Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 09:33
Behavioral task
behavioral1
Sample
0083f36a4304a775787e8af424e93160.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0083f36a4304a775787e8af424e93160.exe
-
Size
453KB
-
MD5
0083f36a4304a775787e8af424e93160
-
SHA1
10459c970e849d969838d2dc1860bc38906eaf97
-
SHA256
d9259af758934c54fb1696e15c6203f35abe91f0327f6a468f4de0cda86d8bdd
-
SHA512
85922c9df18f9fbb311c91c005a5062dce7e4af4c4fdd99fce00e93e2aa8cd447bd3aed0dc6f82a6c8c59e830f835a674b79d023e7e06561c3c89724482340f9
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNmr:x4wFHoS3eFaKHpv/VycgE81lgi
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4020-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1816-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2152-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/528-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2976-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1924-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3076-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4200-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4296-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1012-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1372-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1100-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1640-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3888-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2404-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-532-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2516-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-687-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-724-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-761-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-768-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3056-803-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-810-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-919-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3752-1010-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-1117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nhnhhb.exedppjd.exe5lxxxxx.exeflxlxrl.exetbtnhh.exehthbtt.exelxrlfxr.exetntntt.exexlxxfxf.exe5dvvp.exedppdv.exenthbhh.exethbbtn.exe7xrlflf.exedjjvv.exebtbbtt.exexfllfff.exejppvv.exepppjd.exehnbbtt.exerlrlrfr.exe5ddpj.exepdvvp.exepvvvp.exefxxrllf.exethhhbb.exejpvpd.exeflffxxr.exenhhbhh.exepdjdd.exelxllffx.exedvvpj.exethnbnh.exe9htnbt.exedjvvp.exerxrxlff.exetnnnnn.exejdjjd.exerfrrlrl.exe3lxxrxr.exe9nnnnh.exedddvv.exevpdvd.exerllfxxr.exentnhbb.exedjdvj.exelxrrrrl.exefrxrrrr.exe1nnnnn.exejjvvp.exevpddd.exelxfxxrr.exehbbtth.exedddvj.exejpdvp.exelfflfff.exehhhbbb.exeddvpj.exexlrlffl.exexlxrlll.exetnttnb.exepdjdd.exevjpjd.exexfrrlff.exepid process 1132 nhnhhb.exe 4020 dppjd.exe 4000 5lxxxxx.exe 2152 flxlxrl.exe 3712 tbtnhh.exe 1472 hthbtt.exe 