Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 20:14
Behavioral task
behavioral1
Sample
0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exe
-
Size
379KB
-
MD5
3b96ae3b26c6523554e3a782f7b131c0
-
SHA1
d10f320fc5f84e699d3b8f6b648278785acf5603
-
SHA256
0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e
-
SHA512
b4121c04538870034d22b6312ff006b5cf5f07cf629ffa3bfbf8875d5ca7fdc6c8369982da4902c8e62ec53e847be6a7ffa91a12cea0deb37e1c880047810101
-
SSDEEP
6144:Ocm4FmowdHoSsm4FIc1/cm4FmowdHoSsiNlcJcmHYC9/jvvfwL+TLPfSRcm4FVon:w4wFHoSl4h4wFHoS24yTgL+zfu4/FHov
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4780-4-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2396-13-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2688-19-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2536-27-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2188-56-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3192-70-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1560-83-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5048-89-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3108-107-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2792-114-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2292-122-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2220-129-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2272-143-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4272-204-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2636-216-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2180-221-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4424-226-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4520-240-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3460-248-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/820-253-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/820-257-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1056-276-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1056-280-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/648-285-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3336-312-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2756-324-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4696-333-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1560-1744-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1816-1910-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1060-2054-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3772-1985-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1556-2093-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2532-325-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2560-320-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3604-316-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2368-308-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5072-304-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5072-300-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4880-299-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/332-294-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5036-290-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5036-286-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4920-275-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2008-271-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2008-267-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5040-266-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5040-262-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2880-261-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3312-252-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2444-245-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1656-236-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4288-232-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4288-224-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4272-209-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4204-203-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1900-198-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3712-187-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2580-185-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2108-177-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3448-168-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4540-163-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1412-154-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2272-147-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4696-141-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2396 