Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 09:34
Behavioral task
behavioral1
Sample
00f117a2e2fa90cb9bf17d5ac8750ab0.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
00f117a2e2fa90cb9bf17d5ac8750ab0.exe
-
Size
340KB
-
MD5
00f117a2e2fa90cb9bf17d5ac8750ab0
-
SHA1
c5faaac76aa0de59e259e2597c7044d635a7f890
-
SHA256
ff0a439ff1ac00685ad2b01a381213a46beefa68860ae9578cb674a1c485577c
-
SHA512
4c2d8a28ca21ba9031e1e87d406c5c446af683f78342706bc849079fed35b2e237b04bedaab8e12b9c57228d8b51a97015f7acd24c6c2138de186b121631fa44
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBHNgu5ex1B2OkEv0KvmhNiZ:9cm4FmowdHoS4BtguSPKyHZ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2852-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2728-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/768-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1268-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2724-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/868-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/716-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2896-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/908-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/628-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3028-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-625-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-663-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-672-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-682-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-684-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/824-719-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-743-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-780-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-790-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1084-821-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-1011-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2484-1044-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2468-1156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3pjvd.exettbttt.exejjjdd.exedpjdv.exeflrlrlr.exehhtnhh.exe3vjjd.exepjppp.exejpddv.exelrfxrlr.exetnnhbb.exefxrlrrl.exellrlflf.exeppvpj.exejvvvv.exepjdvj.exelfrlrfx.exellrlfrl.exedjvvv.exehhnhhh.exeddppd.exedjvvp.exennhbhb.exexrfxllx.exebnbbbb.exe7tnhbt.exeffxxlff.exe1ntnhh.exedpvvp.exehbtnhn.exeflxxxrr.exethbnth.exepjjdd.exerxxflff.exepvvjd.exeflrlffx.exenthhhb.exepdppp.exe7lrlflf.exehhhhhn.exethnhtt.exepjdpj.exettntbh.exejjddd.exedpjdv.exefxffxxl.exebtnhhh.exepvvvp.exebbttth.exe5bhbbt.exedddjv.exebntnnn.exettnhbb.exefrlfrrl.exehbhhhn.exedpvpv.exepvvpj.exeflxxlxr.exejdvpj.exe9vdvp.exeffxflxl.exebbbtnn.exejpdjd.exeflrlfxx.exepid process 4552 3pjvd.exe 4560 ttbttt.exe 2728 jjjdd.exe 3012 dpjdv.exe 2448 flrlrlr.exe 3104 hhtnhh.exe 2044 3vjjd.exe 4872 pjppp.exe 624 jpddv.exe 768 lrfxrlr.exe 3340 tnnhbb.exe 3308 