Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
07-07-2024 00:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84cfa44911eca431e2d55019ae3552f48b97fbb24d0c76e8f2287971c6c0a6f2.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
General
-
Target
84cfa44911eca431e2d55019ae3552f48b97fbb24d0c76e8f2287971c6c0a6f2.exe
-
Size
342KB
-
MD5
ff0614b33f2aab02985065c655bb3c3c
-
SHA1
4fd423615abc74e4b6f6cf4e5c50030fc9150dfe
-
SHA256
84cfa44911eca431e2d55019ae3552f48b97fbb24d0c76e8f2287971c6c0a6f2
-
SHA512
7b1c8e298b0c04b8ea17072c0cbeaf03615db0e169be75e12efb6e5982785aa0048d56d6d98af9fbf65068ec8c3b2779e987b260e5132032f7c5cbe8d54d1302
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYA7:l7TcbWXZshJX2VGd7
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1792-5-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3876-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3428-17-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5012-18-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3608-27-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2420-34-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2848-46-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4952-48-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/220-52-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2472-65-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1672-67-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3800-72-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3404-78-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4800-89-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3452-106-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4256-112-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2172-118-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5036-127-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1560-124-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4340-138-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2564-147-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3308-150-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/648-159-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/556-176-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2480-180-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3136-190-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3668-197-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4596-198-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3972-205-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3676-213-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4936-214-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2124-221-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2020-225-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2616-229-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2304-239-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3608-240-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/384-251-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1216-255-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2052-259-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4832-263-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3896-270-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3460-284-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3528-288-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4276-323-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3196-330-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4104-340-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2532-372-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3676-398-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3204-408-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2020-412-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1504-425-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4128-432-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3220-445-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3452-490-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5