Analysis
-
max time kernel
146s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 09:34
Behavioral task
behavioral1
Sample
00ef95e7d5e0bd337ebda82c1ca86eb0.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
00ef95e7d5e0bd337ebda82c1ca86eb0.exe
-
Size
367KB
-
MD5
00ef95e7d5e0bd337ebda82c1ca86eb0
-
SHA1
70374c73eac83d4c58189af94602723a260b58ac
-
SHA256
73ca80b9871f87a5e05a6a444d75debdbb3b6f4b7752e694c794df11baf49684
-
SHA512
cf9a4c30e4fc85cecb58e4c5118def966a2742bc18327fbe593f2abcf658f47a104a107df3b834316b8b5a94d7cb8085f129ea7bf8150a24549195f753882f80
-
SSDEEP
6144:9cm4FmowdHoSdSyEAxyx/ZrTTr4qIMgE81:/4wFHoSQuxy3rTXIM181
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4956-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1408-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3128-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2920-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5888-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2492-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3052-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3408-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5796-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5612-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5612-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/612-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5164-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2860-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5292-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/100-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4636-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5768-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/316-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5544-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3468-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2740-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2820-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2104-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5276-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5648-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5476-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-576-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-586-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-617-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-645-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5800-650-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-654-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3188-700-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3008-704-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5vvpd.exetbhtnh.exebtnbnh.exejvpdd.exepjjpj.exevpvjd.exebhtbnh.exejppvj.exelfxrlrr.exebnbnbb.exevddpd.exe1bhthb.exepddpd.exexlrfrff.exe5hnbnn.exerffrlxr.exehbthhn.exejjjdd.exeffxrfxr.exe5djvd.exe9rrxxrl.exe7tnbnh.exejppdv.exe1lfrfxx.exentbtht.exejddpv.exerlxxllx.exerfxrfxl.exe7flxrlx.exebhhnbt.exedvdpj.exelxxrrlx.exetnbhht.exevjdpj.exefrxrflr.exehtbbtn.exebntntt.exejjdpd.exe5ffrlfx.exehhnhtn.exevjppj.exejddvv.exe9rfxxfl.exe7hnntt.exe9jpjd.exelfffxxr.exe9rxrrxr.exe9hbttt.exedvdvv.exe9lllrrl.exetbhhnn.exebtbthn.exeddppd.exe5xlfxlf.exe3bnhtn.exepvdpp.exe1djvp.exefllfrrf.exehthbbb.exepjdpd.exedvjvj.exefxlffll.exetthhnn.exebhtnhh.exepid