Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
05-03-2024 20:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05.exe
-
Size
55KB
-
MD5
bee693a3e88bdbaead4311e06455974e
-
SHA1
461131c90f5ce809358aa02dca8d2a9d88b03ef0
-
SHA256
4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05
-
SHA512
3fa10ade5d45dcbf0639de5666efe9291d948480990f14b02720e62acdddb2fd643c1df4b801e5bacb229f56308ac51ceaccf3661b4d39cc8e016f522e6b749d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIv6u:ymb3NkkiQ3mdBjFIv/
Malware Config
Signatures
-
Detect Blackmoon payload 34 IoCs
resource yara_rule behavioral1/memory/2108-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1180-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/240-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-473-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-489-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/648-532-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-547-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-570-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-617-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-641-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-701-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-855-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 60 IoCs
resource yara_rule behavioral1/memory/2108-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2108-1-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2448-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2564-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2520-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2552-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2552-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2440-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2536-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2016-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2696-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1512-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1360-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2936-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2924-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1868-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2216-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1180-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1180-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1708-235-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1248-254-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/240-258-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2072-276-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2968-285-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2240-294-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2240-296-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2516-352-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2536-400-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2760-416-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2940-473-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2924-489-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/584-502-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1776-510-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/648-532-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2116-547-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1248-562-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1200-570-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2804-578-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2972-593-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/884-601-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1432-609-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