Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 10:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3bbe701b61223aaf2f3cbfba9d560dcd79d82fca48862bd769c0b0179e0acc3c.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3bbe701b61223aaf2f3cbfba9d560dcd79d82fca48862bd769c0b0179e0acc3c.exe
-
Size
459KB
-
MD5
ced448f808e040825b1bfb936f0f7fa0
-
SHA1
abc1c28dc81e47d5dabeb239f2d45d156c2ff199
-
SHA256
3bbe701b61223aaf2f3cbfba9d560dcd79d82fca48862bd769c0b0179e0acc3c
-
SHA512
8b9de3429bd541563707dd01484b9176a8d0fb3f7738e9be4275ff9828840d31c4cadc14d0eb1b7fb8a9cc1c3dc3cf21702373c56c9aef6d1946a6ed8750d11f
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1HmY:d7Tc9Wj16A3Stvxh
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2148-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/416-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-326-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2648-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-335-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-370-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-387-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-394-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-414-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-429-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-457-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-463-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-473-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-475-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-499-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-539-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-567-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-717-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-806-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-904-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-1042-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-1176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jpjjv.exefxffxlf.exelxrxxlr.exe5tttnt.exepjpjd.exexxlllll.exeffxfflr.exettnhnn.exedpjdv.exexrxffll.exelfrrrxf.exetnbttt.exedjjpp.exe7dvvp.exefxffflr.exe7nbttb.exe9pjdd.exejjppd.exeflfxrrx.exetnnhbt.exetthhnn.exepvvpj.exefxxrfxr.exebnbttn.exetbtnbt.exe3vvpj.exexfffxxr.exeflrlfxr.exehnnhbb.exepdpjj.exejpvjd.exefxxxrrl.exe5nhbtn.exevvdvv.exe7djdv.exerrlffxr.exetntnnn.exenbbbtt.exeddjvp.exe1xrlrrl.exellrlfxr.exennbnhb.exedddvp.exepdvpd.exe7fxrllx.exe3thhbh.exehtttnn.exeddpjj.exelffxllx.exenbbbtt.exentnhtn.exeppvpj.exelrxrffx.exefxrxrxx.exe3ttnbb.exejvpjd.exejjjvp.exelrxrllf.exetttttt.exehtbbtt.exe1jvpj.exerxfxrrl.exe1hnhbb.exethhtnh.exepid process 4784 jpjjv.exe 2400 fxffxlf.exe 2944 lxrxxlr.exe 528 5tttnt.exe 628 pjpjd.exe 440 xxlllll.exe 1028 