Analysis
-
max time kernel
51s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 20:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe
-
Size
55KB
-
MD5
e034c30cd04d381720f3a691960839c7
-
SHA1
d531ae810fba3bbe0dc947f94d9604bcc3f1302e
-
SHA256
2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c
-
SHA512
f9098cdfe997080ecfd87efbe33d797309f4d9e96c5c5ba6d6a1f46a140878e900c29ff3adb13d22834165512169e6d288304ed7eebe505134cc3d803af7c06e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFK:ymb3NkkiQ3mdBjFIFK
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/4860-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/652-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 37 IoCs
Processes:
resource yara_rule behavioral2/memory/4860-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4860-8-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4308-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4572-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4572-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4572-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2940-28-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3572-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3572-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3572-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2024-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2004-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2020-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/980-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/980-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/980-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/980-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/816-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/816-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3032-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3032-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3032-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3752-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3172-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3940-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1460-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2848-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4724-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3456-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2448-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4024-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3860-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/396-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2348-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1148-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/652-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1176-209-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
xrxrfxf.exe5ppjv.exefffflrr.exehbnbhn.exepvddv.exe3bbnth.exejdvdj.exefrxxflr.exehhhhtt.exexlrrllr.exehbhbbb.exefflfllf.exefflrlxr.exebhbbbn.exedjjvj.exe1rrxrll.exebntnnn.exelxfxffx.exe5tntbt.exevjvpp.exenhbbtb.exepdvpd.exexxffllr.exejdrxf.exetbhnth.exejjjpj.exexxllrxx.exerffffxr.exepvpdj.exelrxlfff.exe5bbhbn.exejpdjp.exefflrlrf.exebbthbn.exetnbhht.exevvvvd.exeddppv.exerxlfllr.exebtbthh.exebbhhhh.exevpdvv.exejdvpj.exefrfrxlx.exerfrxxff.exebtntbh.exevpppp.exepvjjj.exexlrrrxx.exetbnbht.exepvjjj.exelllfxxx.exetnnntn.exenhntth.exedpjjp.exellxflrx.exennttbt.exeppjpj.exenhnhbb.exepjdjd.exexxrllrl.exenhbhnb.exejjdjj.exebhhbbn.exepppjj.exepid process 4308 xrxrfxf.exe 4572 5ppjv.exe 2940 fffflrr.exe 3572 hbnbhn.exe 2024 pvddv.exe 2004 3bbnth.exe 2020 jdvdj.exe 980 frxxflr.exe 816 hhhhtt.exe 3032 xlrrllr.exe 3752 hbhbbb.exe 3172 fflfllf.exe 3940 fflrlxr.exe 1016 bhbbbn.exe 1460 djjvj.exe 2848 1rrxrll.exe 4724 bntnnn.exe 3456 lxfxffx.exe 2448 5tntbt.exe 4024 vjvpp.exe 8 nhbbtb.exe 3592 pdvpd.exe 4932 xxffllr.exe 3860 jdrxf.exe 396 tbhnth.exe 2348 jjjpj.exe 1148 xxllrxx.exe 652 rffffxr.exe 3364 pvpdj.exe 1176 lrxlfff.exe 4484 5bbhbn.exe 3684 jpdjp.exe 1700 fflrlrf.exe 4896 bbthbn.exe 4516 tnbhht.exe 3100 vvvvd.exe 4040 ddppv.exe 4764 rxlfllr.exe 4564 btbthh.exe 1436 bbhhhh.exe 2004 vpdvv.exe 4812 jdvpj.exe 3252 frfrxlx.exe 4980 rfrxxff.exe 1992 btntbh.exe 816 vpppp.exe 3896 pvjjj.exe 4056 xlrrrxx.exe 4108 tbnbht.exe 4544 pvjjj.exe 2856 lllfxxx.exe 424 tnnntn.exe 4520 nhntth.exe 3696 dpjjp.exe 1532 llxflrx.exe 4944 nnttbt.exe 1892 ppjpj.exe 4004 nhnhbb.exe 3084 pjdjd.exe 3536 xxrllrl.exe 3472 nhbhnb.exe 5116 jjdjj.exe 2044 bhhbbn.exe 5024 pppjj.exe -
Processes:
resource yara_rule behavioral2/memory/4860-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/652-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exexrxrfxf.exe5ppjv.exefffflrr.exehbnbhn.exepvddv.exe3bbnth.exejdvdj.exefrxxflr.exehhhhtt.exexlrrllr.exehbhbbb.exefflfllf.exefflrlxr.exebhbbbn.exedjjvj.exe1rrxrll.exebntnnn.exelxfxffx.exe5tntbt.exevjvpp.exenhbbtb.exedescription pid process target process PID 4860 wrote to memory of 4308 4860 2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe xrxrfxf.exe PID 4860 wrote to memory of 4308 4860 2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe xrxrfxf.exe PID 4860 wrote to memory of 4308 4860 2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe xrxrfxf.exe PID 4308 wrote to memory of 4572 4308 xrxrfxf.exe 5ppjv.exe PID 4308 wrote to memory of 4572 4308 xrxrfxf.exe 5ppjv.exe PID 4308 wrote to memory of 4572 4308 xrxrfxf.exe 5ppjv.exe PID 4572 wrote to memory of 2940 4572 5ppjv.exe fffflrr.exe PID 4572 wrote to memory of 2940 4572 5ppjv.exe fffflrr.exe PID 4572 wrote to memory of 2940 4572 5ppjv.exe