Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21-07-2024 11:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ba263b5510097e7131341ad4a1aa5770N.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
120 seconds
General
-
Target
ba263b5510097e7131341ad4a1aa5770N.exe
-
Size
411KB
-
MD5
ba263b5510097e7131341ad4a1aa5770
-
SHA1
ca5a3f86aaf15f34d052362923faa1416e9d4acc
-
SHA256
66a32ca5e5e746a11ffc4aceac32c26500d08a17ddb728ee864dd50267f72441
-
SHA512
a0916adac105cfc96a2fde7ad2f02ff176b0ff92069f59485e0801a3ef7cfc81468049949c31902fd09d9e56d52953d2cd3b9f39ae031b0814033740c673ccc2
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jJSp1BwcZN:Pcm7ImGddXtWrXD486jJq1BwcZN
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1428-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/712-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1428-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/908-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-335-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-338-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-354-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-358-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-372-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-385-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-396-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-406-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-419-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-451-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-452-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-487-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-520-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-561-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-605-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-615-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-640-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-659-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-796-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-858-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-871-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-878-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-1176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 388 llfflrx.exe 2180 bntnnn.exe 3312 jjjjp.exe 4500 jdjvv.exe 2592 bnhbbb.exe 3744 1dvjj.exe 2568 hhhhbb.exe 2188 flrlrxr.exe 696 tnbttt.exe 5040 fflflfl.exe 3740 tnbbnh.exe 4884 5rfxrrr.exe 2636 xxfxrrl.exe 1608 7nhbtb.exe 4780 vdpjj.exe 3960 rlxxrrl.exe 2220 pddvp.exe 2788 xfflfrl.exe 2288 7ttttb.exe 4852 llrlxxx.exe 1736 bhhhbb.exe 3752 hnhhhh.exe 2632 hthntb.exe 3244 3jpjp.exe 544 tnttnn.exe 628 hhhtnn.exe 3776 pjjvv.exe 2904 vpvjj.exe 2248 fxfffxl.exe 5020 tbnhhh.exe 2540 dppjd.exe 4284 jdjdv.exe 712 9flfxrl.exe 216 nnhbbb.exe 4020 dvdjj.exe 1428 rlrrlxr.exe 4240 3nhbtn.exe 3884 xfxrffx.exe 3952 lxxlfxr.exe 8 7hbttt.exe 4472 jvvpj.exe 3624 xrlrlfx.exe 3344 9bnhbn.exe 4452 ddjjp.exe 4520 lrxrllx.exe 644 9nbttt.exe 2320 jvvpd.exe 1036 xfrrlxl.exe 1148 lflxrlf.exe 3672 hhnnnn.exe 1880 jvdpj.exe 2636 xxxxrxx.exe 4344 nbnhbb.exe 4860 xxxllff.exe 4780 7ttnnn.exe 624 9ddvp.exe 2264 lfrlrrf.exe 436 htbttt.exe 2500 ddjjd.exe 944 lxlfrxr.exe 2528 1htthn.exe 1736 hbnnht.exe 908 pjdvp.exe 668 rrlfrrl.exe -
