Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 23:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
c01ba660ee5bd25cc236b4be7fed331607a1c7747b0cae28b44ec56334f7a6c9.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
c01ba660ee5bd25cc236b4be7fed331607a1c7747b0cae28b44ec56334f7a6c9.exe
-
Size
467KB
-
MD5
191867ad95fdaacce91c6a52723047bb
-
SHA1
4fa23d7525f9cfcbbdceb1266cc50ef67ff3c896
-
SHA256
c01ba660ee5bd25cc236b4be7fed331607a1c7747b0cae28b44ec56334f7a6c9
-
SHA512
a465f2d570e8c96a01b17f2d624ea60885fd2fe3cf7ac6c9ec3aa4e2af4d3567ed81e53e296dd384e2ee383f0bb7cd02d4f51636b0b7642246f5c67bb1e53e22
-
SSDEEP
12288:n3C9uDVw6326pKZ9asZqoZHz+evcn0Meh2FK:Su326p0aroZt0S
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral2/memory/976-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-325-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2508-348-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-366-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-385-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-409-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/976-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/976-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0010000000023153-6.dat UPX behavioral2/memory/976-7-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2056-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0008000000023202-14.dat UPX behavioral2/files/0x0006000000023207-18.dat UPX behavioral2/memory/4384-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1188-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0006000000023208-28.dat UPX behavioral2/memory/4084-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4084-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0006000000023209-36.dat UPX behavioral2/memory/208-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/208-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000600000002320a-46.dat UPX behavioral2/memory/4844-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4844-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000600000002320b-54.dat UPX behavioral2/memory/4396-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000600000002320d-61.dat UPX behavioral2/memory/2352-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2352-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000600000002320e-68.dat UPX behavioral2/files/0x0008000000023203-73.dat UPX behavioral2/memory/1308-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000600000002320f-80.dat UPX behavioral2/memory/5116-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5116-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0006000000023210-89.dat UPX behavioral2/memory/3400-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0006000000023211-95.dat UPX behavioral2/files/0x0006000000023212-101.dat UPX behavioral2/memory/3516-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0006000000023213-108.dat UPX behavioral2/memory/3020-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0006000000023214-116.dat UPX behavioral2/memory/1816-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0006000000023215-124.dat UPX behavioral2/files/0x0006000000023216-128.dat UPX behavioral2/memory/5112-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0006000000023217-135.dat UPX behavioral2/memory/1652-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0006000000023218-144.dat