032-506-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4340-524-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2000-564-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3644-596-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1528-612-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/384-620-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3188-697-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3892-711-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2648-746-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1920-771-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3876 pdddv.exe 3428 9xrllll.exe 5012 ddpvp.exe 3608 jvvpv.exe 2420 btnhhh.exe 2324 nnnhbb.exe 2848 pvjpj.exe 4952 9xfxrlf.exe 220 hbhbtt.exe 2472 dddvd.exe 1672 hhhnhb.exe 3800 pjvpp.exe 3404 xrrllll.exe 4800 pvppv.exe 3660 llffxxl.exe 468 lfflffx.exe 3452 9vdpd.exe 4256 ttnnhb.exe 2172 jjpjj.exe 1560 hhtnnt.exe 5036 jddvp.exe 4524 lrrlffr.exe 4340 htttnn.exe 2564 jpppj.exe 3308 nnbtnh.exe 648 tnhhhh.exe 924 llrrxxf.exe 2716 bttnhb.exe 556 vdjdj.exe 2480 rllfffx.exe 244 5pddd.exe 3136 pjjdv.exe 3060 lrxxffl.exe 3668 nnnhhh.exe 4596 5dpdd.exe 3972 rrfrfll.exe 1920 fxfxxxx.exe 3676 bntnhb.exe 4936 jjjdj.exe 4408 lrxlrll.exe 2124 3hbtnn.exe 2616 5vvvp.exe 1596 fxxxrxx.exe 3564 httbhb.exe 2304 pjjjj.exe 3608 thnhnh.exe 3076 bbbbnn.exe 384 7jjdv.exe 1216 3lrrxxr.exe 2052 bbhnnb.exe 4832 jjdvp.exe 3704 3xfxrrr.exe 3896 fllfflx.exe 2548 ntbtnh.exe 232 jpjjj.exe 2268 pvpvp.exe 3460 lxlfxxx.exe 3528 tnbhhh.exe 5088 pvvpp.exe 4472 9lllflf.exe 4800 nbhtnn.exe 2300 jdvpj.exe 1060 xxllxxr.exe 3716 nbhbbh.exe -
resource yara_rule behavioral2/memory/1792-5-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3876-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3428-17-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5012-18-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3608-27-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2420-34-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2848-40-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2848-46-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4952-48-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/220-52-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2472-59-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2472-65-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1672-67-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3800-72-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3404-78-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4800-84-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4800-89-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3452-101-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3452-106-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4256-112-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2172-118-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5036-127-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1560-124-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4340-138-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2564-147-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3308-150-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/648-159-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/556-176-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2480-180-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3136-190-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3668-197-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4596-198-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3972-205-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3676-209-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3676-213-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4936-214-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2124-221-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2020-225-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2616-229-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2304-239-