Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 00:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ee380cf5fe07d82328d133508e2ad03acc7ac581c6a754aa29724002d480e00.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 0ee380cf5fe07d82328d133508e2ad03acc7ac581c6a754aa29724002d480e00.exe
- Size 179KB
- Sample240518-arz72aba72
- SHA256 0ee380cf5fe07d82328d133508e2ad03acc7ac581c6a754aa29724002d480e00
- MD5 5e3285be0895cd3479bb4f835a706ba0
- SHA1 cbd0ea159aa0ac37e6b003b3f50f692d7f981951
- SHA512 da1840bec67ff57dc2d120fb7ebfa1a0a53f9f3aae740de25a01cb3e269d66aa1e86748e2eb9f1f132fc7808465c3e2e538e65425a4487c6ca8abfe8eeac45ed
- SSDEEP 1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+IJPhbx:PhOm2sI93UufdC67ciJTm5hN
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/644-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3932-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1596-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-318-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/892-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-359-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-384-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-421-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-434-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-438-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-450-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-463-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-479-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-496-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-518-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-532-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-539-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-557-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-595-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-616-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-630-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-660-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-692-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-772-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-924-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-1004-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-1443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 644 pdjjj.exe 4400 lxrrxrr.exe 1028 vdpdd.exe 1268 xrxxxff.exe 1560 tbbhht.exe 1528 dpppv.exe 4220 nntbtb.exe 3944 dvjjp.exe 4480 fffxfxf.exe 3612 hbntbh.exe 2240 dvddd.exe 3440 tntbtb.exe 4724 tthnth.exe 4184 rfrllrf.exe 1864 bhnnnb.exe 2368 ppvvj.exe 4980 xlxlxrl.exe 3744 htbtnn.exe 3932 ntnbhh.exe 4448 fxfxrfl.exe 1196 9btnhb.exe 4856 9jdvj.exe 3628 7rlrxlr.exe 3192 hhtnhh.exe 2044 xxxrrrf.exe 3556 dpvpv.exe 1480 5xfxrrr.exe 5092 llrlffx.exe 2960 ttthnh.exe 2560 pjvpv.exe 3424 1xxflfr.exe 2084 nhhhbb.exe 1584 dppjd.exe 1640 xrrlllr.exe 1524 lflllll.exe 464 5btbtb.exe 2968 vjvpp.exe 3948 jjdjj.exe 3816 frffxxx.exe 696 nnnnnn.exe 2352 dddvv.exe 752 ffxxrll.exe 4564 ffrlfxx.exe 1596 bbhbhh.exe 4196 llfrllr.exe 392 flxxxxl.exe 3012 1bhbtn.exe 2248 ntthtn.exe 2016 jvpdv.exe 3380 rlffrrl.exe 1068 1llllll.exe 220 7thhnt.exe 1080 jvddv.exe 1728 fflllxf.exe 1872 fxfxxll.exe 3444 bbnnnn.exe 1096 jjpvd.exe 3796 rflfxxx.exe 548 btbbbb.exe 3100 3pddj.exe 1344 rfllfll.exe 3048 frfxxrl.exe 684 nnbhnn.exe 452 djjjd.exe -