ffxfflr.exe 820 ttnhnn.exe 2776 dpjdv.exe 4804 xrxffll.exe 1812 lfrrrxf.exe 4756 tnbttt.exe 4220 djjpp.exe 1404 7dvvp.exe 4976 fxffflr.exe 1488 7nbttb.exe 4864 9pjdd.exe 2412 jjppd.exe 1020 flfxrrx.exe 3300 tnnhbt.exe 3308 tthhnn.exe 5092 pvvpj.exe 1836 fxxrfxr.exe 1584 bnbttn.exe 2736 tbtnbt.exe 2516 3vvpj.exe 2592 xfffxxr.exe 3388 flrlfxr.exe 1676 hnnhbb.exe 1000 pdpjj.exe 4936 jpvjd.exe 1964 fxxxrrl.exe 2648 5nhbtn.exe 2920 vvdvv.exe 3304 7djdv.exe 1280 rrlffxr.exe 3576 tntnnn.exe 468 nbbbtt.exe 1616 ddjvp.exe 2668 1xrlrrl.exe 3472 llrlfxr.exe 4472 nnbnhb.exe 3540 dddvp.exe 436 pdvpd.exe 4544 7fxrllx.exe 3532 3thhbh.exe 3704 htttnn.exe 3980 ddpjj.exe 972 lffxllx.exe 2448 nbbbtt.exe 3808 ntnhtn.exe 1904 ppvpj.exe 4368 lrxrffx.exe 456 fxrxrxx.exe 1888 3ttnbb.exe 348 jvpjd.exe 3728 jjjvp.exe 2924 lrxrllf.exe 416 tttttt.exe 4744 htbbtt.exe 4356 1jvpj.exe 2636 rxfxrrl.exe 2368 1hnhbb.exe 408 thhtnh.exe -
Processes:
resource yara_rule behavioral2/memory/2148-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/820-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/416-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-326-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2648-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-335-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-370-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-387-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1100-394-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-414-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-429-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-433-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-443-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-463-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-473-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-475-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-499-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-539-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-567-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-595-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-614-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-633-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-640-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3bbe701b61223aaf2f3cbfba9d560dcd79d82fca48862bd769c0b0179e0acc3c.exejpjjv.exefxffxlf.exelxrxxlr.exe5tttnt.exepjpjd.exexxlllll.exeffxfflr.exettnhnn.exedpjdv.exexrxffll.exelfrrrxf.exetnbttt.exedjjpp.exe7dvvp.exefxffflr.exe7nbttb.exe9pjdd.exejjppd.exeflfxrrx.exetnnhbt.exetthhnn.exedescription pid process target process PID 2148 wrote to memory of 4784 2148 3bbe701b61223aaf2f3cbfba9d560dcd79d82fca48862bd769c0b0179e0acc3c.exe jpjjv.exe PID 2148 wrote to memory of 4784 