Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 17:58
Behavioral task
behavioral1
Sample
33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exe
-
Size
90KB
-
MD5
227ee42264ec7ed0e6eb5d39fbfe82b0
-
SHA1
89af0ee316315e2fb598f1050a5ff874128062d4
-
SHA256
33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa
-
SHA512
9b95031efa5db1df99ebd1e81bd0b001d21d56d35aa84159516662ebd08325eb645c2590de2ddbb47d08d78740461764e58a03270a47c28a94d20ddb588ca9e1
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWp5:8hOmTsF93UYfwC6GIout0fmCiiiXA6mb
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4572-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2980-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1080-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3768-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2984-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5136-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5324-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/908-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5752-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5708-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5288-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6112-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5336-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1380-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5128-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5644-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2504-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6096-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5652-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1148-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5688-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4220-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3320-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5148-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5820-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2344-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5464-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2860-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-523-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lffrllf.exetntttt.exedddvp.exedppjv.exe5rfxllr.exexlxrxxf.exebthtbt.exejdppv.exerlrrllr.exexlxrlll.exebtntbn.exe9vdpj.exepvvjd.exexrxllfx.exehtbnbh.exe9vdvv.exedvpdp.exefrlxrxr.exenbnnhh.exedvpjd.exexfxxrlf.exebtbhbt.exetnbtnh.exevppjj.exe9xlfrrl.exexlfxlxr.exebhhhbb.exejvvpj.exebhhhtt.exevjvjd.exejpjjv.exeflrffxr.exetbnttt.exetbhbtt.exe5dpjv.exe5ddpd.exejpvpp.exe5ffrfxr.exerllllfl.exehtnhbt.exehtntht.exejdjdv.exerffrflf.exe3ffxxfx.exerllfffr.exenhbttn.exedppdp.exejddvj.exelxfrxxr.exelfrlrlx.exethhnbh.exebbbthh.exeddppd.exepvddd.exelxfrxrr.exe1flfxfx.exebbthnt.exeddpjp.exedjdvv.exerlxrffr.exexrrlrfr.exe3nhbnn.exepjdvv.exe7ppjp.exepid process 2980 lffrllf.exe 1080 