UPX behavioral2/memory/4136-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0006000000023219-149.dat UPX behavioral2/memory/4220-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000600000002321a-158.dat UPX behavioral2/memory/4220-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000600000002321b-163.dat UPX behavioral2/memory/2904-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4408-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000600000002321c-170.dat UPX behavioral2/memory/4780-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x000600000002321d-177.dat UPX behavioral2/files/0x000600000002321e-185.dat UPX behavioral2/files/0x000600000002321f-189.dat UPX behavioral2/memory/4512-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0006000000023220-197.dat UPX behavioral2/memory/4724-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4724-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0006000000023221-205.dat UPX behavioral2/memory/3540-209-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/files/0x0006000000023222-212.dat UPX -
Executes dropped EXE 64 IoCs
pid Process 2056 xffrfxl.exe 4384 pdvpj.exe 1188 5bnnbh.exe 4084 lxrfxrl.exe 208 xllxxrr.exe 4844 jjpjv.exe 4396 xrrfxrl.exe 2352 7jvjd.exe 3588 jdvjv.exe 1308 thhnbn.exe 5116 ffxlxrl.exe 3400 1jppj.exe 400 hhbbbn.exe 3516 3lfrfxr.exe 3020 nnbthb.exe 1816 fxfxfxf.exe 3180 dddvp.exe 5112 jvpvj.exe 1652 nbtbnt.exe 4136 jvddv.exe 4220 nbthtn.exe 2904 xlrlffx.exe 4408 3vvpj.exe 4780 bbthtt.exe 4032 7ppjd.exe 2072 tnbtbt.exe 4512 5lfflxr.exe 4724 pvvvp.exe 3540 lfrlfff.exe 4480 9ddvv.exe 4040 vvpvp.exe 836 1thbnh.exe 3152 pdjvj.exe 2004 bntnhh.exe 2380 vpjdj.exe 4596 rlxrlrr.exe 3032 3vjdp.exe 2068 rfxllff.exe 4260 bhnhbt.exe 3552 vvppj.exe 1740 ffxlxrl.exe 4584 dddvd.exe 3060 xflrfxr.exe 4872 tnhthb.exe 1892 dvdvv.exe 2736 1ppvp.exe 4036 5nhtnn.exe 2356 jvvjd.exe 2168 ntbnbt.exe 4396 xffrfxl.exe 4836 nhnhbb.exe 3312 vpjdp.exe 1988 1rxlxrf.exe 372 hnthtn.exe 1040 xlrlfxf.exe 4324 lxxrffx.exe 2508 dppjv.exe 4240 xxfrlfl.exe 400 nbtbbn.exe 2252 5jdpj.exe 944 9rfxlrl.exe 3168 5nbthh.exe 1912 pvpjp.exe 3344 hnnhbt.exe -
resource yara_rule behavioral2/memory/976-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1308-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-297-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-307-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2508-348-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-366-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-372-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-398-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-409-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 976 wrote to memory of 2056 976 c01ba660ee5bd25cc236b4be7fed331607a1c7747b0cae28b44ec56334f7a6c9.exe 85 PID 976 wrote to memory of 2056 976 c01ba660ee5bd25cc236b4be7fed331607a1c7747b0cae28b44ec56334f7a6c9.exe 85 PID 976 wrote to memory of 2056 976 c01ba660ee5bd25cc236b4be7fed331607a1c7747b0cae28b44ec56334f7a6c9.exe 85 PID 2056 wrote to memory of 4384 2056 xffrfxl.exe 86 PID 2056 wrote to memory of 4384 2056 xffrfxl.exe 86 PID 2056 wrote to memory of 4384 2056 xffrfxl.exe 86 PID 4384 wrote to memory of 1188 4384 pdvpj.exe 87 PID 4384 wrote to memory of 1188 4384 pdvpj.exe 87 PID 4384 wrote to memory of 1188 4384 