process 1408 5vvpd.exe 1008 tbhtnh.exe 3128 btnbnh.exe 4376 jvpdd.exe 1052 pjjpj.exe 1524 vpvjd.exe 2920 bhtbnh.exe 5888 jppvj.exe 624 lfxrlrr.exe 376 bnbnbb.exe 3828 vddpd.exe 3960 1bhthb.exe 2492 pddpd.exe 3052 xlrfrff.exe 3408 5hnbnn.exe 2396 rffrlxr.exe 5796 hbthhn.exe 4900 jjjdd.exe 5612 ffxrfxr.exe 612 5djvd.exe 4056 9rrxxrl.exe 5164 7tnbnh.exe 2860 jppdv.exe 1272 1lfrfxx.exe 4948 ntbtht.exe 4232 jddpv.exe 4140 rlxxllx.exe 5292 rfxrfxl.exe 3504 7flxrlx.exe 3556 bhhnbt.exe 4668 dvdpj.exe 100 lxxrrlx.exe 1432 tnbhht.exe 5020 vjdpj.exe 4636 frxrflr.exe 3592 htbbtn.exe 4632 bntntt.exe 4796 jjdpd.exe 2888 5ffrlfx.exe 4400 hhnhtn.exe 3244 vjppj.exe 5824 jddvv.exe 5768 9rfxxfl.exe 3912 7hnntt.exe 1780 9jpjd.exe 4620 lfffxxr.exe 316 9rxrrxr.exe 1640 9hbttt.exe 2096 dvdvv.exe 4536 9lllrrl.exe 116 tbhhnn.exe 5544 btbthn.exe 1776 ddppd.exe 3468 5xlfxlf.exe 5388 3bnhtn.exe 5952 pvdpp.exe 4036 1djvp.exe 1108 fllfrrf.exe 3292 hthbbb.exe 4288 pjdpd.exe 2740 dvjvj.exe 4072 fxlffll.exe 6024 tthhnn.exe 4384 bhtnhh.exe -
Processes:
resource yara_rule behavioral2/memory/4956-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4956-6-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5vvpd.exe upx behavioral2/memory/1408-7-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tbhtnh.exe upx behavioral2/memory/1408-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1008-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3128-21-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\btnbnh.exe upx \??\c:\jvpdd.exe upx behavioral2/memory/4376-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjjpj.exe upx C:\vpvjd.exe upx behavioral2/memory/1524-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhtbnh.exe upx C:\jppvj.exe upx behavioral2/memory/2920-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5888-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxrlrr.exe upx behavioral2/memory/624-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnbnbb.exe upx behavioral2/memory/376-61-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vddpd.exe upx behavioral2/memory/376-67-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1bhthb.exe upx behavioral2/memory/3828-70-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pddpd.exe upx behavioral2/memory/2492-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlrfrff.exe upx behavioral2/memory/3052-85-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5hnbnn.exe upx behavioral2/memory/3408-90-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rffrlxr.exe upx behavioral2/memory/3408-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbthhn.exe upx C:\jjjdd.exe upx behavioral2/memory/5796-107-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffxrfxr.exe upx behavioral2/memory/5612-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5612-117-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5djvd.exe upx \??