Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 13:31
Behavioral task
behavioral1
Sample
33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exe
-
Size
90KB
-
MD5
227ee42264ec7ed0e6eb5d39fbfe82b0
-
SHA1
89af0ee316315e2fb598f1050a5ff874128062d4
-
SHA256
33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa
-
SHA512
9b95031efa5db1df99ebd1e81bd0b001d21d56d35aa84159516662ebd08325eb645c2590de2ddbb47d08d78740461764e58a03270a47c28a94d20ddb588ca9e1
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWp5:8hOmTsF93UYfwC6GIout0fmCiiiXA6mb
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/464-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2184-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3088-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1032-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4160-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3388-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/460-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5072-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/896-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/628-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1632-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3664-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/828-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4044-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/864-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/704-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/704-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1816-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2888-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2888-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2620-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4488-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2708-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1080-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3664-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-558-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-567-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-641-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-645-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3056-716-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pvdvv.exe5lxrrrl.exe5ntnhh.exepdjdd.exepjdvd.exefxfxrxr.exenntnhh.exe1dpjj.exe7rfffxx.exe1hhbtn.exehtbtnn.exe1djpd.exedpdpj.exefxrlffx.exethtnhh.exe5pdvp.exexrfllrr.exehnthbb.exehthbtt.exevvjdp.exe5lffxxf.exehhhtnh.exebttnhh.exejjdvp.exerfrlxxx.exelxxfffl.exehnbbbb.exepdjjv.exerfxrlfx.exe3tnhbt.exehbhhbb.exejpjvj.exelxffrlf.exe3xlrlfl.exebtbtnt.exe1ddpj.exejddpp.exe9xllrxr.exehnnhbh.exejjjjd.exedvjdv.exexxxlrrr.exelrllffx.exebbthbt.exepvjpj.exexflrlxr.exebhbnbt.exedjvdp.exefrllxrf.exelfrlffx.exetnbbbh.exepjvpv.exedvjdd.exerffxlfl.exetbbbtn.exenttnbn.exevpjdp.exe7lrllrr.exetttbtb.exenbnntb.exevpdpd.exelffxfxr.exexffxrxr.exe3nnbtn.exepid process 2140 pvdvv.exe 5064 5lxrrrl.exe 2764 5ntnhh.exe 4936 pdjdd.exe 3232 pjdvd.exe 3280 