Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:06
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
4a2e547f300b5ddaa8937f6d60ceebc3a43352bc2321d9e45e23f0aa71ea204a.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4a2e547f300b5ddaa8937f6d60ceebc3a43352bc2321d9e45e23f0aa71ea204a.exe
-
Size
175KB
-
MD5
3832882bfecd7bb0af6e4c6aa3b0f5be
-
SHA1
bfacd1ae279e9a105b179737a8915ebe506211ef
-
SHA256
4a2e547f300b5ddaa8937f6d60ceebc3a43352bc2321d9e45e23f0aa71ea204a
-
SHA512
d185795e6c0ac6d7b3dc9cee928885d3adb8db7150e0e0ccfaae72762630e8afc3a00606d69bde0476c0f3109d934711b6308e67f9b6b2a03bcc8cf5856019b6
-
SSDEEP
3072:fhOmTsF93UYfwC6GIoutXGvBZrQlmUzpi8rY9AABa1YRMxlHCM2fDz:fcm4FmowdHoSXGZEBzddWhROiM2/
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/740-6-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/5068-8-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4952-14-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2964-24-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/5060-33-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1232-55-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4308-126-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1224-119-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/508-109-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1280-181-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3452-204-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4204-223-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4120-221-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3696-233-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2120-246-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4912-253-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4328-265-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1396-297-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4936-300-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2056-318-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4608-324-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4596-328-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2976-349-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3420-368-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4324-384-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1560-319-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2432-306-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4132-304-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3684-405-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2708-425-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2840-443-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1660-472-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3840-439-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2848-483-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3424-482-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/5020-284-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3828-283-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3684-269-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4192-236-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3696-229-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1748-226-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1796-209-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