Analysis
-
max time kernel
108s -
max time network
66s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 00:53
Behavioral task
behavioral1
Sample
9e231f0def9dedf51cf37107bd2db9039cdcc423eaca7ba0d254adff738ef163.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
-
Target
9e231f0def9dedf51cf37107bd2db9039cdcc423eaca7ba0d254adff738ef163.exe
-
Size
214KB
-
MD5
b143dfef0404a9aee614c017349b5afd
-
SHA1
863ab08ab14e84cbcd9e22c4c67ed5a59df09970
-
SHA256
9e231f0def9dedf51cf37107bd2db9039cdcc423eaca7ba0d254adff738ef163
-
SHA512
174178da2ff5d00d3c51e07fc71644108909c8abbc36a3f86fd1ff653067a2eef727a4861de28e31e66e084115b4b7361793c956d83e5acae85120b5434631f8
-
SSDEEP
6144:Hcm4FmowdHoSrXZf8l/ubPzYNLPf4t+lT:V4wFHoSBK/ubLcfd
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/652-5-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4324-14-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2536-21-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2524-32-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2532-57-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4876-75-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4872-84-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1556-95-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/964-102-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1948-198-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/412-209-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4160-226-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4212-251-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3264-310-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1636-321-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/804-394-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/920-416-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2396-553-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5068-561-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3664-729-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4696-737-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4776-777-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3892-748-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1472-682-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2256-672-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1256-562-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4872-525-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2208-512-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4460-474-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2828-454-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4116-420-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1592-412-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3800-408-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3572-390-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4440-380-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3080-358-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2764-357-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4988-328-