4664 lxrlfxr.exe 528 tntntt.exe 1424 xlxxfxf.exe 468 5dvvp.exe 2948 dppdv.exe 412 nthbhh.exe 544 thbbtn.exe 3060 7xrlflf.exe 5016 djjvv.exe 1800 btbbtt.exe 2976 xfllfff.exe 1924 jppvv.exe 4776 pppjd.exe 3656 hnbbtt.exe 4124 rlrlrfr.exe 2616 5ddpj.exe 4564 pdvvp.exe 4188 pvvvp.exe 2080 fxxrllf.exe 4992 thhhbb.exe 404 jpvpd.exe 4916 flffxxr.exe 3076 nhhbhh.exe 2600 pdjdd.exe 3212 lxllffx.exe 2644 dvvpj.exe 4088 thnbnh.exe 4584 9htnbt.exe 4304 djvvp.exe 4276 rxrxlff.exe 4224 tnnnnn.exe 4200 jdjjd.exe 1396 rfrrlrl.exe 4108 3lxxrxr.exe 4460 9nnnnh.exe 4432 dddvv.exe 972 vpdvd.exe 2328 rllfxxr.exe 2664 ntnhbb.exe 1564 djdvj.exe 4296 lxrrrrl.exe 3668 frxrrrr.exe 1012 1nnnnn.exe 824 jjvvp.exe 3528 vpddd.exe 1988 lxfxxrr.exe 3944 hbbtth.exe 2436 dddvj.exe 4800 jpdvp.exe 3600 lfflfff.exe 3916 hhhbbb.exe 1888 ddvpj.exe 1568 xlrlffl.exe 3100 xlxrlll.exe 1124 tnttnb.exe 3040 pdjdd.exe 1448 vjpjd.exe 3628 xfrrlff.exe -
Processes:
resource yara_rule behavioral2/memory/1816-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhnhhb.exe upx C:\5lxxxxx.exe upx behavioral2/memory/4000-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4020-14-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dppjd.exe upx behavioral2/memory/1132-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1816-6-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\flxlxrl.exe upx behavioral2/memory/4000-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2152-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbtnhh.exe upx C:\hthbtt.exe upx behavioral2/memory/1472-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3712-36-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxrlfxr.exe upx behavioral2/memory/4664-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tntntt.exe upx C:\xlxxfxf.exe upx behavioral2/memory/528-54-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5dvvp.exe upx behavioral2/memory/1424-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/468-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dppdv.exe upx behavioral2/memory/2948-69-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nthbhh.exe upx behavioral2/memory/412-78-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thbbtn.exe upx C:\7xrlflf.exe upx behavioral2/memory/544-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3060-90-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\djjvv.exe upx behavioral2/memory/5016-92-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\btbbtt.exe upx C:\xfllfff.exe upx behavioral2/memory/2976-104-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jppvv.exe upx C:\pppjd.exe upx behavioral2/memory/1924-114-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnbbtt.exe upx C:\rlrlrfr.exe upx behavioral2/memory/3656-124-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5ddpj.exe upx behavioral2/memory/2616-132-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdvvp.exe