\c:\9rrxxrl.exe upx behavioral2/memory/612-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4056-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7tnbnh.exe upx behavioral2/memory/5164-133-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jppdv.exe upx behavioral2/memory/2860-139-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1lfrfxx.exe upx C:\ntbtht.exe upx behavioral2/memory/4948-150-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jddpv.exe upx \??\c:\rlxxllx.exe upx behavioral2/memory/4140-160-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfxrfxl.exe upx behavioral2/memory/5292-167-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7flxrlx.exe upx C:\bhhnbt.exe upx C:\dvdpj.exe upx C:\lxxrrlx.exe upx behavioral2/memory/100-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1432-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5020-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4636-201-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
00ef95e7d5e0bd337ebda82c1ca86eb0.exe5vvpd.exetbhtnh.exebtnbnh.exejvpdd.exepjjpj.exevpvjd.exebhtbnh.exejppvj.exelfxrlrr.exebnbnbb.exevddpd.exe1bhthb.exepddpd.exexlrfrff.exe5hnbnn.exerffrlxr.exehbthhn.exejjjdd.exeffxrfxr.exe5djvd.exe9rrxxrl.exedescription pid process target process PID 4956 wrote to memory of 1408 4956 00ef95e7d5e0bd337ebda82c1ca86eb0.exe 5vvpd.exe PID 4956 wrote to memory of 1408 4956 00ef95e7d5e0bd337ebda82c1ca86eb0.exe 5vvpd.exe PID 4956 wrote to memory of 1408 4956 00ef95e7d5e0bd337ebda82c1ca86eb0.exe 5vvpd.exe PID 1408 wrote to memory of 1008 1408 5vvpd.exe tbhtnh.exe PID 1408 wrote to memory of 1008 1408 5vvpd.exe tbhtnh.exe PID 1408 wrote to memory of 1008 1408 5vvpd.exe tbhtnh.exe PID 1008 wrote to memory of 3128 1008 tbhtnh.exe btnbnh.exe PID 1008 wrote to memory of 3128 1008 tbhtnh.exe btnbnh.exe PID 1008 wrote to memory of 3128 1008 tbhtnh.exe btnbnh.exe PID 3128 wrote to memory of 4376 3128 btnbnh.exe jvpdd.exe PID 3128 wrote to memory of 4376 3128 btnbnh.exe jvpdd.exe PID 3128 wrote to memory of 4376 3128 btnbnh.exe jvpdd.exe PID 4376 wrote to memory of 1052 4376 jvpdd.exe pjjpj.exe PID 4376 wrote to memory of 1052 4376 jvpdd.exe pjjpj.exe PID 4376 wrote to memory of 1052 4376 jvpdd.exe pjjpj.exe PID 1052 wrote to memory of 1524 1052 pjjpj.exe vpvjd.exe PID 1052 wrote to memory of 1524 1052 pjjpj.exe vpvjd.exe PID 1052 wrote to memory of 1524 1052 pjjpj.exe vpvjd.exe PID 1524 wrote to memory of 2920 1524 vpvjd.exe bhtbnh.exe PID 1524 wrote to memory of 2920 1524 vpvjd.exe bhtbnh.exe PID 1524 wrote to memory of 2920 1524 vpvjd.exe bhtbnh.exe PID 2920 wrote to memory of 5888 2920 bhtbnh.exe jppvj.exe PID 2920 wrote to memory of 5888 2920 bhtbnh.exe jppvj.exe PID 2920 wrote to memory of 5888 2920 