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3988-314-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1584-303-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3544-295-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3032-288-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2536-275-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4380-267-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4152-263-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4364-258-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1112-247-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4536-237-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5112-214-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1540-210-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/676-205-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5036-188-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4268-176-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4916-171-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3656-170-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4668-163-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4528-155-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3524-153-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2884-140-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1912-133-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4480-118-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5064-111-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3480-63-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2512-52-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ffrxfrl.exehbbtbb.exerfrrrxx.exetbnnnn.exe3dvjj.exerllllxf.exebbnnnn.exentthbt.exejpvvd.exehtbhtn.exejpvvd.exevvjvv.exe3fflrrx.exetttbnt.exejjddj.exefxrfrxx.exeddvjd.exefllxrrl.exennhhhh.exevppdp.exejppjv.exexflffxl.exebhhbth.exe1dppp.exepjpjd.exe1xlfxxx.exe5ffllrf.exehhbhhh.exeppvdj.exejvddd.exerlxlllf.exetthnnn.exejdppp.exelrffrrf.exehbbbbb.exe3vddp.exeddvvd.exerrrflrx.exentttnb.exevvvjp.exedpdvv.exefffxrxr.exebttnht.exe3hhhtt.exe9jvvd.exelxlllrr.exe5rlrllx.exehbtbtb.exedvjpp.exe9jjdv.exexffxrll.exe3rxxrxr.exe9hbttt.exehbhbtb.exevpvpd.exexrfxrlx.exefflfllr.exe9btnbb.exeddddv.exeddjjj.exexxlfffl.exehtthhb.exejjjdv.exe5xlrrfl.exepid process 4324 ffrxfrl.exe 2064 hbbtbb.exe 2536 rfrrrxx.exe 2524 tbnnnn.exe 4420 3dvjj.exe 3244 rllllxf.exe 2512 bbnnnn.exe 2532 ntthbt.exe 3480 jpvvd.exe 1264 htbhtn.exe 4444 jpvvd.exe 4876 vvjvv.exe 4872 3fflrrx.exe 4896 tttbnt.exe 1556 jjddj.exe 964 fxrfrxx.exe 1324 ddvjd.exe 5064 fllxrrl.exe 4480 nnhhhh.exe 5068 vppdp.exe 4132 jppjv.exe 1912 xflffxl.exe 2884 bhhbth.exe 4900 1dppp.exe 3524 pjpjd.exe 4528 1xlfxxx.exe 4668 5ffllrf.exe 3656 hhbhhh.exe 4916 ppvdj.exe 4268 jvddd.exe 396 rlxlllf.exe 5036 tthnnn.exe 3556 jdppp.exe 1948 lrffrrf.exe 3296 hbbbbb.exe 676 3vddp.exe 412 ddvvd.exe 1540 rrrflrx.exe 5112 ntttnb.exe 4112 vvvjp.exe 3412 dpdvv.exe 4160 fffxrxr.exe 5100 bttnht.exe 1852 3hhhtt.exe 4536 9jvvd.exe 1040 lxlllrr.exe 4592 5rlrllx.exe 1112 hbtbtb.exe 4212 dvjpp.exe 868 9jjdv.exe 4364 xffxrll.exe 4152 3rxxrxr.exe 1784 9hbttt.exe 4380 hbhbtb.exe 2348 vpvpd.exe 2536 xrfxrlx.exe 2564 fflfllr.exe 3584 9btnbb.exe 3244 ddddv.exe 3032 ddjjj.exe 3544 xxlfffl.exe 1484 htthhb.exe 1584 jjjdv.exe 2424 5xlrrfl.exe -