pdvpj.exe 87 PID 1188 wrote to memory of 4084 1188 5bnnbh.exe 88 PID 1188 wrote to memory of 4084 1188 5bnnbh.exe 88 PID 1188 wrote to memory of 4084 1188 5bnnbh.exe 88 PID 4084 wrote to memory of 208 4084 lxrfxrl.exe 89 PID 4084 wrote to memory of 208 4084 lxrfxrl.exe 89 PID 4084 wrote to memory of 208 4084 lxrfxrl.exe 89 PID 208 wrote to memory of 4844 208 xllxxrr.exe 90 PID 208 wrote to memory of 4844 208 xllxxrr.exe 90 PID 208 wrote to memory of 4844 208 xllxxrr.exe 90 PID 4844 wrote to memory of 4396 4844 jjpjv.exe 91 PID 4844 wrote to memory of 4396 4844 jjpjv.exe 91 PID 4844 wrote to memory of 4396 4844 jjpjv.exe 91 PID 4396 wrote to memory of 2352 4396 xrrfxrl.exe 92 PID 4396 wrote to memory of 2352 4396 xrrfxrl.exe 92 PID 4396 wrote to memory of 2352 4396 xrrfxrl.exe 92 PID 2352 wrote to memory of 3588 2352 7jvjd.exe 93 PID 2352 wrote to memory of 3588 2352 7jvjd.exe 93 PID 2352 wrote to memory of 3588 2352 7jvjd.exe 93 PID 3588 wrote to memory of 1308 3588 jdvjv.exe 94 PID 3588 wrote to memory of 1308 3588 jdvjv.exe 94 PID 3588 wrote to memory of 1308 3588 jdvjv.exe 94 PID 1308 wrote to memory of 5116 1308 thhnbn.exe 95 PID 1308 wrote to memory of 5116 1308 thhnbn.exe 95 PID 1308 wrote to memory of 5116 1308 thhnbn.exe 95 PID 5116 wrote to memory of 3400 5116 ffxlxrl.exe 96 PID 5116 wrote to memory of 3400 5116 ffxlxrl.exe 96 PID 5116 wrote to memory of 3400 5116 ffxlxrl.exe 96 PID 3400 wrote to memory of 400 3400 1jppj.exe 97 PID 3400 wrote to memory of 400 3400 1jppj.exe 97 PID 3400 wrote to memory of 400 3400 1jppj.exe 97 PID 400 wrote to memory of 3516 400 hhbbbn.exe 98 PID 400 wrote to memory of 3516 400 hhbbbn.exe 98 PID 400 wrote to memory of 3516 400 hhbbbn.exe 98 PID 3516 wrote to memory of 3020 3516 3lfrfxr.exe 99 PID 3516 wrote to memory of 3020 3516 3lfrfxr.exe 99 PID 3516 wrote to memory of 3020 3516 3lfrfxr.exe 99 PID 3020 wrote to memory of 1816 3020 nnbthb.exe 100 PID 3020 wrote to memory of 1816 3020 nnbthb.exe 100 PID 3020 wrote to memory of 1816 3020 nnbthb.exe 100 PID 1816 wrote to memory of 3180 1816 fxfxfxf.exe 101 PID 1816 wrote to memory of 3180 1816 fxfxfxf.exe 101 PID 1816 wrote to memory of 3180 1816 fxfxfxf.exe 101 PID 3180 wrote to memory of 5112 3180 dddvp.exe 102 PID 3180 wrote to memory of 5112 3180 dddvp.exe 102 PID 3180 wrote to memory of 5112 3180 dddvp.exe 102 PID 5112 wrote to memory of 1652 5112 jvpvj.exe 103 PID 5112 wrote to memory of 1652 5112 jvpvj.exe 103 PID 5112 wrote to memory of 1652 5112 jvpvj.exe 103 PID 1652 wrote to memory of 4136 1652 nbtbnt.exe 104 PID 1652 wrote to memory of 4136 1652 nbtbnt.exe 104 PID 1652 wrote to memory of 4136 1652 nbtbnt.exe 104 PID 4136 wrote to memory of 4220 4136 jvddv.exe 105 PID 4136 wrote to memory of 4220 4136 jvddv.exe 105 PID 4136 wrote to memory of 4220 4136 jvddv.exe 105 PID 4220 wrote to memory of 2904 4220 nbthtn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\c01ba660ee5bd25cc236b4be7fed331607a1c7747b0cae28b44ec56334f7a6c9.exe"C:\Users\Admin\AppData\Local\Temp\c01ba660ee5bd25cc236b4be7fed331607a1c7747b0cae28b44ec56334f7a6c9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\xffrfxl.exec:\xffrfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\pdvpj.exec:\pdvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\5bnnbh.exec:\5bnnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\lxrfxrl.exec:\lxrfxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\xllxxrr.exec:\xllxxrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\jjpjv.exec:\jjpjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\7jvjd.exec:\7jvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\jdvjv.exec:\jdvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\thhnbn.exec:\thhnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\ffxlxrl.exec:\ffxlxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\1jppj.exec:\1jppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\hhbbbn.exec:\hhbbbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\3lfrfxr.exec:\3lfrfxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\nnbthb.exec:\nnbthb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\fxfxfxf.exec:\fxfxfxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\dddvp.exec:\dddvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\jvpvj.exec:\jvpvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\nbtbnt.exec:\nbtbnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\jvddv.exec:\jvddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\nbthtn.exec:\nbthtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\xlrlffx.exec:\xlrlffx.exe23⤵
- Executes dropped EXE
PID:2904 -
\??\c:\3vvpj.exec:\3vvpj.exe24⤵
- Executes dropped EXE
PID:4408 -
\??\c:\bbthtt.exec:\bbthtt.exe25⤵
- Executes dropped EXE
PID:4780 -
\??\c:\7ppjd.exec:\7ppjd.exe26⤵
- Executes dropped EXE
PID:4032 -
\??\c:\tnbtbt.exec:\tnbtbt.exe27⤵
- Executes dropped EXE
PID:2072 -
\??\c:\5lfflxr.exec:\5lfflxr.exe28⤵
- Executes dropped EXE
PID:4512 -
\??\c:\pvvvp.exec:\pvvvp.exe29⤵
- Executes dropped EXE
PID:4724 -
\??\c:\lfrlfff.exec:\lfrlfff.exe30⤵
- Executes dropped EXE
PID:3540 -
\??\c:\9ddvv.exec:\9ddvv.exe31⤵
- Executes dropped EXE
PID:4480 -
\??\c:\vvpvp.exec:\vvpvp.exe32⤵
- Executes dropped EXE
PID:4040 -
\??\c:\1thbnh.exec:\1thbnh.exe33⤵
- Executes dropped EXE
PID:836 -
\??\c:\pdjvj.exec:\pdjvj.exe34⤵
- Executes dropped EXE
PID:3152 -
\??\c:\bntnhh.exec:\bntnhh.exe35⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vpjdj.exec:\vpjdj.exe36⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rlxrlrr.exec:\rlxrlrr.exe37⤵
- Executes dropped EXE
PID:4596 -
\??\c:\3vjdp.exec:\3vjdp.exe38⤵
- Executes dropped EXE
PID:3032 -
\??\c:\rfxllff.exec:\rfxllff.exe39⤵
- Executes dropped EXE
PID:2068 -
\??\c:\bhnhbt.exec:\bhnhbt.exe40⤵
- Executes dropped EXE
PID:4260 -
\??\c:\vvppj.exec:\vvppj.exe41⤵
- Executes dropped EXE
PID:3552 -
\??\c:\ffxlxrl.exec:\ffxlxrl.exe42⤵
- Executes dropped EXE
PID:1740 -
\??\c:\dddvd.exec:\dddvd.exe43⤵
- Executes dropped EXE
PID:4584 -
\??\c:\xflrfxr.exec:\xflrfxr.exe44⤵
- Executes dropped EXE
PID:3060 -
\??\c:\tnhthb.exec:\tnhthb.exe45⤵
- Executes dropped EXE
PID:4872 -
\??\c:\dvdvv.exec:\dvdvv.exe46⤵
- Executes dropped EXE
PID:1892 -
\??\c:\1ppvp.exec:\1ppvp.exe47⤵
- Executes dropped EXE
PID:2736 -
\??\c:\5nhtnn.exec:\5nhtnn.exe48⤵
- Executes dropped EXE
PID:4036 -
\??\c:\jvvjd.exec:\jvvjd.exe49⤵
- Executes dropped EXE
PID:2356 -
\??\c:\ntbnbt.exec:\ntbnbt.exe50⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xffrfxl.exec:\xffrfxl.exe51⤵
- Executes dropped EXE
PID:4396 -
\??\c:\nhnhbb.exec:\nhnhbb.exe52⤵
- Executes dropped EXE
PID:4836 -
\??\c:\vpjdp.exec:\vpjdp.exe53⤵
- Executes dropped EXE
PID:3312 -
\??\c:\1rxlxrf.exec:\1rxlxrf.exe54⤵