4700-574-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3152-191-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4608-592-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/212-182-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1908-613-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4216-159-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3120-617-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4936-149-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2708-138-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/824-102-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3060-96-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4176-90-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/5004-639-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2152-84-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4560-74-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4192-73-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3596-656-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3036-63-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4208-51-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1528-41-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/5060-38-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/532-31-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/740-0-0x0000000000400000-0x0000000000433000-memory.dmp UPX \??\c:\rllxrxl.exe UPX behavioral2/memory/740-6-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/5068-8-0x0000000000400000-0x0000000000433000-memory.dmp UPX C:\hhttbt.exe UPX behavioral2/memory/4952-14-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/2964-19-0x0000000000400000-0x0000000000433000-memory.dmp UPX \??\c:\5htbhn.exe UPX C:\xlfxlfx.exe UPX behavioral2/memory/532-26-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/2964-24-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/5060-33-0x0000000000400000-0x0000000000433000-memory.dmp UPX \??\c:\tthnht.exe UPX C:\vjjvp.exe UPX behavioral2/memory/1232-55-0x0000000000400000-0x0000000000433000-memory.dmp UPX C:\3flfrrx.exe UPX \??\c:\hbttnn.exe UPX \??\c:\bhbtnh.exe UPX \??\c:\flfxrxr.exe UPX \??\c:\hhtnhb.exe UPX \??\c:\hbbnbt.exe UPX C:\vpjdv.exe UPX \??\c:\bttnht.exe UPX \??\c:\vppjj.exe UPX behavioral2/memory/4308-126-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4308-121-0x0000000000400000-0x0000000000433000-memory.dmp UPX \??\c:\nntnbt.exe UPX behavioral2/memory/1224-119-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/508-109-0x0000000000400000-0x0000000000433000-memory.dmp UPX \??\c:\rlrxrrf.exe UPX \??\c:\hbbttn.exe UPX \??\c:\vpppj.exe UPX \??\c:\3nnhbb.exe UPX \??\c:\nbhbtt.exe UPX behavioral2/memory/1280-181-0x0000000000400000-0x0000000000433000-memory.dmp UPX \??\c:\lrxlfrl.exe UPX behavioral2/memory/3452-204-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4204-223-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4120-221-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/3696-233-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/2120-246-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4912-253-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4328-265-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4012-270-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/1396