fxrlrrl.exe 3224 llrlflf.exe 1468 ppvpj.exe 2796 jvvvv.exe 3724 pjdvj.exe 4428 lfrlrfx.exe 1844 llrlfrl.exe 1268 djvvv.exe 1564 hhnhhh.exe 2724 ddppd.exe 756 djvvp.exe 4680 nnhbhb.exe 868 xrfxllx.exe 912 bnbbbb.exe 3468 7tnhbt.exe 2084 ffxxlff.exe 2940 1ntnhh.exe 4080 dpvvp.exe 2396 hbtnhn.exe 556 flxxxrr.exe 4904 thbnth.exe 4620 pjjdd.exe 3568 rxxflff.exe 4336 pvvjd.exe 3592 flrlffx.exe 716 nthhhb.exe 4780 pdppp.exe 3240 7lrlflf.exe 2276 hhhhhn.exe 1400 thnhtt.exe 2996 pjdpj.exe 2720 ttntbh.exe 3104 jjddd.exe 2820 dpjdv.exe 4876 fxffxxl.exe 1544 btnhhh.exe 1776 pvvvp.exe 5064 bbttth.exe 3212 5bhbbt.exe 3036 dddjv.exe 1424 bntnnn.exe 316 ttnhbb.exe 3208 frlfrrl.exe 1672 hbhhhn.exe 1320 dpvpv.exe 4064 pvvpj.exe 3824 flxxlxr.exe 1300 jdvpj.exe 944 9vdvp.exe 2896 ffxflxl.exe 2208 bbbtnn.exe 4968 jpdjd.exe 4224 flrlfxx.exe -
Processes:
resource yara_rule behavioral2/memory/2852-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3pjvd.exe upx behavioral2/memory/2852-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4552-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4552-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4560-15-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjjdd.exe upx C:\dpjdv.exe upx C:\flrlrlr.exe upx behavioral2/memory/2448-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3012-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2728-21-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ttbttt.exe upx \??\c:\hhtnhh.exe upx behavioral2/memory/2448-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3vjjd.exe upx C:\pjppp.exe upx behavioral2/memory/4872-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2044-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpddv.exe upx C:\lrfxrlr.exe upx behavioral2/memory/768-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/624-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnhbb.exe upx behavioral2/memory/3340-69-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxrlrrl.exe upx C:\llrlflf.exe upx C:\ppvpj.exe upx behavioral2/memory/3224-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvvvv.exe upx C:\pjdvj.exe upx behavioral2/memory/2796-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3724-97-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfrlrfx.exe upx behavioral2/memory/4428-103-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\llrlfrl.exe upx C:\djvvv.exe upx behavioral2/memory/1844-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1268-114-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhnhhh.exe upx behavioral2/memory/1268-119-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddppd.exe upx behavioral2/memory/2724-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djvvp.exe upx behavioral2/memory/756-133-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnhbhb.exe upx C:\xrfxllx.exe upx behavioral2/memory/4680-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/868-145-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnbbbb.exe upx C:\7tnhbt.exe upx \??