- Executes dropped EXE
PID:1988 -
\??\c:\hnthtn.exec:\hnthtn.exe55⤵
- Executes dropped EXE
PID:372 -
\??\c:\xlrlfxf.exec:\xlrlfxf.exe56⤵
- Executes dropped EXE
PID:1040 -
\??\c:\lxxrffx.exec:\lxxrffx.exe57⤵
- Executes dropped EXE
PID:4324 -
\??\c:\dppjv.exec:\dppjv.exe58⤵
- Executes dropped EXE
PID:2508 -
\??\c:\xxfrlfl.exec:\xxfrlfl.exe59⤵
- Executes dropped EXE
PID:4240 -
\??\c:\nbtbbn.exec:\nbtbbn.exe60⤵
- Executes dropped EXE
PID:400 -
\??\c:\5jdpj.exec:\5jdpj.exe61⤵
- Executes dropped EXE
PID:2252 -
\??\c:\9rfxlrl.exec:\9rfxlrl.exe62⤵
- Executes dropped EXE
PID:944 -
\??\c:\5nbthh.exec:\5nbthh.exe63⤵
- Executes dropped EXE
PID:3168 -
\??\c:\pvpjp.exec:\pvpjp.exe64⤵
- Executes dropped EXE
PID:1912 -
\??\c:\hnnhbt.exec:\hnnhbt.exe65⤵
- Executes dropped EXE
PID:3344 -
\??\c:\jjpjp.exec:\jjpjp.exe66⤵PID:664
-
\??\c:\lxrlxrf.exec:\lxrlxrf.exe67⤵PID:640
-
\??\c:\vpjvj.exec:\vpjvj.exe68⤵PID:1432
-
\??\c:\tbhbhb.exec:\tbhbhb.exe69⤵PID:964
-
\??\c:\thbnbt.exec:\thbnbt.exe70⤵PID:4104
-
\??\c:\7lffrrl.exec:\7lffrrl.exe71⤵PID:2904
-
\??\c:\tnbtnh.exec:\tnbtnh.exe72⤵PID:3360
-
\??\c:\jjjvj.exec:\jjjvj.exe73⤵PID:3272
-
\??\c:\1bbnhb.exec:\1bbnhb.exe74⤵PID:5004
-
\??\c:\5pjdp.exec:\5pjdp.exe75⤵PID:2336
-
\??\c:\btthth.exec:\btthth.exe76⤵PID:3124
-
\??\c:\1lxrfxr.exec:\1lxrfxr.exe77⤵PID:4820
-
\??\c:\bnthht.exec:\bnthht.exe78⤵PID:3688
-
\??\c:\vjjdp.exec:\vjjdp.exe79⤵PID:1316
-
\??\c:\xfxlxlx.exec:\xfxlxlx.exe80⤵PID:3252
-
\??\c:\dppdp.exec:\dppdp.exe81⤵PID:3772
-
\??\c:\flrfrlf.exec:\flrfrlf.exe82⤵PID:1224
-
\??\c:\tnthbn.exec:\tnthbn.exe83⤵PID:836
-
\??\c:\3xxrfxl.exec:\3xxrfxl.exe84⤵PID:3152
-
\??\c:\7hhtnh.exec:\7hhtnh.exe85⤵PID:2004
-
\??\c:\fflxflx.exec:\fflxflx.exe86⤵PID:3368
-
\??\c:\nhnhhh.exec:\nhnhhh.exe87⤵PID:4576
-
\??\c:\xllxlfr.exec:\xllxlfr.exe88⤵PID:4812
-
\??\c:\5llxlfx.exec:\5llxlfx.exe89⤵PID:2908
-
\??\c:\pvpjj.exec:\pvpjj.exe90⤵PID:3624
-
\??\c:\rfrfrlx.exec:\rfrfrlx.exe91⤵PID:1688
-
\??\c:\jvvvp.exec:\jvvvp.exe92⤵PID:896
-
\??\c:\7bbtnn.exec:\7bbtnn.exe93⤵PID:3824
-
\??\c:\dvvjd.exec:\dvvjd.exe94⤵PID:5016
-
\??\c:\btnbnh.exec:\btnbnh.exe95⤵PID:3060
-
\??\c:\vdpjv.exec:\vdpjv.exe96⤵PID:1036
-
\??\c:\tbthtn.exec:\tbthtn.exe97⤵PID:3928
-
\??\c:\7vpjp.exec:\7vpjp.exe98⤵PID:228
-
\??\c:\bbtnth.exec:\bbtnth.exe99⤵PID:4400
-
\??\c:\pjddp.exec:\pjddp.exe100⤵PID:2356
-
\??\c:\nbttnn.exec:\nbttnn.exe101⤵PID:4448
-
\??\c:\dpdvd.exec:\dpdvd.exe102⤵PID:4624
-
\??\c:\5xrlxrl.exec:\5xrlxrl.exe103⤵PID:4968
-
\??\c:\ddddv.exec:\ddddv.exe104⤵PID:3312
-
\??\c:\1rlxrlx.exec:\1rlxrlx.exe105⤵PID:4328
-
\??\c:\bnbthh.exec:\bnbthh.exe106⤵PID:4528
-
\??\c:\9fxlxrf.exec:\9fxlxrf.exe107⤵PID:364
-
\??\c:\nbbnhb.exec:\nbbnhb.exe108⤵PID:544
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe109⤵PID:4224
-
\??\c:\nhtntn.exec:\nhtntn.exe110⤵PID:2636
-
\??\c:\xlxrffx.exec:\xlxrffx.exe111⤵PID:856
-
\??\c:\tbbbnh.exec:\tbbbnh.exe112⤵PID:1428
-
\??\c:\9vdvj.exec:\9vdvj.exe113⤵PID:244
-
\??\c:\nhhhbh.exec:\nhhhbh.exe114⤵PID:4476
-
\??\c:\5vppd.exec:\5vppd.exe115⤵PID:1916
-
\??\c:\frrlffx.exec:\frrlffx.exe116⤵PID:4500
-
\??\c:\tnhnhn.exec:\tnhnhn.exe117⤵PID:1652
-
\??\c:\rxfrfxr.exec:\rxfrfxr.exe118⤵PID:424
-
\??\c:\httntt.exec:\httntt.exe119⤵PID:2240
-
\??\c:\vpvvj.exec:\vpvvj.exe120⤵PID:2228
-
\??\c:\rlrllfl.exec:\rlrllfl.exe121⤵PID:4104
-
\??\c:\vjvjj.exec:\vjvjj.exe122⤵PID:1556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-