Analysis
-
max time kernel
49s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 20:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66974914a9028ffd691ee8db0742a8fcade7a6b6def94360633e860b2b8170e2.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
66974914a9028ffd691ee8db0742a8fcade7a6b6def94360633e860b2b8170e2.exe
-
Size
257KB
-
MD5
05e4f35911955afea6e4c2b6f348e428
-
SHA1
ceb8209b0f2e88ab8f82ae29df5a2658c6d6ab63
-
SHA256
66974914a9028ffd691ee8db0742a8fcade7a6b6def94360633e860b2b8170e2
-
SHA512
131385ef0c52dcde53d7b05a3e96873f9ee76c003e29cd33a9da7d5f1b3e49a7f0a825b212d2e2a0506c1202d7e4f922fd071d5d90a5e9e70eb6496420fd3f05
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9FrHSwh/c/hdTWG4lmb37K3BoKLbCZ0N:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0N
Malware Config
Signatures
-
Detect Blackmoon payload 33 IoCs
resource yara_rule behavioral1/memory/2152-2-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1136-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/920-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/472-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-383-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-392-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-432-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-468-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-498-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-521-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1280-537-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-574-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-633-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-765-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 60 IoCs
resource yara_rule behavioral1/memory/2152-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2956-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3068-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2288-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2444-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1756-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2452-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2992-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1868-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2948-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2692-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2412-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1512-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1512-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1780-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/588-210-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2036-219-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1136-229-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2044-240-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/920-269-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/472-279-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2360-288-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/884-298-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2952-316-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2020-332-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2584-347-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2596-362-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1756-383-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3052-392-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2848-407-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3004-422-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1840-432-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2796-452-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2060-467-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2060-468-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1228-483-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