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3608-240-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/384-247-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/384-251-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1216-255-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2052-259-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4832-263-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3896-270-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2548-271-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3460-284-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3528-288-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4464-313-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4276-323-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3196-330-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4104-340-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1712-347-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2532-372-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2024-388-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3676-398-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3204-408-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2020-412-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1504-425-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4128-432-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3220-445-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3704-449-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 3876 1792 84cfa44911eca431e2d55019ae3552f48b97fbb24d0c76e8f2287971c6c0a6f2.exe 83 PID 1792 wrote to memory of 3876 1792 84cfa44911eca431e2d55019ae3552f48b97fbb24d0c76e8f2287971c6c0a6f2.exe 83 PID 1792 wrote to memory of 3876 1792 84cfa44911eca431e2d55019ae3552f48b97fbb24d0c76e8f2287971c6c0a6f2.exe 83 PID 3876 wrote to memory of 3428 3876 pdddv.exe 84 PID 3876 wrote to memory of 3428 3876 pdddv.exe 84 PID 3876 wrote to memory of 3428 3876 pdddv.exe 84 PID 3428 wrote to memory of 5012 3428 9xrllll.exe 86 PID 3428 wrote to memory of 5012 3428 9xrllll.exe 86 PID 3428 wrote to memory of 5012 3428 9xrllll.exe 86 PID 5012 wrote to memory of 3608 5012 ddpvp.exe 87 PID 5012 wrote to memory of 3608 5012 ddpvp.exe 87 PID 5012 wrote to memory of 3608 5012 ddpvp.exe 87 PID 3608 wrote to memory of 2420 3608 jvvpv.exe 88 PID 3608 wrote to memory of 2420 3608 jvvpv.exe 88 PID 3608 wrote to memory of 2420 3608 jvvpv.exe 88 PID 2420 wrote to memory of 2324 2420 btnhhh.exe 89 PID 2420 wrote to memory of 2324 2420 btnhhh.exe 89 PID 2420 wrote to memory of 2324 2420 btnhhh.exe 89 PID 2324 wrote to memory of 2848 2324 nnnhbb.exe 90 PID 2324 wrote to memory of 2848 2324 nnnhbb.exe 90 PID 2324 wrote to memory of 2848 2324 nnnhbb.exe 90 PID 2848 wrote to memory of 4952 2848 pvjpj.exe 91 PID 2848 wrote to memory of 4952 2848 pvjpj.exe 91 PID 2848 wrote to memory of 4952 2848 pvjpj.exe 91 PID 4952 wrote to memory of 220 4952 9xfxrlf.exe 93 PID 4952 wrote to memory of 220 4952 9xfxrlf.exe 93 PID 4952 wrote to memory of 220 4952 9xfxrlf.exe 93 PID 220 wrote to memory of 2472 220 hbhbtt.exe 94 PID 220 wrote to memory of 2472 220 hbhbtt.exe 94 PID 220 wrote to memory of 2472 220 hbhbtt.exe 94 PID 2472 wrote to memory of 1672 2472 dddvd.exe 95 PID 2472 wrote to memory of 1672 2472 dddvd.exe 95 PID 2472 wrote to memory of 1672 2472 dddvd.exe 95 PID 1672 wrote to memory of 3800 1672 hhhnhb.exe 96 PID 1672 wrote to memory of 3800 1672 hhhnhb.exe 96 PID 1672 wrote to memory of 3800 1672 hhhnhb.exe 96 PID 3800 wrote to memory of 3404 3800 pjvpp.exe 97 PID 3800 wrote to memory of 3404 3800 pjvpp.exe 97 PID 3800 wrote to memory of 3404 3800 pjvpp.exe 97 PID 3404 wrote to memory of 4800 3404 xrrllll.exe 98 PID 3404 wrote to memory of 4800 3404 xrrllll.exe 98 PID 3404 wrote to memory of 4800 3404 xrrllll.exe 98 PID 4800 wrote to memory of 3660 4800 pvppv.exe 99 PID 4800 wrote to memory of 3660 4800 pvppv.exe 99 PID 4800 wrote to memory of 3660 4800 pvppv.exe 99 PID 3660 wrote to memory of 468 3660 llffxxl.exe 100 PID 3660 wrote to memory of 468 3660 llffxxl.exe 100 PID 