resource yara_rule behavioral2/memory/644-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1596-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-305-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-318-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/892-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-359-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-389-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-390-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-405-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-421-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-434-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-438-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-450-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-463-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-479-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-492-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-496-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1308-518-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-532-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-539-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-557-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-561-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 644 2244 0ee380cf5fe07d82328d133508e2ad03acc7ac581c6a754aa29724002d480e00.exe 83 PID 2244 wrote to memory of 644 2244 0ee380cf5fe07d82328d133508e2ad03acc7ac581c6a754aa29724002d480e00.exe 83 PID 2244 wrote to memory of 644 2244 0ee380cf5fe07d82328d133508e2ad03acc7ac581c6a754aa29724002d480e00.exe 83 PID 644 wrote to memory of 4400 644 pdjjj.exe 84 PID 644 wrote to memory of 4400 644 pdjjj.exe 84 PID 644 wrote to memory of 4400 644 pdjjj.exe 84 PID 4400 wrote to memory of 1028 4400 lxrrxrr.exe 85 PID 4400 wrote to memory of 1028 4400 lxrrxrr.exe 85 PID 4400 wrote to memory of 1028 4400 lxrrxrr.exe 85 PID 1028 wrote to memory of 1268 1028 vdpdd.exe 86 PID 1028 wrote to memory of 1268 1028 vdpdd.exe 86 PID 1028 wrote to memory of 1268 1028 vdpdd.exe 86 PID 1268 wrote to memory of 1560 1268 xrxxxff.exe 87 PID 1268 wrote to memory of 1560 1268 xrxxxff.exe 87 PID 1268 wrote to memory of 1560 1268 xrxxxff.exe 87 PID 1560 wrote to memory of 1528 1560 tbbhht.exe 88 PID 1560 wrote to memory of 1528 1560 tbbhht.exe 88 PID 1560 wrote to memory of 1528 1560 tbbhht.exe 88 PID 1528 wrote to memory of 4220 1528 dpppv.exe 89 PID 1528 wrote to memory of 4220 1528 dpppv.exe 89 PID 1528 wrote to memory of 4220 1528 dpppv.exe 89 PID 4220 wrote to memory of 3944 4220 nntbtb.exe 90 PID 4220 wrote to memory of 3944 4220 nntbtb.exe 90 PID 4220 wrote to memory of 3944 4220 nntbtb.exe 90 PID 3944 wrote to memory of 4480 3944 dvjjp.exe 92 PID 3944 wrote to memory of 4480 3944 dvjjp.exe 92 PID 3944 wrote to memory