-297-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4936-300-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/2056-318-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4608-324-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4596-328-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4860-338-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/2976-345-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/2976-349-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/3420-368-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4324-384-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/1560-319-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/2432-306-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/4132-304-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/3564-391-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/3016-398-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/3684-405-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/3504-418-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/1216-426-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/2708-425-0x0000000000400000-0x0000000000433000-memory.dmp UPX behavioral2/memory/2840-443-0x0000000000400000-0x0000000000433000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
rllxrxl.exe5htbhn.exehhttbt.exexlfxlfx.exerlfxlxr.exetthnht.exevjjvp.exexrlffxl.exe3flfrrx.exehbttnn.exebhbtnh.exevjjdp.exeflfxrxr.exellfxxrr.exehhtnhb.exehbbnbt.exevpjdv.exexlfrfxl.exebttnht.exenntnbt.exevppjj.exedvppj.exerlrxrrf.exe7nnnhh.exehbbttn.exevpppj.exevvdpd.exelffffff.exe3nnhbb.exenbhbtt.exeddvdd.exelrxlfrl.exerlrlllf.exebntnbb.exedpjdd.exeppppp.exexrfxxrl.exerlffrrr.exelfffffx.exe9nnhbh.exebtnnhn.exepjvpd.exevjdvj.exeflllllf.exenhttnb.exenbbtnt.exebntnnb.exeppvpp.exelllllll.exerrrfxff.exetntnhh.exenbttnt.exeppjdj.exeppjvv.exelxrrllr.exebthhhh.exehbttnn.exebtbbhh.exejpjdp.exeflxrrfx.exexllllll.exexlllffx.exettthnh.exepdpvv.exepid process 5068 rllxrxl.exe 4952 5htbhn.exe 2964 hhttbt.exe 532 xlfxlfx.exe 5060 rlfxlxr.exe 1528 tthnht.exe 4208 vjjvp.exe 1232 xrlffxl.exe 3616 3flfrrx.exe 3036 hbttnn.exe 4192 bhbtnh.exe 4560 vjjdp.exe 2152 flfxrxr.exe 4176 llfxxrr.exe 3060 hhtnhb.exe 824 hbbnbt.exe 3244 vpjdv.exe 508 xlfrfxl.exe 1224 bttnht.exe 4308 nntnbt.exe 1900 vppjj.exe 2928 dvppj.exe 2708 rlrxrrf.exe 1396 7nnnhh.exe 4936 hbbttn.exe 4216 vpppj.exe 2040 vvdpd.exe 2544 lffffff.exe 2628 3nnhbb.exe 1280 nbhbtt.exe 212 ddvdd.exe 1792 lrxlfrl.exe 3152 rlrlllf.exe 3500 bntnbb.exe 1980 dpjdd.exe 3452 ppppp.exe 4412 xrfxxrl.exe 1796 rlffrrr.exe 4900 lfffffx.exe 4120 9nnhbh.exe 4204 btnnhn.exe 1748 pjvpd.exe 3696 vjdvj.exe 4244 flllllf.exe 4192 nhttnb.exe 872 nbbtnt.exe 2120 bntnnb.exe 1040 ppvpp.exe 4912 lllllll.exe 3700 rrrfxff.exe 1400 tntnhh.exe 4328 nbttnt.exe 3684 ppjdj.exe 4012 ppjvv.exe 2160 lxrrllr.exe 3368 bthhhh.exe 3828 hbttnn.exe 5020 btbbhh.exe 2632 jpjdp.exe 2140 flxrrfx.exe 1396 xllllll.exe 4936 xlllffx.exe 4132 ttthnh.exe 2432 pdpvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4a2e547f300b5ddaa8937f6d60ceebc3a43352bc2321d9e45e23f0aa71ea204a.exerllxrxl.exe5htbhn.exehhttbt.exexlfxlfx.exerlfxlxr.exetthnht.exevjjvp.exexrlffxl.exe3flfrrx.exehbttnn.exebhbtnh.exevjjdp.exeflfxrxr.exellfxxrr.exehhtnhb.exehbbnbt.exevpjdv.exexlfrfxl.exebttnht.exenntnbt.exevppjj.exedescription pid process target