fffflrr.exe PID 2940 wrote to memory of 3572 2940 fffflrr.exe bntttn.exe PID 2940 wrote to memory of 3572 2940 fffflrr.exe bntttn.exe PID 2940 wrote to memory of 3572 2940 fffflrr.exe bntttn.exe PID 3572 wrote to memory of 2024 3572 hbnbhn.exe pvddv.exe PID 3572 wrote to memory of 2024 3572 hbnbhn.exe pvddv.exe PID 3572 wrote to memory of 2024 3572 hbnbhn.exe pvddv.exe PID 2024 wrote to memory of 2004 2024 pvddv.exe vpdvv.exe PID 2024 wrote to memory of 2004 2024 pvddv.exe vpdvv.exe PID 2024 wrote to memory of 2004 2024 pvddv.exe vpdvv.exe PID 2004 wrote to memory of 2020 2004 3bbnth.exe jdvdj.exe PID 2004 wrote to memory of 2020 2004 3bbnth.exe jdvdj.exe PID 2004 wrote to memory of 2020 2004 3bbnth.exe jdvdj.exe PID 2020 wrote to memory of 980 2020 jdvdj.exe frxxflr.exe PID 2020 wrote to memory of 980 2020 jdvdj.exe frxxflr.exe PID 2020 wrote to memory of 980 2020 jdvdj.exe frxxflr.exe PID 980 wrote to memory of 816 980 frxxflr.exe fxffxff.exe PID 980 wrote to memory of 816 980 frxxflr.exe fxffxff.exe PID 980 wrote to memory of 816 980 frxxflr.exe fxffxff.exe PID 816 wrote to memory of 3032 816 hhhhtt.exe xlrrllr.exe PID 816 wrote to memory of 3032 816 hhhhtt.exe xlrrllr.exe PID 816 wrote to memory of 3032 816 hhhhtt.exe xlrrllr.exe PID 3032 wrote to memory of 3752 3032 xlrrllr.exe hbbttt.exe PID 3032 wrote to memory of 3752 3032 xlrrllr.exe hbbttt.exe PID 3032 wrote to memory of 3752 3032 xlrrllr.exe hbbttt.exe PID 3752 wrote to memory of 3172 3752 hbhbbb.exe fflfllf.exe PID 3752 wrote to memory of 3172 3752 hbhbbb.exe fflfllf.exe PID 3752 wrote to memory of 3172 3752 hbhbbb.exe fflfllf.exe PID 3172 wrote to memory of 3940 3172 fflfllf.exe bntbnh.exe PID 3172 wrote to memory of 3940 3172 fflfllf.exe bntbnh.exe PID 3172 wrote to memory of 3940 3172 fflfllf.exe bntbnh.exe PID 3940 wrote to memory of 1016 3940 fflrlxr.exe pjddv.exe PID 3940 wrote to memory of 1016 3940 fflrlxr.exe pjddv.exe PID 3940 wrote to memory of 1016 3940 fflrlxr.exe pjddv.exe PID 1016 wrote to memory of 1460 1016 bhbbbn.exe xrlrxll.exe PID 1016 wrote to memory of 1460 1016 bhbbbn.exe xrlrxll.exe PID 1016 wrote to memory of 1460 1016 bhbbbn.exe xrlrxll.exe PID 1460 wrote to memory of 2848 1460 djjvj.exe nbbbbn.exe PID 1460 wrote to memory of 2848 1460 djjvj.exe nbbbbn.exe PID 1460 wrote to memory of 2848 1460 djjvj.exe nbbbbn.exe PID 2848 wrote to memory of 4724 2848 1rrxrll.exe xxffxfr.exe PID 2848 wrote to memory of 4724 2848 1rrxrll.exe xxffxfr.exe PID 2848 wrote to memory of 4724 2848 1rrxrll.exe xxffxfr.exe PID 4724 wrote to memory of 3456 4724 bntnnn.exe lxfxffx.exe PID 4724 wrote to memory of 3456 4724 bntnnn.exe lxfxffx.exe PID 4724 wrote to memory of 3456 4724 bntnnn.exe lxfxffx.exe PID 3456 wrote to memory of 2448 3456 lxfxffx.exe 3xrrxlf.exe PID 3456 wrote to memory of 2448 3456 lxfxffx.exe 