bhtbnh.exe jppvj.exe PID 5888 wrote to memory of 624 5888 jppvj.exe lfxrlrr.exe PID 5888 wrote to memory of 624 5888 jppvj.exe lfxrlrr.exe PID 5888 wrote to memory of 624 5888 jppvj.exe lfxrlrr.exe PID 624 wrote to memory of 376 624 lfxrlrr.exe bnbnbb.exe PID 624 wrote to memory of 376 624 lfxrlrr.exe bnbnbb.exe PID 624 wrote to memory of 376 624 lfxrlrr.exe bnbnbb.exe PID 376 wrote to memory of 3828 376 bnbnbb.exe vddpd.exe PID 376 wrote to memory of 3828 376 bnbnbb.exe vddpd.exe PID 376 wrote to memory of 3828 376 bnbnbb.exe vddpd.exe PID 3828 wrote to memory of 3960 3828 vddpd.exe 1bhthb.exe PID 3828 wrote to memory of 3960 3828 vddpd.exe 1bhthb.exe PID 3828 wrote to memory of 3960 3828 vddpd.exe 1bhthb.exe PID 3960 wrote to memory of 2492 3960 1bhthb.exe pddpd.exe PID 3960 wrote to memory of 2492 3960 1bhthb.exe pddpd.exe PID 3960 wrote to memory of 2492 3960 1bhthb.exe pddpd.exe PID 2492 wrote to memory of 3052 2492 pddpd.exe xlrfrff.exe PID 2492 wrote to memory of 3052 2492 pddpd.exe xlrfrff.exe PID 2492 wrote to memory of 3052 2492 pddpd.exe xlrfrff.exe PID 3052 wrote to memory of 3408 3052 xlrfrff.exe 5hnbnn.exe PID 3052 wrote to memory of 3408 3052 xlrfrff.exe 5hnbnn.exe PID 3052 wrote to memory of 3408 3052 xlrfrff.exe 5hnbnn.exe PID 3408 wrote to memory of 2396 3408 5hnbnn.exe rffrlxr.exe PID 3408 wrote to memory of 2396 3408 5hnbnn.exe rffrlxr.exe PID 3408 wrote to memory of 2396 3408 5hnbnn.exe rffrlxr.exe PID 2396 wrote to memory of 5796 2396 rffrlxr.exe hbthhn.exe PID 2396 wrote to memory of 5796 2396 rffrlxr.exe hbthhn.exe PID 2396 wrote to memory of 5796 2396 rffrlxr.exe hbthhn.exe PID 5796 wrote to memory of 4900 5796 hbthhn.exe jjjdd.exe PID 5796 wrote to memory of 4900 5796 hbthhn.exe jjjdd.exe PID 5796 wrote to memory of 4900 5796 hbthhn.exe jjjdd.exe PID 4900 wrote to memory of 5612 4900 jjjdd.exe ffxrfxr.exe PID 4900 wrote to memory of 5612 4900 jjjdd.exe ffxrfxr.exe PID 4900 wrote to memory of 5612 4900 jjjdd.exe ffxrfxr.exe PID 5612 wrote to memory of 612 5612 ffxrfxr.exe 5djvd.exe PID 5612 wrote to memory of 612 5612 ffxrfxr.exe 5djvd.exe PID 5612 wrote to memory of 612 5612 ffxrfxr.exe 5djvd.exe PID 612 wrote to memory of 4056 612 5djvd.exe 9rrxxrl.exe PID 612 wrote to memory of 4056 612 5djvd.exe 9rrxxrl.exe PID 612 wrote to memory of 4056 612 5djvd.exe 9rrxxrl.exe PID 4056 wrote to memory of 5164 4056 9rrxxrl.exe 7tnbnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00ef95e7d5e0bd337ebda82c1ca86eb0.exe"C:\Users\Admin\AppData\Local\Temp\00ef95e7d5e0bd337ebda82c1ca86eb0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\5vvpd.exec:\5vvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\tbhtnh.exec:\tbhtnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\btnbnh.exec:\btnbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\jvpdd.exec:\jvpdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\pjjpj.exec:\pjjpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\vpvjd.exec:\vpvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\bhtbnh.exec:\bhtbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\jppvj.exec:\jppvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