1956-617-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1960-625-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2448-641-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2512-655-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2500-670-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2376-685-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2440-701-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1292-800-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1560-815-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/888-830-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1548-855-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1728-862-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-877-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2468-934-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2120-977-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2608-985-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2384-993-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1900-1009-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2540-1024-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2448 vdvvp.exe 2992 dpdvv.exe 2564 lfrllll.exe 2520 dvppv.exe 2612 nthhhb.exe 2552 vpvvp.exe 2536 fflxrfx.exe 2440 thnhbb.exe 2016 7ffllrl.exe 2696 tnnbnb.exe 2676 vdjvp.exe 1564 nbnttb.exe 1588 fxllrxf.exe 1512 thnntn.exe 1360 rrflrrr.exe 2936 nnhtbt.exe 2924 hbhbbt.exe 1868 jvppp.exe 2216 hnttnn.exe 1180 rfrllll.exe 2348 hbbbhh.exe 340 7frffxf.exe 1708 thbnnt.exe 1100 1vdjp.exe 1248 1nhhht.exe 240 frxrllr.exe 3044 nhtttn.exe 2072 xrxllxf.exe 2968 nhtbbh.exe 2240 ddppj.exe 880 tntnnh.exe 2952 5djjj.exe 2632 7rfxlxx.exe 2996 jdppv.exe 1932 xrflrrf.exe 2472 bthnhn.exe 2516 pdjjd.exe 2564 3xrxxlx.exe 2520 3pjjv.exe 2400 3rlllrx.exe 2380 bbhnnt.exe 2416 pjjpp.exe 2536 3ntnht.exe 2068 jdppv.exe 2016 5hbbbh.exe 2760 djpdd.exe 2756 lxxrllr.exe 2772 tthhbb.exe 1584 lfrrrrr.exe 2036 3btntb.exe 1604 jdjjd.exe 2652 llrrxxl.exe 2040 djdpd.exe 2940 5fxffrx.exe 2056 hnnhbn.exe 2924 frfxlxr.exe 1872 1ntbbh.exe 584 1lxffff.exe 1776 3vvpj.exe 812 5dpjj.exe 648 hbhhbt.exe 340 1djdd.exe 844 5frrxxx.exe 2116 jvvvd.exe -
resource yara_rule behavioral1/memory/2108-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1180-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1180-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/240-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-473-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-489-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/584-502-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-510-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/648-532-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-547-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-562-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-570-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-578-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-593-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-601-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-609-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-617-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-625-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-641-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-655-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-670-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-685-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-701-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1292-800-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-815-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-830-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-846-0x00000000001B0000-0x00000000001BC000-memory.dmp