upx C:\pvvvp.exe upx behavioral2/memory/4564-141-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxxrllf.exe upx C:\thhhbb.exe upx behavioral2/memory/2080-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4992-154-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpvpd.exe upx behavioral2/memory/404-160-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flffxxr.exe upx C:\nhhbhh.exe upx behavioral2/memory/3076-175-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdjdd.exe upx C:\lxllffx.exe upx \??\c:\dvvpj.exe upx behavioral2/memory/2644-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4584-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4304-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4276-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4224-207-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0083f36a4304a775787e8af424e93160.exenhnhhb.exedppjd.exe5lxxxxx.exeflxlxrl.exetbtnhh.exehthbtt.exelxrlfxr.exetntntt.exexlxxfxf.exe5dvvp.exedppdv.exenthbhh.exethbbtn.exe7xrlflf.exedjjvv.exebtbbtt.exexfllfff.exejppvv.exepppjd.exehnbbtt.exerlrlrfr.exedescription pid process target process PID 1816 wrote to memory of 1132 1816 0083f36a4304a775787e8af424e93160.exe nhnhhb.exe PID 1816 wrote to memory of 1132 1816 0083f36a4304a775787e8af424e93160.exe nhnhhb.exe PID 1816 wrote to memory of 1132 1816 0083f36a4304a775787e8af424e93160.exe nhnhhb.exe PID 1132 wrote to memory of 4020 1132 nhnhhb.exe dppjd.exe PID 1132 wrote to memory of 4020 1132 nhnhhb.exe dppjd.exe PID 1132 wrote to memory of 4020 1132 nhnhhb.exe dppjd.exe PID 4020 wrote to memory of 4000 4020 dppjd.exe 5lxxxxx.exe PID 4020 wrote to memory of 4000 4020 dppjd.exe 5lxxxxx.exe PID 4020 wrote to memory of 4000 4020 dppjd.exe 5lxxxxx.exe PID 4000 wrote to memory of 2152 4000 5lxxxxx.exe flxlxrl.exe PID 4000 wrote to memory of 2152 4000 5lxxxxx.exe flxlxrl.exe PID 4000 wrote to memory of 2152 4000 5lxxxxx.exe flxlxrl.exe PID 2152 wrote to memory of 3712 2152 flxlxrl.exe tbtnhh.exe PID 2152 wrote to memory of 3712 2152 flxlxrl.exe tbtnhh.exe PID 2152 wrote to memory of 3712 2152 flxlxrl.exe tbtnhh.exe PID 3712 wrote to memory of 1472 3712 tbtnhh.exe hthbtt.exe PID 3712 wrote to memory of 1472 3712 tbtnhh.exe hthbtt.exe PID 3712 wrote to memory of 1472 3712 tbtnhh.exe hthbtt.exe PID 1472 wrote to memory of 4664 1472 hthbtt.exe lxrlfxr.exe PID 1472 wrote to memory of 4664 1472 hthbtt.exe lxrlfxr.exe PID 1472 wrote to memory of 4664 1472 hthbtt.exe lxrlfxr.exe PID 4664 wrote to memory of 528 4664 lxrlfxr.exe tntntt.exe PID 4664 wrote to memory of 528 4664 lxrlfxr.exe tntntt.exe PID 4664 wrote to memory of 528 4664 lxrlfxr.exe tntntt.exe PID 528 wrote to memory of 1424 528 tntntt.exe xlxxfxf.exe PID 528 wrote to memory of 1424 528 tntntt.exe xlxxfxf.exe PID 528 wrote to memory of 1424 528 tntntt.exe xlxxfxf.exe PID 1424 wrote to memory of 468 1424 xlxxfxf.exe 5dvvp.exe PID 1424 wrote to memory of 