Processes:
resource yara_rule behavioral2/memory/652-0-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\ffrxfrl.exe upx behavioral2/memory/652-5-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4324-7-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\hbbtbb.exe upx behavioral2/memory/4324-14-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2064-12-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\rfrrrxx.exe upx behavioral2/memory/2536-21-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\tbnnnn.exe upx behavioral2/memory/2524-32-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\rllllxf.exe upx C:\bbnnnn.exe upx behavioral2/memory/2512-44-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\ntthbt.exe upx behavioral2/memory/2532-57-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\jpvvd.exe upx \??\c:\htbhtn.exe upx behavioral2/memory/4876-75-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\3fflrrx.exe upx behavioral2/memory/4872-84-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\tttbnt.exe upx behavioral2/memory/1556-95-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\fxrfrxx.exe upx behavioral2/memory/964-102-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\fllxrrl.exe upx C:\vppdp.exe upx C:\xflffxl.exe upx \??\c:\bhhbth.exe upx C:\5ffllrf.exe upx \??\c:\hhbhhh.exe upx \??\c:\jvddd.exe upx \??\c:\rlxlllf.exe upx behavioral2/memory/1948-198-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/412-209-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4160-226-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4536-233-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4212-251-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4152-259-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3264-310-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1636-321-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3452-341-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/804-394-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3800-404-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/920-416-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2208-508-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2396-553-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/5068-561-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1008-566-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1548-590-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3960-633-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4752-668-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3532-701-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3664-729-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4696-737-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4604-860-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/692-892-