2148 3bbe701b61223aaf2f3cbfba9d560dcd79d82fca48862bd769c0b0179e0acc3c.exe jpjjv.exe PID 2148 wrote to memory of 4784 2148 3bbe701b61223aaf2f3cbfba9d560dcd79d82fca48862bd769c0b0179e0acc3c.exe jpjjv.exe PID 4784 wrote to memory of 2400 4784 jpjjv.exe fxffxlf.exe PID 4784 wrote to memory of 2400 4784 jpjjv.exe fxffxlf.exe PID 4784 wrote to memory of 2400 4784 jpjjv.exe fxffxlf.exe PID 2400 wrote to memory of 2944 2400 fxffxlf.exe lxrxxlr.exe PID 2400 wrote to memory of 2944 2400 fxffxlf.exe lxrxxlr.exe PID 2400 wrote to memory of 2944 2400 fxffxlf.exe lxrxxlr.exe PID 2944 wrote to memory of 528 2944 lxrxxlr.exe 5tttnt.exe PID 2944 wrote to memory of 528 2944 lxrxxlr.exe 5tttnt.exe PID 2944 wrote to memory of 528 2944 lxrxxlr.exe 5tttnt.exe PID 528 wrote to memory of 628 528 5tttnt.exe pjpjd.exe PID 528 wrote to memory of 628 528 5tttnt.exe pjpjd.exe PID 528 wrote to memory of 628 528 5tttnt.exe pjpjd.exe PID 628 wrote to memory of 440 628 pjpjd.exe xxlllll.exe PID 628 wrote to memory of 440 628 pjpjd.exe xxlllll.exe PID 628 wrote to memory of 440 628 pjpjd.exe xxlllll.exe PID 440 wrote to memory of 1028 440 xxlllll.exe ffxfflr.exe PID 440 wrote to memory of 1028 440 xxlllll.exe ffxfflr.exe PID 440 wrote to memory of 1028 440 xxlllll.exe ffxfflr.exe PID 1028 wrote to memory of 820 1028 ffxfflr.exe ttnhnn.exe PID 1028 wrote to memory of 820 1028 ffxfflr.exe ttnhnn.exe PID 1028 wrote to memory of 820 1028 ffxfflr.exe ttnhnn.exe PID 820 wrote to memory of 2776 820 ttnhnn.exe dpjdv.exe PID 820 wrote to memory of 2776 820 ttnhnn.exe dpjdv.exe PID 820 wrote to memory of 2776 820 ttnhnn.exe dpjdv.exe PID 2776 wrote to memory of 4804 2776 dpjdv.exe xrxffll.exe PID 2776 wrote to memory of 4804 2776 dpjdv.exe xrxffll.exe PID 2776 wrote to memory of 4804 2776 dpjdv.exe xrxffll.exe PID 4804 wrote to memory of 1812 4804 xrxffll.exe lfrrrxf.exe PID 4804 wrote to memory of 1812 4804 xrxffll.exe lfrrrxf.exe PID 4804 wrote to memory of 1812 4804 xrxffll.exe lfrrrxf.exe PID 1812 wrote to memory of 4756 1812 lfrrrxf.exe tnbttt.exe PID 1812 wrote to memory of 4756 1812 lfrrrxf.exe tnbttt.exe PID 1812 wrote to memory of 4756 1812 lfrrrxf.exe tnbttt.exe PID 4756 wrote to memory of 4220 4756 tnbttt.exe djjpp.exe PID 4756 wrote to memory of 4220 4756 tnbttt.exe djjpp.exe PID 4756 wrote to memory of 4220 4756 tnbttt.exe djjpp.exe PID 4220 wrote to memory of 1404 4220 djjpp.exe 7dvvp.exe PID 4220 wrote to memory of 1404 4220 djjpp.exe 7dvvp.exe PID 4220 wrote to memory of 1404 4220 djjpp.exe 7dvvp.exe PID 1404 wrote to memory of 4976 1404 7dvvp.exe fxffflr.exe PID 1404 wrote to memory of 4976 1404 7dvvp.exe fxffflr.exe PID 1404 wrote to memory of 4976 1404 7dvvp.exe fxffflr.exe PID 4976 wrote to memory of 1488 4976 fxffflr.exe 7nbttb.exe PID 4976 