3xrrxlf.exe PID 3456 wrote to memory of 2448 3456 lxfxffx.exe 3xrrxlf.exe PID 2448 wrote to memory of 4024 2448 5tntbt.exe ddpdd.exe PID 2448 wrote to memory of 4024 2448 5tntbt.exe ddpdd.exe PID 2448 wrote to memory of 4024 2448 5tntbt.exe ddpdd.exe PID 4024 wrote to memory of 8 4024 vjvpp.exe nhbbtb.exe PID 4024 wrote to memory of 8 4024 vjvpp.exe nhbbtb.exe PID 4024 wrote to memory of 8 4024 vjvpp.exe nhbbtb.exe PID 8 wrote to memory of 3592 8 nhbbtb.exe djddj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe"C:\Users\Admin\AppData\Local\Temp\2ed3dffb6e41ebe2ff589be60f8e1eea853bffb7d57673b61560a5d22a9cef2c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\xrxrfxf.exec:\xrxrfxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5ppjv.exec:\5ppjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fffflrr.exec:\fffflrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbnbhn.exec:\hbnbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvddv.exec:\pvddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3bbnth.exec:\3bbnth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvdj.exec:\jdvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxxflr.exec:\frxxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhhtt.exec:\hhhhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlrrllr.exec:\xlrrllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhbbb.exec:\hbhbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fflfllf.exec:\fflfllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fflrlxr.exec:\fflrlxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbbbn.exec:\bhbbbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djjvj.exec:\djjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1rrxrll.exec:\1rrxrll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bntnnn.exec:\bntnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxfxffx.exec:\lxfxffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5tntbt.exec:\5tntbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvpp.exec:\vjvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbbtb.exec:\nhbbtb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdvpd.exec:\pdvpd.exe23⤵
- Executes dropped EXE
-
\??\c:\xxffllr.exec:\xxffllr.exe24⤵
- Executes dropped EXE
-
\??\c:\jdrxf.exec:\jdrxf.exe25⤵
- Executes dropped EXE
-
\??\c:\tbhnth.exec:\tbhnth.exe26⤵
- Executes dropped EXE
-
\??\c:\jjjpj.exec:\jjjpj.exe27⤵
- Executes dropped EXE
-
\??\c:\xxllrxx.exec:\xxllrxx.exe28⤵
- Executes dropped EXE
-
\??\c:\rffffxr.exec:\rffffxr.exe29⤵
- Executes dropped EXE
-
\??\c:\pvpdj.exec:\pvpdj.exe30⤵
- Executes dropped EXE
-
\??\c:\lrxlfff.exec:\lrxlfff.exe31⤵
- Executes dropped EXE
-
\??\c:\5bbhbn.exec:\5bbhbn.exe32⤵
- Executes dropped EXE
-
\??\c:\jpdjp.exec:\jpdjp.exe33⤵
- Executes dropped EXE
-
\??\c:\fflrlrf.exec:\fflrlrf.exe34⤵