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1720-876-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4784-808-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4776-777-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1352-752-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3892-748-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2324-738-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3932-730-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9e231f0def9dedf51cf37107bd2db9039cdcc423eaca7ba0d254adff738ef163.exeffrxfrl.exehbbtbb.exerfrrrxx.exetbnnnn.exe3dvjj.exerllllxf.exebbnnnn.exentthbt.exejpvvd.exehtbhtn.exejpvvd.exevvjvv.exe3fflrrx.exetttbnt.exejjddj.exefxrfrxx.exeddvjd.exefllxrrl.exennhhhh.exevppdp.exejppjv.exedescription pid process target process PID 652 wrote to memory of 4324 652 9e231f0def9dedf51cf37107bd2db9039cdcc423eaca7ba0d254adff738ef163.exe vddpv.exe PID 652 wrote to memory of 4324 652 9e231f0def9dedf51cf37107bd2db9039cdcc423eaca7ba0d254adff738ef163.exe vddpv.exe PID 652 wrote to memory of 4324 652 9e231f0def9dedf51cf37107bd2db9039cdcc423eaca7ba0d254adff738ef163.exe vddpv.exe PID 4324 wrote to memory of 2064 4324 ffrxfrl.exe frrfrlf.exe PID 4324 wrote to memory of 2064 4324 ffrxfrl.exe frrfrlf.exe PID 4324 wrote to memory of 2064 4324 ffrxfrl.exe frrfrlf.exe PID 2064 wrote to memory of 2536 2064 hbbtbb.exe rfrrrxx.exe PID 2064 wrote to memory of 2536 2064 hbbtbb.exe rfrrrxx.exe PID 2064 wrote to memory of 2536 2064 hbbtbb.exe rfrrrxx.exe PID 2536 wrote to memory of 2524 2536 rfrrrxx.exe tbnnnn.exe PID 2536 wrote to memory of 2524 2536 rfrrrxx.exe tbnnnn.exe PID 2536 wrote to memory of 2524 2536 rfrrrxx.exe tbnnnn.exe PID 2524 wrote to memory of 4420 2524 tbnnnn.exe 3dvjj.exe PID 2524 wrote to memory of 4420 2524 tbnnnn.exe 3dvjj.exe PID 2524 wrote to memory of 4420 2524 tbnnnn.exe 3dvjj.exe PID 4420 wrote to memory of 3244 4420 3dvjj.exe rllllxf.exe PID 4420 wrote to memory of 3244 4420 3dvjj.exe rllllxf.exe PID 4420 wrote to memory of 3244 4420 3dvjj.exe rllllxf.exe PID 3244 wrote to memory of 2512 3244 rllllxf.exe bbnnnn.exe PID 3244 wrote to memory of 2512 3244 rllllxf.exe bbnnnn.exe PID 3244 wrote to memory of 2512 3244 rllllxf.exe bbnnnn.exe PID 2512 wrote to memory of 2532 2512 bbnnnn.exe PID 2512 wrote to memory of 2532 2512 bbnnnn.exe PID 2512 wrote to memory of 2532 2512 bbnnnn.exe PID 2532 wrote to memory of 3480 2532 ntthbt.exe jpvvd.exe PID 2532 wrote to memory of 3480 2532 ntthbt.exe jpvvd.exe PID 2532 wrote to memory of 3480 2532 ntthbt.exe jpvvd.exe PID 3480 wrote to memory of 1264 3480 jpvvd.exe htbhtn.exe PID 3480 wrote to memory of 1264 3480 jpvvd.exe htbhtn.exe PID 3480 wrote to memory of 1264 3480 jpvvd.exe htbhtn.exe PID 1264 wrote to memory of 4444 1264 htbhtn.exe jpvvd.exe PID 1264 wrote to memory of 4444 1264 htbhtn.exe jpvvd.exe PID 1264 wrote to memory of 4444 1264 htbhtn.exe jpvvd.exe PID 4444 wrote to memory of 4876 4444 jpvvd.exe vvjvv.exe PID 4444 wrote to memory of 4876 4444 jpvvd.exe vvjvv.exe PID 4444 wrote to memory of 4876 4444 jpvvd.exe vvjvv.exe