/324-498-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/808-513-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/900-521-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1280-537-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/956-558-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1784-573-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1784-574-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2204-589-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1304-604-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2308-633-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-648-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2624-663-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2500-678-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1436-693-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1636-708-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2808-765-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/324-794-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1852-809-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1152-824-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2132-839-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1956-854-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/704-869-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/992-884-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2956 7rxfflr.exe 3068 vvdjj.exe 2288 3bntth.exe 2648 jjppj.exe 2444 bbntbh.exe 1756 7vpvj.exe 2604 rfxxxfl.exe 2452 ddvpj.exe 2992 rlxfflf.exe 1868 7jvdd.exe 2948 lxlflll.exe 3020 ppdjp.exe 2332 btbbnh.exe 2324 pdpvv.exe 2692 htnntn.exe 2724 5pddd.exe 2412 lfllxxf.exe 1512 jdjdd.exe 1780 fxlxllr.exe 596 pdjvv.exe 588 7bhnth.exe 2036 fxrrfxf.exe 1136 btbbhb.exe 2044 lxllllx.exe 956 jjvdj.exe 2252 tnbbhn.exe 920 pjdpd.exe 472 tthnbh.exe 2360 lxlrxxf.exe 884 bhnbnb.exe 888 lflrxfl.exe 2952 nhntbb.exe 1632 llrxllf.exe 2020 dpdjp.exe 3068 5bnttb.exe 2584 1jjpp.exe 2092 7nnntt.exe 2596 xxfrxfr.exe 2300 tnhnnn.exe 1756 rlrxffl.exe 2480 ttnnbt.exe 3052 xrrrflx.exe 2996 btntbh.exe 2848 xrflxrx.exe 2984 htbnhb.exe 3004 3lffrrx.exe 1840 nhtbnn.exe 2672 7rflxfl.exe 552 nnhbbt.exe 2796 rlfflrl.exe 2800 bthnnh.exe 2060 llfffrf.exe 1352 tnttbt.exe 1228 9pdpd.exe 324 3bntbb.exe 1644 vpdjv.exe 1856 nhtthh.exe 808 frxxfxl.exe 900 nnnhtt.exe 1048 lxrfrxr.exe 1280 tnttbh.exe 1612 pvvjp.exe 1888 btbbhn.exe 956 fflrffr.exe -
resource yara_rule behavioral1/memory/2152-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1136-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/920-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/472-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-332-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-362-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-383-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-392-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-407-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-422-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-432-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-467-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-468-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1228-483-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-498-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-513-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-521-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-537-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-558-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-573-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-574-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-589-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1304-604-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-633-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