fxfxrxr.exe 2184 nntnhh.exe 3088 1dpjj.exe 1032 7rfffxx.exe 4160 1hhbtn.exe 2428 htbtnn.exe 4832 1djpd.exe 4076 dpdpj.exe 4772 fxrlffx.exe 1696 thtnhh.exe 4308 5pdvp.exe 4460 xrfllrr.exe 3736 hnthbb.exe 2424 hthbtt.exe 3388 vvjdp.exe 460 5lffxxf.exe 4440 hhhtnh.exe 3848 bttnhh.exe 5072 jjdvp.exe 4388 rfrlxxx.exe 896 lxxfffl.exe 2196 hnbbbb.exe 628 pdjjv.exe 1632 rfxrlfx.exe 4860 3tnhbt.exe 4900 hbhhbb.exe 2308 jpjvj.exe 4856 lxffrlf.exe 2176 3xlrlfl.exe 3084 btbtnt.exe 4232 1ddpj.exe 1796 jddpp.exe 2000 9xllrxr.exe 3664 hnnhbh.exe 708 jjjjd.exe 2888 dvjdv.exe 2744 xxxlrrr.exe 4920 lrllffx.exe 2964 bbthbt.exe 5056 pvjpj.exe 4088 xflrlxr.exe 828 bhbnbt.exe 3940 djvdp.exe 1552 frllxrf.exe 3232 lfrlffx.exe 868 tnbbbh.exe 4140 pjvpv.exe 2092 dvjdd.exe 2732 rffxlfl.exe 3812 tbbbtn.exe 4044 nttnbn.exe 1008 vpjdp.exe 4432 7lrllrr.exe 2080 tttbtb.exe 2068 nbnntb.exe 1328 vpdpd.exe 2156 lffxfxr.exe 864 xffxrxr.exe 4824 3nnbtn.exe -
Processes:
resource yara_rule behavioral2/memory/464-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvdvv.exe upx behavioral2/memory/464-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2140-6-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5lxrrrl.exe upx behavioral2/memory/2140-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5ntnhh.exe upx behavioral2/memory/5064-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2764-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdjdd.exe upx behavioral2/memory/4936-25-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjdvd.exe upx C:\fxfxrxr.exe upx behavioral2/memory/3232-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3280-35-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nntnhh.exe upx C:\1dpjj.exe upx behavioral2/memory/2184-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3088-42-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7rfffxx.exe upx behavioral2/memory/3088-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1032-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1032-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1hhbtn.exe upx C:\htbtnn.exe upx behavioral2/memory/4160-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2428-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1djpd.exe upx behavioral2/memory/4832-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpdpj.exe upx C:\fxrlffx.exe upx behavioral2/memory/4076-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4772-74-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thtnhh.exe upx behavioral2/memory/4772-78-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5pdvp.exe upx behavioral2/memory/1696-83-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrfllrr.exe upx behavioral2/memory/4460-90-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnthbb.exe upx behavioral2/memory/3736-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hthbtt.exe upx C:\vvjdp.exe upx behavioral2/memory/2424-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3388-105-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5lffxxf.exe upx