PID 4876 wrote to memory of 4872 4876 vvjvv.exe 3fflrrx.exe PID 4876 wrote to memory of 4872 4876 vvjvv.exe 3fflrrx.exe PID 4876 wrote to memory of 4872 4876 vvjvv.exe 3fflrrx.exe PID 4872 wrote to memory of 4896 4872 3fflrrx.exe tttbnt.exe PID 4872 wrote to memory of 4896 4872 3fflrrx.exe tttbnt.exe PID 4872 wrote to memory of 4896 4872 3fflrrx.exe tttbnt.exe PID 4896 wrote to memory of 1556 4896 tttbnt.exe jjddj.exe PID 4896 wrote to memory of 1556 4896 tttbnt.exe jjddj.exe PID 4896 wrote to memory of 1556 4896 tttbnt.exe jjddj.exe PID 1556 wrote to memory of 964 1556 jjddj.exe PID 1556 wrote to memory of 964 1556 jjddj.exe PID 1556 wrote to memory of 964 1556 jjddj.exe PID 964 wrote to memory of 1324 964 fxrfrxx.exe ddvjd.exe PID 964 wrote to memory of 1324 964 fxrfrxx.exe ddvjd.exe PID 964 wrote to memory of 1324 964 fxrfrxx.exe ddvjd.exe PID 1324 wrote to memory of 5064 1324 ddvjd.exe fllxrrl.exe PID 1324 wrote to memory of 5064 1324 ddvjd.exe fllxrrl.exe PID 1324 wrote to memory of 5064 1324 ddvjd.exe fllxrrl.exe PID 5064 wrote to memory of 4480 5064 fllxrrl.exe nnhhhh.exe PID 5064 wrote to memory of 4480 5064 fllxrrl.exe nnhhhh.exe PID 5064 wrote to memory of 4480 5064 fllxrrl.exe nnhhhh.exe PID 4480 wrote to memory of 5068 4480 nnhhhh.exe PID 4480 wrote to memory of 5068 4480 nnhhhh.exe PID 4480 wrote to memory of 5068 4480 nnhhhh.exe PID 5068 wrote to memory of 4132 5068 vppdp.exe PID 5068 wrote to memory of 4132 5068 vppdp.exe PID 5068 wrote to memory of 4132 5068 vppdp.exe PID 4132 wrote to memory of 1912 4132 jppjv.exe xflffxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e231f0def9dedf51cf37107bd2db9039cdcc423eaca7ba0d254adff738ef163.exe"C:\Users\Admin\AppData\Local\Temp\9e231f0def9dedf51cf37107bd2db9039cdcc423eaca7ba0d254adff738ef163.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrxfrl.exec:\ffrxfrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbtbb.exec:\hbbtbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfrrrxx.exec:\rfrrrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbnnnn.exec:\tbnnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3dvjj.exec:\3dvjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rllllxf.exec:\rllllxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbnnnn.exec:\bbnnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntthbt.exec:\ntthbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpvvd.exec:\jpvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htbhtn.exec:\htbhtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpvvd.exec:\jpvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjvv.exec:\vvjvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3fflrrx.exec:\3fflrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tttbnt.exec:\tttbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjddj.exec:\jjddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrfrxx.exec:\fxrfrxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddvjd.exec:\ddvjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fllxrrl.exec:\fllxrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhhhh.exec:\nnhhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vppdp.exec:\vppdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jppjv.exec:\jppjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xflffxl.exec:\xflffxl.exe23⤵