of 4480 3944 dvjjp.exe 92 PID 4480 wrote to memory of 3612 4480 fffxfxf.exe 93 PID 4480 wrote to memory of 3612 4480 fffxfxf.exe 93 PID 4480 wrote to memory of 3612 4480 fffxfxf.exe 93 PID 3612 wrote to memory of 2240 3612 hbntbh.exe 94 PID 3612 wrote to memory of 2240 3612 hbntbh.exe 94 PID 3612 wrote to memory of 2240 3612 hbntbh.exe 94 PID 2240 wrote to memory of 3440 2240 dvddd.exe 95 PID 2240 wrote to memory of 3440 2240 dvddd.exe 95 PID 2240 wrote to memory of 3440 2240 dvddd.exe 95 PID 3440 wrote to memory of 4724 3440 tntbtb.exe 96 PID 3440 wrote to memory of 4724 3440 tntbtb.exe 96 PID 3440 wrote to memory of 4724 3440 tntbtb.exe 96 PID 4724 wrote to memory of 4184 4724 tthnth.exe 97 PID 4724 wrote to memory of 4184 4724 tthnth.exe 97 PID 4724 wrote to memory of 4184 4724 tthnth.exe 97 PID 4184 wrote to memory of 1864 4184 rfrllrf.exe 98 PID 4184 wrote to memory of 1864 4184 rfrllrf.exe 98 PID 4184 wrote to memory of 1864 4184 rfrllrf.exe 98 PID 1864 wrote to memory of 2368 1864 bhnnnb.exe 99 PID 1864 wrote to memory of 2368 1864 bhnnnb.exe 99 PID 1864 wrote to memory of 2368 1864 bhnnnb.exe 99 PID 2368 wrote to memory of 4980 2368 ppvvj.exe 100 PID 2368 wrote to memory of 4980 2368 ppvvj.exe 100 PID 2368 wrote to memory of 4980 2368 ppvvj.exe 100 PID 4980 wrote to memory of 3744 4980 xlxlxrl.exe 101 PID 4980 wrote to memory of 3744 4980 xlxlxrl.exe 101 PID 4980 wrote to memory of 3744 4980 xlxlxrl.exe 101 PID 3744 wrote to memory of 3932 3744 htbtnn.exe 103 PID 3744 wrote to memory of 3932 3744 htbtnn.exe 103 PID 3744 wrote to memory of 3932 3744 htbtnn.exe 103 PID 3932 wrote to memory of 4448 3932 ntnbhh.exe 104 PID 3932 wrote to memory of 4448 3932 ntnbhh.exe 104 PID 3932 wrote to memory of 4448 3932 ntnbhh.exe 104 PID 4448 wrote to memory of 1196 4448 fxfxrfl.exe 105 PID 4448 wrote to memory of 1196 4448 fxfxrfl.exe 105 PID 4448 wrote to memory of 1196 4448 fxfxrfl.exe 105 PID 1196 wrote to memory of 4856 1196 9btnhb.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ee380cf5fe07d82328d133508e2ad03acc7ac581c6a754aa29724002d480e00.exe"C:\Users\Admin\AppData\Local\Temp\0ee380cf5fe07d82328d133508e2ad03acc7ac581c6a754aa29724002d480e00.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\pdjjj.exec:\pdjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\lxrrxrr.exec:\lxrrxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\vdpdd.exec:\vdpdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\xrxxxff.exec:\xrxxxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\tbbhht.exec:\tbbhht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\dpppv.exec:\dpppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\nntbtb.exec:\nntbtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\dvjjp.exec:\dvjjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\fffxfxf.exec:\fffxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\hbntbh.exec:\hbntbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\dvddd.exec:\dvddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\tntbtb.exec:\tntbtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\tthnth.exec