\c:\ffxxlff.exe upx \??\c:\1ntnhh.exe upx C:\dpvvp.exe upx behavioral2/memory/4080-173-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbtnhn.exe upx behavioral2/memory/2396-181-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\flxxxrr.exe upx behavioral2/memory/4904-187-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thbnth.exe upx behavioral2/memory/3568-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3592-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/716-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4780-212-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
00f117a2e2fa90cb9bf17d5ac8750ab0.exe3pjvd.exettbttt.exejjjdd.exedpjdv.exeflrlrlr.exehhtnhh.exe3vjjd.exepjppp.exejpddv.exelrfxrlr.exetnnhbb.exefxrlrrl.exellrlflf.exeppvpj.exejvvvv.exepjdvj.exelfrlrfx.exellrlfrl.exedjvvv.exehhnhhh.exeddppd.exedescription pid process target process PID 2852 wrote to memory of 4552 2852 00f117a2e2fa90cb9bf17d5ac8750ab0.exe 3pjvd.exe PID 2852 wrote to memory of 4552 2852 00f117a2e2fa90cb9bf17d5ac8750ab0.exe 3pjvd.exe PID 2852 wrote to memory of 4552 2852 00f117a2e2fa90cb9bf17d5ac8750ab0.exe 3pjvd.exe PID 4552 wrote to memory of 4560 4552 3pjvd.exe ttbttt.exe PID 4552 wrote to memory of 4560 4552 3pjvd.exe ttbttt.exe PID 4552 wrote to memory of 4560 4552 3pjvd.exe ttbttt.exe PID 4560 wrote to memory of 2728 4560 ttbttt.exe jjjdd.exe PID 4560 wrote to memory of 2728 4560 ttbttt.exe jjjdd.exe PID 4560 wrote to memory of 2728 4560 ttbttt.exe jjjdd.exe PID 2728 wrote to memory of 3012 2728 jjjdd.exe dpjdv.exe PID 2728 wrote to memory of 3012 2728 jjjdd.exe dpjdv.exe PID 2728 wrote to memory of 3012 2728 jjjdd.exe dpjdv.exe PID 3012 wrote to memory of 2448 3012 dpjdv.exe flrlrlr.exe PID 3012 wrote to memory of 2448 3012 dpjdv.exe flrlrlr.exe PID 3012 wrote to memory of 2448 3012 dpjdv.exe flrlrlr.exe PID 2448 wrote to memory of 3104 2448 flrlrlr.exe hhtnhh.exe PID 2448 wrote to memory of 3104 2448 flrlrlr.exe hhtnhh.exe PID 2448 wrote to memory of 3104 2448 flrlrlr.exe hhtnhh.exe PID 3104 wrote to memory of 2044 3104 hhtnhh.exe 3vjjd.exe PID 3104 wrote to memory of 2044 3104 hhtnhh.exe 3vjjd.exe PID 3104 wrote to memory of 2044 3104 hhtnhh.exe 3vjjd.exe PID 2044 wrote to memory of 4872 2044 3vjjd.exe pjppp.exe PID 2044 wrote to memory of 4872 2044 3vjjd.exe pjppp.exe PID 2044 wrote to memory of 4872 2044 3vjjd.exe pjppp.exe PID 4872 wrote to memory of 624 4872 pjppp.exe jpddv.exe PID 4872 wrote to memory of 624 4872 pjppp.exe jpddv.exe PID 4872 wrote to memory of 624 4872 pjppp.exe jpddv.exe PID 624 wrote to memory of 768 624 jpddv.exe lrfxrlr.exe PID 624 wrote to memory of 768 624 jpddv.exe lrfxrlr.exe PID 624 wrote to memory of 768 624 jpddv.exe lrfxrlr.exe PID 768 wrote to memory of 3340 768 lrfxrlr.exe tnnhbb.exe PID 768 