process PID 740 wrote to memory of 5068 740 4a2e547f300b5ddaa8937f6d60ceebc3a43352bc2321d9e45e23f0aa71ea204a.exe rllxrxl.exe PID 740 wrote to memory of 5068 740 4a2e547f300b5ddaa8937f6d60ceebc3a43352bc2321d9e45e23f0aa71ea204a.exe rllxrxl.exe PID 740 wrote to memory of 5068 740 4a2e547f300b5ddaa8937f6d60ceebc3a43352bc2321d9e45e23f0aa71ea204a.exe rllxrxl.exe PID 5068 wrote to memory of 4952 5068 rllxrxl.exe 5htbhn.exe PID 5068 wrote to memory of 4952 5068 rllxrxl.exe 5htbhn.exe PID 5068 wrote to memory of 4952 5068 rllxrxl.exe 5htbhn.exe PID 4952 wrote to memory of 2964 4952 5htbhn.exe Conhost.exe PID 4952 wrote to memory of 2964 4952 5htbhn.exe Conhost.exe PID 4952 wrote to memory of 2964 4952 5htbhn.exe Conhost.exe PID 2964 wrote to memory of 532 2964 hhttbt.exe lfxrllf.exe PID 2964 wrote to memory of 532 2964 hhttbt.exe lfxrllf.exe PID 2964 wrote to memory of 532 2964 hhttbt.exe lfxrllf.exe PID 532 wrote to memory of 5060 532 xlfxlfx.exe rlfxlxr.exe PID 532 wrote to memory of 5060 532 xlfxlfx.exe rlfxlxr.exe PID 532 wrote to memory of 5060 532 xlfxlfx.exe rlfxlxr.exe PID 5060 wrote to memory of 1528 5060 rlfxlxr.exe tthnht.exe PID 5060 wrote to memory of 1528 5060 rlfxlxr.exe tthnht.exe PID 5060 wrote to memory of 1528 5060 rlfxlxr.exe tthnht.exe PID 1528 wrote to memory of 4208 1528 tthnht.exe vjjvp.exe PID 1528 wrote to memory of 4208 1528 tthnht.exe vjjvp.exe PID 1528 wrote to memory of 4208 1528 tthnht.exe vjjvp.exe PID 4208 wrote to memory of 1232 4208 vjjvp.exe xrlffxl.exe PID 4208 wrote to memory of 1232 4208 vjjvp.exe xrlffxl.exe PID 4208 wrote to memory of 1232 4208 vjjvp.exe xrlffxl.exe PID 1232 wrote to memory of 3616 1232 xrlffxl.exe 3flfrrx.exe PID 1232 wrote to memory of 3616 1232 xrlffxl.exe 3flfrrx.exe PID 1232 wrote to memory of 3616 1232 xrlffxl.exe 3flfrrx.exe PID 3616 wrote to memory of 3036 3616 3flfrrx.exe hbttnn.exe PID 3616 wrote to memory of 3036 3616 3flfrrx.exe hbttnn.exe PID 3616 wrote to memory of 3036 3616 3flfrrx.exe hbttnn.exe PID 3036 wrote to memory of 4192 3036 hbttnn.exe nhttnb.exe PID 3036 wrote to memory of 4192 3036 hbttnn.exe nhttnb.exe PID 3036 wrote to memory of 4192 3036 hbttnn.exe nhttnb.exe PID 4192 wrote to memory of 4560 4192 bhbtnh.exe vjjdp.exe PID 4192 wrote to memory of 4560 4192 bhbtnh.exe vjjdp.exe PID 4192 wrote to memory of 4560 4192 bhbtnh.exe vjjdp.exe PID 4560 wrote to memory of 2152 4560 vjjdp.exe flfxrxr.exe PID 4560 wrote to memory of 2152 4560 vjjdp.exe flfxrxr.exe PID 4560 wrote to memory of 2152 4560 vjjdp.exe flfxrxr.exe PID 2152 wrote to memory of 4176 2152 flfxrxr.exe llfxxrr.exe PID 2152 wrote to memory of 4176 2152 flfxrxr.exe llfxxrr.exe PID 2152 wrote to memory of 4176 2152 flfxrxr.exe llfxxrr.exe PID 4176 wrote to memory of 3060 4176 llfxxrr.exe hhtnhb.exe PID 4176 wrote to memory of 3060 4176 llfxxrr.exe hhtnhb.exe PID 4176 wrote to memory of 3060 4176 llfxxrr.exe hhtnhb.exe PID 3060 wrote to memory of 824 3060 hhtnhb.exe hbbnbt.exe PID 3060 wrote to memory of 824 3060 hhtnhb.exe hbbnbt.exe PID 3060 wrote to memory of 824 3060 hhtnhb.exe hbbnbt.exe PID 824 wrote to memory of 3244 824 hbbnbt.exe BackgroundTransferHost.exe PID 824 wrote to memory of 3244 824 hbbnbt.exe BackgroundTransferHost.exe PID 824 wrote to memory of 3244 824 hbbnbt.exe BackgroundTransferHost.exe PID 3244 wrote to memory of 508 3244 vpjdv.exe