behavioral2/memory/460-111-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhtnh.exe upx C:\bttnhh.exe upx C:\jjdvp.exe upx behavioral2/memory/5072-123-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfrlxxx.exe upx behavioral2/memory/4388-130-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxxfffl.exe upx C:\hnbbbb.exe upx behavioral2/memory/896-134-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdjjv.exe upx behavioral2/memory/2196-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/628-142-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfxrlfx.exe upx behavioral2/memory/628-147-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3tnhbt.exe upx behavioral2/memory/1632-150-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhhbb.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exepvdvv.exe5lxrrrl.exe5ntnhh.exepdjdd.exepjdvd.exefxfxrxr.exenntnhh.exe1dpjj.exe7rfffxx.exe1hhbtn.exehtbtnn.exe1djpd.exedpdpj.exefxrlffx.exethtnhh.exe5pdvp.exexrfllrr.exehnthbb.exehthbtt.exevvjdp.exe5lffxxf.exedescription pid process target process PID 464 wrote to memory of 2140 464 33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exe pvdvv.exe PID 464 wrote to memory of 2140 464 33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exe pvdvv.exe PID 464 wrote to memory of 2140 464 33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exe pvdvv.exe PID 2140 wrote to memory of 5064 2140 pvdvv.exe 5lxrrrl.exe PID 2140 wrote to memory of 5064 2140 pvdvv.exe 5lxrrrl.exe PID 2140 wrote to memory of 5064 2140 pvdvv.exe 5lxrrrl.exe PID 5064 wrote to memory of 2764 5064 5lxrrrl.exe 5ntnhh.exe PID 5064 wrote to memory of 2764 5064 5lxrrrl.exe 5ntnhh.exe PID 5064 wrote to memory of 2764 5064 5lxrrrl.exe 5ntnhh.exe PID 2764 wrote to memory of 4936 2764 5ntnhh.exe pdjdd.exe PID 2764 wrote to memory of 4936 2764 5ntnhh.exe pdjdd.exe PID 2764 wrote to memory of 4936 2764 5ntnhh.exe pdjdd.exe PID 4936 wrote to memory of 3232 4936 pdjdd.exe pjdvd.exe PID 4936 wrote to memory of 3232 4936 pdjdd.exe pjdvd.exe PID 4936 wrote to memory of 3232 4936 pdjdd.exe pjdvd.exe PID 3232 wrote to memory of 3280 3232 pjdvd.exe fxfxrxr.exe PID 3232 wrote to memory of 3280 3232 pjdvd.exe fxfxrxr.exe PID 3232 wrote to memory of 3280 3232 pjdvd.exe fxfxrxr.exe PID 3280 wrote to memory of 2184 3280 fxfxrxr.exe nntnhh.exe PID 3280 wrote to memory of 2184 3280 fxfxrxr.exe nntnhh.exe PID 3280 wrote to memory of 2184 3280 fxfxrxr.exe nntnhh.exe PID 2184 wrote to memory of 3088 2184 nntnhh.exe 1dpjj.exe PID 2184 wrote to memory of 3088 2184 nntnhh.exe 1dpjj.exe PID 2184 wrote to memory of 3088 2184 nntnhh.exe 1dpjj.exe PID 3088 wrote to memory of 1032 3088 1dpjj.exe 7rfffxx.exe PID 3088 wrote to memory of 1032 3088 1dpjj.exe 7rfffxx.exe PID 3088 wrote to memory of 1032 3088 1dpjj.exe 7rfffxx.exe PID 1032 wrote to memory of 4160 1032 7rfffxx.exe 1hhbtn.exe PID 1032 wrote to memory of 4160 1032 7rfffxx.exe 1hhbtn.exe PID 1032 wrote to memory of 4160 1032 7rfffxx.exe 1hhbtn.exe PID 4160 wrote to memory of 2428 4160 1hhbtn.exe htbtnn.exe PID 4160 wrote to memory of 2428 4160 