Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 23:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d70fdd19f78860fa05e1a6b94d01cd42.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
d70fdd19f78860fa05e1a6b94d01cd42.exe
-
Size
339KB
-
MD5
d70fdd19f78860fa05e1a6b94d01cd42
-
SHA1
367333ab63c2787ab56503a5e5f16c1393fe6048
-
SHA256
a8280dd1c76136b0579ae65d0e2347685892a91d401e6885cd3304b441118a67
-
SHA512
ad3b1bc092ce969e8fa9baea3ffe2ca39bbf415c400ea43860d5f01aaa9de87860ed444b46d6a6cb5195d01ab072dcc9b4e02bc01e0f0d825145e8e461ae7aed
-
SSDEEP
3072:mhOm2sI93UufdC67ci8M/n5fmCiiiXAsACF486jNaAJ:mcm7ImGddXv/VWrXD486jNaY
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4868-4-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1876-9-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1276-11-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1376-16-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/460-29-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3084-26-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3940-42-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2152-37-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4012-50-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2240-55-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/396-59-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3816-65-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3888-68-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4024-86-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4828-89-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/5064-98-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/636-106-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2584-103-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4792-112-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4588-121-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2300-123-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4796-128-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3864-149-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4580-155-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4580-157-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1596-171-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2632-178-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3872-186-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3876-184-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1656-193-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2460-206-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1428-207-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4324-210-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2368-218-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2544-227-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2076-234-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4856-239-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3940-246-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1104-249-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1696-253-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2848-265-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1400-269-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2548-278-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1144-281-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4024-283-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4476-310-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4588-319-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4644-328-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3864-341-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3012-359-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4488-377-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2764-388-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3440-392-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4412-404-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3520-421-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4860-531-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/5072-540-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2720-549-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2524-571-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/5076-611-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1704-691-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1396-718-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2240-1002-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/5016-1271-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1876 