468 1424 xlxxfxf.exe 5dvvp.exe PID 1424 wrote to memory of 468 1424 xlxxfxf.exe 5dvvp.exe PID 468 wrote to memory of 2948 468 5dvvp.exe dppdv.exe PID 468 wrote to memory of 2948 468 5dvvp.exe dppdv.exe PID 468 wrote to memory of 2948 468 5dvvp.exe dppdv.exe PID 2948 wrote to memory of 412 2948 dppdv.exe nthbhh.exe PID 2948 wrote to memory of 412 2948 dppdv.exe nthbhh.exe PID 2948 wrote to memory of 412 2948 dppdv.exe nthbhh.exe PID 412 wrote to memory of 544 412 nthbhh.exe thbbtn.exe PID 412 wrote to memory of 544 412 nthbhh.exe thbbtn.exe PID 412 wrote to memory of 544 412 nthbhh.exe thbbtn.exe PID 544 wrote to memory of 3060 544 thbbtn.exe 7xrlflf.exe PID 544 wrote to memory of 3060 544 thbbtn.exe 7xrlflf.exe PID 544 wrote to memory of 3060 544 thbbtn.exe 7xrlflf.exe PID 3060 wrote to memory of 5016 3060 7xrlflf.exe djjvv.exe PID 3060 wrote to memory of 5016 3060 7xrlflf.exe djjvv.exe PID 3060 wrote to memory of 5016 3060 7xrlflf.exe djjvv.exe PID 5016 wrote to memory of 1800 5016 djjvv.exe btbbtt.exe PID 5016 wrote to memory of 1800 5016 djjvv.exe btbbtt.exe PID 5016 wrote to memory of 1800 5016 djjvv.exe btbbtt.exe PID 1800 wrote to memory of 2976 1800 btbbtt.exe xfllfff.exe PID 1800 wrote to memory of 2976 1800 btbbtt.exe xfllfff.exe PID 1800 wrote to memory of 2976 1800 btbbtt.exe xfllfff.exe PID 2976 wrote to memory of 1924 2976 xfllfff.exe jppvv.exe PID 2976 wrote to memory of 1924 2976 xfllfff.exe jppvv.exe PID 2976 wrote to memory of 1924 2976 xfllfff.exe jppvv.exe PID 1924 wrote to memory of 4776 1924 jppvv.exe pppjd.exe PID 1924 wrote to memory of 4776 1924 jppvv.exe pppjd.exe PID 1924 wrote to memory of 4776 1924 jppvv.exe pppjd.exe PID 4776 wrote to memory of 3656 4776 pppjd.exe hnbbtt.exe PID 4776 wrote to memory of 3656 4776 pppjd.exe hnbbtt.exe PID 4776 wrote to memory of 3656 4776 pppjd.exe hnbbtt.exe PID 3656 wrote to memory of 4124 3656 hnbbtt.exe rlrlrfr.exe PID 3656 wrote to memory of 4124 3656 hnbbtt.exe rlrlrfr.exe PID 3656 wrote to memory of 4124 3656 hnbbtt.exe rlrlrfr.exe PID 4124 wrote to memory of 2616 4124 rlrlrfr.exe 5ddpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0083f36a4304a775787e8af424e93160.exe"C:\Users\Admin\AppData\Local\Temp\0083f36a4304a775787e8af424e93160.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\nhnhhb.exec:\nhnhhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\dppjd.exec:\dppjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\5lxxxxx.exec:\5lxxxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\flxlxrl.exec:\flxlxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\tbtnhh.exec:\tbtnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\hthbtt.exec:\hthbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\tntntt.exec:\tntntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\xlxxfxf.exec:\xlxxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\5dvvp.exec:\5dvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