exe lxxxfxl.exe PID 3280 wrote to memory of 664 3280 1pjvv.exe lxxxfxl.exe PID 664 wrote to memory of 2688 664 lxxxfxl.exe nthbnn.exe PID 664 wrote to memory of 2688 664 lxxxfxl.exe nthbnn.exe PID 664 wrote to memory of 2688 664 lxxxfxl.exe nthbnn.exe PID 2688 wrote to memory of 2760 2688 nthbnn.exe 5nnbbt.exe PID 2688 wrote to memory of 2760 2688 nthbnn.exe 5nnbbt.exe PID 2688 wrote to memory of 2760 2688 nthbnn.exe 5nnbbt.exe PID 2760 wrote to memory of 992 2760 5nnbbt.exe xlrllfl.exe PID 2760 wrote to memory of 992 2760 5nnbbt.exe xlrllfl.exe PID 2760 wrote to memory of 992 2760 5nnbbt.exe xlrllfl.exe PID 992 wrote to memory of 3320 992 xlrllfl.exe 9frfrlx.exe PID 992 wrote to memory of 3320 992 xlrllfl.exe 9frfrlx.exe PID 992 wrote to memory of 3320 992 xlrllfl.exe 9frfrlx.exe PID 3320 wrote to memory of 2368 3320 9frfrlx.exe bnthth.exe PID 3320 wrote to memory of 2368 3320 9frfrlx.exe bnthth.exe PID 3320 wrote to memory of 2368 3320 9frfrlx.exe bnthth.exe PID 2368 wrote to memory of 3156 2368 bnthth.exe pvpvp.exe PID 2368 wrote to memory of 3156 2368 bnthth.exe pvpvp.exe PID 2368 wrote to memory of 3156 2368 bnthth.exe pvpvp.exe PID 3156 wrote to memory of 5748 3156 pvpvp.exe 5rlxrlr.exe PID 3156 wrote to memory of 5748 3156 pvpvp.exe 5rlxrlr.exe PID 3156 wrote to memory of 5748 3156 pvpvp.exe 5rlxrlr.exe PID 5748 wrote to memory of 3312 5748 5rlxrlr.exe btnbnh.exe PID 5748 wrote to memory of 3312 5748 5rlxrlr.exe btnbnh.exe PID 5748 wrote to memory of 3312 5748 5rlxrlr.exe btnbnh.exe PID 3312 wrote to memory of 4664 3312 btnbnh.exe djvpd.exe PID 3312 wrote to memory of 4664 3312 btnbnh.exe djvpd.exe PID 3312 wrote to memory of 4664 3312 btnbnh.exe djvpd.exe PID 4664 wrote to memory of 5184 4664 djvpd.exe lrrlfxl.exe PID 4664 wrote to memory of 5184 4664 djvpd.exe lrrlfxl.exe PID 4664 wrote to memory of 5184 4664 djvpd.exe lrrlfxl.exe PID 5184 wrote to memory of 5620 5184 lrrlfxl.exe tbhhhh.exe PID 5184 wrote to memory of 5620 5184 lrrlfxl.exe tbhhhh.exe PID 5184 wrote to memory of 5620 5184 lrrlfxl.exe tbhhhh.exe PID 5620 wrote to memory of 1604 5620 tbhhhh.exe pppjv.exe PID 5620 wrote to memory of 1604 5620 tbhhhh.exe pppjv.exe PID 5620 wrote to memory of 1604 5620 tbhhhh.exe pppjv.exe PID 1604 wrote to memory of 2512 1604 pppjv.exe 3pdpj.exe PID 1604 wrote to memory of 2512 1604 pppjv.exe 3pdpj.exe PID 1604 wrote to