5bhbhh.exe 1276 xfrlxrl.exe 1376 hnbthh.exe 3084 1lxrlrl.exe 460 pvdvv.exe 2152 xffxxxx.exe 3940 pvjdv.exe 4012 7tbnhb.exe 2240 lrfrxlx.exe 396 jppdp.exe 3816 5jjpd.exe 3888 djdpd.exe 960 7fflfll.exe 4844 lfxxxxx.exe 4024 5btbbb.exe 4828 dvvvj.exe 5064 5xxrllr.exe 2584 djpvj.exe 636 3bhhbb.exe 4792 vvvpj.exe 4588 1bbttt.exe 2300 pvjvd.exe 4796 frxxxll.exe 4316 5jjjd.exe 1880 nbhhbb.exe 3864 dvjpv.exe 3180 jpdpv.exe 4580 ddvdv.exe 1120 1lllflf.exe 4608 5frllll.exe 1596 bbhbtt.exe 2632 vvppj.exe 4260 fffxrrl.exe 3876 jpjjj.exe 3872 lrflxxl.exe 928 lxxrrrl.exe 1656 bnbhbb.exe 2268 lrrfrfl.exe 824 1tbbhh.exe 2460 bhtnht.exe 1428 vpdvp.exe 5084 ttnnhh.exe 2368 3rfrfxr.exe 4736 hbnhbb.exe 1276 jdvjj.exe 2544 9pvpj.exe 3312 lrfxrrl.exe 2076 djpvd.exe 1964 ddppv.exe 4856 flxrllf.exe 3940 ttbhnn.exe 1104 pdjdd.exe 1696 tbnntb.exe 4540 ppdjd.exe 396 fxlrrxr.exe 2184 tnnhnn.exe 2848 vvjpv.exe 1400 rflllll.exe 1700 htbhhn.exe 2548 ddvdj.exe 1144 flllfff.exe 4024 nnnnnn.exe 1108 pdjpj.exe 4568 7bhbhh.exe -
resource yara_rule behavioral2/memory/4868-4-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1876-9-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1276-11-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1376-16-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/460-29-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3084-26-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3940-42-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2152-37-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4012-45-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4012-50-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2240-55-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/396-59-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3816-65-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3888-68-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4024-86-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4828-89-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/5064-98-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/636-106-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2584-103-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4792-112-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4588-121-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2300-123-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4796-128-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3864-149-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4580-157-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1596-171-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2632-178-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3872-186-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3876-184-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/928-189-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1656-193-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2460-206-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1428-207-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4324-210-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2368-218-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2544-227-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2076-234-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4856-239-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3940-246-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1104-249-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