rlfxfll.exe 2688 bbtbht.exe 2536 rflfxfx.exe 1068 rffrlfx.exe 1156 jvpdp.exe 4508 rrlfrrr.exe 2188 5hntbh.exe 2000 djdpd.exe 3192 lxrrxff.exe 772 tntnnh.exe 1560 jvjvp.exe 5048 7llxllx.exe 2772 lfrlxfr.exe 1676 nhnhtn.exe 3108 vppdd.exe 2792 dpjdp.exe 2168 dvpjv.exe 2292 rfrfrlf.exe 2220 tntntn.exe 4696 fxxxllx.exe 2272 fxrrllf.exe 1412 nbttbt.exe 4540 pdvpv.exe 3448 rrlfxrl.exe 2108 3dvjd.exe 2580 jvdjd.exe 3712 frxxxff.exe 1900 ntnttb.exe 4204 vppvv.exe 4272 lrrxllx.exe 2636 9nhthh.exe 2180 vppjd.exe 4424 1lfrfxx.exe 4288 hhhttn.exe 1656 vvvjv.exe 4520 lfxrffr.exe 2444 bnhthb.exe 3460 nbhnbt.exe 3312 vppvp.exe 820 rlxrlxr.exe 2880 bnnnnt.exe 5040 ppjvp.exe 2008 xlfrfll.exe 4920 xfxfrfx.exe 1056 nhtnbt.exe 648 pdvjv.exe 5036 xflrlxf.exe 332 ntnbnt.exe 4880 vjvpd.exe 5072 jvpjv.exe 2368 rflxlfx.exe 3336 hnhthb.exe 3604 htnnbn.exe 2560 vvdjd.exe 2756 7xxrlfl.exe 2532 lfxxrlf.exe 4696 5nbthn.exe 3276 pjdpd.exe 1648 xxxlfxr.exe 3696 bhhbnn.exe 436 vjjdv.exe 2028 vpvvd.exe 2552 flfrfxf.exe 1748 nbhthb.exe -
resource yara_rule behavioral2/memory/4780-0-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0008000000023286-5.dat upx behavioral2/memory/4780-4-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2396-7-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x000800000002341c-10.dat upx behavioral2/memory/2396-13-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2688-14-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023421-17.dat upx behavioral2/memory/2536-21-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2688-19-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1068-28-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2536-27-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023422-26.dat upx behavioral2/memory/4508-42-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2188-56-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3192-70-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1560-83-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/5048-89-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x000700000002342b-88.dat upx behavioral2/files/0x000700000002342d-98.dat upx behavioral2/files/0x000700000002342e-108.dat upx behavioral2/memory/3108-107-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2792-114-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2292-122-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2220-129-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2272-143-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x000800000002341d-149.dat upx behavioral2/memory/1412-150-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023434-155.dat upx behavioral2/files/0x0007000000023437-166.dat upx behavioral2/files/0x0007000000023439-180.dat upx behavioral2/files/0x000700000002343a-189.dat upx behavioral2/memory/4272-204-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x000700000002343d-207.dat upx