memory of 2512 1604 pppjv.exe 3pdpj.exe PID 2512 wrote to memory of 3740 2512 3pdpj.exe htthhb.exe PID 2512 wrote to memory of 3740 2512 3pdpj.exe htthhb.exe PID 2512 wrote to memory of 3740 2512 3pdpj.exe htthhb.exe PID 3740 wrote to memory of 376 3740 htthhb.exe nnnhtt.exe PID 3740 wrote to memory of 376 3740 htthhb.exe nnnhtt.exe PID 3740 wrote to memory of 376 3740 htthhb.exe nnnhtt.exe PID 376 wrote to memory of 4952 376 nnnhtt.exe jpjdp.exe PID 376 wrote to memory of 4952 376 nnnhtt.exe jpjdp.exe PID 376 wrote to memory of 4952 376 nnnhtt.exe jpjdp.exe PID 4952 wrote to memory of 628 4952 jpjdp.exe tnhbth.exe PID 4952 wrote to memory of 628 4952 jpjdp.exe tnhbth.exe PID 4952 wrote to memory of 628 4952 jpjdp.exe tnhbth.exe PID 628 wrote to memory of 2340 628 tnhbth.exe bnttnn.exe PID 628 wrote to memory of 2340 628 tnhbth.exe bnttnn.exe PID 628 wrote to memory of 2340 628 tnhbth.exe bnttnn.exe PID 2340 wrote to memory of 4320 2340 bnttnn.exe dpdpd.exe PID 2340 wrote to memory of 4320 2340 bnttnn.exe dpdpd.exe PID 2340 wrote to memory of 4320 2340 bnttnn.exe dpdpd.exe PID 4320 wrote to memory of 6016 4320 dpdpd.exe lxrxlxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe"C:\Users\Admin\AppData\Local\Temp\aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\1pjvv.exec:\1pjvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxxxfxl.exec:\lxxxfxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nthbnn.exec:\nthbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5nnbbt.exec:\5nnbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlrllfl.exec:\xlrllfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9frfrlx.exec:\9frfrlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnthth.exec:\bnthth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvpvp.exec:\pvpvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5rlxrlr.exec:\5rlxrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnbnh.exec:\btnbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djvpd.exec:\djvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrrlfxl.exec:\lrrlfxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbhhhh.exec:\tbhhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pppjv.exec:\pppjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3pdpj.exec:\3pdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htthhb.exec:\htthhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnnhtt.exec:\nnnhtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpjdp.exec:\jpjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnhbth.exec:\tnhbth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnttnn.exec:\bnttnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpdpd.exec:\dpdpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxrxlxr.exec:\lxrxlxr.exe23⤵
- Executes dropped EXE
-
\??\c:\tbhbnn.exec:\tbhbnn.exe24⤵
- Executes dropped EXE
-
\??\c:\vpdpj.exec:\vpdpj.exe25⤵
- Executes dropped EXE
-
\??\c:\xfrlrlx.exec:\xfrlrlx.exe26⤵
- Executes dropped EXE
-
\??\c:\9lllrrx.exec:\9lllrrx.exe27⤵
- Executes dropped EXE
-
\??\c:\ntthbb.exec:\ntthbb.exe28⤵
- Executes dropped EXE
-
\??\c:\3dddp.exec:\3dddp.exe29⤵
- Executes dropped EXE
-
\??\c:\rlrxfrf.exec:\rlrxfrf.exe30⤵
- Executes dropped EXE
-
\??\c:\hbtnnh.exec:\hbtnnh.exe31⤵
- Executes dropped EXE
-
\??\c:\pvdpj.exec:\pvdpj.exe32⤵
- Executes dropped EXE
-
\??\c:\djpjv.exec:\djpjv.exe33⤵
- Executes dropped EXE
-
\??\c:\1flxrll.exec:\1flxrll.exe34⤵
- Executes dropped EXE
-
\??\c:\bhnhtn.exec:\bhnhtn.exe35⤵
- Executes dropped EXE
-
\??\c:\pjpjd.exec:\pjpjd.exe36⤵
- Executes dropped EXE
-
\??\c:\9xxrfxr.exec:\9xxrfxr.exe37⤵
- Executes dropped EXE
-
\??\c:\lflfxfx.exec:\lflfxfx.exe38⤵
- Executes dropped EXE
-
\??\c:\nnthhh.exec:\nnthhh.exe39⤵
- Executes dropped EXE
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe40⤵
- Executes dropped EXE
-
\??\c:\tttnbt.exec:\tttnbt.exe41⤵
- Executes dropped EXE
-
\??\c:\djdvj.exec:\djdvj.exe42⤵
- Executes dropped EXE
-
\??\c:\vpjdp.exec:\vpjdp.exe43⤵
- Executes dropped EXE
-
\??\c:\xlrfxxl.exec:\xlrfxxl.exe44⤵
- Executes dropped EXE
-
\??\c:\lffrlxx.exec:\lffrlxx.exe45⤵
- Executes dropped EXE
-
\??\c:\7hbthb.exec:\7hbthb.exe46⤵
- Executes dropped EXE
-
\??\c:\djdvp.exec:\djdvp.exe47⤵
- Executes dropped EXE
-
\??\c:\xlrlxrl.exec:\xlrlxrl.exe48⤵
- Executes dropped EXE
-
\??\c:\nhthtt.exec:\nhthtt.exe49⤵
- Executes dropped EXE
-
\??\c:\vjpjv.exec:\vjpjv.exe50⤵
- Executes dropped EXE
-
\??\c:\xxlrrrl.exec:\xxlrrrl.exe51⤵
- Executes dropped EXE
-
\??\c:\lrlrlll.exec:\lrlrlll.exe52⤵
- Executes dropped EXE
-
\??\c:\nbbnhb.exec:\nbbnhb.exe53⤵
- Executes dropped EXE
-
\??\c:\jdpjp.exec:\jdpjp.exe54⤵
- Executes dropped EXE
-
\??\c:\3jjdp.exec:\3jjdp.exe55⤵
- Executes dropped EXE
-
\??\c:\frlxlxf.exec:\frlxlxf.exe56⤵