:\tthnth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\rfrllrf.exec:\rfrllrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\bhnnnb.exec:\bhnnnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\ppvvj.exec:\ppvvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\xlxlxrl.exec:\xlxlxrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\htbtnn.exec:\htbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\ntnbhh.exec:\ntnbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\fxfxrfl.exec:\fxfxrfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\9btnhb.exec:\9btnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\9jdvj.exec:\9jdvj.exe23⤵
- Executes dropped EXE
PID:4856 -
\??\c:\7rlrxlr.exec:\7rlrxlr.exe24⤵
- Executes dropped EXE
PID:3628 -
\??\c:\hhtnhh.exec:\hhtnhh.exe25⤵
- Executes dropped EXE
PID:3192 -
\??\c:\xxxrrrf.exec:\xxxrrrf.exe26⤵
- Executes dropped EXE
PID:2044 -
\??\c:\dpvpv.exec:\dpvpv.exe27⤵
- Executes dropped EXE
PID:3556 -
\??\c:\5xfxrrr.exec:\5xfxrrr.exe28⤵
- Executes dropped EXE
PID:1480 -
\??\c:\llrlffx.exec:\llrlffx.exe29⤵
- Executes dropped EXE
PID:5092 -
\??\c:\ttthnh.exec:\ttthnh.exe30⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pjvpv.exec:\pjvpv.exe31⤵
- Executes dropped EXE
PID:2560 -
\??\c:\1xxflfr.exec:\1xxflfr.exe32⤵
- Executes dropped EXE
PID:3424 -
\??\c:\nhhhbb.exec:\nhhhbb.exe33⤵
- Executes dropped EXE
PID:2084 -
\??\c:\dppjd.exec:\dppjd.exe34⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xrrlllr.exec:\xrrlllr.exe35⤵
- Executes dropped EXE
PID:1640 -
\??\c:\lflllll.exec:\lflllll.exe36⤵
- Executes dropped EXE
PID:1524 -
\??\c:\5btbtb.exec:\5btbtb.exe37⤵
- Executes dropped EXE
PID:464 -
\??\c:\vjvpp.exec:\vjvpp.exe38⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jjdjj.exec:\jjdjj.exe39⤵
- Executes dropped EXE
PID:3948 -
\??\c:\frffxxx.exec:\frffxxx.exe40⤵
- Executes dropped EXE
PID:3816 -
\??\c:\nnnnnn.exec:\nnnnnn.exe41⤵
- Executes dropped EXE
PID:696 -
\??\c:\dddvv.exec:\dddvv.exe42⤵
- Executes dropped EXE
PID:2352 -
\??\c:\ffxxrll.exec:\ffxxrll.exe43⤵
- Executes dropped EXE
PID:752 -
\??\c:\ffrlfxx.exec:\ffrlfxx.exe44⤵
- Executes dropped EXE
PID:4564 -
\??\c:\bbhbhh.exec:\bbhbhh.exe45⤵
- Executes dropped EXE
PID:1596 -
\??\c:\llfrllr.exec:\llfrllr.exe46⤵
- Executes dropped EXE
PID:4196 -
\??\c:\flxxxxl.exec:\flxxxxl.exe47⤵
- Executes dropped EXE
PID:392 -
\??\c:\1bhbtn.exec:\1bhbtn.exe48⤵
- Executes dropped EXE
PID:3012 -
\??\c:\ntthtn.exec:\ntthtn.exe49⤵
- Executes dropped EXE
PID:2248 -
\??\c:\jvpdv.exec:\jvpdv.exe50⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rlffrrl.exec:\rlffrrl.exe51⤵
- Executes dropped EXE
PID:3380 -
\??\c:\1llllll.exec:\1llllll.exe52⤵
- Executes dropped EXE
PID:1068 -
\??\c:\7thhnt.exec:\7thhnt.exe53⤵
- Executes dropped EXE
PID:220 -
\??\c:\jvddv.exec:\jvddv.exe54⤵
- Executes dropped EXE
PID:1080 -
\??\c:\fflllxf.exec:\fflllxf.exe55⤵
- Executes dropped EXE
PID:1728 -
\??\c:\fxfxxll.exec:\fxfxxll.exe56⤵
- Executes dropped EXE
PID:1872 -
\??\c:\bbnnnn.exec:\bbnnnn.exe57⤵
- Executes dropped EXE
PID:3444 -
\??\c:\jjpvd.exec:\jjpvd.exe58⤵
