Analysis
-
max time kernel
129s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16/04/2024, 03:14
Behavioral task
behavioral1
Sample
ec4b5e48d83a3d3aab124272a2f95f69236c0196246bff691c8df95cbb65052b.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
ec4b5e48d83a3d3aab124272a2f95f69236c0196246bff691c8df95cbb65052b.exe
-
Size
60KB
-
MD5
45e2907c9fe57e4e57361e72bebb387d
-
SHA1
2eb2241e0ff8ec6725fd851a7912ec4f552c4070
-
SHA256
ec4b5e48d83a3d3aab124272a2f95f69236c0196246bff691c8df95cbb65052b
-
SHA512
609bc06c4b3706cfa751ea389059ef47f7154b3e15da9b1a5b42ba70cb988dacd561591c91b8d40dd830ebdb2c42991a78f040029a87a979070b3134987a8252
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+EMdbr:zhOmTsF93UYfwC6GIoutiTWMdbr
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2936-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/940-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/704-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-286-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1584-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/808-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1616-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/944-453-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/700-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1452-519-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-669-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2936-1-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0009000000015b6f-5.dat UPX behavioral1/memory/2792-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000a000000015c52-14.dat UPX behavioral1/memory/2800-15-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2800-19-0x0000000000220000-0x0000000000247000-memory.dmp UPX behavioral1/files/0x0009000000015cfe-23.dat UPX behavioral1/memory/2920-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2540-35-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015d27-33.dat UPX behavioral1/files/0x000a000000015d31-40.dat UPX behavioral1/memory/2920-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0009000000015d98-48.dat UPX behavioral1/memory/2564-49-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0008000000015df1-56.dat UPX behavioral1/memory/2660-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015f01-63.dat UPX behavioral1/files/0x0007000000015f7a-69.dat UPX behavioral1/memory/2472-71-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2488-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00070000000160af-79.dat UPX behavioral1/files/0x0007000000016176-86.dat UPX behavioral1/memory/2464-87-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2748-89-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016287-95.dat UPX behavioral1/files/0x0006000000016448-104.dat UPX behavioral1/memory/2900-103-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000600000001650c-112.dat UPX behavioral1/memory/1748-114-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000165ae-119.dat UPX behavioral1/memory/940-110-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2004-126-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016a29-134.dat UPX behavioral1/files/0x00060000000167d5-128.dat UPX behavioral1/files/0x0006000000016be2-141.dat UPX behavioral1/files/0x0006000000016bfb-148.dat UPX behavioral1/memory/1728-149-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016c04-157.dat UPX behavioral1/files/0x0006000000016c51-164.dat UPX behavioral1/memory/320-165-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016c7c-173.dat UPX behavioral1/files/0x0006000000016ca5-180.dat UPX behavioral1/memory/2736-181-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1872-183-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016cb6-189.dat UPX behavioral1/files/0x0006000000016cbe-196.dat UPX behavioral1/memory/704-204-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2396-211-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016cc6-205.dat UPX behavioral1/memory/1728-215-0x0000000000220000-0x0000000000247000-memory.dmp UPX behavioral1/files/0x0006000000016d16-213.dat UPX behavioral1/files/0x0006000000016d1a-221.dat UPX