xlfrfxl.exe PID 3244 wrote to memory of 508 3244 vpjdv.exe xlfrfxl.exe PID 3244 wrote to memory of 508 3244 vpjdv.exe xlfrfxl.exe PID 508 wrote to memory of 1224 508 xlfrfxl.exe xrxlrff.exe PID 508 wrote to memory of 1224 508 xlfrfxl.exe xrxlrff.exe PID 508 wrote to memory of 1224 508 xlfrfxl.exe xrxlrff.exe PID 1224 wrote to memory of 4308 1224 bttnht.exe jjvpp.exe PID 1224 wrote to memory of 4308 1224 bttnht.exe jjvpp.exe PID 1224 wrote to memory of 4308 1224 bttnht.exe jjvpp.exe PID 4308 wrote to memory of 1900 4308 nntnbt.exe vppjj.exe PID 4308 wrote to memory of 1900 4308 nntnbt.exe vppjj.exe PID 4308 wrote to memory of 1900 4308 nntnbt.exe vppjj.exe PID 1900 wrote to memory of 2928 1900 vppjj.exe dvppj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a2e547f300b5ddaa8937f6d60ceebc3a43352bc2321d9e45e23f0aa71ea204a.exe"C:\Users\Admin\AppData\Local\Temp\4a2e547f300b5ddaa8937f6d60ceebc3a43352bc2321d9e45e23f0aa71ea204a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\rllxrxl.exec:\rllxrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\5htbhn.exec:\5htbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\hhttbt.exec:\hhttbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\xlfxlfx.exec:\xlfxlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\rlfxlxr.exec:\rlfxlxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\tthnht.exec:\tthnht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\vjjvp.exec:\vjjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\xrlffxl.exec:\xrlffxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\3flfrrx.exec:\3flfrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\hbttnn.exec:\hbttnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\bhbtnh.exec:\bhbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\vjjdp.exec:\vjjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\flfxrxr.exec:\flfxrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\llfxxrr.exec:\llfxxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\hhtnhb.exec:\hhtnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\hbbnbt.exec:\hbbnbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\vpjdv.exec:\vpjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\bttnht.exec:\bttnht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\nntnbt.exec:\nntnbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\vppjj.exec:\vppjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\dvppj.exec:\dvppj.exe23⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rlrxrrf.exec:\rlrxrrf.exe24⤵
- Executes dropped EXE
PID:2708 -
\??\c:\7nnnhh.exec:\7nnnhh.exe25⤵
- Executes dropped EXE
PID:1396 -
\??\c:\hbbttn.exec:\hbbttn.exe26⤵
- Executes dropped EXE
PID:4936 -
\??\c:\vpppj.exec:\vpppj.exe27⤵
- Executes dropped EXE
PID:4216 -
\??\c:\vvdpd.exec:\vvdpd.exe28⤵
- Executes dropped EXE
PID:2040 -
\??\c:\lffffff.exec:\lffffff.exe29⤵
- Executes dropped EXE
PID:2544 -
\??\c:\3nnhbb.exec:\3nnhbb.exe30⤵
- Executes dropped EXE
PID:2628 -
\??\c:\nbhbtt.exec:\nbhbtt.exe31⤵
- Executes dropped EXE
PID:1280 -
\??\c:\ddvdd.exec:\ddvdd.exe32⤵
- Executes dropped EXE
PID:212 -
\??\c:\lrxlfrl.exec:\lrxlfrl.exe33⤵
- Executes dropped EXE
PID:1792 -
\??\c:\rlrlllf.exec:\rlrlllf.exe34⤵
- Executes dropped EXE
PID:3152 -
\??\c:\bntnbb.exec:\bntnbb.exe35⤵
- Executes dropped EXE
PID:3500 -