wrote to memory of 1488 4976 fxffflr.exe 7nbttb.exe PID 4976 wrote to memory of 1488 4976 fxffflr.exe 7nbttb.exe PID 1488 wrote to memory of 4864 1488 7nbttb.exe 9pjdd.exe PID 1488 wrote to memory of 4864 1488 7nbttb.exe 9pjdd.exe PID 1488 wrote to memory of 4864 1488 7nbttb.exe 9pjdd.exe PID 4864 wrote to memory of 2412 4864 9pjdd.exe jjppd.exe PID 4864 wrote to memory of 2412 4864 9pjdd.exe jjppd.exe PID 4864 wrote to memory of 2412 4864 9pjdd.exe jjppd.exe PID 2412 wrote to memory of 1020 2412 jjppd.exe flfxrrx.exe PID 2412 wrote to memory of 1020 2412 jjppd.exe flfxrrx.exe PID 2412 wrote to memory of 1020 2412 jjppd.exe flfxrrx.exe PID 1020 wrote to memory of 3300 1020 flfxrrx.exe tnnhbt.exe PID 1020 wrote to memory of 3300 1020 flfxrrx.exe tnnhbt.exe PID 1020 wrote to memory of 3300 1020 flfxrrx.exe tnnhbt.exe PID 3300 wrote to memory of 3308 3300 tnnhbt.exe tthhnn.exe PID 3300 wrote to memory of 3308 3300 tnnhbt.exe tthhnn.exe PID 3300 wrote to memory of 3308 3300 tnnhbt.exe tthhnn.exe PID 3308 wrote to memory of 5092 3308 tthhnn.exe pvvpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bbe701b61223aaf2f3cbfba9d560dcd79d82fca48862bd769c0b0179e0acc3c.exe"C:\Users\Admin\AppData\Local\Temp\3bbe701b61223aaf2f3cbfba9d560dcd79d82fca48862bd769c0b0179e0acc3c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\jpjjv.exec:\jpjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\fxffxlf.exec:\fxffxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\lxrxxlr.exec:\lxrxxlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\5tttnt.exec:\5tttnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\pjpjd.exec:\pjpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\xxlllll.exec:\xxlllll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\ffxfflr.exec:\ffxfflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\ttnhnn.exec:\ttnhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\dpjdv.exec:\dpjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\xrxffll.exec:\xrxffll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\tnbttt.exec:\tnbttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\djjpp.exec:\djjpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\7dvvp.exec:\7dvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\fxffflr.exec:\fxffflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\7nbttb.exec:\7nbttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\9pjdd.exec:\9pjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\jjppd.exec:\jjppd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\flfxrrx.exec:\flfxrrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\tnnhbt.exec:\tnnhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\tthhnn.exec:\tthhnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\pvvpj.exec:\pvvpj.exe23⤵