resource yara_rule behavioral2/memory/1428-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/908-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-335-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-358-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-368-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-372-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1128-396-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-406-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-419-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-447-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-451-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-487-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1428 wrote to memory of 388 1428 ba263b5510097e7131341ad4a1aa5770N.exe 84 PID 1428 wrote to memory of 388 1428 ba263b5510097e7131341ad4a1aa5770N.exe 84 PID 1428 wrote to memory of 388 1428 ba263b5510097e7131341ad4a1aa5770N.exe 84 PID 388 wrote to memory of 2180 388 llfflrx.exe 85 PID 388 wrote to memory of 2180 388 llfflrx.exe 85 PID 388 wrote to memory of 2180 388 llfflrx.exe 85 PID 2180 wrote to memory of 3312 2180 bntnnn.exe 86 PID 2180 wrote to memory of 3312 2180 bntnnn.exe 86 PID 2180 wrote to memory of 3312 2180 bntnnn.exe 86 PID 3312 wrote to memory of 4500 3312 jjjjp.exe 87 PID 3312 wrote to memory of 4500 3312 jjjjp.exe 87 PID 3312 wrote to memory of 4500 3312 jjjjp.exe 87 PID 4500 wrote to memory of 2592 4500 jdjvv.exe 88 PID 4500 wrote to memory of 2592 4500 jdjvv.exe 88 PID 4500 wrote to memory of 2592 4500 jdjvv.exe 88 PID 2592 wrote to memory of 3744 2592 bnhbbb.exe 89 PID 2592 wrote to memory of 3744 2592 bnhbbb.exe 89 PID 2592 wrote to memory of 3744 2592 bnhbbb.exe 89 PID 3744 wrote to memory of 2568 3744 1dvjj.exe 91 PID 3744 wrote to memory of 2568 3744 1dvjj.exe 91 PID 3744 wrote to memory of 2568 3744 1dvjj.exe 91 PID 2568 wrote to memory of 2188 2568 hhhhbb.exe 92 PID 2568 wrote to memory of 2188 2568 hhhhbb.exe 92 PID 2568 wrote to memory of 2188 2568 hhhhbb.exe 92 PID 2188 wrote to memory of 696 2188 flrlrxr.exe 93 PID 2188 wrote to memory of 696 2188 flrlrxr.exe 93 PID 2188 wrote to memory of 696 2188 flrlrxr.exe 93 PID 696 wrote to memory of 5040 696 tnbttt.exe 95 PID 696 wrote to memory of 5040 696 tnbttt.exe 95 PID 696 wrote to memory of 5040 696 tnbttt.exe 95 PID 5040 wrote to memory of 3740 5040 fflflfl.exe 96 PID 5040 wrote to memory of 3740 5040 fflflfl.exe 96 PID 5040 wrote to memory of 3740 5040 fflflfl.exe 96 PID 3740 wrote to memory of 4884 3740 