\??\c:\dpjdd.exec:\dpjdd.exe36⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ppppp.exec:\ppppp.exe37⤵
- Executes dropped EXE
PID:3452 -
\??\c:\xrfxxrl.exec:\xrfxxrl.exe38⤵
- Executes dropped EXE
PID:4412 -
\??\c:\rlffrrr.exec:\rlffrrr.exe39⤵
- Executes dropped EXE
PID:1796 -
\??\c:\lfffffx.exec:\lfffffx.exe40⤵
- Executes dropped EXE
PID:4900 -
\??\c:\9nnhbh.exec:\9nnhbh.exe41⤵
- Executes dropped EXE
PID:4120 -
\??\c:\btnnhn.exec:\btnnhn.exe42⤵
- Executes dropped EXE
PID:4204 -
\??\c:\pjvpd.exec:\pjvpd.exe43⤵
- Executes dropped EXE
PID:1748 -
\??\c:\vjdvj.exec:\vjdvj.exe44⤵
- Executes dropped EXE
PID:3696 -
\??\c:\flllllf.exec:\flllllf.exe45⤵
- Executes dropped EXE
PID:4244 -
\??\c:\nhttnb.exec:\nhttnb.exe46⤵
- Executes dropped EXE
PID:4192 -
\??\c:\nbbtnt.exec:\nbbtnt.exe47⤵
- Executes dropped EXE
PID:872 -
\??\c:\bntnnb.exec:\bntnnb.exe48⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ppvpp.exec:\ppvpp.exe49⤵
- Executes dropped EXE
PID:1040 -
\??\c:\lllllll.exec:\lllllll.exe50⤵
- Executes dropped EXE
PID:4912 -
\??\c:\rrrfxff.exec:\rrrfxff.exe51⤵
- Executes dropped EXE
PID:3700 -
\??\c:\tntnhh.exec:\tntnhh.exe52⤵
- Executes dropped EXE
PID:1400 -
\??\c:\nbttnt.exec:\nbttnt.exe53⤵
- Executes dropped EXE
PID:4328 -
\??\c:\ppjdj.exec:\ppjdj.exe54⤵
- Executes dropped EXE
PID:3684 -
\??\c:\ppjvv.exec:\ppjvv.exe55⤵
- Executes dropped EXE
PID:4012 -
\??\c:\lxrrllr.exec:\lxrrllr.exe56⤵
- Executes dropped EXE
PID:2160 -
\??\c:\bthhhh.exec:\bthhhh.exe57⤵
- Executes dropped EXE
PID:3368 -
\??\c:\hbttnn.exec:\hbttnn.exe58⤵
- Executes dropped EXE
PID:3828 -
\??\c:\btbbhh.exec:\btbbhh.exe59⤵
- Executes dropped EXE
PID:5020 -
\??\c:\jpjdp.exec:\jpjdp.exe60⤵
- Executes dropped EXE
PID:2632 -
\??\c:\flxrrfx.exec:\flxrrfx.exe61⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xllllll.exec:\xllllll.exe62⤵
- Executes dropped EXE
PID:1396 -
\??\c:\xlllffx.exec:\xlllffx.exe63⤵
- Executes dropped EXE
PID:4936 -
\??\c:\ttthnh.exec:\ttthnh.exe64⤵
- Executes dropped EXE
PID:4132 -
\??\c:\pdpvv.exec:\pdpvv.exe65⤵
- Executes dropped EXE
PID:2432 -
\??\c:\5jjdd.exec:\5jjdd.exe66⤵PID:392
-
\??\c:\1dvpd.exec:\1dvpd.exe67⤵PID:4564
-
\??\c:\rxxffxx.exec:\rxxffxx.exe68⤵PID:2056
-
\??\c:\htbttt.exec:\htbttt.exe69⤵PID:1560
-
\??\c:\bhhhbh.exec:\bhhhbh.exe70⤵PID:4608
-
\??\c:\vvdvp.exec:\vvdvp.exe71⤵PID:3404
-
\??\c:\pjpdd.exec:\pjpdd.exe72⤵PID:4596
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe73⤵PID:3604
-
\??\c:\9bbbbb.exec:\9bbbbb.exe74⤵PID:4252
-
\??\c:\ttnbtt.exec:\ttnbtt.exe75⤵PID:4860
-
\??\c:\dvvdv.exec:\dvvdv.exe76⤵PID:3232
-
\??\c:\ddvpj.exec:\ddvpj.exe77⤵PID:2976
-
\??\c:\7fllffx.exec:\7fllffx.exe78⤵PID:1908
-
\??\c:\fffxxll.exec:\fffxxll.exe79⤵PID:3692
-
\??\c:\9hbtbb.exec:\9hbtbb.exe80⤵PID:1232
-
\??\c:\tbhttn.exec:\tbhttn.exe81⤵PID:2948
-
\??\c:\vdjjv.exec:\vdjjv.exe82⤵PID:432
-
\??\c:\pdvjd.exec:\pdvjd.exe83⤵PID:896
-
\??\c:\fxrrlll.exec:\fxrrlll.exe84⤵PID:3420
-
\??\c:\lfrllff.exec:\lfrllff.exe85⤵PID:4560
-
\??\c:\nbhbbb.exec:\nbhbbb.exe86⤵PID:3936
-
\??\c:\5nhbnn.exec:\5nhbnn.exe87⤵PID:4180
-
\??\c:\dvvvv.exec:\dvvvv.exe88⤵PID:4176
-
\??\c:\jdddv.exec:\jdddv.exe89⤵PID:4324
-
\??\c:\fffffff.exec:\fffffff.exe90⤵PID:5072
-
\??\c:\xlflrrx.exec:\xlflrrx.exe91⤵PID:3564
-
\??\c:\hbbttt.exec:\hbbttt.exe92⤵PID:1400
-
\??\c:\5hhbtt.exec:\5hhbtt.exe93⤵PID:3016
-
\??\c:\3ddjj.exec:\3ddjj.exe94⤵PID:3684
-