- Executes dropped EXE
PID:5092 -
\??\c:\fxxrfxr.exec:\fxxrfxr.exe24⤵
- Executes dropped EXE
PID:1836 -
\??\c:\bnbttn.exec:\bnbttn.exe25⤵
- Executes dropped EXE
PID:1584 -
\??\c:\tbtnbt.exec:\tbtnbt.exe26⤵
- Executes dropped EXE
PID:2736 -
\??\c:\3vvpj.exec:\3vvpj.exe27⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xfffxxr.exec:\xfffxxr.exe28⤵
- Executes dropped EXE
PID:2592 -
\??\c:\flrlfxr.exec:\flrlfxr.exe29⤵
- Executes dropped EXE
PID:3388 -
\??\c:\hnnhbb.exec:\hnnhbb.exe30⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pdpjj.exec:\pdpjj.exe31⤵
- Executes dropped EXE
PID:1000 -
\??\c:\jpvjd.exec:\jpvjd.exe32⤵
- Executes dropped EXE
PID:4936 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe33⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5nhbtn.exec:\5nhbtn.exe34⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vvdvv.exec:\vvdvv.exe35⤵
- Executes dropped EXE
PID:2920 -
\??\c:\7djdv.exec:\7djdv.exe36⤵
- Executes dropped EXE
PID:3304 -
\??\c:\rrlffxr.exec:\rrlffxr.exe37⤵
- Executes dropped EXE
PID:1280 -
\??\c:\tntnnn.exec:\tntnnn.exe38⤵
- Executes dropped EXE
PID:3576 -
\??\c:\nbbbtt.exec:\nbbbtt.exe39⤵
- Executes dropped EXE
PID:468 -
\??\c:\ddjvp.exec:\ddjvp.exe40⤵
- Executes dropped EXE
PID:1616 -
\??\c:\1xrlrrl.exec:\1xrlrrl.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\llrlfxr.exec:\llrlfxr.exe42⤵
- Executes dropped EXE
PID:3472 -
\??\c:\nnbnhb.exec:\nnbnhb.exe43⤵
- Executes dropped EXE
PID:4472 -
\??\c:\dddvp.exec:\dddvp.exe44⤵
- Executes dropped EXE
PID:3540 -
\??\c:\pdvpd.exec:\pdvpd.exe45⤵
- Executes dropped EXE
PID:436 -
\??\c:\7fxrllx.exec:\7fxrllx.exe46⤵
- Executes dropped EXE
PID:4544 -
\??\c:\3thhbh.exec:\3thhbh.exe47⤵
- Executes dropped EXE
PID:3532 -
\??\c:\htttnn.exec:\htttnn.exe48⤵
- Executes dropped EXE
PID:3704 -
\??\c:\ddpjj.exec:\ddpjj.exe49⤵
- Executes dropped EXE
PID:3980 -
\??\c:\lffxllx.exec:\lffxllx.exe50⤵
- Executes dropped EXE
PID:972 -
\??\c:\nbbbtt.exec:\nbbbtt.exe51⤵
- Executes dropped EXE
PID:2448 -
\??\c:\ntnhtn.exec:\ntnhtn.exe52⤵
- Executes dropped EXE
PID:3808 -
\??\c:\ppvpj.exec:\ppvpj.exe53⤵
- Executes dropped EXE
PID:1904 -
\??\c:\lrxrffx.exec:\lrxrffx.exe54⤵
- Executes dropped EXE
PID:4368 -
\??\c:\fxrxrxx.exec:\fxrxrxx.exe55⤵
- Executes dropped EXE
PID:456 -
\??\c:\3ttnbb.exec:\3ttnbb.exe56⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jvpjd.exec:\jvpjd.exe57⤵
- Executes dropped EXE
PID:348 -
\??\c:\jjjvp.exec:\jjjvp.exe58⤵
- Executes dropped EXE
PID:3728 -
\??\c:\lrxrllf.exec:\lrxrllf.exe59⤵
- Executes dropped EXE
PID:2924 -
\??\c:\tttttt.exec:\tttttt.exe60⤵
- Executes dropped EXE
PID:416 -
\??\c:\htbbtt.exec:\htbbtt.exe61⤵
- Executes dropped EXE
PID:4744 -
\??\c:\1jvpj.exec:\1jvpj.exe62⤵
- Executes dropped EXE