- Executes dropped EXE
-
\??\c:\5tnhnn.exec:\5tnhnn.exe57⤵
- Executes dropped EXE
-
\??\c:\hbnhbt.exec:\hbnhbt.exe58⤵
- Executes dropped EXE
-
\??\c:\djpjd.exec:\djpjd.exe59⤵
- Executes dropped EXE
-
\??\c:\lfrrxrx.exec:\lfrrxrx.exe60⤵
- Executes dropped EXE
-
\??\c:\xlxrfxl.exec:\xlxrfxl.exe61⤵
- Executes dropped EXE
-
\??\c:\ntnhtt.exec:\ntnhtt.exe62⤵
- Executes dropped EXE
-
\??\c:\nbtnbn.exec:\nbtnbn.exe63⤵
- Executes dropped EXE
-
\??\c:\9vjjd.exec:\9vjjd.exe64⤵
- Executes dropped EXE
-
\??\c:\lfrffrf.exec:\lfrffrf.exe65⤵
- Executes dropped EXE
-
\??\c:\xrrllfx.exec:\xrrllfx.exe66⤵
-
\??\c:\nhhbtb.exec:\nhhbtb.exe67⤵
-
\??\c:\vvjvp.exec:\vvjvp.exe68⤵
-
\??\c:\9jdpv.exec:\9jdpv.exe69⤵
-
\??\c:\lllxfxl.exec:\lllxfxl.exe70⤵
-
\??\c:\ffffrrr.exec:\ffffrrr.exe71⤵
-
\??\c:\nnhbtn.exec:\nnhbtn.exe72⤵
-
\??\c:\vjjvj.exec:\vjjvj.exe73⤵
-
\??\c:\lflxlfr.exec:\lflxlfr.exe74⤵
-
\??\c:\nhbnhb.exec:\nhbnhb.exe75⤵
-
\??\c:\7tthbt.exec:\7tthbt.exe76⤵
-
\??\c:\3ppdv.exec:\3ppdv.exe77⤵
-
\??\c:\ffxrfxl.exec:\ffxrfxl.exe78⤵
-
\??\c:\1htnbt.exec:\1htnbt.exe79⤵
-
\??\c:\hnnbnh.exec:\hnnbnh.exe80⤵
-
\??\c:\5jdpd.exec:\5jdpd.exe81⤵
-
\??\c:\lxrlxrr.exec:\lxrlxrr.exe82⤵
-
\??\c:\rflxrrf.exec:\rflxrrf.exe83⤵
-
\??\c:\nbbtht.exec:\nbbtht.exe84⤵
-
\??\c:\bhbnbt.exec:\bhbnbt.exe85⤵
-
\??\c:\pvppd.exec:\pvppd.exe86⤵
-
\??\c:\jdpjd.exec:\jdpjd.exe87⤵
-
\??\c:\xxrlrrr.exec:\xxrlrrr.exe88⤵
-
\??\c:\ffllrll.exec:\ffllrll.exe89⤵
-
\??\c:\tnhthh.exec:\tnhthh.exe90⤵
-
\??\c:\tbbbtt.exec:\tbbbtt.exe91⤵
-
\??\c:\9djdj.exec:\9djdj.exe92⤵
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe93⤵
-
\??\c:\thnnbh.exec:\thnnbh.exe94⤵
-
\??\c:\nbbnbt.exec:\nbbnbt.exe95⤵
-
\??\c:\ddvvv.exec:\ddvvv.exe96⤵
-
\??\c:\dpvvv.exec:\dpvvv.exe97⤵
-
\??\c:\1lxrffx.exec:\1lxrffx.exe98⤵
-
\??\c:\hbbthb.exec:\hbbthb.exe99⤵
-
\??\c:\tbbnnh.exec:\tbbnnh.exe100⤵
-
\??\c:\1pjdp.exec:\1pjdp.exe101⤵
-
\??\c:\frlxlfr.exec:\frlxlfr.exe102⤵
-
\??\c:\lllfxrl.exec:\lllfxrl.exe103⤵
-
\??\c:\tttnhh.exec:\tttnhh.exe104⤵
-
\??\c:\nnhbnh.exec:\nnhbnh.exe105⤵
-
\??\c:\dppdv.exec:\dppdv.exe106⤵
-
\??\c:\rlfrlxl.exec:\rlfrlxl.exe107⤵
-
\??\c:\lfxxrlf.exec:\lfxxrlf.exe108⤵
-
\??\c:\3bbttt.exec:\3bbttt.exe109⤵
-
\??\c:\3bthnh.exec:\3bthnh.exe110⤵
-
\??\c:\pdvpj.exec:\pdvpj.exe111⤵
-
\??\c:\vddpd.exec:\vddpd.exe112⤵
-
\??\c:\lxrflfx.exec:\lxrflfx.exe113⤵
-
\??\c:\rffxfxl.exec:\rffxfxl.exe114⤵
