Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2024, 23:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a.exe
-
Size
391KB
-
MD5
cf0eb360c1aa2e54e46b230e0808d2b4
-
SHA1
ae873ff1b99738889f3a626590f649b83cb3bfc7
-
SHA256
ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a
-
SHA512
ca7c7dd86c6ead051b7c2e5dfc2628e4c66901d2fb784c4b7fdd8b9cd68790e6bc628754675796e4fcfffed5f9971401ead914f829335c4fe9c0b3093c83e567
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkobjcSbcY+CaQdaFOY4iGFYtRdu/W:n3C9ytvngQjZbz+xt4vFBu
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral2/memory/3476-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/344-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3792-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-379-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-398-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-419-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-423-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-432-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-438-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-442-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-452-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 52 IoCs
resource yara_rule behavioral2/memory/3476-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3476-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/448-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/344-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/392-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1812-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3772-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2256-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3532-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1652-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4660-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1616-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1940-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4688-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4248-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4248-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5008-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2056-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2056-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/936-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2912-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2912-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4368-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2768-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3592-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2984-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2728-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2140-211-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3360-217-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4984-230-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3792-234-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1812-243-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1768-257-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3892-265-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3892-268-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2580-272-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1616-289-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1940-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1940-298-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4952-300-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1640-310-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2936-327-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1324-361-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2984-379-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3836-388-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5108-398-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4528-419-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4476-423-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3312-432-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3812-438-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4660-442-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1092-452-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 448 hbnntt.exe 344 rxfxllf.exe 3532 lrlllll.exe 392 ntbtnn.exe 1812 fflfffx.exe 2256 1nbtbb.exe 3772 nhtnbb.exe 2500 vdpjv.exe 1652 lxfxrxr.exe 4660 nbhbbb.exe 4000 lfrlffr.exe 1616 pppdd.exe 1940 llxfrrr.exe 4688 dvpjj.exe 1184 fxffrrx.exe 4248 djddj.exe 5008 bbtnbb.exe 2056 jdjjv.exe 936 dvvvj.exe 4828 3tbbnn.exe 2912 xrfrlfx.exe 4092 9dpdv.exe 4964 5jdvp.exe 4368 ffrxxxl.exe 2768 vvpdv.exe 3592 3hbthh.exe 2984 7xrffxr.exe 2728 9dvjd.exe 2140 3hhbnh.exe 3360 rxxlrxx.exe 2120 vpjdp.exe 4984 3hbthb.exe 3792 3xrfrlf.exe 4948 jpvdp.exe 1812 xllfrlf.exe 752 vdvjd.exe 1624 xrxlffx.exe 1768 1pppd.exe 4612 xflflff.exe 3892 7pjdp.exe 2580 bthhnn.exe 4304 ddjjd.exe 4892 htnbtn.exe 5044 xrrffxr.exe 1616 nhbthh.exe 1940 pdpdd.exe 4952 tnnhbt.exe 1108 dpddj.exe 1640 hbbtnb.exe 1312 dpdpp.exe 3388 bbbthh.exe 2412 dvddd.exe 2936 bnhbhb.exe 2952 jvpdp.exe 4828 nbbthb.exe 3320 dpppj.exe 3912 1rrfrlf.exe 3980 nhhbtt.exe 3560 rxfxrrr.exe 2916 3tbtnh.exe 1324 bnhhbb.exe 2512 pjddj.exe 2768 nnhbbt.exe 2704 ppvjv.exe -
resource yara_rule behavioral2/memory/3476-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/344-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3792-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-379-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-388-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-398-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-419-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-423-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-432-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-438-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-442-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-452-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3476 wrote to memory of 448 3476 ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a.exe 89 PID 3476 wrote to memory of 448 3476 ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a.exe 89 PID 3476 wrote to memory of 448 3476 ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a.exe 89 PID 448 wrote to memory of 344 448 hbnntt.exe 90 PID 448 wrote to memory of 344 448 hbnntt.exe 90 PID 448 wrote to memory of 344 448 hbnntt.exe 90 PID 344 wrote to memory of 3532 344 rxfxllf.exe 91 PID 344 wrote to memory of 3532 344 rxfxllf.exe 91 PID 344 wrote to memory of 3532 344 rxfxllf.exe 91 PID 3532 wrote