3660 wrote to memory of 468 3660 llffxxl.exe 100 PID 468 wrote to memory of 3452 468 lfflffx.exe 101 PID 468 wrote to memory of 3452 468 lfflffx.exe 101 PID 468 wrote to memory of 3452 468 lfflffx.exe 101 PID 3452 wrote to memory of 4256 3452 9vdpd.exe 102 PID 3452 wrote to memory of 4256 3452 9vdpd.exe 102 PID 3452 wrote to memory of 4256 3452 9vdpd.exe 102 PID 4256 wrote to memory of 2172 4256 ttnnhb.exe 103 PID 4256 wrote to memory of 2172 4256 ttnnhb.exe 103 PID 4256 wrote to memory of 2172 4256 ttnnhb.exe 103 PID 2172 wrote to memory of 1560 2172 jjpjj.exe 104 PID 2172 wrote to memory of 1560 2172 jjpjj.exe 104 PID 2172 wrote to memory of 1560 2172 jjpjj.exe 104 PID 1560 wrote to memory of 5036 1560 hhtnnt.exe 105 PID 1560 wrote to memory of 5036 1560 hhtnnt.exe 105 PID 1560 wrote to memory of 5036 1560 hhtnnt.exe 105 PID 5036 wrote to memory of 4524 5036 jddvp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\84cfa44911eca431e2d55019ae3552f48b97fbb24d0c76e8f2287971c6c0a6f2.exe"C:\Users\Admin\AppData\Local\Temp\84cfa44911eca431e2d55019ae3552f48b97fbb24d0c76e8f2287971c6c0a6f2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\pdddv.exec:\pdddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\9xrllll.exec:\9xrllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\ddpvp.exec:\ddpvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\jvvpv.exec:\jvvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\btnhhh.exec:\btnhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\nnnhbb.exec:\nnnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\pvjpj.exec:\pvjpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\9xfxrlf.exec:\9xfxrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\hbhbtt.exec:\hbhbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\dddvd.exec:\dddvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\hhhnhb.exec:\hhhnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\pjvpp.exec:\pjvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\xrrllll.exec:\xrrllll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\pvppv.exec:\pvppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\llffxxl.exec:\llffxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\lfflffx.exec:\lfflffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\9vdpd.exec:\9vdpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\ttnnhb.exec:\ttnnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\jjpjj.exec:\jjpjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\hhtnnt.exec:\hhtnnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\jddvp.exec:\jddvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\lrrlffr.exec:\lrrlffr.exe23⤵
- Executes dropped EXE
PID:4524 -
\??\c:\htttnn.exec:\htttnn.exe24⤵
- Executes dropped EXE
PID:4340 -
\??\c:\jpppj.exec:\jpppj.exe25⤵
- Executes dropped EXE
PID:2564 -
\??\c:\nnbtnh.exec:\nnbtnh.exe26⤵
- Executes dropped EXE
PID:3308 -
\??\c:\tnhhhh.exec:\tnhhhh.exe27⤵
- Executes dropped EXE
PID:648 -
\??\c:\llrrxxf.exec:\llrrxxf.exe28⤵
- Executes dropped EXE
PID:924 -
\??\c:\bttnhb.exec:\bttnhb.exe29⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vdjdj.exec:\vdjdj.exe30⤵
- Executes dropped EXE
PID:556 -
\??\c:\rllfffx.exec:\rllfffx.exe31⤵
- Executes dropped EXE
PID:2480 -
\??\c:\5pddd.exec:\5pddd.exe32⤵
- Executes dropped EXE
PID:244 -
\??\c:\pjjdv.exec:\pjjdv.exe33⤵
- Executes dropped EXE
PID:3136 -
\??\c:\lrxxffl.exec:\lrxxffl.exe34⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nnnhhh.exec:\nnnhhh.exe35⤵
- Executes dropped EXE
PID:3668 -
\??\c:\5dpdd.exec:\5dpdd.exe36⤵
- Executes dropped EXE
PID:4596 -
\??\c:\rrfrfll.exec:\rrfrfll.exe37⤵
- Executes dropped EXE
PID:3972 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe38⤵
- Executes dropped EXE
PID:1920 -
\??\c:\bntnhb.exec:\bntnhb.exe39⤵
- Executes dropped EXE
PID:3676 -
\??\c:\jjjdj.exec:\jjjdj.exe40⤵
- Executes dropped EXE
PID:4936 -
\??\c:\lrxlrll.exec:\lrxlrll.exe41⤵
- Executes dropped EXE
PID:4408 -
\??\c:\3hbtnn.exec:\3hbtnn.exe42⤵
- Executes dropped EXE
PID:2124 -
\??\c:\ttnhbb.exec:\ttnhbb.exe43⤵PID:2020
-