tntttt.exe 5112 dddvp.exe 1316 dppjv.exe 4184 5rfxllr.exe 1440 xlxrxxf.exe 3768 bthtbt.exe 2984 jdppv.exe 4448 rlrrllr.exe 4884 xlxrlll.exe 5136 btntbn.exe 5748 9vdpj.exe 2060 pvvjd.exe 436 xrxllfx.exe 4668 htbnbh.exe 1036 9vdvv.exe 5324 dvpdp.exe 908 frlxrxr.exe 1604 nbnnhh.exe 3472 dvpjd.exe 3140 xfxxrlf.exe 3652 btbhbt.exe 396 tnbtnh.exe 4192 vppjj.exe 4952 9xlfrrl.exe 5752 xlfxlxr.exe 540 bhhhbb.exe 5708 jvvpj.exe 5288 bhhhtt.exe 5660 vjvjd.exe 3628 jpjjv.exe 6112 flrffxr.exe 636 tbnttt.exe 640 tbhbtt.exe 880 5dpjv.exe 2360 5ddpd.exe 5336 jpvpp.exe 3848 5ffrfxr.exe 3172 rllllfl.exe 2164 htnhbt.exe 1572 htntht.exe 1124 jdjdv.exe 3288 rffrflf.exe 1380 3ffxxfx.exe 3724 rllfffr.exe 5608 nhbttn.exe 5128 dppdp.exe 5644 jddvj.exe 2504 lxfrxxr.exe 6096 lfrlrlx.exe 4428 thhnbh.exe 4032 bbbthh.exe 5652 ddppd.exe 732 pvddd.exe 4700 lxfrxrr.exe 3316 1flfxfx.exe 2232 bbthnt.exe 4936 ddpjp.exe 2904 djdvv.exe 5744 rlxrffr.exe 2408 xrrlrfr.exe 1600 3nhbnn.exe 1148 pjdvv.exe 2324 7ppjp.exe -
Processes:
resource yara_rule behavioral2/memory/4572-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lffrllf.exe upx behavioral2/memory/4572-4-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tntttt.exe upx behavioral2/memory/2980-8-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dddvp.exe upx behavioral2/memory/1080-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5112-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dppjv.exe upx C:\5rfxllr.exe upx C:\xlxrxxf.exe upx behavioral2/memory/4184-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1440-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bthtbt.exe upx behavioral2/memory/3768-36-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdppv.exe upx C:\rlrrllr.exe upx behavioral2/memory/2984-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlxrlll.exe upx C:\btntbn.exe upx behavioral2/memory/4884-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9vdpj.exe upx behavioral2/memory/5136-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvvjd.exe upx C:\xrxllfx.exe upx behavioral2/memory/2060-67-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htbnbh.exe upx behavioral2/memory/436-71-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9vdvv.exe upx behavioral2/memory/4668-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1036-79-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvpdp.exe upx behavioral2/memory/5324-83-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frlxrxr.exe upx behavioral2/memory/908-88-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbnnhh.exe upx behavioral2/memory/908-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1604-95-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvpjd.exe upx C:\xfxxrlf.exe upx behavioral2/memory/3472-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3140-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3140-108-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btbhbt.exe