- Executes dropped EXE
-
\??\c:\bbthbn.exec:\bbthbn.exe35⤵
- Executes dropped EXE
-
\??\c:\tnbhht.exec:\tnbhht.exe36⤵
- Executes dropped EXE
-
\??\c:\vvvvd.exec:\vvvvd.exe37⤵
- Executes dropped EXE
-
\??\c:\ddppv.exec:\ddppv.exe38⤵
- Executes dropped EXE
-
\??\c:\rxlfllr.exec:\rxlfllr.exe39⤵
- Executes dropped EXE
-
\??\c:\btbthh.exec:\btbthh.exe40⤵
- Executes dropped EXE
-
\??\c:\bbhhhh.exec:\bbhhhh.exe41⤵
- Executes dropped EXE
-
\??\c:\vpdvv.exec:\vpdvv.exe42⤵
- Executes dropped EXE
-
\??\c:\jdvpj.exec:\jdvpj.exe43⤵
- Executes dropped EXE
-
\??\c:\frfrxlx.exec:\frfrxlx.exe44⤵
- Executes dropped EXE
-
\??\c:\rfrxxff.exec:\rfrxxff.exe45⤵
- Executes dropped EXE
-
\??\c:\btntbh.exec:\btntbh.exe46⤵
- Executes dropped EXE
-
\??\c:\vpppp.exec:\vpppp.exe47⤵
- Executes dropped EXE
-
\??\c:\pvjjj.exec:\pvjjj.exe48⤵
- Executes dropped EXE
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe49⤵
- Executes dropped EXE
-
\??\c:\tbnbht.exec:\tbnbht.exe50⤵
- Executes dropped EXE
-
\??\c:\pvjjj.exec:\pvjjj.exe51⤵
- Executes dropped EXE
-
\??\c:\lllfxxx.exec:\lllfxxx.exe52⤵
- Executes dropped EXE
-
\??\c:\tnnntn.exec:\tnnntn.exe53⤵
- Executes dropped EXE
-
\??\c:\nhntth.exec:\nhntth.exe54⤵
- Executes dropped EXE
-
\??\c:\dpjjp.exec:\dpjjp.exe55⤵
- Executes dropped EXE
-
\??\c:\llxflrx.exec:\llxflrx.exe56⤵
- Executes dropped EXE
-
\??\c:\nnttbt.exec:\nnttbt.exe57⤵
- Executes dropped EXE
-
\??\c:\ppjpj.exec:\ppjpj.exe58⤵
- Executes dropped EXE
-
\??\c:\nhnhbb.exec:\nhnhbb.exe59⤵
- Executes dropped EXE
-
\??\c:\pjdjd.exec:\pjdjd.exe60⤵
- Executes dropped EXE
-
\??\c:\xxrllrl.exec:\xxrllrl.exe61⤵
- Executes dropped EXE
-
\??\c:\nhbhnb.exec:\nhbhnb.exe62⤵
- Executes dropped EXE
-
\??\c:\jjdjj.exec:\jjdjj.exe63⤵
- Executes dropped EXE
-
\??\c:\bhhbbn.exec:\bhhbbn.exe64⤵
- Executes dropped EXE
-
\??\c:\pppjj.exec:\pppjj.exe65⤵
- Executes dropped EXE
-
\??\c:\bnbtnn.exec:\bnbtnn.exe66⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe67⤵
-
\??\c:\9rfffxx.exec:\9rfffxx.exe68⤵
-
\??\c:\xrflxfr.exec:\xrflxfr.exe69⤵
-
\??\c:\nhhbnn.exec:\nhhbnn.exe70⤵
-
\??\c:\3jdpd.exec:\3jdpd.exe71⤵
-
\??\c:\pdvdj.exec:\pdvdj.exe72⤵
-
\??\c:\xfxrfxf.exec:\xfxrfxf.exe73⤵
-
\??\c:\flllfff.exec:\flllfff.exe74⤵
-
\??\c:\nhnbhb.exec:\nhnbhb.exe75⤵
-
\??\c:\3hthhn.exec:\3hthhn.exe76⤵
-
\??\c:\pdpjd.exec:\pdpjd.exe77⤵
-
\??\c:\rfxrfxf.exec:\rfxrfxf.exe78⤵
-
\??\c:\rrflffx.exec:\rrflffx.exe79⤵
-
\??\c:\thnbtb.exec:\thnbtb.exe80⤵
-
\??\c:\bntttn.exec:\bntttn.exe81⤵
-
\??\c:\jjddd.exec:\jjddd.exe82⤵
-
\??\c:\vpddd.exec:\vpddd.exe83⤵
-
\??\c:\flxxlxl.exec:\flxxlxl.exe84⤵
-
\??\c:\tnttnn.exec:\tnttnn.exe85⤵
-
\??\c:\jdpjj.exec:\jdpjj.exe86⤵
-
\??\c:\pvdpd.exec:\pvdpd.exe87⤵
-
\??\c:\fxxfllf.exec:\fxxfllf.exe88⤵
-
\??\c:\rrrlrxf.exec:\rrrlrxf.exe89⤵
-
\??\c:\tbtnth.exec:\tbtnth.exe90⤵
-
\??\c:\pvpdj.exec:\pvpdj.exe91⤵
-