1hhbtn.exe htbtnn.exe PID 4160 wrote to memory of 2428 4160 1hhbtn.exe htbtnn.exe PID 2428 wrote to memory of 4832 2428 htbtnn.exe 1djpd.exe PID 2428 wrote to memory of 4832 2428 htbtnn.exe 1djpd.exe PID 2428 wrote to memory of 4832 2428 htbtnn.exe 1djpd.exe PID 4832 wrote to memory of 4076 4832 1djpd.exe dpdpj.exe PID 4832 wrote to memory of 4076 4832 1djpd.exe dpdpj.exe PID 4832 wrote to memory of 4076 4832 1djpd.exe dpdpj.exe PID 4076 wrote to memory of 4772 4076 dpdpj.exe fxrlffx.exe PID 4076 wrote to memory of 4772 4076 dpdpj.exe fxrlffx.exe PID 4076 wrote to memory of 4772 4076 dpdpj.exe fxrlffx.exe PID 4772 wrote to memory of 1696 4772 fxrlffx.exe thtnhh.exe PID 4772 wrote to memory of 1696 4772 fxrlffx.exe thtnhh.exe PID 4772 wrote to memory of 1696 4772 fxrlffx.exe thtnhh.exe PID 1696 wrote to memory of 4308 1696 thtnhh.exe 5pdvp.exe PID 1696 wrote to memory of 4308 1696 thtnhh.exe 5pdvp.exe PID 1696 wrote to memory of 4308 1696 thtnhh.exe 5pdvp.exe PID 4308 wrote to memory of 4460 4308 5pdvp.exe xrfllrr.exe PID 4308 wrote to memory of 4460 4308 5pdvp.exe xrfllrr.exe PID 4308 wrote to memory of 4460 4308 5pdvp.exe xrfllrr.exe PID 4460 wrote to memory of 3736 4460 xrfllrr.exe hnthbb.exe PID 4460 wrote to memory of 3736 4460 xrfllrr.exe hnthbb.exe PID 4460 wrote to memory of 3736 4460 xrfllrr.exe hnthbb.exe PID 3736 wrote to memory of 2424 3736 hnthbb.exe hthbtt.exe PID 3736 wrote to memory of 2424 3736 hnthbb.exe hthbtt.exe PID 3736 wrote to memory of 2424 3736 hnthbb.exe hthbtt.exe PID 2424 wrote to memory of 3388 2424 hthbtt.exe vvjdp.exe PID 2424 wrote to memory of 3388 2424 hthbtt.exe vvjdp.exe PID 2424 wrote to memory of 3388 2424 hthbtt.exe vvjdp.exe PID 3388 wrote to memory of 460 3388 vvjdp.exe 5lffxxf.exe PID 3388 wrote to memory of 460 3388 vvjdp.exe 5lffxxf.exe PID 3388 wrote to memory of 460 3388 vvjdp.exe 5lffxxf.exe PID 460 wrote to memory of 4440 460 5lffxxf.exe hhhtnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exe"C:\Users\Admin\AppData\Local\Temp\33b25ee1f0389cef0b6951efa1197bf1e83212501ebb8a4979b69a34c408b9fa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\pvdvv.exec:\pvdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\5lxrrrl.exec:\5lxrrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\5ntnhh.exec:\5ntnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\pdjdd.exec:\pdjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\pjdvd.exec:\pjdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\fxfxrxr.exec:\fxfxrxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\nntnhh.exec:\nntnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\1dpjj.exec:\1dpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\7rfffxx.exec:\7rfffxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\1hhbtn.exec:\1hhbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\htbtnn.exec:\htbtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\1djpd.exec:\1djpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\dpdpj.exec:\dpdpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\fxrlffx.exec:\fxrlffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\thtnhh.exec:\thtnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\5pdvp.exec:\5pdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\xrfllrr.exec:\xrfllrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\hnthbb.exec:\hnthbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\hthbtt.exec:\hthbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\vvjdp.exec:\vvjdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\5lffxxf.exec:\5lffxxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\hhhtnh.exec:\hhhtnh.exe23⤵
- Executes dropped EXE
PID:4440 -
\??\c:\bttnhh.exec:\bttnhh.exe24⤵
- Executes dropped EXE
PID:3848 -
\??\c:\jjdvp.exec:\jjdvp.exe25⤵
- Executes dropped EXE
PID:5072 -
\??\c:\rfrlxxx.exec:\rfrlxxx.exe26⤵
- Executes dropped EXE
PID:4388 -
\??\c:\lxxfffl.exec:\lxxfffl.exe27⤵
- Executes dropped EXE
PID:896 -
\??\c:\hnbbbb.exec:\hnbbbb.exe28⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pdjjv.exec:\pdjjv.exe29⤵
- Executes dropped EXE
PID:628 -
\??\c:\rfxrlfx.exec:\rfxrlfx.exe30⤵
- Executes dropped EXE
PID:1632 -
\??\c:\3tnhbt.exec:\3tnhbt.exe31⤵
- Executes dropped EXE
PID:4860 -
\??\c:\hbhhbb.exec:\hbhhbb.exe32⤵
- Executes dropped EXE
PID:4900 -
\??\c:\jpjvj.exec:\jpjvj.exe33⤵
- Executes dropped EXE
PID:2308 -
\??\c:\lxffrlf.exec:\lxffrlf.exe34⤵
- Executes dropped EXE
PID:4856 -
\??\c:\3xlrlfl.exec:\3xlrlfl.exe35⤵
- Executes dropped EXE
PID:2176 -
\??\c:\btbtnt.exec:\btbtnt.exe36⤵
- Executes dropped EXE
PID:3084 -
\??\c:\1ddpj.exec:\1ddpj.exe37⤵
- Executes dropped EXE
PID:4232 -
\??\c:\jddpp.exec:\jddpp.exe38⤵
- Executes dropped EXE
PID:1796 -
\??\c:\9xllrxr.exec:\9xllrxr.exe39⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hnnhbh.exec:\hnnhbh.exe40⤵
- Executes dropped EXE
PID:3664 -
\??\c:\jjjjd.exec:\jjjjd.exe41⤵
- Executes dropped EXE
PID:708 -
\??\c:\dvjdv.exec:\dvjdv.exe42⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xxxlrrr.exec:\xxxlrrr.exe43⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lrllffx.exec:\lrllffx.exe44⤵
- Executes dropped EXE
PID:4920 -
\??\c:\bbthbt.exec:\bbthbt.exe45⤵
- Executes dropped EXE
PID:2964 -
\??\c:\7jjvp.exec:\7jjvp.exe46⤵PID:1532
-
\??\c:\pvjpj.exec:\pvjpj.exe47⤵
- Executes dropped EXE
PID:5056 -
\??\c:\xflrlxr.exec:\xflrlxr.exe48⤵
- Executes dropped EXE
PID:4088 -
\??\c:\bhbnbt.exec:\bhbnbt.exe49⤵
- Executes dropped EXE
PID:828 -
\??\c:\djvdp.exec:\djvdp.exe50⤵
- Executes dropped EXE
PID:3940 -
\??\c:\frllxrf.exec:\frllxrf.exe51⤵
- Executes dropped EXE
PID:1552 -
\??\c:\lfrlffx.exec:\lfrlffx.exe52⤵
- Executes dropped EXE
PID:3232 -
\??\c:\tnbbbh.exec:\tnbbbh.exe53⤵
- Executes dropped EXE
PID:868 -
\??\c:\pjvpv.exec:\pjvpv.exe54⤵
- Executes dropped EXE
PID:4140 -
\??\c:\dvjdd.exec:\dvjdd.exe55⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rffxlfl.exec:\rffxlfl.exe56⤵
- Executes dropped EXE
PID:2732 -
\??\c:\tbbbtn.exec:\tbbbtn.exe57⤵
- Executes dropped EXE
PID:3812 -
\??\c:\nttnbn.exec:\nttnbn.exe58⤵
- Executes dropped EXE
PID:4044 -
\??\c:\vpjdp.exec:\vpjdp.exe59⤵
- Executes dropped EXE
PID:1008 -