- Executes dropped EXE
PID:1096 -
\??\c:\rflfxxx.exec:\rflfxxx.exe59⤵
- Executes dropped EXE
PID:3796 -
\??\c:\btbbbb.exec:\btbbbb.exe60⤵
- Executes dropped EXE
PID:548 -
\??\c:\3pddj.exec:\3pddj.exe61⤵
- Executes dropped EXE
PID:3100 -
\??\c:\rfllfll.exec:\rfllfll.exe62⤵
- Executes dropped EXE
PID:1344 -
\??\c:\frfxxrl.exec:\frfxxrl.exe63⤵
- Executes dropped EXE
PID:3048 -
\??\c:\nnbhnn.exec:\nnbhnn.exe64⤵
- Executes dropped EXE
PID:684 -
\??\c:\djjjd.exec:\djjjd.exe65⤵
- Executes dropped EXE
PID:452 -
\??\c:\lflfrfl.exec:\lflfrfl.exe66⤵PID:2828
-
\??\c:\1rrrrrl.exec:\1rrrrrl.exe67⤵PID:3388
-
\??\c:\bhnhnh.exec:\bhnhnh.exe68⤵PID:4912
-
\??\c:\vpvjv.exec:\vpvjv.exe69⤵PID:2328
-
\??\c:\rrllllx.exec:\rrllllx.exe70⤵PID:1196
-
\??\c:\nnhbbt.exec:\nnhbbt.exe71⤵PID:3632
-
\??\c:\vjjjj.exec:\vjjjj.exe72⤵PID:3292
-
\??\c:\xflfxxr.exec:\xflfxxr.exe73⤵PID:2256
-
\??\c:\hthnnn.exec:\hthnnn.exe74⤵PID:892
-
\??\c:\3hnhtt.exec:\3hnhtt.exe75⤵PID:4048
-
\??\c:\3pvdj.exec:\3pvdj.exe76⤵PID:4316
-
\??\c:\fxllrrx.exec:\fxllrrx.exe77⤵PID:3636
-
\??\c:\nhnnhh.exec:\nhnnhh.exe78⤵PID:3900
-
\??\c:\jvvvv.exec:\jvvvv.exe79⤵PID:1764
-
\??\c:\3pddd.exec:\3pddd.exe80⤵PID:448
-
\??\c:\rrfxrrx.exec:\rrfxrrx.exe81⤵PID:3840
-
\??\c:\9thntb.exec:\9thntb.exe82⤵PID:3956
-
\??\c:\bbtttb.exec:\bbtttb.exe83⤵PID:624
-
\??\c:\vpjvv.exec:\vpjvv.exe84⤵PID:4356
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe85⤵PID:4032
-
\??\c:\btttnh.exec:\btttnh.exe86⤵PID:2844
-
\??\c:\hbhhnb.exec:\hbhhnb.exe87⤵PID:4204
-
\??\c:\dppjp.exec:\dppjp.exe88⤵PID:4404
-
\??\c:\vpvvd.exec:\vpvvd.exe89⤵PID:2968
-
\??\c:\xrxrfxr.exec:\xrxrfxr.exe90⤵PID:3784
-
\??\c:\nbnhbh.exec:\nbnhbh.exe91⤵PID:4208
-
\??\c:\5vdjp.exec:\5vdjp.exe92⤵PID:1812
-
\??\c:\xrxrlll.exec:\xrxrlll.exe93⤵PID:4996
-
\??\c:\7xfffff.exec:\7xfffff.exe94⤵PID:468
-
\??\c:\pjjjv.exec:\pjjjv.exe95⤵PID:3692
-
\??\c:\rfxrxlr.exec:\rfxrxlr.exe96⤵PID:4220
-
\??\c:\bnnnbt.exec:\bnnnbt.exe97⤵PID:2868
-
\??\c:\nnbttb.exec:\nnbttb.exe98⤵PID:2988
-
\??\c:\pppvv.exec:\pppvv.exe99⤵PID:4480
-
\??\c:\3ffffff.exec:\3ffffff.exe100⤵PID:3836
-
\??\c:\btttht.exec:\btttht.exe101⤵PID:3036
-
\??\c:\bnthnh.exec:\bnthnh.exe102⤵PID:5060
-
\??\c:\vdddd.exec:\vdddd.exe103⤵PID:1756
-
\??\c:\jvvvv.exec:\jvvvv.exe104⤵PID:4124
-
\??\c:\lxfrrxx.exec:\lxfrrxx.exe105⤵PID:2888
-
\??\c:\lllllll.exec:\lllllll.exe106⤵PID:3728
-
\??\c:\ttnthh.exec:\ttnthh.exe107⤵PID:2252
-
\??\c:\bbbhbb.exec:\bbbhbb.exe108⤵PID:2660
-
\??\c:\pvvvj.exec:\pvvvj.exe109⤵PID:2796
-
\??\c:\jpddj.exec:\jpddj.exe110⤵PID:3616
-
\??\c:\ffffxff.exec:\ffffxff.exe111⤵PID:1352
-
\??\c:\bbtbnb.exec:\bbtbnb.exe112⤵PID:1172
-
\??\c:\vddvp.exec:\vddvp.exe113⤵PID:1176
-
\??\c:\fxxxrxx.exec:\fxxxrxx.exe114⤵PID:4968
-
\??\c:\frrlllf.exec:\frrlllf.exe115⤵PID:1920
-
\??\c:\bbbbhh.exec:\bbbbhh.exe116⤵PID:4248
-
\??\c:\ddvvp.exec:\ddvvp.exe117⤵PID:64
-
\??\c:\1lrxflr.exec:\1lrxflr.exe118⤵PID:4680
-
\??\c:\rrrrxff.exec:\rrrrxff.exe119⤵PID:4440
-
\??\c:\vvdpj.exec:\vvdpj.exe120⤵PID:1508
-
\??\c:\vjjjj.exec:\vjjjj.exe121⤵PID:3076
-
\??\c:\lllfxlr.exec:\lllfxlr.exe122⤵PID:2044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-