PID:4356 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe63⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1hnhbb.exec:\1hnhbb.exe64⤵
- Executes dropped EXE
PID:2368 -
\??\c:\thhtnh.exec:\thhtnh.exe65⤵
- Executes dropped EXE
PID:408 -
\??\c:\jdpjp.exec:\jdpjp.exe66⤵PID:3712
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe67⤵PID:1812
-
\??\c:\rfrlrlr.exec:\rfrlrlr.exe68⤵PID:3244
-
\??\c:\thhbtb.exec:\thhbtb.exe69⤵PID:3392
-
\??\c:\vjjvp.exec:\vjjvp.exe70⤵PID:1404
-
\??\c:\rllxffx.exec:\rllxffx.exe71⤵PID:112
-
\??\c:\xllxxrl.exec:\xllxxrl.exe72⤵PID:4056
-
\??\c:\hbbnhh.exec:\hbbnhh.exe73⤵PID:4532
-
\??\c:\pdvvv.exec:\pdvvv.exe74⤵PID:5048
-
\??\c:\xxrlfxr.exec:\xxrlfxr.exe75⤵PID:3300
-
\??\c:\thhbnn.exec:\thhbnn.exe76⤵PID:3880
-
\??\c:\jppjd.exec:\jppjd.exe77⤵PID:4552
-
\??\c:\lrffrlf.exec:\lrffrlf.exe78⤵PID:5088
-
\??\c:\nhhtnh.exec:\nhhtnh.exe79⤵PID:2452
-
\??\c:\dpvpj.exec:\dpvpj.exe80⤵PID:1696
-
\??\c:\fxrrrrl.exec:\fxrrrrl.exe81⤵PID:3228
-
\??\c:\btbnnh.exec:\btbnnh.exe82⤵PID:252
-
\??\c:\5jvjd.exec:\5jvjd.exe83⤵PID:4256
-
\??\c:\frfflxx.exec:\frfflxx.exe84⤵PID:4952
-
\??\c:\llfxrlf.exec:\llfxrlf.exe85⤵PID:1308
-
\??\c:\hbbttb.exec:\hbbttb.exe86⤵PID:8
-
\??\c:\7ppjd.exec:\7ppjd.exe87⤵PID:4980
-
\??\c:\5flffff.exec:\5flffff.exe88⤵PID:1828
-
\??\c:\thnnnt.exec:\thnnnt.exe89⤵PID:2328
-
\??\c:\vvddd.exec:\vvddd.exe90⤵PID:4648
-
\??\c:\xrrxrrx.exec:\xrrxrrx.exe91⤵PID:2840
-
\??\c:\nbhhhh.exec:\nbhhhh.exe92⤵PID:2620
-
\??\c:\1vvpj.exec:\1vvpj.exe93⤵PID:1100
-
\??\c:\rxfxllf.exec:\rxfxllf.exe94⤵PID:2092
-
\??\c:\nnhbhh.exec:\nnhbhh.exe95⤵PID:436
-
\??\c:\jddvv.exec:\jddvv.exe96⤵PID:1104
-
\??\c:\rllrrll.exec:\rllrrll.exe97⤵PID:3040
-
\??\c:\rfflfrr.exec:\rfflfrr.exe98⤵PID:4112
-
\??\c:\ntnnnh.exec:\ntnnnh.exe99⤵PID:3980
-
\??\c:\jjpjj.exec:\jjpjj.exe100⤵PID:1112
-
\??\c:\vjjvp.exec:\vjjvp.exe101⤵PID:3764
-
\??\c:\1rxrllf.exec:\1rxrllf.exe102⤵PID:3808
-
\??\c:\bhhhbb.exec:\bhhhbb.exe103⤵PID:4240
-
\??\c:\vpvvd.exec:\vpvvd.exe104⤵PID:1636
-
\??\c:\7rrrlrr.exec:\7rrrlrr.exe105⤵PID:868
-
\??\c:\5bnnbn.exec:\5bnnbn.exe106⤵PID:1932
-
\??\c:\jpdvv.exec:\jpdvv.exe107⤵PID:768
-
\??\c:\fxlfffx.exec:\fxlfffx.exe108⤵PID:224
-
\??\c:\nhnnnt.exec:\nhnnnt.exe109⤵PID:2924
-
\??\c:\vvjpp.exec:\vvjpp.exe110⤵PID:4152
-
\??\c:\ppvvd.exec:\ppvvd.exe111⤵PID:368
-
\??\c:\rffffll.exec:\rffffll.exe112⤵PID:2076
-
\??\c:\nbnhhh.exec:\nbnhhh.exe113⤵PID:3024
-
\??\c:\vpvpd.exec:\vpvpd.exe114⤵PID:2400
-
\??\c:\ffllrrr.exec:\ffllrrr.exe115⤵PID:628
-
\??\c:\ntbbbh.exec:\ntbbbh.exe116⤵PID:1108
-
\??\c:\5bbttb.exec:\5bbttb.exe117⤵PID:3592
-
\??\c:\vvddd.exec:\vvddd.exe118⤵PID:4768
-
\??\c:\rrllfll.exec:\rrllfll.exe119⤵PID:4612
-
\??\c:\nbbhbt.exec:\nbbhbt.exe120⤵PID:4016
-
\??\c:\jjvvv.exec:\jjvvv.exe121⤵PID:5064
-