-
\??\c:\bntnhh.exec:\bntnhh.exe115⤵
-
\??\c:\jvpdp.exec:\jvpdp.exe116⤵
-
\??\c:\ddvpd.exec:\ddvpd.exe117⤵
-
\??\c:\rflfxrl.exec:\rflfxrl.exe118⤵
-
\??\c:\1fxxlrl.exec:\1fxxlrl.exe119⤵
-
\??\c:\3bnnbt.exec:\3bnnbt.exe120⤵
-
\??\c:\lflxrlr.exec:\lflxrlr.exe121⤵
-
\??\c:\flffxrf.exec:\flffxrf.exe122⤵
-
\??\c:\btthtn.exec:\btthtn.exe123⤵
-
\??\c:\djppj.exec:\djppj.exe124⤵
-
\??\c:\jjddv.exec:\jjddv.exe125⤵
-
\??\c:\rrrlxrl.exec:\rrrlxrl.exe126⤵
-
\??\c:\9rrlxxl.exec:\9rrlxxl.exe127⤵
-
\??\c:\bhhhbt.exec:\bhhhbt.exe128⤵
-
\??\c:\vpjvd.exec:\vpjvd.exe129⤵
-
\??\c:\jvpjv.exec:\jvpjv.exe130⤵
-
\??\c:\rrlxrrl.exec:\rrlxrrl.exe131⤵
-
\??\c:\xrxxflr.exec:\xrxxflr.exe132⤵
-
\??\c:\tbnnhb.exec:\tbnnhb.exe133⤵
-
\??\c:\hnhttb.exec:\hnhttb.exe134⤵
-
\??\c:\3jdvv.exec:\3jdvv.exe135⤵
-
\??\c:\vvpjv.exec:\vvpjv.exe136⤵
-
\??\c:\fffxlfr.exec:\fffxlfr.exe137⤵
-
\??\c:\5nbtnb.exec:\5nbtnb.exe138⤵
-
\??\c:\dppdp.exec:\dppdp.exe139⤵
-
\??\c:\pvdjd.exec:\pvdjd.exe140⤵
-
\??\c:\xllxlfx.exec:\xllxlfx.exe141⤵
-
\??\c:\5rllflf.exec:\5rllflf.exe142⤵
-
\??\c:\bnhnbb.exec:\bnhnbb.exe143⤵
-
\??\c:\3nhthh.exec:\3nhthh.exe144⤵
-
\??\c:\jvpdv.exec:\jvpdv.exe145⤵
-
\??\c:\ppdvj.exec:\ppdvj.exe146⤵
-
\??\c:\xlffxrf.exec:\xlffxrf.exe147⤵
-
\??\c:\lxlxxrf.exec:\lxlxxrf.exe148⤵
-
\??\c:\bnthbb.exec:\bnthbb.exe149⤵
-
\??\c:\hbtnhb.exec:\hbtnhb.exe150⤵
-
\??\c:\1jdjj.exec:\1jdjj.exe151⤵
-
\??\c:\pdjvj.exec:\pdjvj.exe152⤵
-
\??\c:\rfxlxxl.exec:\rfxlxxl.exe153⤵
-
\??\c:\thnhbb.exec:\thnhbb.exe154⤵
-
\??\c:\hnnnhh.exec:\hnnnhh.exe155⤵
-
\??\c:\djjjv.exec:\djjjv.exe156⤵
-
\??\c:\jdvjd.exec:\jdvjd.exe157⤵
-
\??\c:\lxrfrlx.exec:\lxrfrlx.exe158⤵
-
\??\c:\xffxxxl.exec:\xffxxxl.exe159⤵
-
\??\c:\htnbhb.exec:\htnbhb.exe160⤵
-
\??\c:\hbbtnn.exec:\hbbtnn.exe161⤵
-
\??\c:\pdvpd.exec:\pdvpd.exe162⤵
-
\??\c:\lxrfrfx.exec:\lxrfrfx.exe163⤵
-
\??\c:\hbnhbn.exec:\hbnhbn.exe164⤵
-
\??\c:\nbbnbt.exec:\nbbnbt.exe165⤵
-
\??\c:\9rxrrrr.exec:\9rxrrrr.exe166⤵
-
\??\c:\3lfrfrf.exec:\3lfrfrf.exe167⤵
-
\??\c:\hhbnnh.exec:\hhbnnh.exe168⤵
-
\??\c:\htnhtn.exec:\htnhtn.exe169⤵
-
\??\c:\1ppdv.exec:\1ppdv.exe170⤵
-
\??\c:\xrrrffx.exec:\xrrrffx.exe171⤵
-
\??\c:\lfxrffr.exec:\lfxrffr.exe172⤵
-
\??\c:\thhnbh.exec:\thhnbh.exe173⤵
-
\??\c:\tnhhbh.exec:\tnhhbh.exe174⤵
-
\??\c:\pddpv.exec:\pddpv.exe175⤵
-
\??\c:\lxrlffr.exec:\lxrlffr.exe176⤵
-
\??\c:\htbbbt.exec:\htbbbt.exe177⤵
-
\??\c:\jvdvd.exec:\jvdvd.exe178⤵