- Executes dropped EXE
-
\??\c:\bhhbth.exec:\bhhbth.exe24⤵
- Executes dropped EXE
-
\??\c:\1dppp.exec:\1dppp.exe25⤵
- Executes dropped EXE
-
\??\c:\pjpjd.exec:\pjpjd.exe26⤵
- Executes dropped EXE
-
\??\c:\1xlfxxx.exec:\1xlfxxx.exe27⤵
- Executes dropped EXE
-
\??\c:\5ffllrf.exec:\5ffllrf.exe28⤵
- Executes dropped EXE
-
\??\c:\hhbhhh.exec:\hhbhhh.exe29⤵
- Executes dropped EXE
-
\??\c:\ppvdj.exec:\ppvdj.exe30⤵
- Executes dropped EXE
-
\??\c:\jvddd.exec:\jvddd.exe31⤵
- Executes dropped EXE
-
\??\c:\rlxlllf.exec:\rlxlllf.exe32⤵
- Executes dropped EXE
-
\??\c:\tthnnn.exec:\tthnnn.exe33⤵
- Executes dropped EXE
-
\??\c:\jdppp.exec:\jdppp.exe34⤵
- Executes dropped EXE
-
\??\c:\lrffrrf.exec:\lrffrrf.exe35⤵
- Executes dropped EXE
-
\??\c:\hbbbbb.exec:\hbbbbb.exe36⤵
- Executes dropped EXE
-
\??\c:\3vddp.exec:\3vddp.exe37⤵
- Executes dropped EXE
-
\??\c:\ddvvd.exec:\ddvvd.exe38⤵
- Executes dropped EXE
-
\??\c:\rrrflrx.exec:\rrrflrx.exe39⤵
- Executes dropped EXE
-
\??\c:\ntttnb.exec:\ntttnb.exe40⤵
- Executes dropped EXE
-
\??\c:\vvvjp.exec:\vvvjp.exe41⤵
- Executes dropped EXE
-
\??\c:\dpdvv.exec:\dpdvv.exe42⤵
- Executes dropped EXE
-
\??\c:\fffxrxr.exec:\fffxrxr.exe43⤵
- Executes dropped EXE
-
\??\c:\bttnht.exec:\bttnht.exe44⤵
- Executes dropped EXE
-
\??\c:\3hhhtt.exec:\3hhhtt.exe45⤵
- Executes dropped EXE
-
\??\c:\9jvvd.exec:\9jvvd.exe46⤵
- Executes dropped EXE
-
\??\c:\lxlllrr.exec:\lxlllrr.exe47⤵
- Executes dropped EXE
-
\??\c:\5rlrllx.exec:\5rlrllx.exe48⤵
- Executes dropped EXE
-
\??\c:\hbtbtb.exec:\hbtbtb.exe49⤵
- Executes dropped EXE
-
\??\c:\dvjpp.exec:\dvjpp.exe50⤵
- Executes dropped EXE
-
\??\c:\9jjdv.exec:\9jjdv.exe51⤵
- Executes dropped EXE
-
\??\c:\xffxrll.exec:\xffxrll.exe52⤵
- Executes dropped EXE
-
\??\c:\3rxxrxr.exec:\3rxxrxr.exe53⤵
- Executes dropped EXE
-
\??\c:\9hbttt.exec:\9hbttt.exe54⤵
- Executes dropped EXE
-
\??\c:\hbhbtb.exec:\hbhbtb.exe55⤵
- Executes dropped EXE
-
\??\c:\vpvpd.exec:\vpvpd.exe56⤵
- Executes dropped EXE
-
\??\c:\xrfxrlx.exec:\xrfxrlx.exe57⤵
- Executes dropped EXE
-
\??\c:\fflfllr.exec:\fflfllr.exe58⤵
- Executes dropped EXE
-
\??\c:\9btnbb.exec:\9btnbb.exe59⤵
- Executes dropped EXE
-
\??\c:\ddddv.exec:\ddddv.exe60⤵
- Executes dropped EXE
-
\??\c:\ddjjj.exec:\ddjjj.exe61⤵
- Executes dropped EXE
-
\??\c:\xxlfffl.exec:\xxlfffl.exe62⤵
- Executes dropped EXE
-
\??\c:\htthhb.exec:\htthhb.exe63⤵
- Executes dropped EXE
-
\??\c:\jjjdv.exec:\jjjdv.exe64⤵
- Executes dropped EXE
-
\??\c:\5xlrrfl.exec:\5xlrrfl.exe65⤵
- Executes dropped EXE
-
\??\c:\xrlflxf.exec:\xrlflxf.exe66⤵
-
\??\c:\bnbnnh.exec:\bnbnnh.exe67⤵
-
\??\c:\vpppp.exec:\vpppp.exe68⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe69⤵
-
\??\c:\7xxxrrl.exec:\7xxxrrl.exe70⤵
-
\??\c:\vdjdd.exec:\vdjdd.exe71⤵
-
\??\c:\1jddv.exec:\1jddv.exe72⤵
-
\??\c:\xllrxrx.exec:\xllrxrx.exe73⤵
-
\??\c:\bhhhnn.exec:\bhhhnn.exe74⤵
-