behavioral2/memory/2636-216-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2180-221-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4424-226-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1656-229-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4520-240-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3460-248-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/820-253-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/820-257-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1056-276-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1056-280-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/648-285-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3336-312-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2756-324-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4696-329-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4696-333-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1560-1744-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1816-1910-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3772-1985-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2552-1904-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3112-1756-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2532-325-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2560-320-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3604-316-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2368-308-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/5072-304-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/5072-300-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4880-299-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/332-294-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4880-295-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/5036-290-0x0000000000400000-0x0000000000472000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4780 wrote to memory of 2396 4780 0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exe 278 PID 4780 wrote to memory of 2396 4780 0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exe 278 PID 4780 wrote to memory of 2396 4780 0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exe 278 PID 2396 wrote to memory of 2688 2396 rlfxfll.exe 84 PID 2396 wrote to memory of 2688 2396 rlfxfll.exe 84 PID 2396 wrote to memory of 2688 2396 rlfxfll.exe 84 PID 2688 wrote to memory of 2536 2688 bbtbht.exe 85 PID 2688 wrote to memory of 2536 2688 bbtbht.exe 85 PID 2688 wrote to memory of 2536 2688 bbtbht.exe 85 PID 2536 wrote to memory of 1068 2536 rflfxfx.exe 86 PID 2536 wrote to memory of 1068 2536 rflfxfx.exe 86 PID 2536 wrote to memory of 1068 2536 rflfxfx.exe 86 PID 1068 wrote to memory of 1156 1068 rffrlfx.exe 87 PID 1068 wrote to memory of 1156 1068 rffrlfx.exe 87 PID 1068 wrote to memory of 1156 1068 rffrlfx.exe 87 PID 1156 wrote to memory of 4508 1156 jvpdp.exe 88 PID 1156 wrote to memory of 4508 1156 jvpdp.exe 88 PID 1156 wrote to memory of 4508 1156 jvpdp.exe 88 PID 4508 wrote to memory of 2188 4508 rrlfrrr.exe 89 PID 4508 wrote to memory of 2188 4508 rrlfrrr.exe 89 PID 4508 wrote to memory of 2188 4508 rrlfrrr.exe 89 PID 2188 wrote to memory of 2000 2188 5hntbh.exe 528 PID 2188 wrote to memory of 2000 2188 5hntbh.exe 528 PID 2188 wrote to memory of 2000 2188 5hntbh.exe 528 PID 2000 wrote to memory of 3192 2000 djdpd.exe 91 PID 2000 wrote to memory of 3192 2000 djdpd.exe 91 PID 2000 wrote to memory of 3192 2000 djdpd.exe 91 PID 3192 wrote to memory of 772 3192 lxrrxff.exe 374 PID 3192 wrote to memory of 772 3192 lxrrxff.exe 374 PID 3192 wrote to memory of 772 3192 lxrrxff.exe 374 PID 772 wrote to memory of 1560 772 tntnnh.exe 203 PID 772 wrote to memory of 1560 772 tntnnh.exe 203 PID 772 wrote to memory of 1560 772 tntnnh.exe 203 PID 1560 wrote to memory of 5048 1560 jvjvp.exe 95 PID 1560 wrote to memory of 5048 1560 jvjvp.exe 95 PID 1560 wrote to memory of 5048 1560 jvjvp.exe 95 PID 5048 wrote to memory of 2772 5048 7llxllx.exe 96 PID 5048 wrote to memory of 2772 5048 7llxllx.exe 96 PID 5048 wrote to memory of 2772 5048 7llxllx.exe 96 PID 2772 wrote to memory of 1676 2772 lfrlxfr.exe 238 PID 2772 wrote to memory of 1676 2772 lfrlxfr.exe 238 PID 2772 wrote to memory of 1676 2772 lfrlxfr.exe 238 PID 1676 wrote to memory of 3108 1676 nhnhtn.exe 99 PID 1676 wrote to memory of 3108 1676 nhnhtn.exe 99 PID 1676 wrote to memory of 3108 1676 nhnhtn.exe 99 PID 3108 wrote to memory of 2792 3108 vppdd.exe 100 PID 3108 wrote to memory of 2792 3108 vppdd.exe 100 PID 3108 wrote to memory of 2792 3108 vppdd.exe 