tnbbnh.exe 97 PID 3740 wrote to memory of 4884 3740 tnbbnh.exe 97 PID 3740 wrote to memory of 4884 3740 tnbbnh.exe 97 PID 4884 wrote to memory of 2636 4884 5rfxrrr.exe 98 PID 4884 wrote to memory of 2636 4884 5rfxrrr.exe 98 PID 4884 wrote to memory of 2636 4884 5rfxrrr.exe 98 PID 2636 wrote to memory of 1608 2636 xxfxrrl.exe 99 PID 2636 wrote to memory of 1608 2636 xxfxrrl.exe 99 PID 2636 wrote to memory of 1608 2636 xxfxrrl.exe 99 PID 1608 wrote to memory of 4780 1608 7nhbtb.exe 100 PID 1608 wrote to memory of 4780 1608 7nhbtb.exe 100 PID 1608 wrote to memory of 4780 1608 7nhbtb.exe 100 PID 4780 wrote to memory of 3960 4780 vdpjj.exe 101 PID 4780 wrote to memory of 3960 4780 vdpjj.exe 101 PID 4780 wrote to memory of 3960 4780 vdpjj.exe 101 PID 3960 wrote to memory of 2220 3960 rlxxrrl.exe 103 PID 3960 wrote to memory of 2220 3960 rlxxrrl.exe 103 PID 3960 wrote to memory of 2220 3960 rlxxrrl.exe 103 PID 2220 wrote to memory of 2788 2220 pddvp.exe 104 PID 2220 wrote to memory of 2788 2220 pddvp.exe 104 PID 2220 wrote to memory of 2788 2220 pddvp.exe 104 PID 2788 wrote to memory of 2288 2788 xfflfrl.exe 105 PID 2788 wrote to memory of 2288 2788 xfflfrl.exe 105 PID 2788 wrote to memory of 2288 2788 xfflfrl.exe 105 PID 2288 wrote to memory of 4852 2288 7ttttb.exe 106 PID 2288 wrote to memory of 4852 2288 7ttttb.exe 106 PID 2288 wrote to memory of 4852 2288 7ttttb.exe 106 PID 4852 wrote to memory of 1736 4852 llrlxxx.exe 107 PID 4852 wrote to memory of 1736 4852 llrlxxx.exe 107 PID 4852 wrote to memory of 1736 4852 llrlxxx.exe 107 PID 1736 wrote to memory of 3752 1736 bhhhbb.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba263b5510097e7131341ad4a1aa5770N.exe"C:\Users\Admin\AppData\Local\Temp\ba263b5510097e7131341ad4a1aa5770N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\llfflrx.exec:\llfflrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\bntnnn.exec:\bntnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\jjjjp.exec:\jjjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\jdjvv.exec:\jdjvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\bnhbbb.exec:\bnhbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\1dvjj.exec:\1dvjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\hhhhbb.exec:\hhhhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\flrlrxr.exec:\flrlrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\tnbttt.exec:\tnbttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\fflflfl.exec:\fflflfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\tnbbnh.exec:\tnbbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\5rfxrrr.exec:\5rfxrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\7nhbtb.exec:\7nhbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\vdpjj.exec:\vdpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\rlxxrrl.exec:\rlxxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\pddvp.exec:\pddvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\xfflfrl.exec:\xfflfrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\7ttttb.exec:\7ttttb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\llrlxxx.exec:\llrlxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\bhhhbb.exec:\bhhhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\hnhhhh.exec:\hnhhhh.exe23⤵