wrote to memory of 3340 768 lrfxrlr.exe tnnhbb.exe PID 768 wrote to memory of 3340 768 lrfxrlr.exe tnnhbb.exe PID 3340 wrote to memory of 3308 3340 tnnhbb.exe fxrlrrl.exe PID 3340 wrote to memory of 3308 3340 tnnhbb.exe fxrlrrl.exe PID 3340 wrote to memory of 3308 3340 tnnhbb.exe fxrlrrl.exe PID 3308 wrote to memory of 3224 3308 fxrlrrl.exe llrlflf.exe PID 3308 wrote to memory of 3224 3308 fxrlrrl.exe llrlflf.exe PID 3308 wrote to memory of 3224 3308 fxrlrrl.exe llrlflf.exe PID 3224 wrote to memory of 1468 3224 llrlflf.exe ppvpj.exe PID 3224 wrote to memory of 1468 3224 llrlflf.exe ppvpj.exe PID 3224 wrote to memory of 1468 3224 llrlflf.exe ppvpj.exe PID 1468 wrote to memory of 2796 1468 ppvpj.exe jvvvv.exe PID 1468 wrote to memory of 2796 1468 ppvpj.exe jvvvv.exe PID 1468 wrote to memory of 2796 1468 ppvpj.exe jvvvv.exe PID 2796 wrote to memory of 3724 2796 jvvvv.exe pjdvj.exe PID 2796 wrote to memory of 3724 2796 jvvvv.exe pjdvj.exe PID 2796 wrote to memory of 3724 2796 jvvvv.exe pjdvj.exe PID 3724 wrote to memory of 4428 3724 pjdvj.exe lfrlrfx.exe PID 3724 wrote to memory of 4428 3724 pjdvj.exe lfrlrfx.exe PID 3724 wrote to memory of 4428 3724 pjdvj.exe lfrlrfx.exe PID 4428 wrote to memory of 1844 4428 lfrlrfx.exe llrlfrl.exe PID 4428 wrote to memory of 1844 4428 lfrlrfx.exe llrlfrl.exe PID 4428 wrote to memory of 1844 4428 lfrlrfx.exe llrlfrl.exe PID 1844 wrote to memory of 1268 1844 llrlfrl.exe djvvv.exe PID 1844 wrote to memory of 1268 1844 llrlfrl.exe djvvv.exe PID 1844 wrote to memory of 1268 1844 llrlfrl.exe djvvv.exe PID 1268 wrote to memory of 1564 1268 djvvv.exe hhnhhh.exe PID 1268 wrote to memory of 1564 1268 djvvv.exe hhnhhh.exe PID 1268 wrote to memory of 1564 1268 djvvv.exe hhnhhh.exe PID 1564 wrote to memory of 2724 1564 hhnhhh.exe ddppd.exe PID 1564 wrote to memory of 2724 1564 hhnhhh.exe ddppd.exe PID 1564 wrote to memory of 2724 1564 hhnhhh.exe ddppd.exe PID 2724 wrote to memory of 756 2724 ddppd.exe djvvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00f117a2e2fa90cb9bf17d5ac8750ab0.exe"C:\Users\Admin\AppData\Local\Temp\00f117a2e2fa90cb9bf17d5ac8750ab0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\3pjvd.exec:\3pjvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\ttbttt.exec:\ttbttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\jjjdd.exec:\jjjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\dpjdv.exec:\dpjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\flrlrlr.exec:\flrlrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\hhtnhh.exec:\hhtnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\3vjjd.exec:\3vjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\pjppp.exec:\pjppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\jpddv.exec:\jpddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\lrfxrlr.exec:\lrfxrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\tnnhbb.exec:\tnnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\fxrlrrl.exec:\fxrlrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\llrlflf.exec:\llrlflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\ppvpj.exec:\ppvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\jvvvv.exec:\jvvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\pjdvj.exec:\pjdvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\lfrlrfx.exec:\lfrlrfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\llrlfrl.exec:\llrlfrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\djvvv.exec:\djvvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\hhnhhh.exec:\hhnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\ddppd.exec:\ddppd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\djvvp.exec:\djvvp.exe23⤵
- Executes dropped EXE
PID:756 -
\??\c:\nnhbhb.exec:\nnhbhb.exe24⤵
- Executes dropped EXE
PID:4680 -
\??\c:\xrfxllx.exec:\xrfxllx.exe25⤵
- Executes dropped EXE
PID:868 -
\??\c:\bnbbbb.exec:\bnbbbb.exe26⤵
- Executes dropped EXE
PID:912 -
\??\c:\7tnhbt.exec:\7tnhbt.exe27⤵
- Executes dropped EXE
PID:3468 -
\??\c:\ffxxlff.exec:\ffxxlff.exe28⤵
- Executes dropped EXE
PID:2084 -
\??\c:\1ntnhh.exec:\1ntnhh.exe29⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dpvvp.exec:\dpvvp.exe30⤵
- Executes dropped EXE
PID:4080 -
\??\c:\hbtnhn.exec:\hbtnhn.exe31⤵
- Executes dropped EXE
PID:2396 -
\??\c:\flxxxrr.exec:\flxxxrr.exe32⤵
- Executes dropped EXE
PID:556 -
\??\c:\thbnth.exec:\thbnth.exe33⤵
- Executes dropped EXE
PID:4904 -
\??\c:\pjjdd.exec:\pjjdd.exe34⤵
- Executes dropped EXE
PID:4620 -
\??\c:\rxxflff.exec:\rxxflff.exe35⤵
- Executes dropped EXE
PID:3568 -
\??\c:\pvvjd.exec:\pvvjd.exe36⤵
- Executes dropped EXE
PID:4336 -
\??\c:\flrlffx.exec:\flrlffx.exe37⤵
- Executes dropped EXE
PID:3592 -
\??\c:\nthhhb.exec:\nthhhb.exe38⤵
- Executes dropped EXE
PID:716 -
\??\c:\pdppp.exec:\pdppp.exe39⤵
- Executes dropped EXE
PID:4780 -
\??\c:\7lrlflf.exec:\7lrlflf.exe40⤵
- Executes dropped EXE
PID:3240 -
\??\c:\hhhhhn.exec:\hhhhhn.exe41⤵
- Executes dropped EXE
PID:2276 -
\??\c:\thnhtt.exec:\thnhtt.exe42⤵
- Executes dropped EXE
PID:1400 -
\??\c:\pjdpj.exec:\pjdpj.exe43⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ttntbh.exec:\ttntbh.exe44⤵
- Executes dropped EXE
PID:2720 -
\??\c:\jjddd.exec:\jjddd.exe45⤵
- Executes dropped EXE
PID:3104 -
\??\c:\dpjdv.exec:\dpjdv.exe46⤵
- Executes dropped EXE
PID:2820 -
\??\c:\fxffxxl.exec:\fxffxxl.exe47⤵
- Executes dropped EXE
PID:4876 -
\??\c:\btnhhh.exec:\btnhhh.exe48⤵
- Executes dropped EXE
PID:1544 -
\??\c:\pvvvp.exec:\pvvvp.exe49⤵
- Executes dropped EXE
PID:1776 -
\??\c:\bbttth.exec:\bbttth.exe50⤵
- Executes dropped EXE
PID:5064 -
\??\c:\5bhbbt.exec:\5bhbbt.exe51⤵
- Executes dropped EXE
PID:3212 -
\??\c:\dddjv.exec:\dddjv.exe52⤵
- Executes dropped EXE
PID:3036 -
\??\c:\bntnnn.exec:\bntnnn.exe53⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ttnhbb.exec:\ttnhbb.exe54⤵
- Executes dropped EXE