\dppdv.exec:\dppdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\nthbhh.exec:\nthbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\thbbtn.exec:\thbbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\7xrlflf.exec:\7xrlflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\djjvv.exec:\djjvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\btbbtt.exec:\btbbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\xfllfff.exec:\xfllfff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\jppvv.exec:\jppvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\pppjd.exec:\pppjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\hnbbtt.exec:\hnbbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\rlrlrfr.exec:\rlrlrfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\5ddpj.exec:\5ddpj.exe23⤵
- Executes dropped EXE
PID:2616 -
\??\c:\pdvvp.exec:\pdvvp.exe24⤵
- Executes dropped EXE
PID:4564 -
\??\c:\pvvvp.exec:\pvvvp.exe25⤵
- Executes dropped EXE
PID:4188 -
\??\c:\fxxrllf.exec:\fxxrllf.exe26⤵
- Executes dropped EXE
PID:2080 -
\??\c:\thhhbb.exec:\thhhbb.exe27⤵
- Executes dropped EXE
PID:4992 -
\??\c:\jpvpd.exec:\jpvpd.exe28⤵
- Executes dropped EXE
PID:404 -
\??\c:\flffxxr.exec:\flffxxr.exe29⤵
- Executes dropped EXE
PID:4916 -
\??\c:\nhhbhh.exec:\nhhbhh.exe30⤵
- Executes dropped EXE
PID:3076 -
\??\c:\pdjdd.exec:\pdjdd.exe31⤵
- Executes dropped EXE
PID:2600 -
\??\c:\lxllffx.exec:\lxllffx.exe32⤵
- Executes dropped EXE
PID:3212 -
\??\c:\dvvpj.exec:\dvvpj.exe33⤵
- Executes dropped EXE
PID:2644 -
\??\c:\thnbnh.exec:\thnbnh.exe34⤵
- Executes dropped EXE
PID:4088 -
\??\c:\9htnbt.exec:\9htnbt.exe35⤵
- Executes dropped EXE
PID:4584 -
\??\c:\djvvp.exec:\djvvp.exe36⤵
- Executes dropped EXE
PID:4304 -
\??\c:\rxrxlff.exec:\rxrxlff.exe37⤵
- Executes dropped EXE
PID:4276 -
\??\c:\tnnnnn.exec:\tnnnnn.exe38⤵
- Executes dropped EXE
PID:4224 -
\??\c:\jdjjd.exec:\jdjjd.exe39⤵
- Executes dropped EXE
PID:4200 -
\??\c:\rfrrlrl.exec:\rfrrlrl.exe40⤵
- Executes dropped EXE
PID:1396 -
\??\c:\3lxxrxr.exec:\3lxxrxr.exe41⤵
- Executes dropped EXE
PID:4108 -
\??\c:\9nnnnh.exec:\9nnnnh.exe42⤵
- Executes dropped EXE
PID:4460 -
\??\c:\dddvv.exec:\dddvv.exe43⤵
- Executes dropped EXE
PID:4432 -
\??\c:\vpdvd.exec:\vpdvd.exe44⤵
- Executes dropped EXE
PID:972 -
\??\c:\rllfxxr.exec:\rllfxxr.exe45⤵
- Executes dropped EXE
PID:2328 -
\??\c:\ntnhbb.exec:\ntnhbb.exe46⤵
- Executes dropped EXE
PID:2664 -
\??\c:\djdvj.exec:\djdvj.exe47⤵
- Executes dropped EXE
PID:1564 -
\??\c:\lxrrrrl.exec:\lxrrrrl.exe48⤵
- Executes dropped EXE
PID:4296 -
\??\c:\frxrrrr.exec:\frxrrrr.exe49⤵
- Executes dropped EXE
PID:3668 -
\??\c:\1nnnnn.exec:\1nnnnn.exe50⤵
- Executes dropped EXE
PID:1012 -
\??\c:\jjvvp.exec:\jjvvp.exe51⤵
- Executes dropped EXE
PID:824 -
\??\c:\vpddd.exec:\vpddd.exe52⤵
- Executes dropped EXE
PID:3528 -
\??\c:\lxfxxrr.exec:\lxfxxrr.exe53⤵
- Executes dropped EXE
PID:1988 -
\??\c:\hbbtth.exec:\hbbtth.exe54⤵