\??\c:\jvjpv.exec:\jvjpv.exe92⤵
-
\??\c:\lrllrxx.exec:\lrllrxx.exe93⤵
-
\??\c:\nhnnht.exec:\nhnnht.exe94⤵
-
\??\c:\bntntb.exec:\bntntb.exe95⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe96⤵
-
\??\c:\rrrlfff.exec:\rrrlfff.exe97⤵
-
\??\c:\fffrrrl.exec:\fffrrrl.exe98⤵
-
\??\c:\bbntht.exec:\bbntht.exe99⤵
-
\??\c:\7tnhbt.exec:\7tnhbt.exe100⤵
-
\??\c:\pdpvj.exec:\pdpvj.exe101⤵
-
\??\c:\fxxxrlr.exec:\fxxxrlr.exe102⤵
-
\??\c:\rlxxfff.exec:\rlxxfff.exe103⤵
-
\??\c:\hbthhh.exec:\hbthhh.exe104⤵
-
\??\c:\djddj.exec:\djddj.exe105⤵
-
\??\c:\jvjdp.exec:\jvjdp.exe106⤵
-
\??\c:\lrxflfr.exec:\lrxflfr.exe107⤵
-
\??\c:\xfxrrrr.exec:\xfxrrrr.exe108⤵
-
\??\c:\nhnbbn.exec:\nhnbbn.exe109⤵
-
\??\c:\vpjpj.exec:\vpjpj.exe110⤵
-
\??\c:\vjppp.exec:\vjppp.exe111⤵
-
\??\c:\rxfflxl.exec:\rxfflxl.exe112⤵
-
\??\c:\rxfrxrx.exec:\rxfrxrx.exe113⤵
-
\??\c:\bthbhn.exec:\bthbhn.exe114⤵
-
\??\c:\pjvdd.exec:\pjvdd.exe115⤵
-
\??\c:\7flffff.exec:\7flffff.exe116⤵
-
\??\c:\rfrlffx.exec:\rfrlffx.exe117⤵
-
\??\c:\tnnbbt.exec:\tnnbbt.exe118⤵
-
\??\c:\jvjdd.exec:\jvjdd.exe119⤵
-
\??\c:\rllfxxx.exec:\rllfxxx.exe120⤵
-
\??\c:\hbhnnb.exec:\hbhnnb.exe121⤵
-
\??\c:\jvdpv.exec:\jvdpv.exe122⤵
-
\??\c:\vdpdv.exec:\vdpdv.exe123⤵
-
\??\c:\hbbttt.exec:\hbbttt.exe124⤵
-
\??\c:\nbhbnb.exec:\nbhbnb.exe125⤵
-
\??\c:\dpppp.exec:\dpppp.exe126⤵
-
\??\c:\ffllllr.exec:\ffllllr.exe127⤵
-
\??\c:\1hbnbh.exec:\1hbnbh.exe128⤵
-
\??\c:\vpvjd.exec:\vpvjd.exe129⤵
-
\??\c:\pddvd.exec:\pddvd.exe130⤵
-
\??\c:\rxlrffl.exec:\rxlrffl.exe131⤵
-
\??\c:\hnbhnt.exec:\hnbhnt.exe132⤵
-
\??\c:\hbnttb.exec:\hbnttb.exe133⤵
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe134⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe135⤵
-
\??\c:\fxfllrr.exec:\fxfllrr.exe136⤵
-
\??\c:\nnhnnb.exec:\nnhnnb.exe137⤵
-
\??\c:\pvjjp.exec:\pvjjp.exe138⤵
-
\??\c:\flllflr.exec:\flllflr.exe139⤵
-
\??\c:\ntbbbh.exec:\ntbbbh.exe140⤵
-
\??\c:\dpvpd.exec:\dpvpd.exe141⤵
-
\??\c:\pvvdd.exec:\pvvdd.exe142⤵
-
\??\c:\llfxfxf.exec:\llfxfxf.exe143⤵
-
\??\c:\lxrxxfl.exec:\lxrxxfl.exe144⤵
-
\??\c:\tbhnnt.exec:\tbhnnt.exe145⤵
-
\??\c:\hhbbnt.exec:\hhbbnt.exe146⤵
-
\??\c:\pdjjj.exec:\pdjjj.exe147⤵
-
\??\c:\frlffll.exec:\frlffll.exe148⤵
-
\??\c:\xflllrx.exec:\xflllrx.exe149⤵
-
\??\c:\btnnnh.exec:\btnnnh.exe150⤵
-
\??\c:\ttbbhh.exec:\ttbbhh.exe151⤵
-
\??\c:\ppvpp.exec:\ppvpp.exe152⤵
-
\??\c:\lxlrxlr.exec:\lxlrxlr.exe153⤵
-
\??\c:\xllfxll.exec:\xllfxll.exe154⤵
-
\??\c:\htnttn.exec:\htnttn.exe155⤵
-
\??\c:\tbbbbb.exec:\tbbbbb.exe156⤵
-
\??\c:\rxlrrlf.exec:\rxlrrlf.exe157⤵
-
\??\c:\hnbtnh.exec:\hnbtnh.exe158⤵
-
\??\c:\nhntnt.exec:\nhntnt.exe159⤵
-
\??\c:\3jpvd.exec:\3jpvd.exe160⤵
-
\??\c:\lrxrxff.exec:\lrxrxff.exe161⤵
-
\??\c:\rflrxrl.exec:\rflrxrl.exe162⤵
-
\??\c:\hhtbnt.exec:\hhtbnt.exe163⤵
-
\??\c:\7ntbht.exec:\7ntbht.exe164⤵
-
\??\c:\djvdp.exec:\djvdp.exe165⤵
-
\??\c:\llrrlfl.exec:\llrrlfl.exe166⤵