PID:316 -
\??\c:\frlfrrl.exec:\frlfrrl.exe55⤵
- Executes dropped EXE
PID:3208 -
\??\c:\hbhhhn.exec:\hbhhhn.exe56⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dpvpv.exec:\dpvpv.exe57⤵
- Executes dropped EXE
PID:1320 -
\??\c:\pvvpj.exec:\pvvpj.exe58⤵
- Executes dropped EXE
PID:4064 -
\??\c:\flxxlxr.exec:\flxxlxr.exe59⤵
- Executes dropped EXE
PID:3824 -
\??\c:\jdvpj.exec:\jdvpj.exe60⤵
- Executes dropped EXE
PID:1300 -
\??\c:\9vdvp.exec:\9vdvp.exe61⤵
- Executes dropped EXE
PID:944 -
\??\c:\ffxflxl.exec:\ffxflxl.exe62⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bbbtnn.exec:\bbbtnn.exe63⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jpdjd.exec:\jpdjd.exe64⤵
- Executes dropped EXE
PID:4968 -
\??\c:\flrlfxx.exec:\flrlfxx.exe65⤵
- Executes dropped EXE
PID:4224 -
\??\c:\bbbhbb.exec:\bbbhbb.exe66⤵PID:2920
-
\??\c:\bttnhh.exec:\bttnhh.exe67⤵PID:3608
-
\??\c:\pjjdv.exec:\pjjdv.exe68⤵PID:908
-
\??\c:\lxxrxrx.exec:\lxxrxrx.exe69⤵PID:1792
-
\??\c:\htbttn.exec:\htbttn.exe70⤵PID:3160
-
\??\c:\dpvjd.exec:\dpvjd.exe71⤵PID:4040
-
\??\c:\djpvv.exec:\djpvv.exe72⤵PID:4660
-
\??\c:\3rffxff.exec:\3rffxff.exe73⤵PID:3220
-
\??\c:\bntnnn.exec:\bntnnn.exe74⤵PID:2484
-
\??\c:\9vppj.exec:\9vppj.exe75⤵PID:1900
-
\??\c:\rlllfff.exec:\rlllfff.exe76⤵PID:4792
-
\??\c:\xlrrrrl.exec:\xlrrrrl.exe77⤵PID:3228
-
\??\c:\ttnhhb.exec:\ttnhhb.exe78⤵PID:2932
-
\??\c:\jjdjp.exec:\jjdjp.exe79⤵PID:2500
-
\??\c:\jpvpj.exec:\jpvpj.exe80⤵PID:2264
-
\??\c:\5flfxxx.exec:\5flfxxx.exe81⤵PID:4252
-
\??\c:\7hbtnn.exec:\7hbtnn.exe82⤵PID:2132
-
\??\c:\pjjdj.exec:\pjjdj.exe83⤵PID:3744
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe84⤵PID:3248
-
\??\c:\bbhbhb.exec:\bbhbhb.exe85⤵PID:3952
-
\??\c:\dppjd.exec:\dppjd.exe86⤵PID:4336
-
\??\c:\pjjdv.exec:\pjjdv.exe87⤵PID:1812
-
\??\c:\1xxxxxl.exec:\1xxxxxl.exe88⤵PID:3616
-
\??\c:\nhhbtt.exec:\nhhbtt.exe89⤵PID:628
-
\??\c:\jvddv.exec:\jvddv.exe90⤵PID:3012
-
\??\c:\jddvp.exec:\jddvp.exe91⤵PID:4240
-
\??\c:\xlxrfff.exec:\xlxrfff.exe92⤵PID:2616
-
\??\c:\5nbntn.exec:\5nbntn.exe93⤵PID:4404
-
\??\c:\dvjvp.exec:\dvjvp.exe94⤵PID:3104
-
\??\c:\1dvdv.exec:\1dvdv.exe95⤵PID:4400
-
\??\c:\xxllxll.exec:\xxllxll.exe96⤵PID:4284
-
\??\c:\ntbtnn.exec:\ntbtnn.exe97⤵PID:3772
-
\??\c:\vjdvv.exec:\vjdvv.exe98⤵PID:1776
-
\??\c:\pvjdj.exec:\pvjdj.exe99⤵PID:2872
-
\??\c:\fflxrrl.exec:\fflxrrl.exe100⤵PID:3212
-
\??\c:\thnhbb.exec:\thnhbb.exe101⤵PID:2444
-
\??\c:\vdjvv.exec:\vdjvv.exe102⤵PID:1424
-
\??\c:\lxflxlr.exec:\lxflxlr.exe103⤵PID:3980
-
\??\c:\fxffrff.exec:\fxffrff.exe104⤵PID:2416
-
\??\c:\nhnhbb.exec:\nhnhbb.exe105⤵PID:4880
-
\??\c:\jvpvv.exec:\jvpvv.exe106⤵PID:2232
-
\??\c:\ddpjd.exec:\ddpjd.exe107⤵PID:4064
-
\??\c:\xrrrfxf.exec:\xrrrfxf.exe108⤵PID:3724
-
\??\c:\7bbbhh.exec:\7bbbhh.exe109⤵PID:876
-
\??\c:\nbbtnn.exec:\nbbtnn.exe110⤵PID:944
-
\??\c:\jdjjp.exec:\jdjjp.exe111⤵PID:3324
-
\??\c:\xlxflll.exec:\xlxflll.exe112⤵PID:3384
-
\??\c:\bnbbbb.exec:\bnbbbb.exe113⤵PID:2832