\??\c:\lfxrlrr.exec:\lfxrlrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\bnbnbb.exec:\bnbnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\vddpd.exec:\vddpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\1bhthb.exec:\1bhthb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\pddpd.exec:\pddpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\xlrfrff.exec:\xlrfrff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\5hnbnn.exec:\5hnbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\rffrlxr.exec:\rffrlxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\hbthhn.exec:\hbthhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
\??\c:\jjjdd.exec:\jjjdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\ffxrfxr.exec:\ffxrfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
\??\c:\5djvd.exec:\5djvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\9rrxxrl.exec:\9rrxxrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\7tnbnh.exec:\7tnbnh.exe23⤵
- Executes dropped EXE
PID:5164 -
\??\c:\jppdv.exec:\jppdv.exe24⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1lfrfxx.exec:\1lfrfxx.exe25⤵
- Executes dropped EXE
PID:1272 -
\??\c:\ntbtht.exec:\ntbtht.exe26⤵
- Executes dropped EXE
PID:4948 -
\??\c:\jddpv.exec:\jddpv.exe27⤵
- Executes dropped EXE
PID:4232 -
\??\c:\rlxxllx.exec:\rlxxllx.exe28⤵
- Executes dropped EXE
PID:4140 -
\??\c:\rfxrfxl.exec:\rfxrfxl.exe29⤵
- Executes dropped EXE
PID:5292 -
\??\c:\7flxrlx.exec:\7flxrlx.exe30⤵
- Executes dropped EXE
PID:3504 -
\??\c:\bhhnbt.exec:\bhhnbt.exe31⤵
- Executes dropped EXE
PID:3556 -
\??\c:\dvdpj.exec:\dvdpj.exe32⤵
- Executes dropped EXE
PID:4668 -
\??\c:\lxxrrlx.exec:\lxxrrlx.exe33⤵
- Executes dropped EXE
PID:100 -
\??\c:\tnbhht.exec:\tnbhht.exe34⤵
- Executes dropped EXE
PID:1432 -
\??\c:\vjdpj.exec:\vjdpj.exe35⤵
- Executes dropped EXE
PID:5020 -
\??\c:\frxrflr.exec:\frxrflr.exe36⤵
- Executes dropped EXE
PID:4636 -
\??\c:\htbbtn.exec:\htbbtn.exe37⤵
- Executes dropped EXE
PID:3592 -
\??\c:\bntntt.exec:\bntntt.exe38⤵
- Executes dropped EXE
PID:4632 -
\??\c:\jjdpd.exec:\jjdpd.exe39⤵
- Executes dropped EXE
PID:4796 -
\??\c:\5ffrlfx.exec:\5ffrlfx.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hhnhtn.exec:\hhnhtn.exe41⤵
- Executes dropped EXE
PID:4400 -
\??\c:\vjppj.exec:\vjppj.exe42⤵
- Executes dropped EXE
PID:3244 -
\??\c:\jddvv.exec:\jddvv.exe43⤵
- Executes dropped EXE
PID:5824 -
\??\c:\9rfxxfl.exec:\9rfxxfl.exe44⤵
- Executes dropped EXE
PID:5768 -
\??\c:\7hnntt.exec:\7hnntt.exe45⤵
- Executes dropped EXE
PID:3912 -
\??\c:\9jpjd.exec:\9jpjd.exe46⤵
- Executes dropped EXE
PID:1780 -
\??\c:\lfffxxr.exec:\lfffxxr.exe47⤵
- Executes dropped EXE
PID:4620 -
\??\c:\9rxrrxr.exec:\9rxrrxr.exe48⤵
- Executes dropped EXE
PID:316 -
\??\c:\9hbttt.exec:\9hbttt.exe49⤵
- Executes dropped EXE
PID:1640 -
\??\c:\dvdvv.exec:\dvdvv.exe50⤵
- Executes dropped EXE