upx behavioral1/memory/1548-855-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-862-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-877-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-934-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-977-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-985-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-993-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-1009-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-1024-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2448 2108 4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05.exe 28 PID 2108 wrote to memory of 2448 2108 4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05.exe 28 PID 2108 wrote to memory of 2448 2108 4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05.exe 28 PID 2108 wrote to memory of 2448 2108 4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05.exe 28 PID 2448 wrote to memory of 2992 2448 vdvvp.exe 29 PID 2448 wrote to memory of 2992 2448 vdvvp.exe 29 PID 2448 wrote to memory of 2992 2448 vdvvp.exe 29 PID 2448 wrote to memory of 2992 2448 vdvvp.exe 29 PID 2992 wrote to memory of 2564 2992 dpdvv.exe 30 PID 2992 wrote to memory of 2564 2992 dpdvv.exe 30 PID 2992 wrote to memory of 2564 2992 dpdvv.exe 30 PID 2992 wrote to memory of 2564 2992 dpdvv.exe 30 PID 2564 wrote to memory of 2520 2564 lfrllll.exe 31 PID 2564 wrote to memory of 2520 2564 lfrllll.exe 31 PID 2564 wrote to memory of 2520 2564 lfrllll.exe 31 PID 2564 wrote to memory of 2520 2564 lfrllll.exe 31 PID 2520 wrote to memory of 2612 2520 dvppv.exe 32 PID 2520 wrote to memory of 2612 2520 dvppv.exe 32 PID 2520 wrote to memory of 2612 2520 dvppv.exe 32 PID 2520 wrote to memory of 2612 2520 dvppv.exe 32 PID 2612 wrote to memory of 2552 2612 nthhhb.exe 33 PID 2612 wrote to memory of 2552 2612 nthhhb.exe 33 PID 2612 wrote to memory of 2552 2612 nthhhb.exe 33 PID 2612 wrote to memory of 2552 2612 nthhhb.exe 33 PID 2552 wrote to memory of 2536 2552 vpvvp.exe 34 PID 2552 wrote to memory of 2536 2552 vpvvp.exe 34 PID 2552 wrote to memory of 2536 2552 vpvvp.exe 34 PID 2552 wrote to memory of 2536 2552 vpvvp.exe 34 PID 2536 wrote to memory of 2440 2536 fflxrfx.exe 35 PID 2536 wrote to memory of 2440 2536 fflxrfx.exe 35 PID 2536 wrote to memory of 2440 2536 fflxrfx.exe 35 PID 2536 wrote to memory of 2440 2536 fflxrfx.exe 35 PID 2440 wrote to memory of 2016 2440 thnhbb.exe 36 PID 2440 wrote to memory of 2016 2440 thnhbb.exe 36 PID 2440 wrote to memory of 2016 2440 thnhbb.exe 36 PID 2440 wrote to memory of 2016 2440 thnhbb.exe 36 PID 2016 wrote to memory of 2696 2016 7ffllrl.exe 37 PID 2016 wrote to memory of 2696 2016 7ffllrl.exe 37 PID 2016 wrote to memory of 2696 2016 7ffllrl.exe 37 PID 2016 wrote to memory of 2696 2016 7ffllrl.exe 37 PID 2696 wrote to memory of 2676 2696 tnnbnb.exe 38 PID 2696 wrote to memory of 2676 2696 tnnbnb.exe 38 PID 2696 wrote to memory of 2676 2696 tnnbnb.exe 38 PID 2696 wrote to memory of 2676 2696 tnnbnb.exe 38 PID 2676 wrote to memory of 1564 2676 vdjvp.exe 39 PID 2676 wrote to memory of 1564 2676 vdjvp.exe 39 PID 2676 wrote to memory of 1564 2676 vdjvp.exe 39 PID 2676 wrote to memory of 1564 2676 vdjvp.exe 39 PID 1564 wrote to memory of 1588 1564 nbnttb.exe 40 PID 1564 wrote to memory of 1588 1564 nbnttb.exe 40 PID 1564 wrote to memory of 1588 1564 nbnttb.exe 40 PID 1564 wrote to memory of 1588 1564 nbnttb.exe 40 PID 1588 wrote to memory of 1512 1588 fxllrxf.exe 41 PID 1588 wrote to memory of 1512 1588 fxllrxf.exe 41 PID 1588 wrote to memory of 1512 1588 fxllrxf.exe 41 PID 1588 wrote to memory of 1512 1588 fxllrxf.exe 41 PID 1512 wrote to memory of 1360 1512 thnntn.exe 42 PID 1512 wrote to memory of 1360 1512 thnntn.exe 42 PID 1512 wrote to memory of 1360 1512 thnntn.exe 42 PID 1512 wrote to memory of 1360 1512 thnntn.exe 42 PID 1360 wrote to memory of 2936 1360 rrflrrr.exe 43 PID 1360 wrote to memory of 2936 1360 rrflrrr.exe 43 PID 1360 wrote to memory of 2936 1360 rrflrrr.exe 43 PID 1360 wrote to memory of 2936 1360 rrflrrr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05.exe"C:\Users\Admin\AppData\Local\Temp\4788db99955c046f7c91beb1dd09e5c378f1d4681219a5e16121880a186c1f05.