\??\c:\jjvpp.exec:\jjvpp.exe95⤵PID:4308
-
\??\c:\9frllrx.exec:\9frllrx.exe96⤵PID:900
-
\??\c:\llllfrr.exec:\llllfrr.exe97⤵PID:2864
-
\??\c:\9nnnhh.exec:\9nnnhh.exe98⤵PID:3552
-
\??\c:\bbbnhb.exec:\bbbnhb.exe99⤵PID:3504
-
\??\c:\3ppjj.exec:\3ppjj.exe100⤵PID:2708
-
\??\c:\ppvpp.exec:\ppvpp.exe101⤵PID:1216
-
\??\c:\dppjj.exec:\dppjj.exe102⤵PID:4992
-
\??\c:\xrxlrff.exec:\xrxlrff.exe103⤵PID:1224
-
\??\c:\ttnnnn.exec:\ttnnnn.exe104⤵PID:3840
-
\??\c:\nnnnhn.exec:\nnnnhn.exe105⤵PID:2840
-
\??\c:\vddvp.exec:\vddvp.exe106⤵PID:4464
-
\??\c:\jpjdj.exec:\jpjdj.exe107⤵PID:392
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe108⤵PID:4848
-
\??\c:\xlxrrfl.exec:\xlxrrfl.exe109⤵PID:952
-
\??\c:\lxxlllx.exec:\lxxlllx.exe110⤵PID:2188
-
\??\c:\bthbnh.exec:\bthbnh.exe111⤵PID:224
-
\??\c:\bnnhtt.exec:\bnnhtt.exe112⤵PID:852
-
\??\c:\7ddvd.exec:\7ddvd.exe113⤵PID:2736
-
\??\c:\3jjjd.exec:\3jjjd.exe114⤵PID:2372
-
\??\c:\xflffxx.exec:\xflffxx.exe115⤵PID:1660
-
\??\c:\5xxlxxl.exec:\5xxlxxl.exe116⤵PID:812
-
\??\c:\htnhhh.exec:\htnhhh.exe117⤵PID:3424
-
\??\c:\nhhhnt.exec:\nhhhnt.exe118⤵PID:2848
-
\??\c:\hbnttt.exec:\hbnttt.exe119⤵PID:1704
-
\??\c:\vpjvp.exec:\vpjvp.exe120⤵PID:4120
-
\??\c:\dvvdv.exec:\dvvdv.exe121⤵PID:3556
-
\??\c:\lfffxxl.exec:\lfffxxl.exe122⤵PID:4356
-
\??\c:\3fxrfxl.exec:\3fxrfxl.exe123⤵PID:4244
-
\??\c:\7nnhbb.exec:\7nnhbb.exe124⤵PID:4316
-
\??\c:\hnnhhb.exec:\hnnhhb.exe125⤵PID:3632
-
\??\c:\htbbbb.exec:\htbbbb.exe126⤵PID:3316
-
\??\c:\djpvj.exec:\djpvj.exe127⤵PID:636
-
\??\c:\3jjjj.exec:\3jjjj.exe128⤵PID:5032
-
\??\c:\fxlxfxl.exec:\fxlxfxl.exe129⤵PID:3888
-
\??\c:\rllfxrr.exec:\rllfxrr.exe130⤵PID:1220
-
\??\c:\lrlfxxl.exec:\lrlfxxl.exe131⤵PID:3044
-
\??\c:\tnnbtt.exec:\tnnbtt.exe132⤵PID:5072
-
\??\c:\ttnnhh.exec:\ttnnhh.exe133⤵PID:1500
-
\??\c:\vpddd.exec:\vpddd.exe134⤵PID:3728
-
\??\c:\3dvpp.exec:\3dvpp.exe135⤵PID:2320
-
\??\c:\xxxrlll.exec:\xxxrlll.exe136⤵PID:3596
-
\??\c:\llffxrf.exec:\llffxrf.exe137⤵PID:2400
-
\??\c:\btbbbt.exec:\btbbbt.exe138⤵PID:2160
-
\??\c:\tnbhtt.exec:\tnbhtt.exe139⤵PID:5064
-
\??\c:\vdpjd.exec:\vdpjd.exe140⤵PID:2864
-
\??\c:\5rllfff.exec:\5rllfff.exe141⤵PID:2612
-
\??\c:\ffrrffl.exec:\ffrrffl.exe142⤵PID:4528
-
\??\c:\btbbtt.exec:\btbbtt.exe143⤵PID:2708
-
\??\c:\thhbtt.exec:\thhbtt.exe144⤵PID:4104
-
\??\c:\nbthbt.exec:\nbthbt.exe145⤵PID:4936
-
\??\c:\7vjdp.exec:\7vjdp.exe146⤵PID:2760
-
\??\c:\pjjjj.exec:\pjjjj.exe147⤵PID:4132
-
\??\c:\9fxrlrr.exec:\9fxrlrr.exe148⤵PID:4700
-
\??\c:\xrxlllx.exec:\xrxlllx.exe149⤵PID:5084
-
\??\c:\frrrrxr.exec:\frrrrxr.exe150⤵PID:4392
-
\??\c:\hhnhbb.exec:\hhnhbb.exe151⤵PID:3136
-
\??\c:\tnttnt.exec:\tnttnt.exe152⤵PID:4416
-
\??\c:\pvpdv.exec:\pvpdv.exe153⤵PID:4608
-
\??\c:\vjpvp.exec:\vjpvp.exe154⤵PID:1448
-
\??\c:\rlrlfll.exec:\rlrlfll.exe155⤵PID:4596
-
\??\c:\lfxrllf.exec:\lfxrllf.exe156⤵PID:532
-
\??\c:\tntthn.exec:\tntthn.exe157⤵PID:4976
-
\??\c:\bnnbbt.exec:\bnnbbt.exe158⤵PID:3508
-
\??\c:\dppvv.exec:\dppvv.exe159⤵PID:1908
-
\??\c:\5pvpv.exec:\5pvpv.exe160⤵PID:2676
-
\??\c:\xlrlfff.exec:\xlrlfff.exe161⤵PID:3120
-
\??\c:\rllfflf.exec:\rllfflf.exe162⤵PID:432
-
\??\c:\9xrlfff.exec:\9xrlfff.exe163⤵PID:2436
-
\??\c:\1lfxfxx.exec:\1lfxfxx.exe164⤵PID:4316
-
\??\c:\xrxrlll.exec:\xrxrlll.exe165⤵PID:3936
-
\??\c:\ttttnn.exec:\ttttnn.exe166⤵PID:2152
-
\??\c:\nttbhb.exec:\nttbhb.exe167⤵PID:1640
-
\??\c:\djvpp.exec:\djvpp.exe168⤵PID:5004
-