upx C:\tnbtnh.exe upx behavioral2/memory/3652-113-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vppjj.exe upx behavioral2/memory/396-118-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9xlfrrl.exe upx C:\xlfxlxr.exe upx behavioral2/memory/4952-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhhhbb.exe upx behavioral2/memory/5752-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/540-137-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvvpj.exe upx C:\bhhhtt.exe upx behavioral2/memory/5708-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5288-146-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjvjd.exe upx C:\jpjjv.exe upx C:\flrffxr.exe upx behavioral2/memory/6112-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2360-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5336-172-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exelffrllf.exetntttt.exedddvp.exedppjv.exe5rfxllr.exexlxrxxf.exebthtbt.exejdppv.exerlrrllr.exexlxrlll.exebtntbn.exe9vdpj.exepvvjd.exexrxllfx.exehtbnbh.exe9vdvv.exedvpdp.exefrlxrxr.exenbnnhh.exedvpjd.exexfxxrlf.exedescription pid process target process PID 4572 wrote to memory of 2980 4572 33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exe lffrllf.exe PID 4572 wrote to memory of 2980 4572 33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exe lffrllf.exe PID 4572 wrote to memory of 2980 4572 33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exe lffrllf.exe PID 2980 wrote to memory of 1080 2980 lffrllf.exe tntttt.exe PID 2980 wrote to memory of 1080 2980 lffrllf.exe tntttt.exe PID 2980 wrote to memory of 1080 2980 lffrllf.exe tntttt.exe PID 1080 wrote to memory of 5112 1080 tntttt.exe dddvp.exe PID 1080 wrote to memory of 5112 1080 tntttt.exe dddvp.exe PID 1080 wrote to memory of 5112 1080 tntttt.exe dddvp.exe PID 5112 wrote to memory of 1316 5112 dddvp.exe dppjv.exe PID 5112 wrote to memory of 1316 5112 dddvp.exe dppjv.exe PID 5112 wrote to memory of 1316 5112 dddvp.exe dppjv.exe PID 1316 wrote to memory of 4184 1316 dppjv.exe 5rfxllr.exe PID 1316 wrote to memory of 4184 1316 dppjv.exe 5rfxllr.exe PID 1316 wrote to memory of 4184 1316 dppjv.exe 5rfxllr.exe PID 4184 wrote to memory of 1440 4184 5rfxllr.exe xlxrxxf.exe PID 4184 wrote to memory of 1440 4184 5rfxllr.exe xlxrxxf.exe PID 4184 wrote to memory of 1440 4184 5rfxllr.exe xlxrxxf.exe PID 1440 wrote to memory of 3768 1440 xlxrxxf.exe bthtbt.exe PID 1440 wrote to memory of 3768 1440 xlxrxxf.exe bthtbt.exe PID 1440 wrote to memory of 3768 1440 xlxrxxf.exe bthtbt.exe PID 3768 wrote to memory of 2984 3768 bthtbt.exe jdppv.exe PID 3768 wrote to memory of 2984 3768 bthtbt.exe jdppv.exe PID 3768 wrote to memory of 2984 3768 bthtbt.exe jdppv.exe PID 2984 wrote to memory of 4448 2984 jdppv.exe rlrrllr.exe PID 2984 wrote to memory of 4448 2984 jdppv.exe rlrrllr.exe PID 2984 wrote to memory of 4448 2984 jdppv.exe rlrrllr.exe PID 4448 wrote to memory of 4884 4448 