-
\??\c:\tnhbtt.exec:\tnhbtt.exe114⤵PID:2184
-
\??\c:\djvdv.exec:\djvdv.exe115⤵PID:4292
-
\??\c:\tbhnbb.exec:\tbhnbb.exe116⤵PID:1524
-
\??\c:\thhbtt.exec:\thhbtt.exe117⤵PID:3928
-
\??\c:\pjjjd.exec:\pjjjd.exe118⤵PID:756
-
\??\c:\rxlfxfx.exec:\rxlfxfx.exe119⤵PID:1008
-
\??\c:\bthbbb.exec:\bthbbb.exe120⤵PID:1796
-
\??\c:\pddjd.exec:\pddjd.exe121⤵PID:4660
-
\??\c:\jddvp.exec:\jddvp.exe122⤵PID:1932
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe123⤵PID:412
-
\??\c:\bttnhn.exec:\bttnhn.exe124⤵PID:1920
-
\??\c:\hnnnhh.exec:\hnnnhh.exe125⤵PID:2844
-
\??\c:\pjpdv.exec:\pjpdv.exe126⤵PID:2396
-
\??\c:\1jpjv.exec:\1jpjv.exe127⤵PID:4788
-
\??\c:\fffxllf.exec:\fffxllf.exe128⤵PID:852
-
\??\c:\tbhbtn.exec:\tbhbtn.exe129⤵PID:2624
-
\??\c:\nbbnnn.exec:\nbbnnn.exe130⤵PID:3960
-
\??\c:\jjjjd.exec:\jjjjd.exe131⤵PID:1812
-
\??\c:\vjpvj.exec:\vjpvj.exe132⤵PID:3616
-
\??\c:\1xrxfrf.exec:\1xrxfrf.exe133⤵PID:3328
-
\??\c:\xrxrffl.exec:\xrxrffl.exe134⤵PID:3480
-
\??\c:\nbbhhb.exec:\nbbhhb.exe135⤵PID:3028
-
\??\c:\pjpjp.exec:\pjpjp.exe136⤵PID:2100
-
\??\c:\1flfffl.exec:\1flfffl.exe137⤵PID:4976
-
\??\c:\hthbtn.exec:\hthbtn.exe138⤵PID:4808
-
\??\c:\lrrlflr.exec:\lrrlflr.exe139⤵PID:3796
-
\??\c:\3fxrllf.exec:\3fxrllf.exe140⤵PID:4644
-
\??\c:\hhtnhb.exec:\hhtnhb.exe141⤵PID:3044
-
\??\c:\1dvdv.exec:\1dvdv.exe142⤵PID:3244
-
\??\c:\ppvdd.exec:\ppvdd.exe143⤵PID:5044
-
\??\c:\rlxrxfl.exec:\rlxrxfl.exe144⤵PID:5064
-
\??\c:\hbhbhh.exec:\hbhbhh.exe145⤵PID:3920
-
\??\c:\dddpv.exec:\dddpv.exe146⤵PID:1352
-
\??\c:\rflxfxx.exec:\rflxfxx.exe147⤵PID:2124
-
\??\c:\1tttnb.exec:\1tttnb.exe148⤵PID:3224
-
\??\c:\jdvvv.exec:\jdvvv.exe149⤵PID:856
-
\??\c:\pjvpp.exec:\pjvpp.exe150⤵PID:1468
-
\??\c:\rlxrxxx.exec:\rlxrxxx.exe151⤵PID:4504
-
\??\c:\bhbnnh.exec:\bhbnnh.exe152⤵PID:2320
-
\??\c:\3tbbnn.exec:\3tbbnn.exe153⤵PID:3824
-
\??\c:\pjdjd.exec:\pjdjd.exe154⤵PID:1312
-
\??\c:\lrrlffx.exec:\lrrlffx.exe155⤵PID:4412
-
\??\c:\5nntnh.exec:\5nntnh.exe156⤵PID:876
-
\??\c:\nbhntb.exec:\nbhntb.exe157⤵PID:2628
-
\??\c:\ppdjj.exec:\ppdjj.exe158⤵PID:3324
-
\??\c:\9lrxrrf.exec:\9lrxrrf.exe159⤵PID:1588
-
\??\c:\xrfrlll.exec:\xrfrlll.exe160⤵PID:2832
-
\??\c:\bttnnn.exec:\bttnnn.exe161⤵PID:4668
-
\??\c:\bnnhtn.exec:\bnnhtn.exe162⤵PID:4292
-
\??\c:\dpjdv.exec:\dpjdv.exe163⤵PID:1524
-
\??\c:\pjjvj.exec:\pjjvj.exe164⤵PID:1548
-
\??\c:\lffrxrl.exec:\lffrxrl.exe165⤵PID:1704
-
\??\c:\btntnh.exec:\btntnh.exe166⤵PID:1028
-
\??\c:\vjdvv.exec:\vjdvv.exe167⤵PID:4048
-
\??\c:\djvdj.exec:\djvdj.exe168⤵PID:3660
-
\??\c:\lrfrfrl.exec:\lrfrfrl.exe169⤵PID:1932
-
\??\c:\xrxrlll.exec:\xrxrlll.exe170⤵PID:1904
-
\??\c:\htnhhb.exec:\htnhhb.exe171⤵PID:1920
-
\??\c:\vpvdd.exec:\vpvdd.exe172⤵PID:732
-
\??\c:\rflfxrr.exec:\rflfxrr.exe173⤵PID:1208
-
\??\c:\xfllfxx.exec:\xfllfxx.exe174⤵PID:4836
-
\??\c:\ntbbtt.exec:\ntbbtt.exe175⤵PID:852
-
\??\c:\nnnhhh.exec:\nnnhhh.exe176⤵PID:1348
-
\??\c:\3pvvd.exec:\3pvvd.exe177⤵PID:1980
-