- Executes dropped EXE
PID:3944 -
\??\c:\dddvj.exec:\dddvj.exe55⤵
- Executes dropped EXE
PID:2436 -
\??\c:\jpdvp.exec:\jpdvp.exe56⤵
- Executes dropped EXE
PID:4800 -
\??\c:\lfflfff.exec:\lfflfff.exe57⤵
- Executes dropped EXE
PID:3600 -
\??\c:\hhhbbb.exec:\hhhbbb.exe58⤵
- Executes dropped EXE
PID:3916 -
\??\c:\ddvpj.exec:\ddvpj.exe59⤵
- Executes dropped EXE
PID:1888 -
\??\c:\xlrlffl.exec:\xlrlffl.exe60⤵
- Executes dropped EXE
PID:1568 -
\??\c:\xlxrlll.exec:\xlxrlll.exe61⤵
- Executes dropped EXE
PID:3100 -
\??\c:\tnttnb.exec:\tnttnb.exe62⤵
- Executes dropped EXE
PID:1124 -
\??\c:\pdjdd.exec:\pdjdd.exe63⤵
- Executes dropped EXE
PID:3040 -
\??\c:\vjpjd.exec:\vjpjd.exe64⤵
- Executes dropped EXE
PID:1448 -
\??\c:\xfrrlff.exec:\xfrrlff.exe65⤵
- Executes dropped EXE
PID:3628 -
\??\c:\ppppj.exec:\ppppj.exe66⤵PID:1372
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe67⤵PID:1100
-
\??\c:\5tnhbb.exec:\5tnhbb.exe68⤵PID:4180
-
\??\c:\jddvv.exec:\jddvv.exe69⤵PID:2012
-
\??\c:\ffxllll.exec:\ffxllll.exe70⤵PID:544
-
\??\c:\tbhnbt.exec:\tbhnbt.exe71⤵PID:2688
-
\??\c:\3ppjv.exec:\3ppjv.exe72⤵PID:1640
-
\??\c:\7vvpd.exec:\7vvpd.exe73⤵PID:5012
-
\??\c:\flrlfrr.exec:\flrlfrr.exe74⤵PID:3208
-
\??\c:\tnttbt.exec:\tnttbt.exe75⤵PID:884
-
\??\c:\nbtnnh.exec:\nbtnnh.exe76⤵PID:2440
-
\??\c:\vppdp.exec:\vppdp.exe77⤵PID:1696
-
\??\c:\frrlffr.exec:\frrlffr.exe78⤵PID:3136
-
\??\c:\hbhnnb.exec:\hbhnnb.exe79⤵PID:2824
-
\??\c:\tnttnt.exec:\tnttnt.exe80⤵PID:548
-
\??\c:\djjjd.exec:\djjjd.exe81⤵PID:4188
-
\??\c:\5xxfxfx.exec:\5xxfxfx.exe82⤵PID:3788
-
\??\c:\frxllff.exec:\frxllff.exe83⤵PID:1152
-
\??\c:\tbhtnh.exec:\tbhtnh.exe84⤵PID:4692
-
\??\c:\dvddv.exec:\dvddv.exe85⤵PID:3888
-
\??\c:\jjjdv.exec:\jjjdv.exe86⤵PID:4260
-
\??\c:\rrfxxxx.exec:\rrfxxxx.exe87⤵PID:2404
-
\??\c:\hthhnn.exec:\hthhnn.exe88⤵PID:4380
-
\??\c:\ffxrllf.exec:\ffxrllf.exe89⤵PID:4084
-
\??\c:\bnbttt.exec:\bnbttt.exe90⤵PID:1072
-
\??\c:\5pvdv.exec:\5pvdv.exe91⤵PID:4328
-
\??\c:\pvdjd.exec:\pvdjd.exe92⤵PID:4548
-
\??\c:\lllrlfx.exec:\lllrlfx.exe93⤵PID:2348
-
\??\c:\ntnnhh.exec:\ntnnhh.exe94⤵PID:2788
-
\??\c:\dvpjd.exec:\dvpjd.exe95⤵PID:2408
-
\??\c:\5rfllrr.exec:\5rfllrr.exe96⤵PID:3892
-
\??\c:\xxffxxx.exec:\xxffxxx.exe97⤵PID:2488
-
\??\c:\5tttnt.exec:\5tttnt.exe98⤵PID:4460
-
\??\c:\jvjdv.exec:\jvjdv.exe99⤵PID:4432
-
\??\c:\frlllll.exec:\frlllll.exe100⤵PID:972
-
\??\c:\nbbbtt.exec:\nbbbtt.exe101⤵PID:4832
-
\??\c:\jdvvj.exec:\jdvvj.exe102⤵PID:1348
-
\??\c:\rflllll.exec:\rflllll.exe103⤵PID:4284
-
\??\c:\ttnbth.exec:\ttnbth.exe104⤵PID:4492
-
\??\c:\ntntht.exec:\ntntht.exe105⤵PID:932
-
\??\c:\jdjvj.exec:\jdjvj.exe106⤵PID:4356
-
\??\c:\fllrxff.exec:\fllrxff.exe107⤵PID:2100
-
\??\c:\nhnttt.exec:\nhnttt.exe108⤵PID:3680
-
\??\c:\dvvjj.exec:\dvvjj.exe109⤵PID:3936
-
\??\c:\jjpdp.exec:\jjpdp.exe110⤵PID:2716
-
\??\c:\httbtn.exec:\httbtn.exe111⤵PID:2148
-
\??\c:\nnbbnn.exec:\nnbbnn.exe112⤵PID:2152
-
\??\c:\jjppv.exec:\jjppv.exe113⤵PID:3056
-