rlrrllr.exe xlxrlll.exe PID 4448 wrote to memory of 4884 4448 rlrrllr.exe xlxrlll.exe PID 4448 wrote to memory of 4884 4448 rlrrllr.exe xlxrlll.exe PID 4884 wrote to memory of 5136 4884 xlxrlll.exe btntbn.exe PID 4884 wrote to memory of 5136 4884 xlxrlll.exe btntbn.exe PID 4884 wrote to memory of 5136 4884 xlxrlll.exe btntbn.exe PID 5136 wrote to memory of 5748 5136 btntbn.exe 9vdpj.exe PID 5136 wrote to memory of 5748 5136 btntbn.exe 9vdpj.exe PID 5136 wrote to memory of 5748 5136 btntbn.exe 9vdpj.exe PID 5748 wrote to memory of 2060 5748 9vdpj.exe pvvjd.exe PID 5748 wrote to memory of 2060 5748 9vdpj.exe pvvjd.exe PID 5748 wrote to memory of 2060 5748 9vdpj.exe pvvjd.exe PID 2060 wrote to memory of 436 2060 pvvjd.exe xrxllfx.exe PID 2060 wrote to memory of 436 2060 pvvjd.exe xrxllfx.exe PID 2060 wrote to memory of 436 2060 pvvjd.exe xrxllfx.exe PID 436 wrote to memory of 4668 436 xrxllfx.exe htbnbh.exe PID 436 wrote to memory of 4668 436 xrxllfx.exe htbnbh.exe PID 436 wrote to memory of 4668 436 xrxllfx.exe htbnbh.exe PID 4668 wrote to memory of 1036 4668 htbnbh.exe 9vdvv.exe PID 4668 wrote to memory of 1036 4668 htbnbh.exe 9vdvv.exe PID 4668 wrote to memory of 1036 4668 htbnbh.exe 9vdvv.exe PID 1036 wrote to memory of 5324 1036 9vdvv.exe dvpdp.exe PID 1036 wrote to memory of 5324 1036 9vdvv.exe dvpdp.exe PID 1036 wrote to memory of 5324 1036 9vdvv.exe dvpdp.exe PID 5324 wrote to memory of 908 5324 dvpdp.exe frlxrxr.exe PID 5324 wrote to memory of 908 5324 dvpdp.exe frlxrxr.exe PID 5324 wrote to memory of 908 5324 dvpdp.exe frlxrxr.exe PID 908 wrote to memory of 1604 908 frlxrxr.exe nbnnhh.exe PID 908 wrote to memory of 1604 908 frlxrxr.exe nbnnhh.exe PID 908 wrote to memory of 1604 908 frlxrxr.exe nbnnhh.exe PID 1604 wrote to memory of 3472 1604 nbnnhh.exe dvpjd.exe PID 1604 wrote to memory of 3472 1604 nbnnhh.exe dvpjd.exe PID 1604 wrote to memory of 3472 1604 nbnnhh.exe dvpjd.exe PID 3472 wrote to memory of 3140 3472 dvpjd.exe xfxxrlf.exe PID 3472 wrote to memory of 3140 3472 dvpjd.exe xfxxrlf.exe PID 3472 wrote to memory of 3140 3472 dvpjd.exe xfxxrlf.exe PID 3140 wrote to memory of 3652 3140 xfxxrlf.exe btbhbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exe"C:\Users\Admin\AppData\Local\Temp\33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\lffrllf.exec:\lffrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\tntttt.exec:\tntttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\dddvp.exec:\dddvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\dppjv.exec:\dppjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\5rfxllr.exec:\5rfxllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\xlxrxxf.exec:\xlxrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\bthtbt.exec:\bthtbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\jdppv.exec:\jdppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\rlrrllr.exec:\rlrrllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\xlxrlll.exec:\xlxrlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\btntbn.exec:\btntbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