PID:2096 -
\??\c:\9lllrrl.exec:\9lllrrl.exe51⤵
- Executes dropped EXE
PID:4536 -
\??\c:\tbhhnn.exec:\tbhhnn.exe52⤵
- Executes dropped EXE
PID:116 -
\??\c:\btbthn.exec:\btbthn.exe53⤵
- Executes dropped EXE
PID:5544 -
\??\c:\ddppd.exec:\ddppd.exe54⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5xlfxlf.exec:\5xlfxlf.exe55⤵
- Executes dropped EXE
PID:3468 -
\??\c:\3bnhtn.exec:\3bnhtn.exe56⤵
- Executes dropped EXE
PID:5388 -
\??\c:\pvdpp.exec:\pvdpp.exe57⤵
- Executes dropped EXE
PID:5952 -
\??\c:\1djvp.exec:\1djvp.exe58⤵
- Executes dropped EXE
PID:4036 -
\??\c:\fllfrrf.exec:\fllfrrf.exe59⤵
- Executes dropped EXE
PID:1108 -
\??\c:\hthbbb.exec:\hthbbb.exe60⤵
- Executes dropped EXE
PID:3292 -
\??\c:\pjdpd.exec:\pjdpd.exe61⤵
- Executes dropped EXE
PID:4288 -
\??\c:\dvjvj.exec:\dvjvj.exe62⤵
- Executes dropped EXE
PID:2740 -
\??\c:\fxlffll.exec:\fxlffll.exe63⤵
- Executes dropped EXE
PID:4072 -
\??\c:\tthhnn.exec:\tthhnn.exe64⤵
- Executes dropped EXE
PID:6024 -
\??\c:\bhtnhh.exec:\bhtnhh.exe65⤵
- Executes dropped EXE
PID:4384 -
\??\c:\vddjj.exec:\vddjj.exe66⤵PID:2600
-
\??\c:\vpdpj.exec:\vpdpj.exe67⤵PID:2820
-
\??\c:\rllffxr.exec:\rllffxr.exe68⤵PID:4780
-
\??\c:\ntthht.exec:\ntthht.exe69⤵PID:5352
-
\??\c:\3jpjv.exec:\3jpjv.exe70⤵PID:4336
-
\??\c:\lxflfxl.exec:\lxflfxl.exe71⤵PID:1008
-
\??\c:\xlrxrrf.exec:\xlrxrrf.exe72⤵PID:2104
-
\??\c:\hbbbbb.exec:\hbbbbb.exe73⤵PID:3692
-
\??\c:\vppjj.exec:\vppjj.exe74⤵PID:1300
-
\??\c:\5lrxlxx.exec:\5lrxlxx.exe75⤵PID:3724
-
\??\c:\tthtbb.exec:\tthtbb.exe76⤵PID:5084
-
\??\c:\hbhbtt.exec:\hbhbtt.exe77⤵PID:1728
-
\??\c:\dpvvv.exec:\dpvvv.exe78⤵PID:4712
-
\??\c:\vpjjp.exec:\vpjjp.exe79⤵PID:5276
-
\??\c:\xffllff.exec:\xffllff.exe80⤵PID:1388
-
\??\c:\hhnntt.exec:\hhnntt.exe81⤵PID:1632
-
\??\c:\nnnhtt.exec:\nnnhtt.exe82⤵PID:3856
-
\??\c:\dvjjd.exec:\dvjjd.exe83⤵PID:3536
-
\??\c:\lfllffx.exec:\lfllffx.exe84⤵PID:3828
-
\??\c:\xrlrlll.exec:\xrlrlll.exe85⤵PID:3048
-
\??\c:\bnbbnn.exec:\bnbbnn.exe86⤵PID:2968
-
\??\c:\djvvp.exec:\djvvp.exe87⤵PID:4944
-
\??\c:\5pppj.exec:\5pppj.exe88⤵PID:4808
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe89⤵PID:3532
-
\??\c:\tnnnhh.exec:\tnnnhh.exe90⤵PID:4500
-
\??\c:\tnbbtt.exec:\tnbbtt.exe91⤵PID:4892
-
\??\c:\jvddp.exec:\jvddp.exe92⤵PID:3564
-
\??\c:\ppvpj.exec:\ppvpj.exe93⤵PID:4436
-
\??\c:\5xrfxll.exec:\5xrfxll.exe94⤵PID:3476
-
\??\c:\bthhhb.exec:\bthhhb.exe95⤵PID:4900
-
\??\c:\bnbthh.exec:\bnbthh.exe96⤵PID:4576
-
\??\c:\ppppd.exec:\ppppd.exe97⤵PID:5800
-
\??\c:\3xlxxfx.exec:\3xlxxfx.exe98⤵PID:5648
-
\??\c:\tnbttt.exec:\tnbttt.exe99⤵PID:4056
-
\??\c:\djpjj.exec:\djpjj.exe100⤵PID:5704
-
\??\c:\rrlxffl.exec:\rrlxffl.exe101⤵PID:3732
-
\??\c:\nbnbbt.exec:\nbnbbt.exe102⤵PID:2012
-
\??\c:\nhbntn.exec:\nhbntn.exe103⤵PID:4192
-
\??\c:\pjdvv.exec:\pjdvv.exe104⤵PID:1172
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe105⤵PID:1736
-
\??\c:\tnhhbb.exec:\tnhhbb.exe106⤵PID:5920
-
\??\c:\vppjv.exec:\vppjv.exe107⤵PID:5024
-
\??\c:\vvjjv.exec:\vvjjv.exe108⤵PID:3764
-
\??\c:\xfxxrll.exec:\xfxxrll.exe109⤵PID:5116