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\vdvvp.exec:\vdvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\dpdvv.exec:\dpdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\lfrllll.exec:\lfrllll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\dvppv.exec:\dvppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\nthhhb.exec:\nthhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\vpvvp.exec:\vpvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\fflxrfx.exec:\fflxrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\thnhbb.exec:\thnhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\7ffllrl.exec:\7ffllrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\tnnbnb.exec:\tnnbnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\vdjvp.exec:\vdjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\nbnttb.exec:\nbnttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\fxllrxf.exec:\fxllrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\thnntn.exec:\thnntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\rrflrrr.exec:\rrflrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\nnhtbt.exec:\nnhtbt.exe17⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hbhbbt.exec:\hbhbbt.exe18⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jvppp.exec:\jvppp.exe19⤵
- Executes dropped EXE
PID:1868 -
\??\c:\hnttnn.exec:\hnttnn.exe20⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rfrllll.exec:\rfrllll.exe21⤵
- Executes dropped EXE
PID:1180 -
\??\c:\hbbbhh.exec:\hbbbhh.exe22⤵
- Executes dropped EXE
PID:2348 -
\??\c:\7frffxf.exec:\7frffxf.exe23⤵
- Executes dropped EXE
PID:340 -
\??\c:\thbnnt.exec:\thbnnt.exe24⤵
- Executes dropped EXE
PID:1708 -
\??\c:\1vdjp.exec:\1vdjp.exe25⤵
- Executes dropped EXE
PID:1100 -
\??\c:\1nhhht.exec:\1nhhht.exe26⤵
- Executes dropped EXE
PID:1248 -
\??\c:\frxrllr.exec:\frxrllr.exe27⤵
- Executes dropped EXE
PID:240 -
\??\c:\nhtttn.exec:\nhtttn.exe28⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xrxllxf.exec:\xrxllxf.exe29⤵
- Executes dropped EXE
PID:2072 -
\??\c:\nhtbbh.exec:\nhtbbh.exe30⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ddppj.exec:\ddppj.exe31⤵
- Executes dropped EXE
PID:2240 -
\??\c:\tntnnh.exec:\tntnnh.exe32⤵
- Executes dropped EXE
PID:880 -
\??\c:\5djjj.exec:\5djjj.exe33⤵
- Executes dropped EXE
PID:2952 -
\??\c:\7rfxlxx.exec:\7rfxlxx.exe34⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jdppv.exec:\jdppv.exe35⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xrflrrf.exec:\xrflrrf.exe36⤵
- Executes dropped EXE
PID:1932 -
\??\c:\bthnhn.exec:\bthnhn.exe37⤵
- Executes dropped EXE
PID:2472 -
\??\c:\pdjjd.exec:\pdjjd.exe38⤵
- Executes dropped EXE
PID:2516 -
\??\c:\3xrxxlx.exec:\3xrxxlx.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\3pjjv.exec:\3pjjv.exe40⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3rlllrx.exec:\3rlllrx.exe41⤵
- Executes dropped EXE
PID:2400 -
\??\c:\bbhnnt.exec:\bbhnnt.exe42⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pjjpp.exec:\pjjpp.exe43⤵
- Executes dropped EXE
PID:2416 -
\??\c:\3ntnht.exec:\3ntnht.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jdppv.exec:\jdppv.exe45⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5hbbbh.exec:\5hbbbh.exe46⤵
- Executes dropped EXE
PID:2016 -
\??\c:\djpdd.exec:\djpdd.exe47⤵
- Executes dropped EXE
PID:2760 -
\??\c:\lxxrllr.exec:\lxxrllr.exe48⤵