1696-250-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1696-253-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/396-257-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2848-265-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1400-269-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2548-278-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1144-281-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4024-283-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/5008-301-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4476-310-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4588-319-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4644-328-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3864-341-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3012-359-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4488-377-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2764-388-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3440-392-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4412-404-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3520-421-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1816-487-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4860-531-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/5072-540-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2720-549-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2524-571-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4868 wrote to memory of 1876 4868 d70fdd19f78860fa05e1a6b94d01cd42.exe 86 PID 4868 wrote to memory of 1876 4868 d70fdd19f78860fa05e1a6b94d01cd42.exe 86 PID 4868 wrote to memory of 1876 4868 d70fdd19f78860fa05e1a6b94d01cd42.exe 86 PID 1876 wrote to memory of 1276 1876 5bhbhh.exe 87 PID 1876 wrote to memory of 1276 1876 5bhbhh.exe 87 PID 1876 wrote to memory of 1276 1876 5bhbhh.exe 87 PID 1276 wrote to memory of 1376 1276 xfrlxrl.exe 88 PID 1276 wrote to memory of 1376 1276 xfrlxrl.exe 88 PID 1276 wrote to memory of 1376 1276 xfrlxrl.exe 88 PID 1376 wrote to memory of 3084 1376 hnbthh.exe 89 PID 1376 wrote to memory of 3084 1376 hnbthh.exe 89 PID 1376 wrote to memory of 3084 1376 hnbthh.exe 89 PID 3084 wrote to memory of 460 3084 1lxrlrl.exe 90 PID 3084 wrote to memory of 460 3084 1lxrlrl.exe 90 PID 3084 wrote to memory of 460 3084 1lxrlrl.exe 90 PID 460 wrote to memory of 2152 460 pvdvv.exe 91 PID 460 wrote to memory of 2152 460 pvdvv.exe 91 PID 460 wrote to memory of 2152 460 pvdvv.exe 91 PID 2152 wrote to memory of 3940 2152 xffxxxx.exe 92 PID 2152 wrote to memory of 3940 2152 xffxxxx.exe 92 PID 2152 wrote to memory of 3940 2152 xffxxxx.exe 92 PID 3940 wrote to memory of 4012 3940 pvjdv.exe 94 PID 3940 wrote to memory of 4012 3940 pvjdv.exe 94 PID 3940 wrote to memory of 4012 3940 pvjdv.exe 94 PID 4012 wrote to memory of 2240 4012 7tbnhb.exe 95 PID 4012 wrote to memory of 2240 4012 7tbnhb.exe 95 PID 4012 wrote to memory of 2240 4012 7tbnhb.exe 95 PID 2240 wrote to memory of 396 2240 lrfrxlx.exe 96 PID 2240 wrote to memory of 396 2240 lrfrxlx.exe 96 PID 2240 wrote to memory of 396 2240 lrfrxlx.exe 96 PID 396 wrote to memory of 3816 396 jppdp.exe 97 PID 396 wrote to memory of 3816 396 jppdp.exe 97 PID 396 wrote to memory of 3816 396 jppdp.exe 97 PID 3816 wrote to memory of 3888 3816 5jjpd.exe 99 PID 3816 wrote to memory of 3888 3816 5jjpd.exe 99 PID 3816 wrote to memory of 3888 3816 5jjpd.exe 99 PID 3888 wrote to memory of 960 3888 djdpd.exe 100 PID 3888 wrote to memory of 960 3888 djdpd.exe 100 PID 3888 wrote to memory of 960 3888 djdpd.exe 100 PID 960 wrote to memory of 4844 960 7fflfll.exe 101 PID 960 wrote to memory of 4844 960 7fflfll.exe 101 PID 960 wrote to memory of 4844 960 7fflfll.exe 101 PID 4844 wrote to memory of 4024 4844 lfxxxxx.exe 102 PID 4844 wrote to memory of 4024 4844 lfxxxxx.exe 102 PID 4844 wrote to memory of 4024 4844 lfxxxxx.exe 102 PID 4024 wrote to memory of 4828 4024 5btbbb.exe 103 PID 4024 wrote to memory of 4828 4024 5btbbb.exe 103 PID 4024 wrote to memory of 4828 4024 5btbbb.exe 103 PID 4828 