\??\c:\9vdpj.exec:\9vdpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
\??\c:\pvvjd.exec:\pvvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\xrxllfx.exec:\xrxllfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\htbnbh.exec:\htbnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\9vdvv.exec:\9vdvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\dvpdp.exec:\dvpdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
\??\c:\frlxrxr.exec:\frlxrxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\nbnnhh.exec:\nbnnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\dvpjd.exec:\dvpjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\xfxxrlf.exec:\xfxxrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\btbhbt.exec:\btbhbt.exe23⤵
- Executes dropped EXE
PID:3652 -
\??\c:\tnbtnh.exec:\tnbtnh.exe24⤵
- Executes dropped EXE
PID:396 -
\??\c:\vppjj.exec:\vppjj.exe25⤵
- Executes dropped EXE
PID:4192 -
\??\c:\9xlfrrl.exec:\9xlfrrl.exe26⤵
- Executes dropped EXE
PID:4952 -
\??\c:\xlfxlxr.exec:\xlfxlxr.exe27⤵
- Executes dropped EXE
PID:5752 -
\??\c:\bhhhbb.exec:\bhhhbb.exe28⤵
- Executes dropped EXE
PID:540 -
\??\c:\jvvpj.exec:\jvvpj.exe29⤵
- Executes dropped EXE
PID:5708 -
\??\c:\bhhhtt.exec:\bhhhtt.exe30⤵
- Executes dropped EXE
PID:5288 -
\??\c:\vjvjd.exec:\vjvjd.exe31⤵
- Executes dropped EXE
PID:5660 -
\??\c:\jpjjv.exec:\jpjjv.exe32⤵
- Executes dropped EXE
PID:3628 -
\??\c:\flrffxr.exec:\flrffxr.exe33⤵
- Executes dropped EXE
PID:6112 -
\??\c:\tbnttt.exec:\tbnttt.exe34⤵
- Executes dropped EXE
PID:636 -
\??\c:\tbhbtt.exec:\tbhbtt.exe35⤵
- Executes dropped EXE
PID:640 -
\??\c:\5dpjv.exec:\5dpjv.exe36⤵
- Executes dropped EXE
PID:880 -
\??\c:\5ddpd.exec:\5ddpd.exe37⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jpvpp.exec:\jpvpp.exe38⤵
- Executes dropped EXE
PID:5336 -
\??\c:\5ffrfxr.exec:\5ffrfxr.exe39⤵
- Executes dropped EXE
PID:3848 -
\??\c:\rllllfl.exec:\rllllfl.exe40⤵
- Executes dropped EXE
PID:3172 -
\??\c:\htnhbt.exec:\htnhbt.exe41⤵
- Executes dropped EXE
PID:2164 -
\??\c:\htntht.exec:\htntht.exe42⤵
- Executes dropped EXE
PID:1572 -
\??\c:\jdjdv.exec:\jdjdv.exe43⤵
- Executes dropped EXE
PID:1124 -
\??\c:\rffrflf.exec:\rffrflf.exe44⤵
- Executes dropped EXE
PID:3288 -
\??\c:\3ffxxfx.exec:\3ffxxfx.exe45⤵
- Executes dropped EXE
PID:1380 -
\??\c:\rllfffr.exec:\rllfffr.exe46⤵
- Executes dropped EXE
PID:3724 -
\??\c:\nhbttn.exec:\nhbttn.exe47⤵
- Executes dropped EXE
PID:5608 -
\??\c:\dppdp.exec:\dppdp.exe48⤵
- Executes dropped EXE
PID:5128 -
\??\c:\jddvj.exec:\jddvj.exe49⤵
- Executes dropped EXE
PID:5644 -
\??\c:\lxfrxxr.exec:\lxfrxxr.exe50⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lfrlrlx.exec:\lfrlrlx.exe51⤵
- Executes dropped EXE
PID:6096 -
\??\c:\thhnbh.exec:\thhnbh.exe52⤵
- Executes dropped EXE
PID:4428 -
\??\c:\bbbthh.exec:\bbbthh.exe53⤵