\??\c:\lfrxxfx.exec:\lfrxxfx.exe114⤵PID:1472
-
\??\c:\fllrlrx.exec:\fllrlrx.exe115⤵PID:3916
-
\??\c:\tbntnh.exec:\tbntnh.exe116⤵PID:1896
-
\??\c:\pjjjd.exec:\pjjjd.exe117⤵PID:1568
-
\??\c:\xlrlrrl.exec:\xlrlrrl.exe118⤵PID:1524
-
\??\c:\btbttt.exec:\btbttt.exe119⤵PID:2504
-
\??\c:\1jdvj.exec:\1jdvj.exe120⤵PID:3040
-
\??\c:\vpppj.exec:\vpppj.exe121⤵PID:3384
-
\??\c:\1flfxxr.exec:\1flfxxr.exe122⤵PID:1740
-
\??\c:\btnhtn.exec:\btnhtn.exe123⤵PID:1612
-
\??\c:\bbnhbb.exec:\bbnhbb.exe124⤵PID:2432
-
\??\c:\dvdpp.exec:\dvdpp.exe125⤵PID:1096
-
\??\c:\lxrlfrf.exec:\lxrlfrf.exe126⤵PID:3856
-
\??\c:\thnhbb.exec:\thnhbb.exe127⤵PID:3960
-
\??\c:\vdjdd.exec:\vdjdd.exe128⤵PID:5052
-
\??\c:\vjpvv.exec:\vjpvv.exe129⤵PID:2060
-
\??\c:\lllxrll.exec:\lllxrll.exe130⤵PID:2852
-
\??\c:\hbtnhb.exec:\hbtnhb.exe131⤵PID:2976
-
\??\c:\jddvp.exec:\jddvp.exe132⤵PID:320
-
\??\c:\jvjdd.exec:\jvjdd.exe133⤵PID:2440
-
\??\c:\ffxxllr.exec:\ffxxllr.exe134⤵PID:2068
-
\??\c:\nhhbbb.exec:\nhhbbb.exe135⤵PID:2384
-
\??\c:\pjjdv.exec:\pjjdv.exe136⤵PID:2228
-
\??\c:\dvdvv.exec:\dvdvv.exe137⤵PID:2908
-
\??\c:\9lrlllf.exec:\9lrlllf.exe138⤵PID:600
-
\??\c:\thtnhh.exec:\thtnhh.exe139⤵PID:3140
-
\??\c:\1jpjd.exec:\1jpjd.exe140⤵PID:4808
-
\??\c:\vjjjp.exec:\vjjjp.exe141⤵PID:2120
-
\??\c:\lrrrfrf.exec:\lrrrfrf.exe142⤵PID:2376
-
\??\c:\nhbbhn.exec:\nhbbhn.exe143⤵PID:3888
-
\??\c:\7djdd.exec:\7djdd.exe144⤵PID:1056
-
\??\c:\xrrrrrl.exec:\xrrrrrl.exe145⤵PID:2264
-
\??\c:\frrllfx.exec:\frrllfx.exe146⤵PID:1028
-
\??\c:\ntnntt.exec:\ntnntt.exe147⤵PID:2800
-
\??\c:\dvppp.exec:\dvppp.exe148⤵PID:4880
-
\??\c:\rfllxff.exec:\rfllxff.exe149⤵PID:3380
-
\??\c:\hhnhhb.exec:\hhnhhb.exe150⤵PID:2784
-
\??\c:\tbnhbb.exec:\tbnhbb.exe151⤵PID:4752
-
\??\c:\pvjdd.exec:\pvjdd.exe152⤵PID:3240
-
\??\c:\5frxrxx.exec:\5frxrxx.exe153⤵PID:1488
-
\??\c:\ntnbtn.exec:\ntnbtn.exe154⤵PID:1364
-
\??\c:\dpjpp.exec:\dpjpp.exe155⤵PID:4636
-
\??\c:\jddvd.exec:\jddvd.exe156⤵PID:5092
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe157⤵PID:2836
-
\??\c:\ntbhbh.exec:\ntbhbh.exe158⤵PID:1248
-
\??\c:\dvddv.exec:\dvddv.exe159⤵PID:2516
-
\??\c:\jvddd.exec:\jvddd.exe160⤵PID:2664
-
\??\c:\3flfxxx.exec:\3flfxxx.exe161⤵PID:1420
-
\??\c:\1bbhht.exec:\1bbhht.exe162⤵PID:4528
-
\??\c:\vvppj.exec:\vvppj.exe163⤵PID:2812
-
\??\c:\xrflfrx.exec:\xrflfrx.exe164⤵PID:3488
-
\??\c:\3hnnhn.exec:\3hnnhn.exe165⤵PID:3044
-
\??\c:\jpvpp.exec:\jpvpp.exe166⤵PID:1500
-
\??\c:\llfxrrl.exec:\llfxrrl.exe167⤵PID:4120
-
\??\c:\btbtbt.exec:\btbtbt.exe168⤵PID:700
-
\??\c:\vpppj.exec:\vpppj.exe169⤵PID:3632
-
\??\c:\pddvp.exec:\pddvp.exe170⤵PID:3600
-
\??\c:\hnhbtt.exec:\hnhbtt.exe171⤵PID:4388
-
\??\c:\ntbhbb.exec:\ntbhbb.exe172⤵PID:1572
-
\??\c:\dddvv.exec:\dddvv.exe173⤵PID:1916
-
\??\c:\7vvdv.exec:\7vvdv.exe174⤵PID:396
-
\??\c:\lrxrrll.exec:\lrxrrll.exe175⤵PID:4924
-
\??\c:\htbtnh.exec:\htbtnh.exe176⤵PID:2504
-
\??\c:\5pdvj.exec:\5pdvj.exe177⤵PID:3040
-
\??\c:\lrxrxxx.exec:\lrxrxxx.exe178⤵PID:2628
-