-
\??\c:\thbtbt.exec:\thbtbt.exe110⤵PID:4668
-
\??\c:\1hhbtt.exec:\1hhbtt.exe111⤵PID:4660
-
\??\c:\3ppjj.exec:\3ppjj.exe112⤵PID:2348
-
\??\c:\rrlfrrr.exec:\rrlfrrr.exe113⤵PID:5748
-
\??\c:\fxrllll.exec:\fxrllll.exe114⤵PID:3592
-
\??\c:\thnnhn.exec:\thnnhn.exe115⤵PID:2268
-
\??\c:\bntnhh.exec:\bntnhh.exe116⤵PID:2868
-
\??\c:\pjjjp.exec:\pjjjp.exe117⤵PID:4580
-
\??\c:\fxrlrlr.exec:\fxrlrlr.exe118⤵PID:4228
-
\??\c:\lrxxrll.exec:\lrxxrll.exe119⤵PID:5016
-
\??\c:\bntnhh.exec:\bntnhh.exe120⤵PID:1060
-
\??\c:\ddvpj.exec:\ddvpj.exe121⤵PID:736
-
\??\c:\5rrrlrl.exec:\5rrrlrl.exe122⤵PID:1780
-
\??\c:\hhnhhb.exec:\hhnhhb.exe123⤵PID:4968
-
\??\c:\pjddv.exec:\pjddv.exe124⤵PID:5856
-
\??\c:\7ppjv.exec:\7ppjv.exe125⤵PID:5476
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe126⤵PID:4364
-
\??\c:\lrrrrrr.exec:\lrrrrrr.exe127⤵PID:3296
-
\??\c:\tttbhh.exec:\tttbhh.exe128⤵PID:4596
-
\??\c:\djppj.exec:\djppj.exe129⤵PID:4360
-
\??\c:\7dvvp.exec:\7dvvp.exe130⤵PID:5784
-
\??\c:\xlxrxff.exec:\xlxrxff.exe131⤵PID:2696
-
\??\c:\bhhnnn.exec:\bhhnnn.exe132⤵PID:4696
-
\??\c:\thnnhn.exec:\thnnhn.exe133⤵PID:4156
-
\??\c:\vjpjj.exec:\vjpjj.exe134⤵PID:5720
-
\??\c:\hhhhht.exec:\hhhhht.exe135⤵PID:3292
-
\??\c:\pppjj.exec:\pppjj.exe136⤵PID:4288
-
\??\c:\rflffrr.exec:\rflffrr.exe137⤵PID:5068
-
\??\c:\5lllfff.exec:\5lllfff.exe138⤵PID:4440
-
\??\c:\tnbbbb.exec:\tnbbbb.exe139⤵PID:6024
-
\??\c:\3pvvd.exec:\3pvvd.exe140⤵PID:4384
-
\??\c:\pjvjj.exec:\pjvjj.exe141⤵PID:2600
-
\??\c:\rllfrfl.exec:\rllfrfl.exe142⤵PID:4388
-
\??\c:\hnhhbb.exec:\hnhhbb.exe143⤵PID:4780
-
\??\c:\bthhbb.exec:\bthhbb.exe144⤵PID:1816
-
\??\c:\vdjdj.exec:\vdjdj.exe145⤵PID:4336
-
\??\c:\xxlxffl.exec:\xxlxffl.exe146⤵PID:3128
-
\??\c:\lrfxrlr.exec:\lrfxrlr.exe147⤵PID:4376
-
\??\c:\hhbtbb.exec:\hhbtbb.exe148⤵PID:1052
-
\??\c:\dddvp.exec:\dddvp.exe149⤵PID:1300
-
\??\c:\3rrxrff.exec:\3rrxrff.exe150⤵PID:3724
-
\??\c:\ffffxxx.exec:\ffffxxx.exe151⤵PID:5084
-
\??\c:\tnhbnn.exec:\tnhbnn.exe152⤵PID:1728
-
\??\c:\vvjvv.exec:\vvjvv.exe153⤵PID:4712
-
\??\c:\3xfflrr.exec:\3xfflrr.exe154⤵PID:1664
-
\??\c:\lxfxrll.exec:\lxfxrll.exe155⤵PID:4108
-
\??\c:\btnhbb.exec:\btnhbb.exe156⤵PID:3612
-
\??\c:\vppjj.exec:\vppjj.exe157⤵PID:1048
-
\??\c:\vvvjv.exec:\vvvjv.exe158⤵PID:3536
-
\??\c:\xxffrrf.exec:\xxffrrf.exe159⤵PID:3828
-
\??\c:\btttth.exec:\btttth.exe160⤵PID:3048
-
\??\c:\tnbttt.exec:\tnbttt.exe161⤵PID:5996
-
\??\c:\pvdvv.exec:\pvdvv.exe162⤵PID:5436
-
\??\c:\vppjv.exec:\vppjv.exe163⤵PID:1036
-
\??\c:\frfrxrr.exec:\frfrxrr.exe164⤵PID:4084
-
\??\c:\bttthn.exec:\bttthn.exe165⤵PID:4608
-
\??\c:\hhtnhh.exec:\hhtnhh.exe166⤵PID:5396
-
\??\c:\dvvpj.exec:\dvvpj.exe167⤵PID:5620
-
\??\c:\rlrrxxr.exec:\rlrrxxr.exe168⤵PID:5336
-
\??\c:\xrlfllf.exec:\xrlfllf.exe169⤵PID:5640
-
\??\c:\tnhbtt.exec:\tnhbtt.exe170⤵PID:1948
-
\??\c:\vddvj.exec:\vddvj.exe171⤵PID:1072
-
\??\c:\vvjdv.exec:\vvjdv.exe172⤵PID:5800
-
\??\c:\rxrrrrx.exec:\rxrrrrx.exe173⤵PID:700
-
\??\c:\7bttnn.exec:\7bttnn.exe174⤵PID:4548
-
\??\c:\3hnnnb.exec:\3hnnnb.exe175⤵PID:5156
-