\??\c:\5vvvp.exec:\5vvvp.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe45⤵
- Executes dropped EXE
PID:1596 -
\??\c:\httbhb.exec:\httbhb.exe46⤵
- Executes dropped EXE
PID:3564 -
\??\c:\pjjjj.exec:\pjjjj.exe47⤵
- Executes dropped EXE
PID:2304 -
\??\c:\thnhnh.exec:\thnhnh.exe48⤵
- Executes dropped EXE
PID:3608 -
\??\c:\bbbbnn.exec:\bbbbnn.exe49⤵
- Executes dropped EXE
PID:3076 -
\??\c:\7jjdv.exec:\7jjdv.exe50⤵
- Executes dropped EXE
PID:384 -
\??\c:\3lrrxxr.exec:\3lrrxxr.exe51⤵
- Executes dropped EXE
PID:1216 -
\??\c:\bbhnnb.exec:\bbhnnb.exe52⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jjdvp.exec:\jjdvp.exe53⤵
- Executes dropped EXE
PID:4832 -
\??\c:\3xfxrrr.exec:\3xfxrrr.exe54⤵
- Executes dropped EXE
PID:3704 -
\??\c:\fllfflx.exec:\fllfflx.exe55⤵
- Executes dropped EXE
PID:3896 -
\??\c:\ntbtnh.exec:\ntbtnh.exe56⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jpjjj.exec:\jpjjj.exe57⤵
- Executes dropped EXE
PID:232 -
\??\c:\pvpvp.exec:\pvpvp.exe58⤵
- Executes dropped EXE
PID:2268 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe59⤵
- Executes dropped EXE
PID:3460 -
\??\c:\tnbhhh.exec:\tnbhhh.exe60⤵
- Executes dropped EXE
PID:3528 -
\??\c:\pvvpp.exec:\pvvpp.exe61⤵
- Executes dropped EXE
PID:5088 -
\??\c:\9lllflf.exec:\9lllflf.exe62⤵
- Executes dropped EXE
PID:4472 -
\??\c:\nbhtnn.exec:\nbhtnn.exe63⤵
- Executes dropped EXE
PID:4800 -
\??\c:\jdvpj.exec:\jdvpj.exe64⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xxllxxr.exec:\xxllxxr.exe65⤵
- Executes dropped EXE
PID:1060 -
\??\c:\nbhbbh.exec:\nbhbbh.exe66⤵
- Executes dropped EXE
PID:3716 -
\??\c:\btbtbt.exec:\btbtbt.exe67⤵PID:2952
-
\??\c:\ppjdv.exec:\ppjdv.exe68⤵PID:1860
-
\??\c:\llxllff.exec:\llxllff.exe69⤵PID:4464
-
\??\c:\ttbtnn.exec:\ttbtnn.exe70⤵PID:4024
-
\??\c:\ddjpv.exec:\ddjpv.exe71⤵PID:4276
-
\??\c:\flxlrrl.exec:\flxlrrl.exe72⤵PID:1560
-
\??\c:\hhbttt.exec:\hhbttt.exe73⤵PID:3196
-
\??\c:\1dpjj.exec:\1dpjj.exe74⤵PID:552
-
\??\c:\xrxrrfr.exec:\xrxrrfr.exe75⤵PID:1924
-
\??\c:\nnhntb.exec:\nnhntb.exe76⤵PID:3540
-
\??\c:\pjvvv.exec:\pjvvv.exe77⤵PID:4104
-
\??\c:\flrlflf.exec:\flrlflf.exe78⤵PID:412
-
\??\c:\lflxlfr.exec:\lflxlfr.exe79⤵PID:1712
-
\??\c:\btbtbt.exec:\btbtbt.exe80⤵PID:1304
-
\??\c:\vpjdv.exec:\vpjdv.exe81⤵PID:2448
-
\??\c:\jjjvv.exec:\jjjvv.exe82⤵PID:1544
-
\??\c:\vppjj.exec:\vppjj.exe83⤵PID:3248
-
\??\c:\fxffrrf.exec:\fxffrrf.exe84⤵PID:1192
-
\??\c:\xfxxrlx.exec:\xfxxrlx.exe85⤵PID:3480
-
\??\c:\bbnhtn.exec:\bbnhtn.exe86⤵PID:2532
-
\??\c:\pjjjj.exec:\pjjjj.exe87⤵PID:788
-
\??\c:\vppjd.exec:\vppjd.exe88⤵PID:3136
-
\??\c:\lffrfxl.exec:\lffrfxl.exe89⤵PID:3868
-
\??\c:\tbhbnn.exec:\tbhbnn.exe90⤵PID:992
-
\??\c:\1vpdv.exec:\1vpdv.exe91⤵PID:3580
-
\??\c:\xxfrfxl.exec:\xxfrfxl.exe92⤵PID:2024
-
\??\c:\rrfxrlf.exec:\rrfxrlf.exe93⤵PID:2348
-
\??\c:\bnthbt.exec:\bnthbt.exe94⤵PID:1920
-
\??\c:\ppvpv.exec:\ppvpv.exe95⤵PID:3676
-
\??\c:\9jvjd.exec:\9jvjd.exe96⤵PID:4456
-
\??\c:\fllxfxr.exec:\fllxfxr.exe97⤵PID:5056
-
\??\c:\tnttbh.exec:\tnttbh.exe98⤵PID:3204
-
\??\c:\vjvvv.exec:\vjvvv.exe99⤵PID:2020
-
\??\c:\pvdvd.exec:\pvdvd.exe100⤵PID:2780
-
\??\c:\rlrxxrx.exec:\rlrxxrx.exe101⤵PID:5012
-
\??\c:\ththbb.exec:\ththbb.exe102⤵PID:1504
-
\??\c:\pjppj.exec:\pjppj.exe103⤵PID:2304
-
\??\c:\vppdv.exec:\vppdv.exe104⤵PID:3608
-
\??\c:\9ffxlrf.exec:\9ffxlrf.exe105⤵PID:4128
-
\??\c:\lxfrlfx.exec:\lxfrlfx.exe106⤵PID:3280
-
\??\c:\bbbnbt.exec:\bbbnbt.exe107⤵PID:4720
-
\??\c:\vjppd.exec:\vjppd.exe108⤵PID:4296
-
\??\c:\5hhtnh.exec:\5hhtnh.exe109⤵PID:3220
-
\??\c:\pjjdj.exec:\pjjdj.exe110⤵PID:3704
-
\??\c:\fffrrll.exec:\fffrrll.exe111⤵PID:1108
-
\??\c:\7bthbt.exec:\7bthbt.exe112⤵PID:4976
-
\??\c:\tbhnnt.exec:\tbhnnt.exe113⤵PID:2224
-
\??\c:\jvdpv.exec:\jvdpv.exe114⤵PID:2308
-
\??\c:\lflffff.exec:\lflffff.exe115⤵PID:3800
-
\??\c:\bhhtnh.exec:\bhhtnh.exe116⤵PID:5000
-
\??\c:\jjddp.exec:\jjddp.exe117⤵PID:1508
-
\??\c:\jvpjd.exec:\jvpjd.exe118⤵PID:388
-
\??\c:\xxlfxxr.exec:\xxlfxxr.exe119⤵PID:4848
-
\??\c:\bttnnn.exec:\bttnnn.exe120⤵PID:3660
-
\??\c:\vddpv.exec:\vddpv.exe121⤵PID:4536
-
\??\c:\1pvjd.exec:\1pvjd.exe122⤵PID:3452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-