-
\??\c:\xrlfflx.exec:\xrlfflx.exe167⤵
-
\??\c:\hbtbbb.exec:\hbtbbb.exe168⤵
-
\??\c:\dvddj.exec:\dvddj.exe169⤵
-
\??\c:\vjvpd.exec:\vjvpd.exe170⤵
-
\??\c:\flxrlxr.exec:\flxrlxr.exe171⤵
-
\??\c:\hbhtnb.exec:\hbhtnb.exe172⤵
-
\??\c:\bttbtt.exec:\bttbtt.exe173⤵
-
\??\c:\pvvvj.exec:\pvvvj.exe174⤵
-
\??\c:\frxfrfr.exec:\frxfrfr.exe175⤵
-
\??\c:\bthbnh.exec:\bthbnh.exe176⤵
-
\??\c:\nbnnth.exec:\nbnnth.exe177⤵
-
\??\c:\vvjvj.exec:\vvjvj.exe178⤵
-
\??\c:\dpjdd.exec:\dpjdd.exe179⤵
-
\??\c:\xxxlrrr.exec:\xxxlrrr.exe180⤵
-
\??\c:\nnthnb.exec:\nnthnb.exe181⤵
-
\??\c:\tttttn.exec:\tttttn.exe182⤵
-
\??\c:\pvvdv.exec:\pvvdv.exe183⤵
-
\??\c:\rllxfrx.exec:\rllxfrx.exe184⤵
-
\??\c:\lrxfrxx.exec:\lrxfrxx.exe185⤵
-
\??\c:\nnthhh.exec:\nnthhh.exe186⤵
-
\??\c:\httnbh.exec:\httnbh.exe187⤵
-
\??\c:\vvvvd.exec:\vvvvd.exe188⤵
-
\??\c:\jjjvj.exec:\jjjvj.exe189⤵
-
\??\c:\frllfll.exec:\frllfll.exe190⤵
-
\??\c:\nthbtn.exec:\nthbtn.exe191⤵
-
\??\c:\htbbbb.exec:\htbbbb.exe192⤵
-
\??\c:\1jvpv.exec:\1jvpv.exe193⤵
-
\??\c:\dvppp.exec:\dvppp.exe194⤵
-
\??\c:\rxlxxxr.exec:\rxlxxxr.exe195⤵
-
\??\c:\hhbhnh.exec:\hhbhnh.exe196⤵
-
\??\c:\1nbttb.exec:\1nbttb.exe197⤵
-
\??\c:\jdvpp.exec:\jdvpp.exe198⤵
-
\??\c:\vppjp.exec:\vppjp.exe199⤵
-
\??\c:\ffrxxfr.exec:\ffrxxfr.exe200⤵
-
\??\c:\3xrrxlf.exec:\3xrrxlf.exe201⤵
-
\??\c:\nthhnb.exec:\nthhnb.exe202⤵
-
\??\c:\jdpvv.exec:\jdpvv.exe203⤵
-
\??\c:\vppvj.exec:\vppvj.exe204⤵
-
\??\c:\lfrxfrf.exec:\lfrxfrf.exe205⤵
-
\??\c:\nthhhh.exec:\nthhhh.exe206⤵
-
\??\c:\jjvvp.exec:\jjvvp.exe207⤵
-
\??\c:\5rlfxff.exec:\5rlfxff.exe208⤵
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe209⤵
-
\??\c:\bbttbb.exec:\bbttbb.exe210⤵
-
\??\c:\vdvvv.exec:\vdvvv.exe211⤵
-
\??\c:\pjppp.exec:\pjppp.exe212⤵
-
\??\c:\frflrxl.exec:\frflrxl.exe213⤵
-
\??\c:\rfrllll.exec:\rfrllll.exe214⤵
-
\??\c:\ttbbbn.exec:\ttbbbn.exe215⤵
-
\??\c:\vdjjp.exec:\vdjjp.exe216⤵
-
\??\c:\vpvvd.exec:\vpvvd.exe217⤵
-
\??\c:\rrxrlfr.exec:\rrxrlfr.exe218⤵
-
\??\c:\rxlrrxf.exec:\rxlrrxf.exe219⤵
-
\??\c:\hhhnbb.exec:\hhhnbb.exe220⤵
-
\??\c:\hhnnnb.exec:\hhnnnb.exe221⤵
-
\??\c:\ffrlrxf.exec:\ffrlrxf.exe222⤵
-
\??\c:\bthnbn.exec:\bthnbn.exe223⤵
-
\??\c:\nnbtht.exec:\nnbtht.exe224⤵
-
\??\c:\vvpjj.exec:\vvpjj.exe225⤵
-
\??\c:\fxffxff.exec:\fxffxff.exe226⤵
-
\??\c:\nntbhn.exec:\nntbhn.exe227⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe228⤵
-
\??\c:\jvjpv.exec:\jvjpv.exe229⤵
-
\??\c:\1jjdp.exec:\1jjdp.exe230⤵
-
\??\c:\xrlrxll.exec:\xrlrxll.exe231⤵
-
\??\c:\fllrfxr.exec:\fllrfxr.exe232⤵
-
\??\c:\bhtbhb.exec:\bhtbhb.exe233⤵
-
\??\c:\thnhbb.exec:\thnhbb.exe234⤵
-
\??\c:\pvjdj.exec:\pvjdj.exe235⤵
-
\??\c:\rxffflr.exec:\rxffflr.exe236⤵
-
\??\c:\xlrrxxl.exec:\xlrrxxl.exe237⤵
-
\??\c:\tnnnhn.exec:\tnnnhn.exe238⤵
-
\??\c:\tthbbn.exec:\tthbbn.exe239⤵
-
\??\c:\jdjvd.exec:\jdjvd.exe240⤵
-
\??\c:\fxlffrx.exec:\fxlffrx.exe241⤵