\??\c:\bbnthn.exec:\bbnthn.exe179⤵PID:2292
-
\??\c:\ttbhhb.exec:\ttbhhb.exe180⤵PID:4960
-
\??\c:\fxxrfff.exec:\fxxrfff.exe181⤵PID:2432
-
\??\c:\9hnhhb.exec:\9hnhhb.exe182⤵PID:5056
-
\??\c:\hthbbb.exec:\hthbbb.exe183⤵PID:1312
-
\??\c:\pjdvv.exec:\pjdvv.exe184⤵PID:5040
-
\??\c:\rxflffx.exec:\rxflffx.exe185⤵PID:3200
-
\??\c:\9btnbb.exec:\9btnbb.exe186⤵PID:3612
-
\??\c:\ppdvj.exec:\ppdvj.exe187⤵PID:3176
-
\??\c:\xxffrrr.exec:\xxffrrr.exe188⤵PID:2976
-
\??\c:\bbtnbb.exec:\bbtnbb.exe189⤵PID:320
-
\??\c:\pdddv.exec:\pdddv.exe190⤵PID:4612
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe191⤵PID:2512
-
\??\c:\flfflll.exec:\flfflll.exe192⤵PID:3756
-
\??\c:\hbtnbb.exec:\hbtnbb.exe193⤵PID:2096
-
\??\c:\9djjp.exec:\9djjp.exe194⤵PID:2908
-
\??\c:\xrlrxlx.exec:\xrlrxlx.exe195⤵PID:3460
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe196⤵PID:4604
-
\??\c:\5bbtnn.exec:\5bbtnn.exe197⤵PID:2180
-
\??\c:\jjjdv.exec:\jjjdv.exe198⤵PID:1692
-
\??\c:\vpjdp.exec:\vpjdp.exe199⤵PID:708
-
\??\c:\rrrlfxx.exec:\rrrlfxx.exe200⤵PID:5088
-
\??\c:\5nhhbb.exec:\5nhhbb.exe201⤵PID:4884
-
\??\c:\3htnhn.exec:\3htnhn.exe202⤵PID:3544
-
\??\c:\9ppjj.exec:\9ppjj.exe203⤵PID:936
-
\??\c:\lfrlxxl.exec:\lfrlxxl.exe204⤵PID:4304
-
\??\c:\htbbbt.exec:\htbbbt.exe205⤵PID:4224
-
\??\c:\vpvdd.exec:\vpvdd.exe206⤵PID:4200
-
\??\c:\rrrlfxx.exec:\rrrlfxx.exe207⤵PID:3844
-
\??\c:\rfllrrl.exec:\rfllrrl.exe208⤵PID:4580
-
\??\c:\htbtbb.exec:\htbtbb.exe209⤵PID:4868
-
\??\c:\3pppp.exec:\3pppp.exe210⤵PID:3892
-
\??\c:\jdjpp.exec:\jdjpp.exe211⤵PID:2884
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe212⤵PID:4636
-
\??\c:\7bhhnn.exec:\7bhhnn.exe213⤵PID:5092
-
\??\c:\9jpdv.exec:\9jpdv.exe214⤵PID:1216
-
\??\c:\llxrlrl.exec:\llxrlrl.exe215⤵PID:1304
-
\??\c:\bntnnn.exec:\bntnnn.exe216⤵PID:2700
-
\??\c:\jvddv.exec:\jvddv.exe217⤵PID:4020
-
\??\c:\rlrfxxx.exec:\rlrfxxx.exe218⤵PID:4440
-
\??\c:\fxllfxr.exec:\fxllfxr.exe219⤵PID:4528
-
\??\c:\tnbtnn.exec:\tnbtnn.exe220⤵PID:2812
-
\??\c:\dvdvv.exec:\dvdvv.exe221⤵PID:4840
-
\??\c:\1flfxll.exec:\1flfxll.exe222⤵PID:2020
-
\??\c:\nnttnn.exec:\nnttnn.exe223⤵PID:4800
-
\??\c:\vpvpp.exec:\vpvpp.exe224⤵PID:4120
-
\??\c:\9fxrfff.exec:\9fxrfff.exe225⤵PID:3056
-
\??\c:\3fxfxlf.exec:\3fxfxlf.exe226⤵PID:2756
-
\??\c:\bnnbht.exec:\bnnbht.exe227⤵PID:488
-
\??\c:\3dddv.exec:\3dddv.exe228⤵PID:3472
-
\??\c:\lfxfxxr.exec:\lfxfxxr.exe229⤵PID:4080
-
\??\c:\lrxrlff.exec:\lrxrlff.exe230⤵PID:3000
-
\??\c:\bbttnn.exec:\bbttnn.exe231⤵PID:1448
-
\??\c:\1pjdv.exec:\1pjdv.exe232⤵PID:2024
-
\??\c:\pvvvp.exec:\pvvvp.exe233⤵PID:4680
-
\??\c:\xrrrlll.exec:\xrrrlll.exe234⤵PID:2948
-
\??\c:\tnhhnh.exec:\tnhhnh.exe235⤵PID:1612
-
\??\c:\bhtnhh.exec:\bhtnhh.exe236⤵PID:2140
-
\??\c:\pvpvv.exec:\pvpvv.exe237⤵PID:1836
-
\??\c:\rrxxxfr.exec:\rrxxxfr.exe238⤵PID:5004
-
\??\c:\hnthhb.exec:\hnthhb.exe239⤵PID:2276
-
\??\c:\dddpj.exec:\dddpj.exe240⤵PID:5016
-
\??\c:\dvvpj.exec:\dvvpj.exe241⤵PID:3208
-
\??\c:\7xffflr.exec:\7xffflr.exe242⤵PID:1468