-648-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-663-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-678-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-693-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-708-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-765-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-794-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-809-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-824-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-839-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-854-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/704-869-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-884-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2152 wrote to memory of 2956 2152 66974914a9028ffd691ee8db0742a8fcade7a6b6def94360633e860b2b8170e2.exe 28 PID 2152 wrote to memory of 2956 2152 66974914a9028ffd691ee8db0742a8fcade7a6b6def94360633e860b2b8170e2.exe 28 PID 2152 wrote to memory of 2956 2152 66974914a9028ffd691ee8db0742a8fcade7a6b6def94360633e860b2b8170e2.exe 28 PID 2152 wrote to memory of 2956 2152 66974914a9028ffd691ee8db0742a8fcade7a6b6def94360633e860b2b8170e2.exe 28 PID 2956 wrote to memory of 3068 2956 7rxfflr.exe 29 PID 2956 wrote to memory of 3068 2956 7rxfflr.exe 29 PID 2956 wrote to memory of 3068 2956 7rxfflr.exe 29 PID 2956 wrote to memory of 3068 2956 7rxfflr.exe 29 PID 3068 wrote to memory of 2288 3068 vvdjj.exe 30 PID 3068 wrote to memory of 2288 3068 vvdjj.exe 30 PID 3068 wrote to memory of 2288 3068 vvdjj.exe 30 PID 3068 wrote to memory of 2288 3068 vvdjj.exe 30 PID 2288 wrote to memory of 2648 2288 3bntth.exe 31 PID 2288 wrote to memory of 2648 2288 3bntth.exe 31 PID 2288 wrote to memory of 2648 2288 3bntth.exe 31 PID 2288 wrote to memory of 2648 2288 3bntth.exe 31 PID 2648 wrote to memory of 2444 2648 jjppj.exe 32 PID 2648 wrote to memory of 2444 2648 jjppj.exe 32 PID 2648 wrote to memory of 2444 2648 jjppj.exe 32 PID 2648 wrote to memory of 2444 2648 jjppj.exe 32 PID 2444 wrote to memory of 1756 2444 bbntbh.exe 33 PID 2444 wrote to memory of 1756 2444 bbntbh.exe 33 PID 2444 wrote to memory of 1756 2444 bbntbh.exe 33 PID 2444 wrote to memory of 1756 2444 bbntbh.exe 33 PID 1756 wrote to memory of 2604 1756 7vpvj.exe 34 PID 1756 wrote to memory of 2604 1756 7vpvj.exe 34 PID 1756 wrote to memory of 2604 1756 7vpvj.exe 34 PID 1756 wrote to memory of 2604 1756 7vpvj.exe 34 PID 2604 wrote to memory of 2452 2604 rfxxxfl.exe 35 PID 2604 wrote to memory of 2452 2604 rfxxxfl.exe 35 PID 2604 wrote to memory of 2452 2604 rfxxxfl.exe 35 PID 2604 wrote to memory of 2452 2604 rfxxxfl.exe 35 PID 2452 wrote to memory of 2992 2452 ddvpj.exe 36 PID 2452 wrote to memory of 2992 2452 ddvpj.exe 36 PID 2452 wrote to memory of 2992 2452 ddvpj.exe 36 PID 2452 wrote to memory of 2992 2452 ddvpj.exe 36 PID 2992 wrote to memory of 1868 2992 rlxfflf.exe 37 PID 2992 wrote to memory of 1868 2992 rlxfflf.exe 37 PID 2992 wrote to memory of 1868 2992 rlxfflf.exe 37 PID 2992 wrote to memory of 1868 2992 rlxfflf.exe 37 PID 1868 wrote to memory of 2948 1868 7jvdd.exe 38 PID 1868 wrote to memory of 2948 1868 7jvdd.exe 38 PID 1868 wrote to memory of 2948 1868 7jvdd.exe 38 PID 1868 wrote to memory of 2948 1868 7jvdd.exe 38 PID 2948 wrote to memory of 3020 2948 lxlflll.exe 39 PID 2948 wrote to memory of 3020 2948 lxlflll.exe 39 PID 2948 wrote to memory of 3020 2948 lxlflll.exe 39 PID 2948 wrote to memory of 3020 2948 lxlflll.exe 39 PID 3020 wrote to memory of 2332 3020 ppdjp.exe 40 PID 3020 wrote to memory of 2332 3020 ppdjp.exe 40 PID 3020 wrote to memory of 2332 3020 ppdjp.exe 40 PID 3020 wrote to memory of 2332 3020 ppdjp.exe 40 PID 2332 wrote to memory of 2324 2332 btbbnh.exe 41 PID 2332 wrote to memory of 2324 2332 btbbnh.exe 41 PID 2332 wrote to memory of 2324 2332 btbbnh.exe 41 PID 2332 wrote to memory of 2324 2332 btbbnh.exe 41 PID 