wrote to memory of 5064 4828 dvvvj.exe 104 PID 4828 wrote to memory of 5064 4828 dvvvj.exe 104 PID 4828 wrote to memory of 5064 4828 dvvvj.exe 104 PID 5064 wrote to memory of 2584 5064 5xxrllr.exe 105 PID 5064 wrote to memory of 2584 5064 5xxrllr.exe 105 PID 5064 wrote to memory of 2584 5064 5xxrllr.exe 105 PID 2584 wrote to memory of 636 2584 djpvj.exe 106 PID 2584 wrote to memory of 636 2584 djpvj.exe 106 PID 2584 wrote to memory of 636 2584 djpvj.exe 106 PID 636 wrote to memory of 4792 636 3bhhbb.exe 107 PID 636 wrote to memory of 4792 636 3bhhbb.exe 107 PID 636 wrote to memory of 4792 636 3bhhbb.exe 107 PID 4792 wrote to memory of 4588 4792 vvvpj.exe 108 PID 4792 wrote to memory of 4588 4792 vvvpj.exe 108 PID 4792 wrote to memory of 4588 4792 vvvpj.exe 108 PID 4588 wrote to memory of 2300 4588 1bbttt.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\d70fdd19f78860fa05e1a6b94d01cd42.exe"C:\Users\Admin\AppData\Local\Temp\d70fdd19f78860fa05e1a6b94d01cd42.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\5bhbhh.exec:\5bhbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\xfrlxrl.exec:\xfrlxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\hnbthh.exec:\hnbthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\1lxrlrl.exec:\1lxrlrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\pvdvv.exec:\pvdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\xffxxxx.exec:\xffxxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\pvjdv.exec:\pvjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\7tbnhb.exec:\7tbnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\lrfrxlx.exec:\lrfrxlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\jppdp.exec:\jppdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\5jjpd.exec:\5jjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\djdpd.exec:\djdpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\7fflfll.exec:\7fflfll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\lfxxxxx.exec:\lfxxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\5btbbb.exec:\5btbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\dvvvj.exec:\dvvvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\5xxrllr.exec:\5xxrllr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\djpvj.exec:\djpvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\3bhhbb.exec:\3bhhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\vvvpj.exec:\vvvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\1bbttt.exec:\1bbttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\pvjvd.exec:\pvjvd.exe23⤵
- Executes dropped EXE
PID:2300 -
\??\c:\frxxxll.exec:\frxxxll.exe24⤵
- Executes dropped EXE
PID:4796 -
\??\c:\5jjjd.exec:\5jjjd.exe25⤵
- Executes dropped EXE
PID:4316 -
\??\c:\nbhhbb.exec:\nbhhbb.exe26⤵
- Executes dropped EXE
PID:1880 -
\??\c:\dvjpv.exec:\dvjpv.exe27⤵
- Executes dropped EXE
PID:3864 -
\??\c:\jpdpv.exec:\jpdpv.exe28⤵
- Executes dropped EXE
PID:3180 -
\??\c:\ddvdv.exec:\ddvdv.exe29⤵
- Executes dropped EXE
PID:4580 -
\??\c:\1lllflf.exec:\1lllflf.exe30⤵
- Executes dropped EXE
PID:1120 -
\??\c:\5frllll.exec:\5frllll.exe31⤵
- Executes dropped EXE
PID:4608 -
\??\c:\bbhbtt.exec:\bbhbtt.exe32⤵
- Executes dropped EXE
PID:1596 -
\??\c:\vvppj.exec:\vvppj.exe33⤵
- Executes dropped EXE
PID:2632 -
\??\c:\fffxrrl.exec:\fffxrrl.exe34⤵
- Executes dropped EXE
PID:4260 -
\??\c:\jpjjj.exec:\jpjjj.exe35⤵
- Executes dropped EXE
PID:3876 -
\??\c:\lrflxxl.exec:\lrflxxl.exe36⤵
- Executes dropped EXE
PID:3872 -
\??\c:\lxxrrrl.exec:\lxxrrrl.exe37⤵
- Executes dropped EXE
PID:928 -
\??\c:\bnbhbb.exec:\bnbhbb.exe38⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lrrfrfl.exec:\lrrfrfl.exe39⤵
- Executes dropped EXE
PID:2268 -
\??\c:\1tbbhh.exec:\1tbbhh.exe40⤵
- Executes dropped EXE
PID:824 -
\??\c:\bhtnht.exec:\bhtnht.exe41⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vpdvp.exec:\vpdvp.exe42⤵
- Executes dropped EXE
PID:1428 -
\??\c:\bnthhh.exec:\bnthhh.exe43⤵PID:4324
-
\??\c:\ttnnhh.exec:\ttnnhh.exe44⤵
- Executes dropped EXE
PID:5084 -
\??\c:\3rfrfxr.exec:\3rfrfxr.exe45⤵
- Executes dropped EXE