\??\c:\jvppp.exec:\jvppp.exe122⤵PID:4420
-
\??\c:\rlrrlrr.exec:\rlrrlrr.exe123⤵PID:3912
-
\??\c:\ntnhhh.exec:\ntnhhh.exe124⤵PID:3116
-
\??\c:\dvjdd.exec:\dvjdd.exe125⤵PID:1488
-
\??\c:\xffxrlf.exec:\xffxrlf.exe126⤵PID:4532
-
\??\c:\nttnnn.exec:\nttnnn.exe127⤵PID:2044
-
\??\c:\vpdvv.exec:\vpdvv.exe128⤵PID:3504
-
\??\c:\rrxxffl.exec:\rrxxffl.exe129⤵PID:4856
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe130⤵PID:3904
-
\??\c:\jddvv.exec:\jddvv.exe131⤵PID:5092
-
\??\c:\xfxflrx.exec:\xfxflrx.exe132⤵PID:1584
-
\??\c:\nhnnnn.exec:\nhnnnn.exe133⤵PID:4672
-
\??\c:\bhbbbh.exec:\bhbbbh.exe134⤵PID:2164
-
\??\c:\dpddj.exec:\dpddj.exe135⤵PID:3740
-
\??\c:\9fflfll.exec:\9fflfll.exe136⤵PID:2740
-
\??\c:\hnhhbb.exec:\hnhhbb.exe137⤵PID:4556
-
\??\c:\pdpvv.exec:\pdpvv.exe138⤵PID:4936
-
\??\c:\dpdvv.exec:\dpdvv.exe139⤵PID:4408
-
\??\c:\rrrrrxl.exec:\rrrrrxl.exe140⤵PID:3304
-
\??\c:\tbnhbb.exec:\tbnhbb.exe141⤵PID:4876
-
\??\c:\9pjpj.exec:\9pjpj.exe142⤵PID:2328
-
\??\c:\5rxrllf.exec:\5rxrllf.exe143⤵PID:884
-
\??\c:\9nnhbh.exec:\9nnhbh.exe144⤵PID:4680
-
\??\c:\pvpjj.exec:\pvpjj.exe145⤵PID:3120
-
\??\c:\frxfxrr.exec:\frxfxrr.exe146⤵PID:3416
-
\??\c:\bbnthh.exec:\bbnthh.exe147⤵PID:4840
-
\??\c:\dvvvv.exec:\dvvvv.exe148⤵PID:2244
-
\??\c:\7fffxrx.exec:\7fffxrx.exe149⤵PID:880
-
\??\c:\tnbbbh.exec:\tnbbbh.exe150⤵PID:5068
-
\??\c:\tbnhhb.exec:\tbnhhb.exe151⤵PID:4968
-
\??\c:\jpddd.exec:\jpddd.exe152⤵PID:972
-
\??\c:\rrxrrxf.exec:\rrxrrxf.exe153⤵PID:3380
-
\??\c:\thnhhn.exec:\thnhhn.exe154⤵PID:2584
-
\??\c:\tttnnn.exec:\tttnnn.exe155⤵PID:3248
-
\??\c:\jdppv.exec:\jdppv.exe156⤵PID:2252
-
\??\c:\1llllrl.exec:\1llllrl.exe157⤵PID:1636
-
\??\c:\bthbbb.exec:\bthbbb.exe158⤵PID:4444
-
\??\c:\jvjdd.exec:\jvjdd.exe159⤵PID:1520
-
\??\c:\xfllrxr.exec:\xfllrxr.exe160⤵PID:768
-
\??\c:\nbhhhn.exec:\nbhhhn.exe161⤵PID:4348
-
\??\c:\bbtnhh.exec:\bbtnhh.exe162⤵PID:3696
-
\??\c:\3vdvv.exec:\3vdvv.exe163⤵PID:4356
-
\??\c:\9xrllrr.exec:\9xrllrr.exe164⤵PID:1240
-
\??\c:\bhbbhh.exec:\bhbbhh.exe165⤵PID:3756
-
\??\c:\pppjj.exec:\pppjj.exe166⤵PID:4528
-
\??\c:\1dvpj.exec:\1dvpj.exe167⤵PID:1576
-
\??\c:\flxxrlr.exec:\flxxrlr.exe168⤵PID:3536
-
\??\c:\hhhhht.exec:\hhhhht.exe169⤵PID:5064
-
\??\c:\dvvvv.exec:\dvvvv.exe170⤵PID:4000
-
\??\c:\vjjjv.exec:\vjjjv.exe171⤵PID:664
-
\??\c:\lllfxxr.exec:\lllfxxr.exe172⤵PID:4932
-
\??\c:\nntttt.exec:\nntttt.exe173⤵PID:5096
-
\??\c:\pvjdv.exec:\pvjdv.exe174⤵PID:1940
-
\??\c:\flxrxff.exec:\flxrxff.exe175⤵PID:2412
-
\??\c:\dddvv.exec:\dddvv.exe176⤵PID:2424
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe177⤵PID:3904
-
\??\c:\1ntttt.exec:\1ntttt.exe178⤵PID:1836
-
\??\c:\dvddj.exec:\dvddj.exe179⤵PID:4552
-
\??\c:\1bbttt.exec:\1bbttt.exe180⤵PID:3204
-
\??\c:\frllfll.exec:\frllfll.exe181⤵PID:2452
-
\??\c:\hhthnn.exec:\hhthnn.exe182⤵PID:3108
-