\??\c:\rllfrrl.exec:\rllfrrl.exe178⤵PID:4216
-
\??\c:\5xlfxlf.exec:\5xlfxlf.exe179⤵PID:628
-
\??\c:\hbtnnh.exec:\hbtnnh.exe180⤵PID:960
-
\??\c:\tbnnhb.exec:\tbnnhb.exe181⤵PID:3264
-
\??\c:\vdjdv.exec:\vdjdv.exe182⤵PID:2152
-
\??\c:\fflllll.exec:\fflllll.exe183⤵PID:4404
-
\??\c:\fxrllfx.exec:\fxrllfx.exe184⤵PID:4400
-
\??\c:\thtnhh.exec:\thtnhh.exe185⤵PID:4488
-
\??\c:\pdvpd.exec:\pdvpd.exe186⤵PID:4712
-
\??\c:\xffrlfx.exec:\xffrlfx.exe187⤵PID:3472
-
\??\c:\lrfxffl.exec:\lrfxffl.exe188⤵PID:3044
-
\??\c:\nhnhbb.exec:\nhnhbb.exe189⤵PID:220
-
\??\c:\vvvpj.exec:\vvvpj.exe190⤵PID:2352
-
\??\c:\vjjdv.exec:\vjjdv.exe191⤵PID:4664
-
\??\c:\lffffrr.exec:\lffffrr.exe192⤵PID:3920
-
\??\c:\nnnhbb.exec:\nnnhbb.exe193⤵PID:2444
-
\??\c:\bbnbtn.exec:\bbnbtn.exe194⤵PID:1424
-
\??\c:\jdjjd.exec:\jdjjd.exe195⤵PID:1672
-
\??\c:\xfrrlll.exec:\xfrrlll.exe196⤵PID:856
-
\??\c:\ffrlllf.exec:\ffrlllf.exe197⤵PID:4880
-
\??\c:\htnhhh.exec:\htnhhh.exe198⤵PID:824
-
\??\c:\pvdpv.exec:\pvdpv.exe199⤵PID:2320
-
\??\c:\dpvpj.exec:\dpvpj.exe200⤵PID:4228
-
\??\c:\7xffxff.exec:\7xffxff.exe201⤵PID:5004
-
\??\c:\nttbbb.exec:\nttbbb.exe202⤵PID:2104
-
\??\c:\7hnhbn.exec:\7hnhbn.exe203⤵PID:876
-
\??\c:\jpvjp.exec:\jpvjp.exe204⤵PID:3384
-
\??\c:\rxrrlrr.exec:\rxrrlrr.exe205⤵PID:5104
-
\??\c:\xlxxxfl.exec:\xlxxxfl.exe206⤵PID:2184
-
\??\c:\hthhtt.exec:\hthhtt.exe207⤵PID:4868
-
\??\c:\jjpjd.exec:\jjpjd.exe208⤵PID:1040
-
\??\c:\vjjdv.exec:\vjjdv.exe209⤵PID:4672
-
\??\c:\rrlxlfr.exec:\rrlxlfr.exe210⤵PID:3928
-
\??\c:\bhtttn.exec:\bhtttn.exe211⤵PID:4680
-
\??\c:\1djdp.exec:\1djdp.exe212⤵PID:1536
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe213⤵PID:912
-
\??\c:\7ffxrrf.exec:\7ffxrrf.exe214⤵PID:1900
-
\??\c:\thnhbb.exec:\thnhbb.exe215⤵PID:412
-
\??\c:\hhnnhb.exec:\hhnnhb.exe216⤵PID:1456
-
\??\c:\pjvpp.exec:\pjvpp.exe217⤵PID:1972
-
\??\c:\xfrrlxr.exec:\xfrrlxr.exe218⤵PID:4632
-
\??\c:\bbtbhn.exec:\bbtbhn.exe219⤵PID:4788
-
\??\c:\5dddd.exec:\5dddd.exe220⤵PID:4444
-
\??\c:\vpvpd.exec:\vpvpd.exe221⤵PID:3896
-
\??\c:\1xffxxr.exec:\1xffxxr.exe222⤵PID:3252
-
\??\c:\ntbbtn.exec:\ntbbtn.exe223⤵PID:3616
-
\??\c:\1dvvp.exec:\1dvvp.exe224⤵PID:628
-
\??\c:\3lrlffr.exec:\3lrlffr.exe225⤵PID:960
-
\??\c:\3tbbtt.exec:\3tbbtt.exe226⤵PID:3264
-
\??\c:\nhnnhh.exec:\nhnnhh.exe227⤵PID:4844
-
\??\c:\vjppj.exec:\vjppj.exe228⤵PID:452
-
\??\c:\rrrlflf.exec:\rrrlflf.exe229⤵PID:4976
-
\??\c:\xllrrrl.exec:\xllrrrl.exe230⤵PID:1084
-
\??\c:\nthhbh.exec:\nthhbh.exe231⤵PID:3032
-
\??\c:\9btnnn.exec:\9btnnn.exe232⤵PID:4484
-
\??\c:\pdjdv.exec:\pdjdv.exe233⤵PID:5048
-
\??\c:\9lrlflf.exec:\9lrlflf.exe234⤵PID:768
-
\??\c:\bnbbhb.exec:\bnbbhb.exe235⤵PID:3340
-
\??\c:\bntnhh.exec:\bntnhh.exe236⤵PID:2872
-
\??\c:\3vdpj.exec:\3vdpj.exe237⤵PID:3308
-
\??\c:\frfrlff.exec:\frfrlff.exe238⤵PID:2376
-
\??\c:\btbtnn.exec:\btbtnn.exe239⤵PID:2028
-
\??\c:\bnbnhh.exec:\bnbnhh.exe240⤵PID:3980
-
\??\c:\vppjd.exec:\vppjd.exe241⤵PID:2780
-
\??\c:\jpvpd.exec:\jpvpd.exe242⤵PID:2364