PID:2368 -
\??\c:\hbnhbb.exec:\hbnhbb.exe46⤵
- Executes dropped EXE
PID:4736 -
\??\c:\jdvjj.exec:\jdvjj.exe47⤵
- Executes dropped EXE
PID:1276 -
\??\c:\9pvpj.exec:\9pvpj.exe48⤵
- Executes dropped EXE
PID:2544 -
\??\c:\lrfxrrl.exec:\lrfxrrl.exe49⤵
- Executes dropped EXE
PID:3312 -
\??\c:\djpvd.exec:\djpvd.exe50⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ddppv.exec:\ddppv.exe51⤵
- Executes dropped EXE
PID:1964 -
\??\c:\flxrllf.exec:\flxrllf.exe52⤵
- Executes dropped EXE
PID:4856 -
\??\c:\ttbhnn.exec:\ttbhnn.exe53⤵
- Executes dropped EXE
PID:3940 -
\??\c:\pdjdd.exec:\pdjdd.exe54⤵
- Executes dropped EXE
PID:1104 -
\??\c:\tbnntb.exec:\tbnntb.exe55⤵
- Executes dropped EXE
PID:1696 -
\??\c:\ppdjd.exec:\ppdjd.exe56⤵
- Executes dropped EXE
PID:4540 -
\??\c:\fxlrrxr.exec:\fxlrrxr.exe57⤵
- Executes dropped EXE
PID:396 -
\??\c:\tnnhnn.exec:\tnnhnn.exe58⤵
- Executes dropped EXE
PID:2184 -
\??\c:\vvjpv.exec:\vvjpv.exe59⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rflllll.exec:\rflllll.exe60⤵
- Executes dropped EXE
PID:1400 -
\??\c:\htbhhn.exec:\htbhhn.exe61⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ddvdj.exec:\ddvdj.exe62⤵
- Executes dropped EXE
PID:2548 -
\??\c:\flllfff.exec:\flllfff.exe63⤵
- Executes dropped EXE
PID:1144 -
\??\c:\nnnnnn.exec:\nnnnnn.exe64⤵
- Executes dropped EXE
PID:4024 -
\??\c:\pdjpj.exec:\pdjpj.exe65⤵
- Executes dropped EXE
PID:1108 -
\??\c:\7bhbhh.exec:\7bhbhh.exe66⤵
- Executes dropped EXE
PID:4568 -
\??\c:\5pjdv.exec:\5pjdv.exe67⤵PID:2452
-
\??\c:\lfxrllf.exec:\lfxrllf.exe68⤵PID:4760
-
\??\c:\frfxxxr.exec:\frfxxxr.exe69⤵PID:3996
-
\??\c:\7hhnnt.exec:\7hhnnt.exe70⤵PID:5008
-
\??\c:\pvdvp.exec:\pvdvp.exe71⤵PID:3344
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe72⤵PID:4476
-
\??\c:\htnbtn.exec:\htnbtn.exe73⤵PID:4920
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe74⤵PID:1856
-
\??\c:\nnnnbb.exec:\nnnnbb.exe75⤵PID:4588
-
\??\c:\hntnhh.exec:\hntnhh.exe76⤵PID:2688
-
\??\c:\vpvpv.exec:\vpvpv.exe77⤵PID:4644
-
\??\c:\xrlfxxl.exec:\xrlfxxl.exe78⤵PID:4104
-
\??\c:\tnnhbb.exec:\tnnhbb.exe79⤵PID:1832
-
\??\c:\llxxrrl.exec:\llxxrrl.exe80⤵PID:2124
-
\??\c:\lrxrllf.exec:\lrxrllf.exe81⤵PID:3864
-
\??\c:\thttnn.exec:\thttnn.exe82⤵PID:2476
-
\??\c:\dvvpj.exec:\dvvpj.exe83⤵PID:3064
-
\??\c:\rffxrxr.exec:\rffxrxr.exe84⤵PID:3024
-
\??\c:\bthbnn.exec:\bthbnn.exe85⤵PID:4512
-
\??\c:\vpddj.exec:\vpddj.exe86⤵PID:3508
-
\??\c:\xfrflrr.exec:\xfrflrr.exe87⤵PID:3012
-
\??\c:\1fllfff.exec:\1fllfff.exe88⤵PID:4368
-
\??\c:\nhtnnn.exec:\nhtnnn.exe89⤵PID:3876
-
\??\c:\nbnthb.exec:\nbnthb.exe90⤵PID:2536
-
\??\c:\vdjdv.exec:\vdjdv.exe91⤵PID:4840
-
\??\c:\rrxfrrr.exec:\rrxfrrr.exe92⤵PID:4488
-
\??\c:\rfrlffl.exec:\rfrlffl.exe93⤵PID:856
-
\??\c:\jvdpj.exec:\jvdpj.exe94⤵PID:4348
-
\??\c:\dpdvp.exec:\dpdvp.exe95⤵PID:2188
-
\??\c:\rllfxrr.exec:\rllfxrr.exe96⤵PID:2764
-
\??\c:\nbhnhh.exec:\nbhnhh.exe97⤵PID:3440
-
\??\c:\ppddd.exec:\ppddd.exe98⤵PID:2740
-
\??\c:\xrxrffx.exec:\xrxrffx.exe99⤵PID:1724
-
\??\c:\nnnhnh.exec:\nnnhnh.exe100⤵PID:2456
-
\??\c:\thbnhh.exec:\thbnhh.exe101⤵PID:4412
-
\??\c:\vdppd.exec:\vdppd.exe102⤵PID:460
-
\??\c:\7pvjj.exec:\7pvjj.exe103⤵PID:1648
-
\??\c:\rlxxxff.exec:\rlxxxff.exe104⤵PID:2076
-
\??\c:\nbbbnn.exec:\nbbbnn.exe105⤵PID:3520
-
\??\c:\tnbhbb.exec:\tnbhbb.exe106⤵PID:1396
-
\??\c:\dvdjv.exec:\dvdjv.exe107⤵PID:916
-
\??\c:\1lrrffl.exec:\1lrrffl.exe108⤵PID:1272
-
\??\c:\hnnhhh.exec:\hnnhhh.exe109⤵PID:4232
-
\??\c:\vdjvd.exec:\vdjvd.exe110⤵PID:2024
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe111⤵PID:2044
-
\??\c:\lxxrlrr.exec:\lxxrlrr.exe112⤵PID:2916
-
\??\c:\3btnnn.exec:\3btnnn.exe113⤵PID:2848
-
\??\c:\pjjdv.exec:\pjjdv.exe114⤵PID:2156
-
\??\c:\lrxrrxx.exec:\lrxrrxx.exe115⤵PID:1152
-
\??\c:\rfxlrlx.exec:\rfxlrlx.exe116⤵PID:1544
-
\??\c:\bbhbbb.exec:\bbhbbb.exe117⤵PID:1144
-
\??\c:\pjjdd.exec:\pjjdd.exe118⤵PID:4508
-
\??\c:\xrxrllf.exec:\xrxrllf.exe119⤵PID:1676
-
\??\c:\rrxrllf.exec:\rrxrllf.exe120⤵PID:2896
-
\??\c:\tbhtbh.exec:\tbhtbh.exe121⤵PID:4960
-
\??\c:\vjpvd.exec:\vjpvd.exe122⤵PID:436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-