- Executes dropped EXE
PID:4032 -
\??\c:\ddppd.exec:\ddppd.exe54⤵
- Executes dropped EXE
PID:5652 -
\??\c:\pvddd.exec:\pvddd.exe55⤵
- Executes dropped EXE
PID:732 -
\??\c:\lxfrxrr.exec:\lxfrxrr.exe56⤵
- Executes dropped EXE
PID:4700 -
\??\c:\1flfxfx.exec:\1flfxfx.exe57⤵
- Executes dropped EXE
PID:3316 -
\??\c:\bbthnt.exec:\bbthnt.exe58⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ddpjp.exec:\ddpjp.exe59⤵
- Executes dropped EXE
PID:4936 -
\??\c:\djdvv.exec:\djdvv.exe60⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rlxrffr.exec:\rlxrffr.exe61⤵
- Executes dropped EXE
PID:5744 -
\??\c:\xrrlrfr.exec:\xrrlrfr.exe62⤵
- Executes dropped EXE
PID:2408 -
\??\c:\3nhbnn.exec:\3nhbnn.exe63⤵
- Executes dropped EXE
PID:1600 -
\??\c:\pjdvv.exec:\pjdvv.exe64⤵
- Executes dropped EXE
PID:1148 -
\??\c:\7ppjp.exec:\7ppjp.exe65⤵
- Executes dropped EXE
PID:2324 -
\??\c:\frfrlfx.exec:\frfrlfx.exe66⤵PID:2224
-
\??\c:\rrxrlrf.exec:\rrxrlrf.exe67⤵PID:1160
-
\??\c:\9tnthb.exec:\9tnthb.exe68⤵PID:3536
-
\??\c:\pjddj.exec:\pjddj.exe69⤵PID:3048
-
\??\c:\pvvjv.exec:\pvvjv.exe70⤵PID:956
-
\??\c:\3xlrrlx.exec:\3xlrrlx.exe71⤵PID:3576
-
\??\c:\nthhhn.exec:\nthhhn.exe72⤵PID:3524
-
\??\c:\tnthhh.exec:\tnthhh.exe73⤵PID:2080
-
\??\c:\pjddd.exec:\pjddd.exe74⤵PID:3064
-
\??\c:\dpjvp.exec:\dpjvp.exe75⤵PID:2284
-
\??\c:\5xxrflf.exec:\5xxrflf.exe76⤵PID:5688
-
\??\c:\7lfxrrl.exec:\7lfxrrl.exe77⤵PID:4744
-
\??\c:\ntnbnh.exec:\ntnbnh.exe78⤵PID:432
-
\??\c:\jdpjp.exec:\jdpjp.exe79⤵PID:3512
-
\??\c:\jdpvd.exec:\jdpvd.exe80⤵PID:1708
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe81⤵PID:1824
-
\??\c:\nbttnh.exec:\nbttnh.exe82⤵PID:4220
-
\??\c:\tttbnn.exec:\tttbnn.exe83⤵PID:2972
-
\??\c:\vpjdp.exec:\vpjdp.exe84⤵PID:5768
-
\??\c:\jpjvj.exec:\jpjvj.exe85⤵PID:4504
-
\??\c:\frlxxrl.exec:\frlxxrl.exe86⤵PID:4600
-
\??\c:\lfrrrll.exec:\lfrrrll.exe87⤵PID:548
-
\??\c:\tbnnnh.exec:\tbnnnh.exe88⤵PID:4332
-
\??\c:\jdvjv.exec:\jdvjv.exe89⤵PID:4932
-
\??\c:\5lfxllf.exec:\5lfxllf.exe90⤵PID:2088
-
\??\c:\rlfxxxr.exec:\rlfxxxr.exe91⤵PID:2688
-
\??\c:\tbnbbh.exec:\tbnbbh.exe92⤵PID:2652
-
\??\c:\jvjvv.exec:\jvjvv.exe93⤵PID:3540
-
\??\c:\ppdjv.exec:\ppdjv.exe94⤵PID:1948
-
\??\c:\xrfrfxl.exec:\xrfrfxl.exe95⤵PID:3320
-
\??\c:\hhbbbh.exec:\hhbbbh.exe96⤵PID:4112
-
\??\c:\nbhtht.exec:\nbhtht.exe97⤵PID:3388
-
\??\c:\jdjjv.exec:\jdjjv.exe98⤵PID:1004
-
\??\c:\fxrfxrl.exec:\fxrfxrl.exe99⤵PID:1608
-
\??\c:\xrlxrlx.exec:\xrlxrlx.exe100⤵PID:1412
-
\??\c:\7tnbtn.exec:\7tnbtn.exe101⤵PID:2636
-
\??\c:\hhnnhh.exec:\hhnnhh.exe102⤵PID:5756
-
\??\c:\jpvpv.exec:\jpvpv.exe103⤵PID:5764
-
\??\c:\9jddd.exec:\9jddd.exe104⤵PID:2060
-
\??\c:\xlxlfxl.exec:\xlxlfxl.exe105⤵PID:4664
-
\??\c:\rlrfrlf.exec:\rlrfrlf.exe106⤵PID:5040
-
\??\c:\bbhbnh.exec:\bbhbnh.exe107⤵PID:800
-
\??\c:\tnbbtn.exec:\tnbbtn.exe108⤵PID:724
-
\??\c:\vvvjd.exec:\vvvjd.exe109⤵PID:1036
-
\??\c:\jpdpd.exec:\jpdpd.exe110⤵PID:5148
-
\??\c:\frllfxr.exec:\frllfxr.exe111⤵PID:5820
-
\??\c:\lxxrffx.exec:\lxxrffx.exe112⤵PID:5320