\??\c:\tbtthh.exec:\tbtthh.exe75⤵
-
\??\c:\ppppp.exec:\ppppp.exe76⤵
-
\??\c:\rlxxrlx.exec:\rlxxrlx.exe77⤵
-
\??\c:\rxfrrlf.exec:\rxfrrlf.exe78⤵
-
\??\c:\7btnhh.exec:\7btnhh.exe79⤵
-
\??\c:\dvpjj.exec:\dvpjj.exe80⤵
-
\??\c:\ppdpj.exec:\ppdpj.exe81⤵
-
\??\c:\xrrffxx.exec:\xrrffxx.exe82⤵
-
\??\c:\tthbbh.exec:\tthbbh.exe83⤵
-
\??\c:\hntnnh.exec:\hntnnh.exe84⤵
-
\??\c:\dvvdd.exec:\dvvdd.exe85⤵
-
\??\c:\frlfxff.exec:\frlfxff.exe86⤵
-
\??\c:\fllfrll.exec:\fllfrll.exe87⤵
-
\??\c:\ntnntt.exec:\ntnntt.exe88⤵
-
\??\c:\ttbnnh.exec:\ttbnnh.exe89⤵
-
\??\c:\jjdpp.exec:\jjdpp.exe90⤵
-
\??\c:\frrlffx.exec:\frrlffx.exe91⤵
-
\??\c:\xlrxflr.exec:\xlrxflr.exe92⤵
-
\??\c:\btbhbn.exec:\btbhbn.exe93⤵
-
\??\c:\vppjd.exec:\vppjd.exe94⤵
-
\??\c:\ppddj.exec:\ppddj.exe95⤵
-
\??\c:\7lflxrf.exec:\7lflxrf.exe96⤵
-
\??\c:\nbbbbb.exec:\nbbbbb.exe97⤵
-
\??\c:\nhtntt.exec:\nhtntt.exe98⤵
-
\??\c:\jdppj.exec:\jdppj.exe99⤵
-
\??\c:\7jjvd.exec:\7jjvd.exe100⤵
-
\??\c:\xrrrlll.exec:\xrrrlll.exe101⤵
-
\??\c:\hbnbbb.exec:\hbnbbb.exe102⤵
-
\??\c:\bnnnnn.exec:\bnnnnn.exe103⤵
-
\??\c:\dpdvj.exec:\dpdvj.exe104⤵
-
\??\c:\9djjj.exec:\9djjj.exe105⤵
-
\??\c:\9xxxfff.exec:\9xxxfff.exe106⤵
-
\??\c:\7hnhhh.exec:\7hnhhh.exe107⤵
-
\??\c:\hnntth.exec:\hnntth.exe108⤵
-
\??\c:\vvdvv.exec:\vvdvv.exe109⤵
-
\??\c:\jjddd.exec:\jjddd.exe110⤵
-
\??\c:\fxflfxr.exec:\fxflfxr.exe111⤵
-
\??\c:\3ffxxfx.exec:\3ffxxfx.exe112⤵
-
\??\c:\ntbtnt.exec:\ntbtnt.exe113⤵
-
\??\c:\nthtnh.exec:\nthtnh.exe114⤵
-
\??\c:\jjvvp.exec:\jjvvp.exe115⤵
-
\??\c:\llfffff.exec:\llfffff.exe116⤵
-
\??\c:\rxxrrll.exec:\rxxrrll.exe117⤵
-
\??\c:\hhtnhb.exec:\hhtnhb.exe118⤵
-
\??\c:\jvvpd.exec:\jvvpd.exe119⤵
-
\??\c:\vpppp.exec:\vpppp.exe120⤵
-
\??\c:\3xffxlx.exec:\3xffxlx.exe121⤵
-
\??\c:\fflxrrr.exec:\fflxrrr.exe122⤵
-
\??\c:\9bbhbb.exec:\9bbhbb.exe123⤵
-
\??\c:\thhhbt.exec:\thhhbt.exe124⤵
-
\??\c:\7dpjd.exec:\7dpjd.exe125⤵
-
\??\c:\jppdv.exec:\jppdv.exe126⤵
-
\??\c:\xrxrflr.exec:\xrxrflr.exe127⤵
-
\??\c:\fffxllx.exec:\fffxllx.exe128⤵
-
\??\c:\1ttnhh.exec:\1ttnhh.exe129⤵
-
\??\c:\pvddj.exec:\pvddj.exe130⤵
-
\??\c:\vdjpv.exec:\vdjpv.exe131⤵
-
\??\c:\lfllllr.exec:\lfllllr.exe132⤵
-
\??\c:\1ffrlfr.exec:\1ffrlfr.exe133⤵
-
\??\c:\bnnbnb.exec:\bnnbnb.exe134⤵
-
\??\c:\httnnt.exec:\httnnt.exe135⤵
-
\??\c:\dpddd.exec:\dpddd.exe136⤵
-
\??\c:\pvdpj.exec:\pvdpj.exe137⤵
-
\??\c:\xxffllf.exec:\xxffllf.exe138⤵
-
\??\c:\fflxllf.exec:\fflxllf.exe139⤵
-
\??\c:\7nntnb.exec:\7nntnb.exe140⤵
-
\??\c:\tnhhbh.exec:\tnhhbh.exe141⤵
-
\??\c:\jddvv.exec:\jddvv.exe142⤵
-
\??\c:\pvvvp.exec:\pvvvp.exe143⤵
-
\??\c:\fxfffff.exec:\fxfffff.exe144⤵
-
\??\c:\httnnh.exec:\httnnh.exe145⤵
-
\??\c:\htthth.exec:\htthth.exe146⤵
-
\??\c:\dppjd.exec:\dppjd.exe147⤵
-
\??\c:\llxrlfr.exec:\llxrlfr.exe148⤵
-
\??\c:\7rrrrxx.exec:\7rrrrxx.exe149⤵
-
\??\c:\nttnhb.exec:\nttnhb.exe150⤵
-
\??\c:\ddddv.exec:\ddddv.exe151⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe152⤵
-
\??\c:\rlrrlff.exec:\rlrrlff.exe153⤵
-
\??\c:\9llfrxf.exec:\9llfrxf.exe154⤵
-
\??\c:\tnttnn.exec:\tnttnn.exe155⤵
-
\??\c:\hntnhh.exec:\hntnhh.exe156⤵
-
\??\c:\lllffxx.exec:\lllffxx.exe157⤵
-