2324 wrote to memory of 2692 2324 pdpvv.exe 42 PID 2324 wrote to memory of 2692 2324 pdpvv.exe 42 PID 2324 wrote to memory of 2692 2324 pdpvv.exe 42 PID 2324 wrote to memory of 2692 2324 pdpvv.exe 42 PID 2692 wrote to memory of 2724 2692 htnntn.exe 43 PID 2692 wrote to memory of 2724 2692 htnntn.exe 43 PID 2692 wrote to memory of 2724 2692 htnntn.exe 43 PID 2692 wrote to memory of 2724 2692 htnntn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\66974914a9028ffd691ee8db0742a8fcade7a6b6def94360633e860b2b8170e2.exe"C:\Users\Admin\AppData\Local\Temp\66974914a9028ffd691ee8db0742a8fcade7a6b6def94360633e860b2b8170e2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\7rxfflr.exec:\7rxfflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\vvdjj.exec:\vvdjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\3bntth.exec:\3bntth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\jjppj.exec:\jjppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\bbntbh.exec:\bbntbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\7vpvj.exec:\7vpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\rfxxxfl.exec:\rfxxxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\ddvpj.exec:\ddvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\rlxfflf.exec:\rlxfflf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\7jvdd.exec:\7jvdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\lxlflll.exec:\lxlflll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\ppdjp.exec:\ppdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\btbbnh.exec:\btbbnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\pdpvv.exec:\pdpvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\htnntn.exec:\htnntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\5pddd.exec:\5pddd.exe17⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lfllxxf.exec:\lfllxxf.exe18⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jdjdd.exec:\jdjdd.exe19⤵
- Executes dropped EXE
PID:1512 -
\??\c:\fxlxllr.exec:\fxlxllr.exe20⤵
- Executes dropped EXE
PID:1780 -
\??\c:\pdjvv.exec:\pdjvv.exe21⤵
- Executes dropped EXE
PID:596 -
\??\c:\7bhnth.exec:\7bhnth.exe22⤵
- Executes dropped EXE
PID:588 -
\??\c:\fxrrfxf.exec:\fxrrfxf.exe23⤵
- Executes dropped EXE
PID:2036 -
\??\c:\btbbhb.exec:\btbbhb.exe24⤵
- Executes dropped EXE
PID:1136 -
\??\c:\lxllllx.exec:\lxllllx.exe25⤵
- Executes dropped EXE
PID:2044 -
\??\c:\jjvdj.exec:\jjvdj.exe26⤵
- Executes dropped EXE
PID:956 -
\??\c:\tnbbhn.exec:\tnbbhn.exe27⤵
- Executes dropped EXE
PID:2252 -
\??\c:\pjdpd.exec:\pjdpd.exe28⤵
- Executes dropped EXE
PID:920 -
\??\c:\tthnbh.exec:\tthnbh.exe29⤵
- Executes dropped EXE
PID:472 -
\??\c:\lxlrxxf.exec:\lxlrxxf.exe30⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bhnbnb.exec:\bhnbnb.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\lflrxfl.exec:\lflrxfl.exe32⤵
- Executes dropped EXE
PID:888 -
\??\c:\nhntbb.exec:\nhntbb.exe33⤵
- Executes dropped EXE
PID:2952 -
\??\c:\llrxllf.exec:\llrxllf.exe34⤵
- Executes dropped EXE
PID:1632 -
\??\c:\dpdjp.exec:\dpdjp.exe35⤵
- Executes dropped EXE
PID:2020 -
\??\c:\5bnttb.exec:\5bnttb.exe36⤵
- Executes dropped EXE
PID:3068 -
\??\c:\1jjpp.exec:\1jjpp.exe37⤵
- Executes dropped EXE
PID:2584 -
\??\c:\7nnntt.exec:\7nnntt.exe38⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xxfrxfr.exec:\xxfrxfr.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\tnhnnn.exec:\tnhnnn.exe40⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rlrxffl.exec:\rlrxffl.exe41⤵
- Executes dropped EXE
PID:1756 -
\??\c:\ttnnbt.exec:\ttnnbt.exe42⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xrrrflx.exec:\xrrrflx.exe43⤵
- Executes dropped EXE
PID:3052 -
\??\c:\btntbh.exec:\btntbh.exe44⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xrflxrx.exec:\xrflxrx.exe45⤵
- Executes dropped EXE
PID:2848 -
\??\c:\htbnhb.exec:\htbnhb.exe46⤵
- Executes dropped EXE
PID:2984 -
\??\c:\3lffrrx.exec:\3lffrrx.exe47⤵