behavioral1/files/0x0006000000016d3e-227.dat UPX behavioral1/files/0x0006000000016d51-234.dat UPX behavioral1/files/0x0006000000016d57-241.dat UPX behavioral1/memory/2312-245-0x0000000000220000-0x0000000000247000-memory.dmp UPX behavioral1/files/0x0006000000016e24-249.dat UPX behavioral1/memory/1732-271-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1732-277-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1716-293-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1584-292-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2268-299-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2668-320-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2564-326-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2792 btbhth.exe 2800 9pdjj.exe 2920 1lrllff.exe 2540 tbhnnh.exe 2660 thnnnh.exe 2564 3vdvp.exe 2696 vpvjd.exe 2472 7flffxr.exe 2488 tbhbnh.exe 2464 nbhbtn.exe 2748 pdjjj.exe 2900 jpvvp.exe 940 1lxrfxx.exe 1748 1btnnt.exe 2004 bhnnbt.exe 948 vjddp.exe 2344 jvvvp.exe 1728 5fxrrll.exe 2180 flrrrrr.exe 320 3bhnhh.exe 2876 tnbttn.exe 2736 jppvd.exe 1872 rrffxxl.exe 2136 rxfflfx.exe 704 htnbtt.exe 2396 nbbthh.exe 2340 jvdjp.exe 340 5vjpp.exe 1876 3lxlfff.exe 1812 xffllll.exe 2312 nhhhnt.exe 2064 dpjjp.exe 3056 frrllff.exe 2412 llxfflf.exe 2996 btbthb.exe 1732 htbbbb.exe 2208 5pvvd.exe 1716 djdjp.exe 1588 frlrfff.exe 2268 9pvdj.exe 2848 pdjvd.exe 2744 xlfxxrr.exe 2540 lrflxrr.exe 2668 3htttt.exe 2564 1bttbn.exe 2704 pvjdj.exe 2680 7dppj.exe 2616 pvddj.exe 2604 rfxflff.exe 2188 rxffrfr.exe 2752 htbbtt.exe 2480 3tbnhb.exe 2484 vjpjd.exe 2024 vpjvv.exe 2288 rfrrlfr.exe 940 lfxrrrx.exe 2040 thbhbb.exe 1980 7bttbt.exe 944 hbttnh.exe 1180 pdjjd.exe 1752 3vvvd.exe 808 frffxxr.exe 1728 fxflxxl.exe 1616 vvppj.exe -
resource yara_rule behavioral1/memory/2936-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015b6f-5.dat upx behavioral1/memory/2792-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000015c52-14.dat upx behavioral1/memory/2800-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-19-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0009000000015cfe-23.dat upx behavioral1/memory/2920-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2540-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d27-33.dat upx behavioral1/files/0x000a000000015d31-40.dat upx behavioral1/memory/2920-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015d98-48.dat upx behavioral1/memory/2564-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015df1-56.dat upx behavioral1/memory/2660-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f01-63.dat upx behavioral1/files/0x0007000000015f7a-69.dat upx behavioral1/memory/2472-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2488-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000160af-79.dat upx behavioral1/files/0x0007000000016176-86.dat upx behavioral1/memory/2464-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2748-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016287-95.dat upx behavioral1/files/0x0006000000016448-104.dat upx behavioral1/memory/2900-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001650c-112.dat upx behavioral1/memory/1748-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000165ae-119.dat upx behavioral1/memory/940-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2004-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016a29-134.dat upx behavioral1/files/0x00060000000167d5-128.dat upx behavioral1/files/0x0006000000016be2-141.dat upx behavioral1/files/0x0006000000016bfb-148.dat upx behavioral1/memory/1728-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c04-157.dat upx behavioral1/files/0x0006000000016c51-164.dat upx behavioral1/memory/320-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c7c-173.dat upx behavioral1/files/0x0006000000016ca5-180.dat upx behavioral1/memory/2736-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1872-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cb6-189.dat upx behavioral1/files/0x0006000000016cbe-196.dat upx behavioral1/memory/704-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2396-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cc6-205.dat upx