-
\??\c:\nnbbtt.exec:\nnbbtt.exe113⤵PID:4696
-
\??\c:\jvppj.exec:\jvppj.exe114⤵PID:2768
-
\??\c:\rfxrfxr.exec:\rfxrfxr.exe115⤵PID:448
-
\??\c:\5xrllll.exec:\5xrllll.exe116⤵PID:3140
-
\??\c:\tbtnhb.exec:\tbtnhb.exe117⤵PID:4140
-
\??\c:\nhbthh.exec:\nhbthh.exe118⤵PID:1444
-
\??\c:\jvdpd.exec:\jvdpd.exe119⤵PID:3156
-
\??\c:\ddjdv.exec:\ddjdv.exe120⤵PID:3024
-
\??\c:\fxlxfxl.exec:\fxlxfxl.exe121⤵PID:2448
-
\??\c:\5lfxrlf.exec:\5lfxrlf.exe122⤵PID:5552
-
\??\c:\ntnnhh.exec:\ntnnhh.exe123⤵PID:2344
-
\??\c:\7bbbtt.exec:\7bbbtt.exe124⤵PID:3296
-
\??\c:\jjjdv.exec:\jjjdv.exe125⤵PID:6024
-
\??\c:\fxllfrl.exec:\fxllfrl.exe126⤵PID:5392
-
\??\c:\tnhbbh.exec:\tnhbbh.exe127⤵PID:3148
-
\??\c:\hbnntt.exec:\hbnntt.exe128⤵PID:2288
-
\??\c:\vdvpj.exec:\vdvpj.exe129⤵PID:3796
-
\??\c:\9xrlxrf.exec:\9xrlxrf.exe130⤵PID:5496
-
\??\c:\xrrxrll.exec:\xrrxrll.exe131⤵PID:4916
-
\??\c:\htbbtt.exec:\htbbtt.exe132⤵PID:4356
-
\??\c:\7ttntt.exec:\7ttntt.exe133⤵PID:2940
-
\??\c:\dvdvp.exec:\dvdvp.exe134⤵PID:6112
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe135⤵PID:3528
-
\??\c:\bhnbbt.exec:\bhnbbt.exe136⤵PID:1628
-
\??\c:\jjdvj.exec:\jjdvj.exe137⤵PID:1704
-
\??\c:\lfxrllf.exec:\lfxrllf.exe138⤵PID:1416
-
\??\c:\1rrxlxl.exec:\1rrxlxl.exe139⤵PID:3324
-
\??\c:\nthtnb.exec:\nthtnb.exe140⤵PID:3108
-
\??\c:\vdpjp.exec:\vdpjp.exe141⤵PID:2164
-
\??\c:\dvvdv.exec:\dvvdv.exe142⤵PID:1648
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe143⤵PID:3308
-
\??\c:\llrrlfx.exec:\llrrlfx.exe144⤵PID:4544
-
\??\c:\nnhhhh.exec:\nnhhhh.exe145⤵PID:5544
-
\??\c:\ttbtnn.exec:\ttbtnn.exe146⤵PID:5464
-
\??\c:\jpdvd.exec:\jpdvd.exe147⤵PID:5692
-
\??\c:\7vdvp.exec:\7vdvp.exe148⤵PID:3516
-
\??\c:\3frrflf.exec:\3frrflf.exe149⤵PID:2860
-
\??\c:\frlfxxx.exec:\frlfxxx.exe150⤵PID:4980
-
\??\c:\nnbbbt.exec:\nnbbbt.exe151⤵PID:4348
-
\??\c:\hbnthh.exec:\hbnthh.exe152⤵PID:4956
-
\??\c:\vdvvj.exec:\vdvvj.exe153⤵PID:4964
-
\??\c:\lflflfx.exec:\lflflfx.exe154⤵PID:3096
-
\??\c:\rrlrxlr.exec:\rrlrxlr.exe155⤵PID:4728
-
\??\c:\hnhhbb.exec:\hnhhbb.exe156⤵PID:4700
-
\??\c:\bbnhtn.exec:\bbnhtn.exe157⤵PID:3316
-
\??\c:\jdvpp.exec:\jdvpp.exe158⤵PID:2232
-
\??\c:\frrfxxr.exec:\frrfxxr.exe159⤵PID:2968
-
\??\c:\rlrfrlr.exec:\rlrfrlr.exe160⤵PID:1120
-
\??\c:\tnnhbh.exec:\tnnhbh.exe161⤵PID:5744
-
\??\c:\thbnbb.exec:\thbnbb.exe162⤵PID:4028
-
\??\c:\pvppp.exec:\pvppp.exe163⤵PID:4508
-
\??\c:\rrrflxf.exec:\rrrflxf.exe164⤵PID:5672
-
\??\c:\xxxflrr.exec:\xxxflrr.exe165⤵PID:2480
-
\??\c:\nnbtnh.exec:\nnbtnh.exe166⤵PID:6060
-
\??\c:\ntbnhb.exec:\ntbnhb.exe167⤵PID:536
-
\??\c:\jdvpv.exec:\jdvpv.exe168⤵PID:1884
-
\??\c:\jjdvj.exec:\jjdvj.exe169⤵PID:2680
-
\??\c:\7rxlxxr.exec:\7rxlxxr.exe170⤵PID:3248
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe171⤵PID:1916
-
\??\c:\tnhhbb.exec:\tnhhbb.exe172⤵PID:3572
-
\??\c:\9bbtnh.exec:\9bbtnh.exe173⤵PID:5176
-
\??\c:\ppjvp.exec:\ppjvp.exe174⤵PID:2192
-
\??\c:\llflxff.exec:\llflxff.exe175⤵PID:5224
-
\??\c:\xfxrxlr.exec:\xfxrxlr.exe176⤵PID:5624