- Executes dropped EXE
PID:2756 -
\??\c:\tthhbb.exec:\tthhbb.exe49⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lfrrrrr.exec:\lfrrrrr.exe50⤵
- Executes dropped EXE
PID:1584 -
\??\c:\3btntb.exec:\3btntb.exe51⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jdjjd.exec:\jdjjd.exe52⤵
- Executes dropped EXE
PID:1604 -
\??\c:\llrrxxl.exec:\llrrxxl.exe53⤵
- Executes dropped EXE
PID:2652 -
\??\c:\djdpd.exec:\djdpd.exe54⤵
- Executes dropped EXE
PID:2040 -
\??\c:\5fxffrx.exec:\5fxffrx.exe55⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hnnhbn.exec:\hnnhbn.exe56⤵
- Executes dropped EXE
PID:2056 -
\??\c:\frfxlxr.exec:\frfxlxr.exe57⤵
- Executes dropped EXE
PID:2924 -
\??\c:\1ntbbh.exec:\1ntbbh.exe58⤵
- Executes dropped EXE
PID:1872 -
\??\c:\1lxffff.exec:\1lxffff.exe59⤵
- Executes dropped EXE
PID:584 -
\??\c:\3vvpj.exec:\3vvpj.exe60⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5dpjj.exec:\5dpjj.exe61⤵
- Executes dropped EXE
PID:812 -
\??\c:\hbhhbt.exec:\hbhhbt.exe62⤵
- Executes dropped EXE
PID:648 -
\??\c:\1djdd.exec:\1djdd.exe63⤵
- Executes dropped EXE
PID:340 -
\??\c:\5frrxxx.exec:\5frrxxx.exe64⤵
- Executes dropped EXE
PID:844 -
\??\c:\jvvvd.exec:\jvvvd.exe65⤵
- Executes dropped EXE
PID:2116 -
\??\c:\9fxrrxf.exec:\9fxrrxf.exe66⤵PID:1948
-
\??\c:\tthtbn.exec:\tthtbn.exe67⤵PID:1248
-
\??\c:\lxfrlll.exec:\lxfrlll.exe68⤵PID:1200
-
\??\c:\7lxxlrf.exec:\7lxxlrf.exe69⤵PID:2804
-
\??\c:\ddjpv.exec:\ddjpv.exe70⤵PID:2076
-
\??\c:\7flfxxr.exec:\7flfxxr.exe71⤵PID:2972
-
\??\c:\1pvdv.exec:\1pvdv.exe72⤵PID:884
-
\??\c:\dppdp.exec:\dppdp.exe73⤵PID:1432
-
\??\c:\hbhhhn.exec:\hbhhhn.exe74⤵PID:1956
-
\??\c:\jvpdd.exec:\jvpdd.exe75⤵PID:1960
-
\??\c:\btttbb.exec:\btttbb.exe76⤵PID:1520
-
\??\c:\7dvpd.exec:\7dvpd.exe77⤵PID:2448
-
\??\c:\9frlllr.exec:\9frlllr.exe78⤵PID:1652
-
\??\c:\1vjvv.exec:\1vjvv.exe79⤵PID:2512
-
\??\c:\tbnhnn.exec:\tbnhnn.exe80⤵PID:2592
-
\??\c:\vdpvj.exec:\vdpvj.exe81⤵PID:2500
-
\??\c:\5lrxxxx.exec:\5lrxxxx.exe82⤵PID:2520
-
\??\c:\jjdpp.exec:\jjdpp.exe83⤵PID:2376
-
\??\c:\htthnh.exec:\htthnh.exe84⤵PID:2364
-
\??\c:\3dppj.exec:\3dppj.exe85⤵PID:2440
-
\??\c:\7llrrxx.exec:\7llrrxx.exe86⤵PID:2452
-
\??\c:\jdvjd.exec:\jdvjd.exe87⤵PID:2548
-
\??\c:\lllrlxr.exec:\lllrlxr.exe88⤵PID:2716
-
\??\c:\7bnhnn.exec:\7bnhnn.exe89⤵PID:2740
-
\??\c:\ppjvv.exec:\ppjvv.exe90⤵PID:996
-
\??\c:\5flfxlx.exec:\5flfxlx.exe91⤵PID:1612
-
\??\c:\ttbhht.exec:\ttbhht.exe92⤵PID:1220
-
\??\c:\9rffffl.exec:\9rffffl.exe93⤵PID:2604
-
\??\c:\tnnnhh.exec:\tnnnhh.exe94⤵PID:1444
-
\??\c:\dvddd.exec:\dvddd.exe95⤵PID:2912
-
\??\c:\tnhbbb.exec:\tnhbbb.exe96⤵PID:2040
-
\??\c:\dvddd.exec:\dvddd.exe97⤵PID:2940
-
\??\c:\llxfxrl.exec:\llxfxrl.exe98⤵PID:1676
-
\??\c:\hnhnhn.exec:\hnhnhn.exe99⤵PID:1292
-
\??\c:\dpppj.exec:\dpppj.exe100⤵PID:2344
-
\??\c:\3bhbtn.exec:\3bhbtn.exe101⤵PID:1560
-
\??\c:\nhtbnn.exec:\nhtbnn.exe102⤵PID:2336
-
\??\c:\ffxrxxf.exec:\ffxrxxf.exe103⤵PID:888
-
\??\c:\btnbbh.exec:\btnbbh.exe104⤵PID:3020
-
\??\c:\7dpdd.exec:\7dpdd.exe105⤵PID:1680
-
\??\c:\nhntbh.exec:\nhntbh.exe106⤵PID:1548
-
\??\c:\vpvpp.exec:\vpvpp.exe107⤵PID:1728
-
\??\c:\bntttb.exec:\bntttb.exe108⤵PID:1908
-
\??\c:\vpddd.exec:\vpddd.exe109⤵PID:2832
-
\??\c:\lrflrfl.exec:\lrflrfl.exe110⤵PID:2072
-
\??\c:\jdjpp.exec:\jdjpp.exe111⤵PID:1920
-
\??\c:\rflfffl.exec:\rflfffl.exe112⤵PID:2968
-
\??\c:\jvppp.exec:\jvppp.exe113⤵PID:2860
-
\??\c:\xrffllr.exec:\xrffllr.exe114⤵PID:1428
-
\??\c:\bttbbh.exec:\bttbbh.exe115⤵PID:2636
-
\??\c:\pddpp.exec:\pddpp.exe116⤵PID:1956
-
\??\c:\nbhhnn.exec:\nbhhnn.exe117⤵PID:2468
-
\??\c:\dpvpv.exec:\dpvpv.exe118⤵PID:1520
-
\??\c:\hbhbtn.exec:\hbhbtn.exe119⤵PID:2584
-
\??\c:\dvdvd.exec:\dvdvd.exe120⤵PID:2808
-
\??\c:\dpvvd.exec:\dpvvd.exe121⤵PID:2512
-
\??\c:\lxrrfrx.exec:\lxrrfrx.exe122⤵PID:2420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-