\??\c:\dpdvp.exec:\dpdvp.exe183⤵PID:1612
-
\??\c:\nbhbtt.exec:\nbhbtt.exe184⤵PID:2648
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe185⤵PID:1168
-
\??\c:\9hnnnb.exec:\9hnnnb.exe186⤵PID:4796
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe187⤵PID:4384
-
\??\c:\jvdvv.exec:\jvdvv.exe188⤵PID:3304
-
\??\c:\pvdvv.exec:\pvdvv.exe189⤵PID:3376
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe190⤵PID:4472
-
\??\c:\nhbbnn.exec:\nhbbnn.exe191⤵PID:3608
-
\??\c:\pjdvv.exec:\pjdvv.exe192⤵PID:4940
-
\??\c:\frffxfx.exec:\frffxfx.exe193⤵PID:4960
-
\??\c:\pjdjj.exec:\pjdjj.exe194⤵PID:4584
-
\??\c:\xxxxxrr.exec:\xxxxxrr.exe195⤵PID:4176
-
\??\c:\hnbhhn.exec:\hnbhhn.exe196⤵PID:324
-
\??\c:\5pppd.exec:\5pppd.exe197⤵PID:2836
-
\??\c:\flxxllx.exec:\flxxllx.exe198⤵PID:3964
-
\??\c:\nnbhnt.exec:\nnbhnt.exe199⤵PID:232
-
\??\c:\ddppv.exec:\ddppv.exe200⤵PID:3380
-
\??\c:\xlxxxll.exec:\xlxxxll.exe201⤵PID:2584
-
\??\c:\9xfxrrl.exec:\9xfxrrl.exe202⤵PID:4596
-
\??\c:\thtbbh.exec:\thtbbh.exe203⤵PID:4572
-
\??\c:\jddvp.exec:\jddvp.exe204⤵PID:1636
-
\??\c:\lxllxxx.exec:\lxllxxx.exe205⤵PID:4460
-
\??\c:\nbnbbb.exec:\nbnbbb.exe206⤵PID:1520
-
\??\c:\jvjjd.exec:\jvjjd.exe207⤵PID:3200
-
\??\c:\3vdvv.exec:\3vdvv.exe208⤵PID:2064
-
\??\c:\xflrllr.exec:\xflrllr.exe209⤵PID:2636
-
\??\c:\nnbhtt.exec:\nnbhtt.exe210⤵PID:1812
-
\??\c:\pvvvp.exec:\pvvvp.exe211⤵PID:928
-
\??\c:\rrfxrff.exec:\rrfxrff.exe212⤵PID:3828
-
\??\c:\tthnbn.exec:\tthnbn.exe213⤵PID:1404
-
\??\c:\3ddvv.exec:\3ddvv.exe214⤵PID:1948
-
\??\c:\flrllll.exec:\flrllll.exe215⤵PID:3652
-
\??\c:\3lxrlrl.exec:\3lxrlrl.exe216⤵PID:5044
-
\??\c:\nnhhbt.exec:\nnhhbt.exe217⤵PID:1488
-
\??\c:\7pjdp.exec:\7pjdp.exe218⤵PID:3156
-
\??\c:\7rrxrxx.exec:\7rrxrxx.exe219⤵PID:4532
-
\??\c:\tttntt.exec:\tttntt.exe220⤵PID:4568
-
\??\c:\thtttb.exec:\thtttb.exe221⤵PID:2576
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe222⤵PID:3708
-
\??\c:\xrfffll.exec:\xrfffll.exe223⤵PID:3880
-
\??\c:\hhtnnn.exec:\hhtnnn.exe224⤵PID:1584
-
\??\c:\ddvpp.exec:\ddvpp.exe225⤵PID:5004
-
\??\c:\rlffxrl.exec:\rlffxrl.exe226⤵PID:1696
-
\??\c:\3bntnt.exec:\3bntnt.exe227⤵PID:4692
-
\??\c:\9jppp.exec:\9jppp.exe228⤵PID:2524
-
\??\c:\xflllll.exec:\xflllll.exe229⤵PID:4048
-
\??\c:\hhtttt.exec:\hhtttt.exe230⤵PID:1308
-
\??\c:\7bhhtb.exec:\7bhhtb.exe231⤵PID:1168
-
\??\c:\jdjdd.exec:\jdjdd.exe232⤵PID:3940
-
\??\c:\fxxlffx.exec:\fxxlffx.exe233⤵PID:2824
-
\??\c:\bttnnn.exec:\bttnnn.exe234⤵PID:3368
-
\??\c:\pjjdd.exec:\pjjdd.exe235⤵PID:3032
-
\??\c:\dpdvp.exec:\dpdvp.exe236⤵PID:1100
-
\??\c:\9rxrrff.exec:\9rxrrff.exe237⤵PID:3332
-
\??\c:\5hhhhn.exec:\5hhhhn.exe238⤵PID:3456
-
\??\c:\pdjjp.exec:\pdjjp.exe239⤵PID:3596
-
\??\c:\1vddd.exec:\1vddd.exe240⤵PID:324
-
\??\c:\lxxxxrr.exec:\lxxxxrr.exe241⤵PID:2836
-
\??\c:\1nnnnt.exec:\1nnnnt.exe242⤵PID:972