to memory of 392 3532 lrlllll.exe 92 PID 3532 wrote to memory of 392 3532 lrlllll.exe 92 PID 3532 wrote to memory of 392 3532 lrlllll.exe 92 PID 392 wrote to memory of 1812 392 ntbtnn.exe 93 PID 392 wrote to memory of 1812 392 ntbtnn.exe 93 PID 392 wrote to memory of 1812 392 ntbtnn.exe 93 PID 1812 wrote to memory of 2256 1812 fflfffx.exe 94 PID 1812 wrote to memory of 2256 1812 fflfffx.exe 94 PID 1812 wrote to memory of 2256 1812 fflfffx.exe 94 PID 2256 wrote to memory of 3772 2256 1nbtbb.exe 95 PID 2256 wrote to memory of 3772 2256 1nbtbb.exe 95 PID 2256 wrote to memory of 3772 2256 1nbtbb.exe 95 PID 3772 wrote to memory of 2500 3772 nhtnbb.exe 96 PID 3772 wrote to memory of 2500 3772 nhtnbb.exe 96 PID 3772 wrote to memory of 2500 3772 nhtnbb.exe 96 PID 2500 wrote to memory of 1652 2500 vdpjv.exe 97 PID 2500 wrote to memory of 1652 2500 vdpjv.exe 97 PID 2500 wrote to memory of 1652 2500 vdpjv.exe 97 PID 1652 wrote to memory of 4660 1652 lxfxrxr.exe 98 PID 1652 wrote to memory of 4660 1652 lxfxrxr.exe 98 PID 1652 wrote to memory of 4660 1652 lxfxrxr.exe 98 PID 4660 wrote to memory of 4000 4660 nbhbbb.exe 100 PID 4660 wrote to memory of 4000 4660 nbhbbb.exe 100 PID 4660 wrote to memory of 4000 4660 nbhbbb.exe 100 PID 4000 wrote to memory of 1616 4000 lfrlffr.exe 101 PID 4000 wrote to memory of 1616 4000 lfrlffr.exe 101 PID 4000 wrote to memory of 1616 4000 lfrlffr.exe 101 PID 1616 wrote to memory of 1940 1616 pppdd.exe 102 PID 1616 wrote to memory of 1940 1616 pppdd.exe 102 PID 1616 wrote to memory of 1940 1616 pppdd.exe 102 PID 1940 wrote to memory of 4688 1940 llxfrrr.exe 103 PID 1940 wrote to memory of 4688 1940 llxfrrr.exe 103 PID 1940 wrote to memory of 4688 1940 llxfrrr.exe 103 PID 4688 wrote to memory of 1184 4688 dvpjj.exe 104 PID 4688 wrote to memory of 1184 4688 dvpjj.exe 104 PID 4688 wrote to memory of 1184 4688 dvpjj.exe 104 PID 1184 wrote to memory of 4248 1184 fxffrrx.exe 105 PID 1184 wrote to memory of 4248 1184 fxffrrx.exe 105 PID 1184 wrote to memory of 4248 1184 fxffrrx.exe 105 PID 4248 wrote to memory of 5008 4248 djddj.exe 106 PID 4248 wrote to memory of 5008 4248 djddj.exe 106 PID 4248 wrote to memory of 5008 4248 djddj.exe 106 PID 5008 wrote to memory of 2056 5008 bbtnbb.exe 107 PID 5008 wrote to memory of 2056 5008 bbtnbb.exe 107 PID 5008 wrote to memory of 2056 5008 bbtnbb.exe 107 PID 2056 wrote to memory of 936 2056 jdjjv.exe 108 PID 2056 wrote to memory of 936 2056 jdjjv.exe 108 PID 2056 wrote to memory of 936 2056 jdjjv.exe 108 PID 936 wrote to memory of 4828 936 dvvvj.exe 109 PID 936 wrote to memory of 4828 936 dvvvj.exe 109 PID 936 wrote to memory of 4828 936 dvvvj.exe 109 PID 4828 wrote to memory of 2912 4828 3tbbnn.exe 110 PID 4828 wrote to memory of 2912 4828 3tbbnn.exe 110 PID 4828 wrote to memory of 2912 4828 3tbbnn.exe 110 PID 2912 wrote to memory of 4092 2912 xrfrlfx.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a.exe"C:\Users\Admin\AppData\Local\Temp\ac4f321efe49526a1d6c815859a0125f4d6b97ed726b8329bf68732b74d6a02a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\hbnntt.exec:\hbnntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\rxfxllf.exec:\rxfxllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\lrlllll.exec:\lrlllll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\ntbtnn.exec:\ntbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\fflfffx.exec:\fflfffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\1nbtbb.exec:\1nbtbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\nhtnbb.exec:\nhtnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\vdpjv.exec:\vdpjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\lxfxrxr.exec:\lxfxrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\nbhbbb.exec:\nbhbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\lfrlffr.exec:\lfrlffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\pppdd.exec:\pppdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\llxfrrr.exec:\llxfrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\dvpjj.exec:\dvpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\fxffrrx.exec:\fxffrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\djddj.exec:\djddj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\bbtnbb.exec:\bbtnbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\jdjjv.exec:\jdjjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\dvvvj.exec:\dvvvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\3tbbnn.exec:\3tbbnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\xrfrlfx.exec:\xrfrlfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\9dpdv.exec:\9dpdv.exe23⤵
- Executes dropped EXE
PID:4092 -
\??\c:\5jdvp.exec:\5jdvp.exe24⤵
- Executes dropped EXE
PID:4964 -
\??\c:\ffrxxxl.exec:\ffrxxxl.exe25⤵
- Executes dropped EXE
PID:4368 -
\??\c:\vvpdv.exec:\vvpdv.exe26⤵
- Executes dropped EXE
PID:2768 -
\??\c:\3hbthh.exec:\3hbthh.exe27⤵
- Executes dropped EXE
PID:3592 -
\??\c:\7xrffxr.exec:\7xrffxr.exe28⤵
- Executes dropped EXE
PID:2984 -
\??\c:\9dvjd.exec:\9dvjd.exe29⤵
- Executes dropped EXE
PID:2728 -
\??\c:\3hhbnh.exec:\3hhbnh.exe30⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rxxlrxx.exec:\rxxlrxx.exe31⤵
- Executes dropped EXE
PID:3360 -
\??\c:\vpjdp.exec:\vpjdp.exe32⤵
- Executes dropped EXE
PID:2120 -
\??\c:\3hbthb.exec:\3hbthb.exe33⤵
- Executes dropped EXE
PID:4984 -
\??\c:\3xrfrlf.exec:\3xrfrlf.exe34⤵
- Executes dropped EXE
PID:3792 -
\??\c:\jpvdp.exec:\jpvdp.exe35⤵
- Executes dropped EXE
PID:4948 -
\??\c:\xllfrlf.exec:\xllfrlf.exe36⤵
- Executes dropped EXE
PID:1812 -
\??\c:\vdvjd.exec:\vdvjd.exe37⤵
- Executes dropped EXE
PID:752 -
\??\c:\xrxlffx.exec:\xrxlffx.exe38⤵
- Executes dropped EXE
PID:1624 -
\??\c:\1pppd.exec:\1pppd.exe39⤵
- Executes dropped EXE
PID:1768 -
\??\c:\xflflff.exec:\xflflff.exe40⤵
- Executes dropped EXE
PID:4612 -
\??\c:\7pjdp.exec:\7pjdp.exe41⤵
- Executes dropped EXE
PID:3892 -
\??\c:\bthhnn.exec:\bthhnn.exe42⤵
- Executes dropped EXE
PID:2580 -
\??\c:\ddjjd.exec:\ddjjd.exe43⤵
- Executes dropped EXE
PID:4304 -
\??\c:\htnbtn.exec:\htnbtn.exe44⤵
- Executes dropped EXE
PID:4892 -
\??\c:\xrrffxr.exec:\xrrffxr.exe45⤵
- Executes dropped EXE
PID:5044 -
\??\c:\nhbthh.exec:\nhbthh.exe46⤵
- Executes dropped EXE
PID:1616 -
\??\c:\pdpdd.exec:\pdpdd.exe47⤵
- Executes dropped EXE
PID:1940 -
\??\c:\tnnhbt.exec:\tnnhbt.exe48⤵
- Executes dropped EXE
PID:4952 -
\??\c:\dpddj.exec:\dpddj.exe49⤵
- Executes dropped EXE
PID:1108 -
\??\c:\hbbtnb.exec:\hbbtnb.exe50⤵
- Executes dropped EXE
PID:1640 -
\??\c:\dpdpp.exec:\dpdpp.exe51⤵
- Executes dropped EXE
PID:1312 -
\??\c:\bbbthh.exec:\bbbthh.exe52⤵
- Executes dropped EXE
PID:3388 -
\??\c:\dvddd.exec:\dvddd.exe53⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bnhbhb.exec:\bnhbhb.exe54⤵
- Executes dropped EXE
PID:2936 -