-
\??\c:\hnhthb.exec:\hnhthb.exe179⤵
-
\??\c:\hhtthb.exec:\hhtthb.exe180⤵
-
\??\c:\pddpp.exec:\pddpp.exe181⤵
-
\??\c:\vjdpj.exec:\vjdpj.exe182⤵
-
\??\c:\3llfrlx.exec:\3llfrlx.exe183⤵
-
\??\c:\lflffxr.exec:\lflffxr.exe184⤵
-
\??\c:\btbnbb.exec:\btbnbb.exe185⤵
-
\??\c:\jdpdv.exec:\jdpdv.exe186⤵
-
\??\c:\lxlrrlf.exec:\lxlrrlf.exe187⤵
-
\??\c:\5tbhtt.exec:\5tbhtt.exe188⤵
-
\??\c:\dppvp.exec:\dppvp.exe189⤵
-
\??\c:\lrlffxx.exec:\lrlffxx.exe190⤵
-
\??\c:\3ttttb.exec:\3ttttb.exe191⤵
-
\??\c:\btbthh.exec:\btbthh.exe192⤵
-
\??\c:\1jddv.exec:\1jddv.exe193⤵
-
\??\c:\1fffffx.exec:\1fffffx.exe194⤵
-
\??\c:\nbbtnn.exec:\nbbtnn.exe195⤵
-
\??\c:\dvvpp.exec:\dvvpp.exe196⤵
-
\??\c:\rfxxlll.exec:\rfxxlll.exe197⤵
-
\??\c:\llrrlll.exec:\llrrlll.exe198⤵
-
\??\c:\nbnnhh.exec:\nbnnhh.exe199⤵
-
\??\c:\hbbbnb.exec:\hbbbnb.exe200⤵
-
\??\c:\ppjjv.exec:\ppjjv.exe201⤵
-
\??\c:\vpdvj.exec:\vpdvj.exe202⤵
-
\??\c:\llfxxxr.exec:\llfxxxr.exe203⤵
-
\??\c:\lxxxrfr.exec:\lxxxrfr.exe204⤵
-
\??\c:\bhnnnn.exec:\bhnnnn.exe205⤵
-
\??\c:\7dddd.exec:\7dddd.exe206⤵
-
\??\c:\7jpjd.exec:\7jpjd.exe207⤵
-
\??\c:\5lxxrxr.exec:\5lxxrxr.exe208⤵
-
\??\c:\1rrrlll.exec:\1rrrlll.exe209⤵
-
\??\c:\nhnhbb.exec:\nhnhbb.exe210⤵
-
\??\c:\jjpvp.exec:\jjpvp.exe211⤵
-
\??\c:\1dvpj.exec:\1dvpj.exe212⤵
-
\??\c:\lflfrrr.exec:\lflfrrr.exe213⤵
-
\??\c:\lfflfff.exec:\lfflfff.exe214⤵
-
\??\c:\tnbthh.exec:\tnbthh.exe215⤵
-
\??\c:\djpjj.exec:\djpjj.exe216⤵
-
\??\c:\7ppjj.exec:\7ppjj.exe217⤵
-
\??\c:\frxrfff.exec:\frxrfff.exe218⤵
-
\??\c:\lfxrxrf.exec:\lfxrxrf.exe219⤵
-
\??\c:\1tnnnn.exec:\1tnnnn.exe220⤵
-
\??\c:\7djpj.exec:\7djpj.exe221⤵
-
\??\c:\jdjvv.exec:\jdjvv.exe222⤵
-
\??\c:\llxxflf.exec:\llxxflf.exe223⤵
-
\??\c:\rrrlffx.exec:\rrrlffx.exe224⤵
-
\??\c:\5hhttb.exec:\5hhttb.exe225⤵
-
\??\c:\3nbbnb.exec:\3nbbnb.exe226⤵
-
\??\c:\vjpjv.exec:\vjpjv.exe227⤵
-
\??\c:\vdvvp.exec:\vdvvp.exe228⤵
-
\??\c:\rrxfxff.exec:\rrxfxff.exe229⤵
-
\??\c:\llllxxf.exec:\llllxxf.exe230⤵
-
\??\c:\nbtnbh.exec:\nbtnbh.exe231⤵
-
\??\c:\3tbtbb.exec:\3tbtbb.exe232⤵
-
\??\c:\vjddd.exec:\vjddd.exe233⤵
-
\??\c:\ddjjj.exec:\ddjjj.exe234⤵
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe235⤵
-
\??\c:\fllfffx.exec:\fllfffx.exe236⤵
-
\??\c:\tthbtt.exec:\tthbtt.exe237⤵
-
\??\c:\bbhnnn.exec:\bbhnnn.exe238⤵
-
\??\c:\ppvpp.exec:\ppvpp.exe239⤵
-
\??\c:\lxlrrfr.exec:\lxlrrfr.exe240⤵
-
\??\c:\9frlxfl.exec:\9frlxfl.exe241⤵