\??\c:\7lrllrr.exec:\7lrllrr.exe60⤵
- Executes dropped EXE
PID:4432 -
\??\c:\tttbtb.exec:\tttbtb.exe61⤵
- Executes dropped EXE
PID:2080 -
\??\c:\nbnntb.exec:\nbnntb.exe62⤵
- Executes dropped EXE
PID:2068 -
\??\c:\vpdpd.exec:\vpdpd.exe63⤵
- Executes dropped EXE
PID:1328 -
\??\c:\lffxfxr.exec:\lffxfxr.exe64⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xffxrxr.exec:\xffxrxr.exe65⤵
- Executes dropped EXE
PID:864 -
\??\c:\3nnbtn.exec:\3nnbtn.exe66⤵
- Executes dropped EXE
PID:4824 -
\??\c:\7bntbh.exec:\7bntbh.exe67⤵PID:596
-
\??\c:\pjpdj.exec:\pjpdj.exe68⤵PID:4448
-
\??\c:\lfxlxrl.exec:\lfxlxrl.exe69⤵PID:3596
-
\??\c:\9flfxxr.exec:\9flfxxr.exe70⤵PID:2828
-
\??\c:\hbbthh.exec:\hbbthh.exe71⤵PID:1596
-
\??\c:\jddvj.exec:\jddvj.exe72⤵PID:2104
-
\??\c:\ffrflff.exec:\ffrflff.exe73⤵PID:5040
-
\??\c:\rllfxxl.exec:\rllfxxl.exe74⤵PID:704
-
\??\c:\htbnhh.exec:\htbnhh.exe75⤵PID:4600
-
\??\c:\vpvpd.exec:\vpvpd.exe76⤵PID:3272
-
\??\c:\9pvpj.exec:\9pvpj.exe77⤵PID:4012
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe78⤵PID:896
-
\??\c:\5rrxrlx.exec:\5rrxrlx.exe79⤵PID:2644
-
\??\c:\hhhtnh.exec:\hhhtnh.exe80⤵PID:2112
-
\??\c:\5vdvj.exec:\5vdvj.exe81⤵PID:1300
-
\??\c:\djdvp.exec:\djdvp.exe82⤵PID:2044
-
\??\c:\lllrlfx.exec:\lllrlfx.exe83⤵PID:2232
-
\??\c:\hbtnhh.exec:\hbtnhh.exe84⤵PID:4860
-
\??\c:\3ppjv.exec:\3ppjv.exe85⤵PID:4556
-
\??\c:\lxfrllx.exec:\lxfrllx.exe86⤵PID:1816
-
\??\c:\nhtttb.exec:\nhtttb.exe87⤵PID:3108
-
\??\c:\hhbtbh.exec:\hhbtbh.exe88⤵PID:1844
-
\??\c:\pddpd.exec:\pddpd.exe89⤵PID:3144
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe90⤵PID:4468
-
\??\c:\lxxrlll.exec:\lxxrlll.exe91⤵PID:3124
-
\??\c:\3nnhtt.exec:\3nnhtt.exe92⤵PID:4252
-
\??\c:\vddvj.exec:\vddvj.exe93⤵PID:4336
-
\??\c:\xllxlfr.exec:\xllxlfr.exe94⤵PID:3976
-
\??\c:\xxffxfl.exec:\xxffxfl.exe95⤵PID:2888
-
\??\c:\nhbtnn.exec:\nhbtnn.exe96⤵PID:4284
-
\??\c:\pddpd.exec:\pddpd.exe97⤵PID:4268
-
\??\c:\pdvpd.exec:\pdvpd.exe98⤵PID:2620
-
\??\c:\fflxlfx.exec:\fflxlfx.exe99⤵PID:2840
-
\??\c:\xfllllf.exec:\xfllllf.exe100⤵PID:2088
-
\??\c:\btbttn.exec:\btbttn.exe101⤵PID:3656
-
\??\c:\5hnbbt.exec:\5hnbbt.exe102⤵PID:3048
-
\??\c:\ppjdp.exec:\ppjdp.exe103⤵PID:1552
-
\??\c:\dppdv.exec:\dppdv.exe104⤵PID:1652
-
\??\c:\fxxlxlx.exec:\fxxlxlx.exe105⤵PID:3024
-
\??\c:\rllxflf.exec:\rllxflf.exe106⤵PID:5088
-
\??\c:\hhnbnn.exec:\hhnbnn.exe107⤵PID:3060
-
\??\c:\vpppv.exec:\vpppv.exe108⤵PID:3440
-
\??\c:\pvdvd.exec:\pvdvd.exe109⤵PID:3888
-
\??\c:\xrrxlfx.exec:\xrrxlfx.exe110⤵PID:792
-
\??\c:\lffrxxr.exec:\lffrxxr.exe111⤵PID:1984
-
\??\c:\nhnhtt.exec:\nhnhtt.exe112⤵PID:3560
-
\??\c:\1nhttn.exec:\1nhttn.exe113⤵PID:3704
-
\??\c:\pjdjv.exec:\pjdjv.exe114⤵PID:2068
-
\??\c:\jjjvj.exec:\jjjvj.exe115⤵PID:4772
-
\??\c:\lfrlllf.exec:\lfrlllf.exe116⤵PID:2624
-
\??\c:\xxrrxfl.exec:\xxrrxfl.exe117⤵PID:3368
-
\??\c:\3thbnn.exec:\3thbnn.exe118⤵PID:3876
-
\??\c:\htbthb.exec:\htbthb.exe119⤵PID:5032
-
\??\c:\vdjdj.exec:\vdjdj.exe120⤵PID:3400
-
\??\c:\rllffll.exec:\rllffll.exe121⤵PID:4448
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe122⤵PID:3348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-