100 PID 2792 wrote to memory of 2168 2792 dpjdp.exe 102 PID 2792 wrote to memory of 2168 2792 dpjdp.exe 102 PID 2792 wrote to memory of 2168 2792 dpjdp.exe 102 PID 2168 wrote to memory of 2292 2168 dvpjv.exe 103 PID 2168 wrote to memory of 2292 2168 dvpjv.exe 103 PID 2168 wrote to memory of 2292 2168 dvpjv.exe 103 PID 2292 wrote to memory of 2220 2292 rfrfrlf.exe 104 PID 2292 wrote to memory of 2220 2292 rfrfrlf.exe 104 PID 2292 wrote to memory of 2220 2292 rfrfrlf.exe 104 PID 2220 wrote to memory of 4696 2220 tntntn.exe 105 PID 2220 wrote to memory of 4696 2220 tntntn.exe 105 PID 2220 wrote to memory of 4696 2220 tntntn.exe 105 PID 4696 wrote to memory of 2272 4696 fxxxllx.exe 106 PID 4696 wrote to memory of 2272 4696 fxxxllx.exe 106 PID 4696 wrote to memory of 2272 4696 fxxxllx.exe 106 PID 2272 wrote to memory of 1412 2272 fxrrllf.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exe"C:\Users\Admin\AppData\Local\Temp\0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\rlfxfll.exec:\rlfxfll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\bbtbht.exec:\bbtbht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\rflfxfx.exec:\rflfxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\rffrlfx.exec:\rffrlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\jvpdp.exec:\jvpdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\rrlfrrr.exec:\rrlfrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\5hntbh.exec:\5hntbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\djdpd.exec:\djdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\lxrrxff.exec:\lxrrxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\tntnnh.exec:\tntnnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\jvjvp.exec:\jvjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\7llxllx.exec:\7llxllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\lfrlxfr.exec:\lfrlxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nhnhtn.exec:\nhnhtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\vppdd.exec:\vppdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\dpjdp.exec:\dpjdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\dvpjv.exec:\dvpjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\rfrfrlf.exec:\rfrfrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\tntntn.exec:\tntntn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\fxxxllx.exec:\fxxxllx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\fxrrllf.exec:\fxrrllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\nbttbt.exec:\nbttbt.exe23⤵
- Executes dropped EXE
PID:1412 -
\??\c:\pdvpv.exec:\pdvpv.exe24⤵
- Executes dropped EXE
PID:4540 -
\??\c:\rrlfxrl.exec:\rrlfxrl.exe25⤵
- Executes dropped EXE
PID:3448 -
\??\c:\3dvjd.exec:\3dvjd.exe26⤵
- Executes dropped EXE
PID:2108 -
\??\c:\jvdjd.exec:\jvdjd.exe27⤵
- Executes dropped EXE
PID:2580 -
\??\c:\frxxxff.exec:\frxxxff.exe28⤵
- Executes dropped EXE
PID:3712 -
\??\c:\ntnttb.exec:\ntnttb.exe29⤵
- Executes dropped EXE
PID:1900 -
\??\c:\vppvv.exec:\vppvv.exe30⤵
- Executes dropped EXE
PID:4204 -
\??\c:\lrrxllx.exec:\lrrxllx.exe31⤵
- Executes dropped EXE
PID:4272 -
\??\c:\9nhthh.exec:\9nhthh.exe32⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vppjd.exec:\vppjd.exe33⤵
- Executes dropped EXE
PID:2180 -
\??\c:\1lfrfxx.exec:\1lfrfxx.exe34⤵
- Executes dropped EXE
PID:4424 -
\??\c:\hhhttn.exec:\hhhttn.exe35⤵
- Executes dropped EXE
PID:4288 -
\??\c:\vvvjv.exec:\vvvjv.exe36⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lfxrffr.exec:\lfxrffr.exe37⤵
- Executes dropped EXE
PID:4520 -
\??\c:\bnhthb.exec:\bnhthb.exe38⤵
- Executes dropped EXE
PID:2444 -
\??\c:\nbhnbt.exec:\nbhnbt.exe39⤵
- Executes dropped EXE
PID:3460 -
\??\c:\vppvp.exec:\vppvp.exe40⤵
- Executes dropped EXE
PID:3312 -
\??\c:\rlxrlxr.exec:\rlxrlxr.exe41⤵
- Executes dropped EXE
PID:820 -
\??\c:\bnnnnt.exec:\bnnnnt.exe42⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ppjvp.exec:\ppjvp.exe43⤵
- Executes dropped EXE
PID:5040 -
\??\c:\xlfrfll.exec:\xlfrfll.exe44⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xfxfrfx.exec:\xfxfrfx.exe45⤵