- Executes dropped EXE
PID:3752 -
\??\c:\hthntb.exec:\hthntb.exe24⤵
- Executes dropped EXE
PID:2632 -
\??\c:\3jpjp.exec:\3jpjp.exe25⤵
- Executes dropped EXE
PID:3244 -
\??\c:\tnttnn.exec:\tnttnn.exe26⤵
- Executes dropped EXE
PID:544 -
\??\c:\hhhtnn.exec:\hhhtnn.exe27⤵
- Executes dropped EXE
PID:628 -
\??\c:\pjjvv.exec:\pjjvv.exe28⤵
- Executes dropped EXE
PID:3776 -
\??\c:\vpvjj.exec:\vpvjj.exe29⤵
- Executes dropped EXE
PID:2904 -
\??\c:\fxfffxl.exec:\fxfffxl.exe30⤵
- Executes dropped EXE
PID:2248 -
\??\c:\tbnhhh.exec:\tbnhhh.exe31⤵
- Executes dropped EXE
PID:5020 -
\??\c:\dppjd.exec:\dppjd.exe32⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jdjdv.exec:\jdjdv.exe33⤵
- Executes dropped EXE
PID:4284 -
\??\c:\9flfxrl.exec:\9flfxrl.exe34⤵
- Executes dropped EXE
PID:712 -
\??\c:\nnhbbb.exec:\nnhbbb.exe35⤵
- Executes dropped EXE
PID:216 -
\??\c:\dvdjj.exec:\dvdjj.exe36⤵
- Executes dropped EXE
PID:4020 -
\??\c:\rlrrlxr.exec:\rlrrlxr.exe37⤵
- Executes dropped EXE
PID:1428 -
\??\c:\3nhbtn.exec:\3nhbtn.exe38⤵
- Executes dropped EXE
PID:4240 -
\??\c:\xfxrffx.exec:\xfxrffx.exe39⤵
- Executes dropped EXE
PID:3884 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe40⤵
- Executes dropped EXE
PID:3952 -
\??\c:\7hbttt.exec:\7hbttt.exe41⤵
- Executes dropped EXE
PID:8 -
\??\c:\jvvpj.exec:\jvvpj.exe42⤵
- Executes dropped EXE
PID:4472 -
\??\c:\xrlrlfx.exec:\xrlrlfx.exe43⤵
- Executes dropped EXE
PID:3624 -
\??\c:\9bnhbn.exec:\9bnhbn.exe44⤵
- Executes dropped EXE
PID:3344 -
\??\c:\ddjjp.exec:\ddjjp.exe45⤵
- Executes dropped EXE
PID:4452 -
\??\c:\lrxrllx.exec:\lrxrllx.exe46⤵
- Executes dropped EXE
PID:4520 -
\??\c:\9nbttt.exec:\9nbttt.exe47⤵
- Executes dropped EXE
PID:644 -
\??\c:\jvvpd.exec:\jvvpd.exe48⤵
- Executes dropped EXE
PID:2320 -
\??\c:\xfrrlxl.exec:\xfrrlxl.exe49⤵
- Executes dropped EXE
PID:1036 -
\??\c:\lflxrlf.exec:\lflxrlf.exe50⤵
- Executes dropped EXE
PID:1148 -
\??\c:\hhnnnn.exec:\hhnnnn.exe51⤵
- Executes dropped EXE
PID:3672 -
\??\c:\jvdpj.exec:\jvdpj.exe52⤵
- Executes dropped EXE
PID:1880 -
\??\c:\xxxxrxx.exec:\xxxxrxx.exe53⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nbnhbb.exec:\nbnhbb.exe54⤵
- Executes dropped EXE
PID:4344 -
\??\c:\xxxllff.exec:\xxxllff.exe55⤵
- Executes dropped EXE
PID:4860 -
\??\c:\7ttnnn.exec:\7ttnnn.exe56⤵
- Executes dropped EXE
PID:4780 -
\??\c:\9ddvp.exec:\9ddvp.exe57⤵
- Executes dropped EXE
PID:624 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe58⤵
- Executes dropped EXE
PID:2264 -
\??\c:\htbttt.exec:\htbttt.exe59⤵
- Executes dropped EXE
PID:436 -
\??\c:\ddjjd.exec:\ddjjd.exe60⤵
- Executes dropped EXE
PID:2500 -