\??\c:\jvjdv.exec:\jvjdv.exe176⤵PID:3144
-
\??\c:\lxxrlff.exec:\lxxrlff.exe177⤵PID:3744
-
\??\c:\1frlffx.exec:\1frlffx.exe178⤵PID:4948
-
\??\c:\ntnntt.exec:\ntnntt.exe179⤵PID:1732
-
\??\c:\ddjjj.exec:\ddjjj.exe180⤵PID:3184
-
\??\c:\pvjvp.exec:\pvjvp.exe181⤵PID:1012
-
\??\c:\rflflff.exec:\rflflff.exe182⤵PID:4420
-
\??\c:\hbhbnt.exec:\hbhbnt.exe183⤵PID:4684
-
\??\c:\hnbthh.exec:\hnbthh.exe184⤵PID:4664
-
\??\c:\dvdjd.exec:\dvdjd.exe185⤵PID:1032
-
\??\c:\9flxrlx.exec:\9flxrlx.exe186⤵PID:4460
-
\??\c:\rxffxxx.exec:\rxffxxx.exe187⤵PID:1988
-
\??\c:\nnbbnn.exec:\nnbbnn.exe188⤵PID:1448
-
\??\c:\ppdvj.exec:\ppdvj.exe189⤵PID:3188
-
\??\c:\pvdvv.exec:\pvdvv.exe190⤵PID:3008
-
\??\c:\xllllrr.exec:\xllllrr.exe191⤵PID:6012
-
\??\c:\rflfxrl.exec:\rflfxrl.exe192⤵PID:3248
-
\??\c:\tttbhh.exec:\tttbhh.exe193⤵PID:4964
-
\??\c:\jjjjp.exec:\jjjjp.exe194⤵PID:5696
-
\??\c:\jvvvv.exec:\jvvvv.exe195⤵PID:5260
-
\??\c:\llllllf.exec:\llllllf.exe196⤵PID:1780
-
\??\c:\bhnnhh.exec:\bhnnhh.exe197⤵PID:5816
-
\??\c:\5hnntt.exec:\5hnntt.exe198⤵PID:1640
-
\??\c:\jjvpd.exec:\jjvpd.exe199⤵PID:4536
-
\??\c:\ddjjd.exec:\ddjjd.exe200⤵PID:2320
-
\??\c:\fffxrrl.exec:\fffxrrl.exe201⤵PID:5832
-
\??\c:\hbhntb.exec:\hbhntb.exe202⤵PID:5104
-
\??\c:\vpddd.exec:\vpddd.exe203⤵PID:112
-
\??\c:\dvdvv.exec:\dvdvv.exe204⤵PID:2232
-
\??\c:\7rlxlll.exec:\7rlxlll.exe205⤵PID:5424
-
\??\c:\xlllllf.exec:\xlllllf.exe206⤵PID:1440
-
\??\c:\tbbtnh.exec:\tbbtnh.exe207⤵PID:1120
-
\??\c:\7dvpp.exec:\7dvpp.exe208⤵PID:5720
-
\??\c:\dvvpp.exec:\dvvpp.exe209⤵PID:5076
-
\??\c:\xxlxxfx.exec:\xxlxxfx.exe210⤵PID:4416
-
\??\c:\9bntnt.exec:\9bntnt.exe211⤵PID:2528
-
\??\c:\vvdjd.exec:\vvdjd.exe212⤵PID:6024
-
\??\c:\3vpjp.exec:\3vpjp.exe213⤵PID:4384
-
\??\c:\lfrlllf.exec:\lfrlllf.exe214⤵PID:3472
-
\??\c:\nbbthn.exec:\nbbthn.exe215⤵PID:4768
-
\??\c:\1nhhbb.exec:\1nhhbb.exe216⤵PID:5188
-
\??\c:\7vvpd.exec:\7vvpd.exe217⤵PID:1408
-
\??\c:\rflxlll.exec:\rflxlll.exe218⤵PID:2624
-
\??\c:\ffrrlfr.exec:\ffrrlfr.exe219⤵PID:4324
-
\??\c:\ntbtnt.exec:\ntbtnt.exe220⤵PID:948
-
\??\c:\1jjdv.exec:\1jjdv.exe221⤵PID:3672
-
\??\c:\dvdvp.exec:\dvdvp.exe222⤵PID:1300
-
\??\c:\lrlllrr.exec:\lrlllrr.exe223⤵PID:5036
-
\??\c:\rfxfxlx.exec:\rfxfxlx.exe224⤵PID:1504
-
\??\c:\hhhbbb.exec:\hhhbbb.exe225⤵PID:808
-
\??\c:\7pvjj.exec:\7pvjj.exe226⤵PID:624
-
\??\c:\rxllxrx.exec:\rxllxrx.exe227⤵PID:2956
-
\??\c:\3nthbb.exec:\3nthbb.exe228⤵PID:4016
-
\??\c:\bntnbb.exec:\bntnbb.exe229⤵PID:376
-
\??\c:\dpvjd.exec:\dpvjd.exe230⤵PID:5172
-
\??\c:\1flfrrr.exec:\1flfrrr.exe231⤵PID:4556
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe232⤵PID:4168
-
\??\c:\hhthnb.exec:\hhthnb.exe233⤵PID:448
-
\??\c:\vpvpj.exec:\vpvpj.exe234⤵PID:2276
-
\??\c:\fxxxxff.exec:\fxxxxff.exe235⤵PID:2404
-
\??\c:\xrrrrrl.exec:\xrrrrrl.exe236⤵PID:4492
-
\??\c:\nhtttt.exec:\nhtttt.exe237⤵PID:5772
-
\??\c:\vdjjd.exec:\vdjjd.exe238⤵PID:5428
-
\??\c:\xllflfr.exec:\xllflfr.exe239⤵PID:5228
-
\??\c:\rfrllll.exec:\rfrllll.exe240⤵PID:4436
-
\??\c:\nnhbbb.exec:\nnhbbb.exe241⤵PID:5612
-
\??\c:\jdjvj.exec:\jdjvj.exe242⤵PID:5340