- Executes dropped EXE
PID:4920 -
\??\c:\nhtnbt.exec:\nhtnbt.exe46⤵
- Executes dropped EXE
PID:1056 -
\??\c:\pdvjv.exec:\pdvjv.exe47⤵
- Executes dropped EXE
PID:648 -
\??\c:\xflrlxf.exec:\xflrlxf.exe48⤵
- Executes dropped EXE
PID:5036 -
\??\c:\ntnbnt.exec:\ntnbnt.exe49⤵
- Executes dropped EXE
PID:332 -
\??\c:\vjvpd.exec:\vjvpd.exe50⤵
- Executes dropped EXE
PID:4880 -
\??\c:\jvpjv.exec:\jvpjv.exe51⤵
- Executes dropped EXE
PID:5072 -
\??\c:\rflxlfx.exec:\rflxlfx.exe52⤵
- Executes dropped EXE
PID:2368 -
\??\c:\hnhthb.exec:\hnhthb.exe53⤵
- Executes dropped EXE
PID:3336 -
\??\c:\htnnbn.exec:\htnnbn.exe54⤵
- Executes dropped EXE
PID:3604 -
\??\c:\vvdjd.exec:\vvdjd.exe55⤵
- Executes dropped EXE
PID:2560 -
\??\c:\7xxrlfl.exec:\7xxrlfl.exe56⤵
- Executes dropped EXE
PID:2756 -
\??\c:\lfxxrlf.exec:\lfxxrlf.exe57⤵
- Executes dropped EXE
PID:2532 -
\??\c:\5nbthn.exec:\5nbthn.exe58⤵
- Executes dropped EXE
PID:4696 -
\??\c:\pjdpd.exec:\pjdpd.exe59⤵
- Executes dropped EXE
PID:3276 -
\??\c:\xxxlfxr.exec:\xxxlfxr.exe60⤵
- Executes dropped EXE
PID:1648 -
\??\c:\bhhbnn.exec:\bhhbnn.exe61⤵
- Executes dropped EXE
PID:3696 -
\??\c:\vjjdv.exec:\vjjdv.exe62⤵
- Executes dropped EXE
PID:436 -
\??\c:\vpvvd.exec:\vpvvd.exe63⤵
- Executes dropped EXE
PID:2028 -
\??\c:\flfrfxf.exec:\flfrfxf.exe64⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nbhthb.exec:\nbhthb.exe65⤵
- Executes dropped EXE
PID:1748 -
\??\c:\nhhtbb.exec:\nhhtbb.exe66⤵PID:4148
-
\??\c:\pvjvj.exec:\pvjvj.exe67⤵PID:5096
-
\??\c:\frrlxlx.exec:\frrlxlx.exe68⤵PID:4684
-
\??\c:\ttbhht.exec:\ttbhht.exe69⤵PID:5064
-
\??\c:\nhbnbh.exec:\nhbnbh.exe70⤵PID:1236
-
\??\c:\jdjvv.exec:\jdjvv.exe71⤵PID:2484
-
\??\c:\3lfxxrl.exec:\3lfxxrl.exe72⤵PID:2204
-
\??\c:\xlrrfxr.exec:\xlrrfxr.exe73⤵PID:3196
-
\??\c:\1bthhb.exec:\1bthhb.exe74⤵PID:1880
-
\??\c:\nbthth.exec:\nbthth.exe75⤵PID:364
-
\??\c:\pvvjd.exec:\pvvjd.exe76⤵PID:2744
-
\??\c:\rfxrrff.exec:\rfxrrff.exe77⤵PID:2100
-
\??\c:\5rrfxrf.exec:\5rrfxrf.exe78⤵PID:824
-
\??\c:\nbhtbt.exec:\nbhtbt.exe79⤵PID:1368
-
\??\c:\7jvvj.exec:\7jvvj.exe80⤵PID:2724
-
\??\c:\jvvpd.exec:\jvvpd.exe81⤵PID:2612
-
\??\c:\lflxlxl.exec:\lflxlxl.exe82⤵PID:4856
-
\??\c:\rxxlfxl.exec:\rxxlfxl.exe83⤵PID:2324
-
\??\c:\tbnthb.exec:\tbnthb.exe84⤵PID:1276
-
\??\c:\bnhbnh.exec:\bnhbnh.exe85⤵PID:1544
-
\??\c:\dpvjp.exec:\dpvjp.exe86⤵PID:464
-
\??\c:\pdvjd.exec:\pdvjd.exe87⤵PID:2364
-
\??\c:\xrfrfxl.exec:\xrfrfxl.exe88⤵PID:2820
-
\??\c:\xflxrlr.exec:\xflxrlr.exe89⤵PID:4848
-
\??\c:\btbnth.exec:\btbnth.exe90⤵PID:1580
-
\??\c:\1jjvd.exec:\1jjvd.exe91⤵PID:4220
-
\??\c:\pdjjd.exec:\pdjjd.exe92⤵PID:1420
-
\??\c:\fxfxlfl.exec:\fxfxlfl.exe93⤵PID:556
-
\??\c:\lxfrfxx.exec:\lxfrfxx.exe94⤵PID:3448
-
\??\c:\thhthb.exec:\thhthb.exe95⤵PID:2580
-
\??\c:\tnhbnn.exec:\tnhbnn.exe96⤵PID:1016
-
\??\c:\frlxlfr.exec:\frlxlfr.exe97⤵PID:3712
-
\??\c:\ntbnbn.exec:\ntbnbn.exe98⤵PID:1856
-
\??\c:\3tnbnh.exec:\3tnbnh.exe99⤵PID:2908
-
\??\c:\pddpd.exec:\pddpd.exe100⤵PID:4148
-
\??\c:\7dpdp.exec:\7dpdp.exe101⤵PID:1252
-
\??\c:\9rlxlfr.exec:\9rlxlfr.exe102⤵PID:4980
-
\??\c:\rlrlxrl.exec:\rlrlxrl.exe103⤵PID:2180
-
\??\c:\nttnnh.exec:\nttnnh.exe104⤵PID:2296
-
\??\c:\tttbnn.exec:\tttbnn.exe105⤵PID:944
-
\??\c:\vjjdj.exec:\vjjdj.exe106⤵PID:3788
-
\??\c:\fllxxrf.exec:\fllxxrf.exe107⤵PID:3672
-
\??\c:\rflxrlx.exec:\rflxrlx.exe108⤵PID:2856
-
\??\c:\nttnbh.exec:\nttnbh.exe109⤵PID:1880
-
\??\c:\bnbhbh.exec:\bnbhbh.exe110⤵PID:3568
-
\??\c:\1vpdj.exec:\1vpdj.exe111⤵PID:3452
-
\??\c:\pjpdv.exec:\pjpdv.exe112⤵PID:1084
-
\??\c:\fllxlff.exec:\fllxlff.exe113⤵PID:1740
-
\??\c:\rllxlfx.exec:\rllxlfx.exe114⤵PID:4992
-
\??\c:\9bnbhb.exec:\9bnbhb.exe115⤵PID:2640
-
\??\c:\htbtbt.exec:\htbtbt.exe116⤵PID:784
-
\??\c:\vjvjv.exec:\vjvjv.exe117⤵PID:1560
-
\??\c:\rxrlllf.exec:\rxrlllf.exe118⤵PID:1388
-
\??\c:\9rrfrff.exec:\9rrfrff.exe119⤵PID:4404
-
\??\c:\7hhtnb.exec:\7hhtnb.exe120⤵PID:4880
-
\??\c:\hnthbt.exec:\hnthbt.exe121⤵PID:1544
-
\??\c:\7jvpj.exec:\7jvpj.exe122⤵PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-