\??\c:\lxlfrxr.exec:\lxlfrxr.exe61⤵
- Executes dropped EXE
PID:944 -
\??\c:\1htthn.exec:\1htthn.exe62⤵
- Executes dropped EXE
PID:2528 -
\??\c:\hbnnht.exec:\hbnnht.exe63⤵
- Executes dropped EXE
PID:1736 -
\??\c:\pjdvp.exec:\pjdvp.exe64⤵
- Executes dropped EXE
PID:908 -
\??\c:\rrlfrrl.exec:\rrlfrrl.exe65⤵
- Executes dropped EXE
PID:668 -
\??\c:\hthbtt.exec:\hthbtt.exe66⤵PID:1164
-
\??\c:\hnntnn.exec:\hnntnn.exe67⤵PID:4132
-
\??\c:\pjpjd.exec:\pjpjd.exe68⤵PID:3584
-
\??\c:\fxflfff.exec:\fxflfff.exe69⤵PID:4456
-
\??\c:\bhbbtn.exec:\bhbbtn.exe70⤵PID:740
-
\??\c:\nttnbb.exec:\nttnbb.exe71⤵PID:3212
-
\??\c:\pjppj.exec:\pjppj.exe72⤵PID:4932
-
\??\c:\xllffll.exec:\xllffll.exe73⤵PID:5048
-
\??\c:\hbbtbh.exec:\hbbtbh.exe74⤵PID:1640
-
\??\c:\nbbtnh.exec:\nbbtnh.exe75⤵PID:2540
-
\??\c:\1ddpj.exec:\1ddpj.exe76⤵PID:4140
-
\??\c:\fxxlxrl.exec:\fxxlxrl.exe77⤵PID:3504
-
\??\c:\rxlfxrl.exec:\rxlfxrl.exe78⤵PID:2004
-
\??\c:\3hbtnn.exec:\3hbtnn.exe79⤵PID:4220
-
\??\c:\ddpdp.exec:\ddpdp.exe80⤵PID:4020
-
\??\c:\fffrlfr.exec:\fffrlfr.exe81⤵PID:4080
-
\??\c:\tntttn.exec:\tntttn.exe82⤵PID:4036
-
\??\c:\nhhthb.exec:\nhhthb.exe83⤵PID:4396
-
\??\c:\pvjpv.exec:\pvjpv.exe84⤵PID:4320
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe85⤵PID:3456
-
\??\c:\hbbttt.exec:\hbbttt.exe86⤵PID:3312
-
\??\c:\pvdjj.exec:\pvdjj.exe87⤵PID:1924
-
\??\c:\9pjjv.exec:\9pjjv.exe88⤵PID:980
-
\??\c:\9ffxllr.exec:\9ffxllr.exe89⤵PID:696
-
\??\c:\7hhhbt.exec:\7hhhbt.exe90⤵PID:2376
-
\??\c:\jvdpd.exec:\jvdpd.exe91⤵PID:1128
-
\??\c:\xrrfxfr.exec:\xrrfxfr.exe92⤵PID:2320
-
\??\c:\tnbbtt.exec:\tnbbtt.exe93⤵PID:2380
-
\??\c:\tnhttb.exec:\tnhttb.exe94⤵PID:2184
-
\??\c:\jpjpd.exec:\jpjpd.exe95⤵PID:956
-
\??\c:\fxlflll.exec:\fxlflll.exe96⤵PID:4016
-
\??\c:\bhnhbb.exec:\bhnhbb.exe97⤵PID:3964
-
\??\c:\dpdvj.exec:\dpdvj.exe98⤵PID:3756
-
\??\c:\jjvvj.exec:\jjvvj.exe99⤵PID:2788
-
\??\c:\rllfxxr.exec:\rllfxxr.exe100⤵PID:2500
-
\??\c:\ttnnnt.exec:\ttnnnt.exe101⤵PID:812
-
\??\c:\nhhnbh.exec:\nhhnbh.exe102⤵PID:2892
-
\??\c:\9djdp.exec:\9djdp.exe103⤵PID:2632
-
\??\c:\7pvjd.exec:\7pvjd.exe104⤵PID:4488
-
\??\c:\lrxrlll.exec:\lrxrlll.exe105⤵PID:1164
-
\??\c:\nhnhbb.exec:\nhnhbb.exe106⤵PID:4436
-
\??\c:\bbtntt.exec:\bbtntt.exe107⤵PID:628
-
\??\c:\jvdvp.exec:\jvdvp.exe108⤵PID:4864
-
\??\c:\rllfxxr.exec:\rllfxxr.exe109⤵PID:868
-
\??\c:\ffxrllf.exec:\ffxrllf.exe110⤵PID:4412
-
\??\c:\tnnhtt.exec:\tnnhtt.exe111⤵PID:1692
-
\??\c:\9rlllll.exec:\9rlllll.exe112⤵PID:5048
-
\??\c:\nbhbtn.exec:\nbhbtn.exe113⤵PID:4504
-
\??\c:\pjdvj.exec:\pjdvj.exe114⤵PID:4512
-
\??\c:\vpdvj.exec:\vpdvj.exe115⤵PID:2856
-
\??\c:\hhhbhn.exec:\hhhbhn.exe116⤵PID:4340
-
\??\c:\jdddd.exec:\jdddd.exe117⤵PID:4328
-
\??\c:\7jddd.exec:\7jddd.exe118⤵PID:4292
-
\??\c:\xfffxxf.exec:\xfffxxf.exe119⤵PID:388
-
\??\c:\tbtnnn.exec:\tbtnnn.exe120⤵PID:4240
-
\??\c:\ddpvp.exec:\ddpvp.exe121⤵PID:2232
-
\??\c:\xrxrlrl.exec:\xrxrlrl.exe122⤵PID:4468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-