\??\c:\pdjjj.exec:\pdjjj.exe169⤵PID:4248
-
\??\c:\rfllxxx.exec:\rfllxxx.exe170⤵PID:2668
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe171⤵PID:1684
-
\??\c:\tntttt.exec:\tntttt.exe172⤵PID:3596
-
\??\c:\nhbtnh.exec:\nhbtnh.exe173⤵PID:3956
-
\??\c:\vdddj.exec:\vdddj.exe174⤵PID:3828
-
\??\c:\1dddv.exec:\1dddv.exe175⤵PID:3668
-
\??\c:\lffxrrr.exec:\lffxrrr.exe176⤵PID:3988
-
\??\c:\5flllll.exec:\5flllll.exe177⤵PID:3512
-
\??\c:\tnhnnn.exec:\tnhnnn.exe178⤵PID:1216
-
\??\c:\hhhhnh.exec:\hhhhnh.exe179⤵PID:2184
-
\??\c:\5jpjj.exec:\5jpjj.exe180⤵PID:1700
-
\??\c:\vvdjd.exec:\vvdjd.exe181⤵PID:688
-
\??\c:\fxlxrlf.exec:\fxlxrlf.exe182⤵PID:4924
-
\??\c:\frrffxr.exec:\frrffxr.exe183⤵PID:3140
-
\??\c:\7tbnnb.exec:\7tbnnb.exe184⤵PID:1272
-
\??\c:\5vvpd.exec:\5vvpd.exe185⤵PID:1296
-
\??\c:\dppjj.exec:\dppjj.exe186⤵PID:3928
-
\??\c:\3pdvj.exec:\3pdvj.exe187⤵PID:3344
-
\??\c:\xrffrrr.exec:\xrffrrr.exe188⤵PID:4456
-
\??\c:\lxfxrxl.exec:\lxfxrxl.exe189⤵PID:2624
-
\??\c:\9tbbtb.exec:\9tbbtb.exe190⤵PID:3152
-
\??\c:\nbhhbb.exec:\nbhhbb.exe191⤵PID:3872
-
\??\c:\vdvpv.exec:\vdvpv.exe192⤵PID:1660
-
\??\c:\dpvpj.exec:\dpvpj.exe193⤵PID:212
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe194⤵PID:2684
-
\??\c:\tthbtt.exec:\tthbtt.exe195⤵PID:1908
-
\??\c:\9pvpj.exec:\9pvpj.exe196⤵PID:2676
-
\??\c:\dvdvp.exec:\dvdvp.exe197⤵PID:904
-
\??\c:\flxflll.exec:\flxflll.exe198⤵PID:4252
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe199⤵PID:4688
-
\??\c:\7nbbhn.exec:\7nbbhn.exe200⤵PID:4988
-
\??\c:\nbhtnn.exec:\nbhtnn.exe201⤵PID:2884
-
\??\c:\dvvvp.exec:\dvvvp.exe202⤵PID:872
-
\??\c:\dvppj.exec:\dvppj.exe203⤵PID:1040
-
\??\c:\llflfff.exec:\llflfff.exe204⤵PID:1220
-
\??\c:\pjdvp.exec:\pjdvp.exe205⤵PID:4912
-
\??\c:\htbbhh.exec:\htbbhh.exe206⤵PID:1192
-
\??\c:\nnttnh.exec:\nnttnh.exe207⤵PID:2484
-
\??\c:\djppj.exec:\djppj.exe208⤵PID:1956
-
\??\c:\jddvp.exec:\jddvp.exe209⤵PID:3968
-
\??\c:\rflfxxr.exec:\rflfxxr.exe210⤵PID:4568
-
\??\c:\bbtnnh.exec:\bbtnnh.exe211⤵PID:5020
-
\??\c:\1bbtnn.exec:\1bbtnn.exe212⤵PID:3260
-
\??\c:\vvvpp.exec:\vvvpp.exe213⤵PID:2364
-
\??\c:\ffxfxlf.exec:\ffxfxlf.exe214⤵PID:2708
-
\??\c:\ffllrrf.exec:\ffllrrf.exe215⤵PID:4104
-
\??\c:\bnbttt.exec:\bnbttt.exe216⤵PID:3680
-
\??\c:\pddvj.exec:\pddvj.exe217⤵PID:3840
-
\??\c:\jpjjd.exec:\jpjjd.exe218⤵PID:1044
-
\??\c:\xxfxfll.exec:\xxfxfll.exe219⤵PID:2172
-
\??\c:\tntbbn.exec:\tntbbn.exe220⤵PID:1840
-
\??\c:\nnhbtb.exec:\nnhbtb.exe221⤵PID:1560
-
\??\c:\tnttnn.exec:\tnttnn.exe222⤵PID:2200
-
\??\c:\vvvdd.exec:\vvvdd.exe223⤵PID:4292
-
\??\c:\vjjjv.exec:\vjjjv.exe224⤵PID:852
-
\??\c:\xlrfrll.exec:\xlrfrll.exe225⤵PID:4296
-
\??\c:\xffffll.exec:\xffffll.exe226⤵PID:3152
-
\??\c:\hhtnhh.exec:\hhtnhh.exe227⤵PID:532
-
\??\c:\pjvvp.exec:\pjvvp.exe228⤵PID:4976
-
\??\c:\pdjdp.exec:\pdjdp.exe229⤵PID:748
-
\??\c:\3xflffx.exec:\3xflffx.exe230⤵PID:2204
-
\??\c:\bnhntb.exec:\bnhntb.exe231⤵PID:4900
-
\??\c:\nhhbtt.exec:\nhhbtt.exe232⤵PID:1748
-
\??\c:\vppjd.exec:\vppjd.exe233⤵PID:1908
-
\??\c:\jvdpj.exec:\jvdpj.exe234⤵PID:3556
-
\??\c:\ffxxxxr.exec:\ffxxxxr.exe235⤵PID:3568
-
\??\c:\rxxrrlf.exec:\rxxrrlf.exe236⤵PID:3776
-
\??\c:\nbbbnb.exec:\nbbbnb.exe237⤵PID:3696
-
\??\c:\5hbnhh.exec:\5hbnhh.exe238⤵PID:2120
-
\??\c:\7pppj.exec:\7pppj.exe239⤵PID:4404
-
\??\c:\vpdvd.exec:\vpdvd.exe240⤵PID:116
-
\??\c:\3rllfxr.exec:\3rllfxr.exe241⤵PID:704
-
\??\c:\hbbbtt.exec:\hbbbtt.exe242⤵PID:2300