\??\c:\jvpdp.exec:\jvpdp.exe55⤵
- Executes dropped EXE
PID:2952 -
\??\c:\nbbthb.exec:\nbbthb.exe56⤵
- Executes dropped EXE
PID:4828 -
\??\c:\dpppj.exec:\dpppj.exe57⤵
- Executes dropped EXE
PID:3320 -
\??\c:\1rrfrlf.exec:\1rrfrlf.exe58⤵
- Executes dropped EXE
PID:3912 -
\??\c:\nhhbtt.exec:\nhhbtt.exe59⤵
- Executes dropped EXE
PID:3980 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe60⤵
- Executes dropped EXE
PID:3560 -
\??\c:\3tbtnh.exec:\3tbtnh.exe61⤵
- Executes dropped EXE
PID:2916 -
\??\c:\bnhhbb.exec:\bnhhbb.exe62⤵
- Executes dropped EXE
PID:1324 -
\??\c:\pjddj.exec:\pjddj.exe63⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nnhbbt.exec:\nnhbbt.exe64⤵
- Executes dropped EXE
PID:2768 -
\??\c:\ppvjv.exec:\ppvjv.exe65⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rrlffxx.exec:\rrlffxx.exe66⤵PID:2984
-
\??\c:\5ddvp.exec:\5ddvp.exe67⤵PID:4044
-
\??\c:\flrrlxx.exec:\flrrlxx.exe68⤵PID:3836
-
\??\c:\hnbnhh.exec:\hnbnhh.exe69⤵PID:3004
-
\??\c:\lflxrlf.exec:\lflxrlf.exe70⤵PID:5108
-
\??\c:\hbtnhh.exec:\hbtnhh.exe71⤵PID:2524
-
\??\c:\jpvpd.exec:\jpvpd.exe72⤵PID:1380
-
\??\c:\bbhbnt.exec:\bbhbnt.exe73⤵PID:4340
-
\??\c:\jpdpv.exec:\jpdpv.exe74⤵PID:4880
-
\??\c:\btnhnn.exec:\btnhnn.exe75⤵PID:4528
-
\??\c:\frrfrxl.exec:\frrfrxl.exe76⤵PID:4476
-
\??\c:\5lrfrlr.exec:\5lrfrlr.exe77⤵PID:4636
-
\??\c:\3dvpj.exec:\3dvpj.exe78⤵PID:3312
-
\??\c:\3htbnh.exec:\3htbnh.exe79⤵PID:3812
-
\??\c:\3vjjv.exec:\3vjjv.exe80⤵PID:4660
-
\??\c:\3bbnhb.exec:\3bbnhb.exe81⤵PID:2976
-
\??\c:\pjdvp.exec:\pjdvp.exe82⤵PID:1092
-
\??\c:\rfxrfxr.exec:\rfxrfxr.exe83⤵PID:4712
-
\??\c:\hbtbth.exec:\hbtbth.exe84⤵PID:3248
-
\??\c:\5vpdv.exec:\5vpdv.exe85⤵PID:1008
-
\??\c:\9lxrxlx.exec:\9lxrxlx.exe86⤵PID:4100
-
\??\c:\dddvv.exec:\dddvv.exe87⤵PID:1048
-
\??\c:\7rlxfxl.exec:\7rlxfxl.exe88⤵PID:3020
-
\??\c:\3btnbt.exec:\3btnbt.exe89⤵PID:3060
-
\??\c:\1vpjd.exec:\1vpjd.exe90⤵PID:1864
-
\??\c:\fffxlfr.exec:\fffxlfr.exe91⤵PID:2740
-
\??\c:\pjjdv.exec:\pjjdv.exe92⤵PID:5112
-
\??\c:\3ffxxrr.exec:\3ffxxrr.exe93⤵PID:4532
-
\??\c:\7pjjj.exec:\7pjjj.exe94⤵PID:1500
-
\??\c:\3flfxrr.exec:\3flfxrr.exe95⤵PID:2772
-
\??\c:\bhhtnh.exec:\bhhtnh.exe96⤵PID:3304
-
\??\c:\xllfxrl.exec:\xllfxrl.exe97⤵PID:1884
-
\??\c:\jdjdp.exec:\jdjdp.exe98⤵PID:1964
-
\??\c:\rffrlfx.exec:\rffrlfx.exe99⤵PID:4452
-
\??\c:\pddvv.exec:\pddvv.exe100⤵PID:5000
-
\??\c:\lxrxxxr.exec:\lxrxxxr.exe101⤵PID:3208
-
\??\c:\vdvvv.exec:\vdvvv.exe102⤵PID:1924
-
\??\c:\lfrlxff.exec:\lfrlxff.exe103⤵PID:4356
-
\??\c:\hbhbbt.exec:\hbhbbt.exe104⤵PID:1608
-
\??\c:\fxxrfff.exec:\fxxrfff.exe105⤵PID:3108
-
\??\c:\frfxfff.exec:\frfxfff.exe106⤵PID:1868
-
\??\c:\7hnnnn.exec:\7hnnnn.exe107⤵PID:752
-
\??\c:\rfrlfff.exec:\rfrlfff.exe108⤵PID:2324
-
\??\c:\hnthtb.exec:\hnthtb.exe109⤵PID:1080
-
\??\c:\9dpjd.exec:\9dpjd.exe110⤵PID:2528
-
\??\c:\htttnt.exec:\htttnt.exe111⤵PID:3228
-
\??\c:\vjpjp.exec:\vjpjp.exe112⤵PID:1320
-
\??\c:\rrllllr.exec:\rrllllr.exe113⤵PID:1568
-
\??\c:\hnhhhh.exec:\hnhhhh.exe114⤵PID:3272
-
\??\c:\fxxxlll.exec:\fxxxlll.exe115⤵PID:4952
-
\??\c:\3nhbtt.exec:\3nhbtt.exe116⤵PID:1184
-
\??\c:\ddvpp.exec:\ddvpp.exe117⤵PID:436
-
\??\c:\hhtthh.exec:\hhtthh.exe118⤵PID:3156
-
\??\c:\vvjpp.exec:\vvjpp.exe119⤵PID:508
-
\??\c:\rlllxxx.exec:\rlllxxx.exe120⤵PID:3388
-
\??\c:\bbbtnh.exec:\bbbtnh.exe121⤵PID:4816
-
\??\c:\djvvj.exec:\djvvj.exe122⤵PID:4116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-