\??\c:\hbhbtt.exec:\hbhbtt.exe158⤵
-
\??\c:\bhttnh.exec:\bhttnh.exe159⤵
-
\??\c:\dpvvd.exec:\dpvvd.exe160⤵
-
\??\c:\jjdvv.exec:\jjdvv.exe161⤵
-
\??\c:\ffxlfrl.exec:\ffxlfrl.exe162⤵
-
\??\c:\xffxrxr.exec:\xffxrxr.exe163⤵
-
\??\c:\hbhtnb.exec:\hbhtnb.exe164⤵
-
\??\c:\bhnhnb.exec:\bhnhnb.exe165⤵
-
\??\c:\pjppd.exec:\pjppd.exe166⤵
-
\??\c:\jddvv.exec:\jddvv.exe167⤵
-
\??\c:\frfffrr.exec:\frfffrr.exe168⤵
-
\??\c:\lxrlrrl.exec:\lxrlrrl.exe169⤵
-
\??\c:\btnhhn.exec:\btnhhn.exe170⤵
-
\??\c:\bttttt.exec:\bttttt.exe171⤵
-
\??\c:\vpppj.exec:\vpppj.exe172⤵
-
\??\c:\1vvdd.exec:\1vvdd.exe173⤵
-
\??\c:\xxffrrx.exec:\xxffrrx.exe174⤵
-
\??\c:\xxllrxf.exec:\xxllrxf.exe175⤵
-
\??\c:\1hhtht.exec:\1hhtht.exe176⤵
-
\??\c:\djjvd.exec:\djjvd.exe177⤵
-
\??\c:\djdpj.exec:\djdpj.exe178⤵
-
\??\c:\lfrrfff.exec:\lfrrfff.exe179⤵
-
\??\c:\rlrlxfl.exec:\rlrlxfl.exe180⤵
-
\??\c:\tbnbbb.exec:\tbnbbb.exe181⤵
-
\??\c:\jvvvv.exec:\jvvvv.exe182⤵
-
\??\c:\ppjvd.exec:\ppjvd.exe183⤵
-
\??\c:\flxxfrr.exec:\flxxfrr.exe184⤵
-
\??\c:\frfrfrx.exec:\frfrfrx.exe185⤵
-
\??\c:\bhbntt.exec:\bhbntt.exe186⤵
-
\??\c:\vpvpp.exec:\vpvpp.exe187⤵
-
\??\c:\9jvdd.exec:\9jvdd.exe188⤵
-
\??\c:\xflrffl.exec:\xflrffl.exe189⤵
-
\??\c:\fxrrlrl.exec:\fxrrlrl.exe190⤵
-
\??\c:\tnbhbh.exec:\tnbhbh.exe191⤵
-
\??\c:\bthnnt.exec:\bthnnt.exe192⤵
-
\??\c:\ppvpd.exec:\ppvpd.exe193⤵
-
\??\c:\jvvvj.exec:\jvvvj.exe194⤵
-
\??\c:\rxxxxlf.exec:\rxxxxlf.exe195⤵
-
\??\c:\rlxrlrf.exec:\rlxrlrf.exe196⤵
-
\??\c:\nnhbbh.exec:\nnhbbh.exe197⤵
-
\??\c:\ttbtbh.exec:\ttbtbh.exe198⤵
-
\??\c:\5djpp.exec:\5djpp.exe199⤵
-
\??\c:\jpdpj.exec:\jpdpj.exe200⤵
-
\??\c:\llrfffl.exec:\llrfffl.exe201⤵
-
\??\c:\rrxxxff.exec:\rrxxxff.exe202⤵
-
\??\c:\thtttt.exec:\thtttt.exe203⤵
-
\??\c:\vjppp.exec:\vjppp.exe204⤵
-
\??\c:\1pjpd.exec:\1pjpd.exe205⤵
-
\??\c:\lrxxlrr.exec:\lrxxlrr.exe206⤵
-
\??\c:\rrflxfl.exec:\rrflxfl.exe207⤵
-
\??\c:\nbttnt.exec:\nbttnt.exe208⤵
-
\??\c:\tntbbh.exec:\tntbbh.exe209⤵
-
\??\c:\7vvvv.exec:\7vvvv.exe210⤵
-
\??\c:\9dddd.exec:\9dddd.exe211⤵
-
\??\c:\lxxrxfr.exec:\lxxrxfr.exe212⤵
-
\??\c:\5xlrrxx.exec:\5xlrrxx.exe213⤵
-
\??\c:\tntttt.exec:\tntttt.exe214⤵
-
\??\c:\bhtnbh.exec:\bhtnbh.exe215⤵
-
\??\c:\pppjj.exec:\pppjj.exe216⤵
-
\??\c:\djvvd.exec:\djvvd.exe217⤵
-
\??\c:\xxrrfxr.exec:\xxrrfxr.exe218⤵
-
\??\c:\tnnhhb.exec:\tnnhhb.exe219⤵
-
\??\c:\thttbb.exec:\thttbb.exe220⤵
-
\??\c:\bthbbn.exec:\bthbbn.exe221⤵
-
\??\c:\vdpjp.exec:\vdpjp.exe222⤵
-
\??\c:\jpvpv.exec:\jpvpv.exe223⤵
-
\??\c:\ffxrlrl.exec:\ffxrlrl.exe224⤵
-
\??\c:\rlxrffr.exec:\rlxrffr.exe225⤵
-
\??\c:\httttt.exec:\httttt.exe226⤵
-
\??\c:\tbhttn.exec:\tbhttn.exe227⤵
-
\??\c:\jpvpd.exec:\jpvpd.exe228⤵
-
\??\c:\frlfxfx.exec:\frlfxfx.exe229⤵
-
\??\c:\xrrlfff.exec:\xrrlfff.exe230⤵
-
\??\c:\htnnhh.exec:\htnnhh.exe231⤵
-
\??\c:\hhnnnn.exec:\hhnnnn.exe232⤵
-
\??\c:\vjdvv.exec:\vjdvv.exe233⤵
-
\??\c:\jvvvv.exec:\jvvvv.exe234⤵
-
\??\c:\jdddv.exec:\jdddv.exe235⤵
-
\??\c:\fflllrl.exec:\fflllrl.exe236⤵
-
\??\c:\frxrrxx.exec:\frxrrxx.exe237⤵
-
\??\c:\tnhhbh.exec:\tnhhbh.exe238⤵
-
\??\c:\bbtnnn.exec:\bbtnnn.exe239⤵
-
\??\c:\ppppd.exec:\ppppd.exe240⤵
-
\??\c:\vpjjd.exec:\vpjjd.exe241⤵