- Executes dropped EXE
PID:3004 -
\??\c:\nhtbnn.exec:\nhtbnn.exe48⤵
- Executes dropped EXE
PID:1840 -
\??\c:\7rflxfl.exec:\7rflxfl.exe49⤵
- Executes dropped EXE
PID:2672 -
\??\c:\nnhbbt.exec:\nnhbbt.exe50⤵
- Executes dropped EXE
PID:552 -
\??\c:\rlfflrl.exec:\rlfflrl.exe51⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bthnnh.exec:\bthnnh.exe52⤵
- Executes dropped EXE
PID:2800 -
\??\c:\llfffrf.exec:\llfffrf.exe53⤵
- Executes dropped EXE
PID:2060 -
\??\c:\tnttbt.exec:\tnttbt.exe54⤵
- Executes dropped EXE
PID:1352 -
\??\c:\9pdpd.exec:\9pdpd.exe55⤵
- Executes dropped EXE
PID:1228 -
\??\c:\3bntbb.exec:\3bntbb.exe56⤵
- Executes dropped EXE
PID:324 -
\??\c:\vpdjv.exec:\vpdjv.exe57⤵
- Executes dropped EXE
PID:1644 -
\??\c:\nhtthh.exec:\nhtthh.exe58⤵
- Executes dropped EXE
PID:1856 -
\??\c:\frxxfxl.exec:\frxxfxl.exe59⤵
- Executes dropped EXE
PID:808 -
\??\c:\nnnhtt.exec:\nnnhtt.exe60⤵
- Executes dropped EXE
PID:900 -
\??\c:\lxrfrxr.exec:\lxrfrxr.exe61⤵
- Executes dropped EXE
PID:1048 -
\??\c:\tnttbh.exec:\tnttbh.exe62⤵
- Executes dropped EXE
PID:1280 -
\??\c:\pvvjp.exec:\pvvjp.exe63⤵
- Executes dropped EXE
PID:1612 -
\??\c:\btbbhn.exec:\btbbhn.exe64⤵
- Executes dropped EXE
PID:1888 -
\??\c:\fflrffr.exec:\fflrffr.exe65⤵
- Executes dropped EXE
PID:956 -
\??\c:\9nhntt.exec:\9nhntt.exe66⤵PID:2316
-
\??\c:\fxrflfr.exec:\fxrflfr.exe67⤵PID:1784
-
\??\c:\htbbhn.exec:\htbbhn.exe68⤵PID:764
-
\??\c:\ppddp.exec:\ppddp.exe69⤵PID:2204
-
\??\c:\rrlrflr.exec:\rrlrflr.exe70⤵PID:1312
-
\??\c:\9xllrxf.exec:\9xllrxf.exe71⤵PID:1304
-
\??\c:\ntnbnt.exec:\ntnbnt.exe72⤵PID:1948
-
\??\c:\xxlrflx.exec:\xxlrflx.exe73⤵PID:2652
-
\??\c:\9bnthn.exec:\9bnthn.exe74⤵PID:2308
-
\??\c:\pjddj.exec:\pjddj.exe75⤵PID:2040
-
\??\c:\5ttbnt.exec:\5ttbnt.exe76⤵PID:2904
-
\??\c:\vjppp.exec:\vjppp.exe77⤵PID:2592
-
\??\c:\5nhbnn.exec:\5nhbnn.exe78⤵PID:2804
-
\??\c:\5vjpv.exec:\5vjpv.exe79⤵PID:2624
-
\??\c:\hbthth.exec:\hbthth.exe80⤵PID:2656
-
\??\c:\pjdpd.exec:\pjdpd.exe81⤵PID:2500
-
\??\c:\tntttb.exec:\tntttb.exe82⤵PID:3000
-
\??\c:\frxlrxl.exec:\frxlrxl.exe83⤵PID:1436
-
\??\c:\tnhbbt.exec:\tnhbbt.exe84⤵PID:2992
-
\??\c:\7xlllff.exec:\7xlllff.exe85⤵PID:1636
-
\??\c:\nhhbbt.exec:\nhhbbt.exe86⤵PID:2768
-
\??\c:\rlxlllr.exec:\rlxlllr.exe87⤵PID:3012
-
\??\c:\tnnbhn.exec:\tnnbhn.exe88⤵PID:3028
-
\??\c:\lxxflxl.exec:\lxxflxl.exe89⤵PID:2332
-
\??\c:\htntnt.exec:\htntnt.exe90⤵PID:2684
-
\??\c:\rxrrlrl.exec:\rxrrlrl.exe91⤵PID:2688
-
\??\c:\hbhbbn.exec:\hbhbbn.exe92⤵PID:2836
-
\??\c:\9pddj.exec:\9pddj.exe93⤵PID:2808
-
\??\c:\rllfflr.exec:\rllfflr.exe94⤵PID:2412
-
\??\c:\hthhtb.exec:\hthhtb.exe95⤵PID:1352
-
\??\c:\frfxxrr.exec:\frfxxrr.exe96⤵PID:1128
-
\??\c:\hbbnhh.exec:\hbbnhh.exe97⤵PID:324
-
\??\c:\lfrllfl.exec:\lfrllfl.exe98⤵PID:1056
-
\??\c:\3bnnbh.exec:\3bnnbh.exe99⤵PID:1852
-
\??\c:\lfxxlrx.exec:\lfxxlrx.exe100⤵PID:2408
-
\??\c:\1nhbtb.exec:\1nhbtb.exe101⤵PID:1152
-
\??\c:\7frrlrr.exec:\7frrlrr.exe102⤵PID:700
-
\??\c:\tnbnbh.exec:\tnbnbh.exe103⤵PID:2132
-
\??\c:\1lrlffl.exec:\1lrlffl.exe104⤵PID:2340
-
\??\c:\tnttht.exec:\tnttht.exe105⤵PID:1956
-
\??\c:\lxlxxfr.exec:\lxlxxfr.exe106⤵PID:768
-
\??\c:\nbnhnt.exec:\nbnhnt.exe107⤵PID:704
-
\??\c:\dvdpv.exec:\dvdpv.exe108⤵PID:612
-
\??\c:\nnnbnb.exec:\nnnbnb.exe109⤵PID:992
-
\??\c:\7djpv.exec:\7djpv.exe110⤵PID:2204
-
\??\c:\thtbhn.exec:\thtbhn.exe111⤵PID:1800
-
\??\c:\dpvjj.exec:\dpvjj.exe112⤵PID:1600
-
\??\c:\1lxrrfl.exec:\1lxrrfl.exe113⤵PID:2248
-
\??\c:\9vpvd.exec:\9vpvd.exe114⤵PID:1032
-
\??\c:\1lflllx.exec:\1lflllx.exe115⤵PID:2032
-
\??\c:\dpdpv.exec:\dpdpv.exe116⤵PID:2308
-
\??\c:\3lrlrlx.exec:\3lrlrlx.exe117⤵PID:3068
-
\??\c:\jdvdj.exec:\jdvdj.exe118⤵PID:2736
-
\??\c:\1xllllr.exec:\1xllllr.exe119⤵PID:2592
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe120⤵PID:2460
-
\??\c:\jdppd.exec:\jdppd.exe121⤵PID:2436
-
\??\c:\9rfflfx.exec:\9rfflfx.exe122⤵PID:2560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-