-
\??\c:\ttbbtn.exec:\ttbbtn.exe177⤵PID:1756
-
\??\c:\ntnhbb.exec:\ntnhbb.exe178⤵PID:3512
-
\??\c:\djjjd.exec:\djjjd.exe179⤵PID:5792
-
\??\c:\ddvpj.exec:\ddvpj.exe180⤵PID:2196
-
\??\c:\9frlxrf.exec:\9frlxrf.exe181⤵PID:3356
-
\??\c:\xrlrffx.exec:\xrlrffx.exe182⤵PID:4504
-
\??\c:\1ttnnh.exec:\1ttnnh.exe183⤵PID:4600
-
\??\c:\jjdpd.exec:\jjdpd.exe184⤵PID:5112
-
\??\c:\rlflfll.exec:\rlflfll.exe185⤵PID:3672
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe186⤵PID:2760
-
\??\c:\hbbbbb.exec:\hbbbbb.exe187⤵PID:992
-
\??\c:\tnnhnh.exec:\tnnhnh.exe188⤵PID:4832
-
\??\c:\vdvdv.exec:\vdvdv.exe189⤵PID:3768
-
\??\c:\lrxrlll.exec:\lrxrlll.exe190⤵PID:5796
-
\??\c:\ttbtnh.exec:\ttbtnh.exe191⤵PID:2068
-
\??\c:\hbthht.exec:\hbthht.exe192⤵PID:1208
-
\??\c:\jvjvp.exec:\jvjvp.exe193⤵PID:1436
-
\??\c:\7ddvd.exec:\7ddvd.exe194⤵PID:5760
-
\??\c:\rxxlfrr.exec:\rxxlfrr.exe195⤵PID:2992
-
\??\c:\lfffrlx.exec:\lfffrlx.exe196⤵PID:5740
-
\??\c:\5hhtnt.exec:\5hhtnt.exe197⤵PID:3620
-
\??\c:\htnbnn.exec:\htnbnn.exe198⤵PID:5052
-
\??\c:\pvpjd.exec:\pvpjd.exe199⤵PID:4376
-
\??\c:\vvvpd.exec:\vvvpd.exe200⤵PID:5356
-
\??\c:\lxlfflf.exec:\lxlfflf.exe201⤵PID:5036
-
\??\c:\lfxfxrf.exec:\lfxfxrf.exe202⤵PID:6072
-
\??\c:\hnnhbt.exec:\hnnhbt.exe203⤵PID:5204
-
\??\c:\dvjdd.exec:\dvjdd.exe204⤵PID:6068
-
\??\c:\ddvpj.exec:\ddvpj.exe205⤵PID:5988
-
\??\c:\fflffll.exec:\fflffll.exe206⤵PID:4420
-
\??\c:\1lrrllf.exec:\1lrrllf.exe207⤵PID:3648
-
\??\c:\nhtntt.exec:\nhtntt.exe208⤵PID:2440
-
\??\c:\ntbbtb.exec:\ntbbtb.exe209⤵PID:3740
-
\??\c:\jddvp.exec:\jddvp.exe210⤵PID:4756
-
\??\c:\lfxrllf.exec:\lfxrllf.exe211⤵PID:3780
-
\??\c:\lxlllfl.exec:\lxlllfl.exe212⤵PID:5520
-
\??\c:\tbtnbt.exec:\tbtnbt.exe213⤵PID:2824
-
\??\c:\thbnbt.exec:\thbnbt.exe214⤵PID:2648
-
\??\c:\5jjvj.exec:\5jjvj.exe215⤵PID:1848
-
\??\c:\ffxxlfx.exec:\ffxxlfx.exe216⤵PID:388
-
\??\c:\1btnbn.exec:\1btnbn.exe217⤵PID:5732
-
\??\c:\htthtn.exec:\htthtn.exe218⤵PID:5524
-
\??\c:\pjdjv.exec:\pjdjv.exe219⤵PID:3040
-
\??\c:\llxxrxr.exec:\llxxrxr.exe220⤵PID:628
-
\??\c:\flxxrxx.exec:\flxxrxx.exe221⤵PID:3148
-
\??\c:\thbthb.exec:\thbthb.exe222⤵PID:5084
-
\??\c:\7ttnhb.exec:\7ttnhb.exe223⤵PID:3292
-
\??\c:\dpdpv.exec:\dpdpv.exe224⤵PID:5368
-
\??\c:\jvpdp.exec:\jvpdp.exe225⤵PID:3628
-
\??\c:\xrxlxrl.exec:\xrxlxrl.exe226⤵PID:4748
-
\??\c:\xrlfxrf.exec:\xrlfxrf.exe227⤵PID:2940
-
\??\c:\5nhtnb.exec:\5nhtnb.exe228⤵PID:6112
-
\??\c:\btthhh.exec:\btthhh.exe229⤵PID:3528
-
\??\c:\vvvpj.exec:\vvvpj.exe230⤵PID:5160
-
\??\c:\1xlrxrl.exec:\1xlrxrl.exe231⤵PID:1900
-
\??\c:\xfxrflx.exec:\xfxrflx.exe232⤵PID:3848
-
\??\c:\7bbnhb.exec:\7bbnhb.exe233⤵PID:3172
-
\??\c:\nhnnbt.exec:\nhnnbt.exe234⤵PID:1668
-
\??\c:\pjjdj.exec:\pjjdj.exe235⤵PID:1808
-
\??\c:\vdpjv.exec:\vdpjv.exe236⤵PID:1664
-
\??\c:\xfxrffr.exec:\xfxrffr.exe237⤵PID:4372
-
\??\c:\lffffxx.exec:\lffffxx.exe238⤵PID:4616
-
\??\c:\nhnntt.exec:\nhnntt.exe239⤵PID:3724
-
\??\c:\hhnntb.exec:\hhnntb.exe240⤵PID:5632
-
\??\c:\vvdpp.exec:\vvdpp.exe241⤵PID:5128
-