behavioral1/memory/1728-215-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000016d16-213.dat upx behavioral1/files/0x0006000000016d1a-221.dat upx behavioral1/files/0x0006000000016d3e-227.dat upx behavioral1/files/0x0006000000016d51-234.dat upx behavioral1/files/0x0006000000016d57-241.dat upx behavioral1/memory/2312-245-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000016e24-249.dat upx behavioral1/memory/1732-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1732-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1716-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1584-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2668-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2564-326-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2792 2936 ec4b5e48d83a3d3aab124272a2f95f69236c0196246bff691c8df95cbb65052b.exe 28 PID 2936 wrote to memory of 2792 2936 ec4b5e48d83a3d3aab124272a2f95f69236c0196246bff691c8df95cbb65052b.exe 28 PID 2936 wrote to memory of 2792 2936 ec4b5e48d83a3d3aab124272a2f95f69236c0196246bff691c8df95cbb65052b.exe 28 PID 2936 wrote to memory of 2792 2936 ec4b5e48d83a3d3aab124272a2f95f69236c0196246bff691c8df95cbb65052b.exe 28 PID 2792 wrote to memory of 2800 2792 btbhth.exe 29 PID 2792 wrote to memory of 2800 2792 btbhth.exe 29 PID 2792 wrote to memory of 2800 2792 btbhth.exe 29 PID 2792 wrote to memory of 2800 2792 btbhth.exe 29 PID 2800 wrote to memory of 2920 2800 9pdjj.exe 30 PID 2800 wrote to memory of 2920 2800 9pdjj.exe 30 PID 2800 wrote to memory of 2920 2800 9pdjj.exe 30 PID 2800 wrote to memory of 2920 2800 9pdjj.exe 30 PID 2920 wrote to memory of 2540 2920 1lrllff.exe 31 PID 2920 wrote to memory of 2540 2920 1lrllff.exe 31 PID 2920 wrote to memory of 2540 2920 1lrllff.exe 31 PID 2920 wrote to memory of 2540 2920 1lrllff.exe 31 PID 2540 wrote to memory of 2660 2540 tbhnnh.exe 32 PID 2540 wrote to memory of 2660 2540 tbhnnh.exe 32 PID 2540 wrote to memory of 2660 2540 tbhnnh.exe 32 PID 2540 wrote to memory of 2660 2540 tbhnnh.exe 32 PID 2660 wrote to memory of 2564 2660 thnnnh.exe 33 PID 2660 wrote to memory of 2564 2660 thnnnh.exe 33 PID 2660 wrote to memory of 2564 2660 thnnnh.exe 33 PID 2660 wrote to memory of 2564 2660 thnnnh.exe 33 PID 2564 wrote to memory of 2696 2564 3vdvp.exe 34 PID 2564 wrote to memory of 2696 2564 3vdvp.exe 34 PID 2564 wrote to memory of 2696 2564 3vdvp.exe 34 PID 2564 wrote to memory of 2696 2564 3vdvp.exe 34 PID 2696 wrote to memory of 2472 2696 vpvjd.exe 35 PID 2696 wrote to memory of 2472 2696 vpvjd.exe 35 PID 2696 wrote to memory of 2472 2696 vpvjd.exe 35 PID 2696 wrote to memory of 2472 2696 vpvjd.exe 35 PID 2472 wrote to memory of 2488 2472 7flffxr.exe 36 PID 2472 wrote to memory of 2488 2472 7flffxr.exe 36 PID 2472 wrote to memory of 2488 2472 7flffxr.exe 36 PID 2472 wrote to memory of 2488 2472 7flffxr.exe 36 PID 2488 wrote to memory of 2464 2488 tbhbnh.exe 37 PID 2488 wrote to memory of 2464 2488 tbhbnh.exe 37 PID 2488 wrote to memory of 2464 2488 tbhbnh.exe 37 PID 2488 wrote to memory of 2464 2488 tbhbnh.exe 37 PID 2464 wrote to memory of 2748 2464 nbhbtn.exe 38 PID 2464 wrote to memory of 2748 2464 nbhbtn.exe 38 PID 2464 wrote to memory of 2748 2464 nbhbtn.exe 38 PID 2464 wrote to memory of 2748 2464 nbhbtn.exe 38 PID 2748 wrote to memory of 2900 2748 pdjjj.exe 39 PID 2748 wrote to memory of 2900 2748 pdjjj.exe 39 PID 2748 wrote to memory of 2900 2748 pdjjj.exe 39 PID 2748 wrote to memory of 2900 2748 pdjjj.exe 39 PID 2900 wrote to memory of 940 2900 jpvvp.exe 40 PID 2900 wrote to memory of 940 2900 jpvvp.exe 40 PID 2900 wrote to memory of 940 2900 jpvvp.exe 40 PID 2900 wrote to memory of 940 2900 jpvvp.exe 40 PID 940 wrote to memory of 1748 940 1lxrfxx.exe 41 PID 940 wrote to memory of 1748 940 1lxrfxx.exe 41 PID 940 wrote to memory of 1748 940 1lxrfxx.exe 41 PID 940 wrote to memory of 1748 940 1lxrfxx.exe 41 PID 1748 wrote to memory of 2004 1748 1btnnt.exe 42 PID 1748 wrote to memory of 2004 1748 1btnnt.exe 42 PID 1748 wrote to memory of 2004 1748 1btnnt.exe 42 PID 1748 wrote to memory of 2004 1748 1btnnt.exe 42 PID 2004 wrote to memory of 948 2004 bhnnbt.exe 43 PID 2004 wrote to memory of 948 2004 bhnnbt.exe 43 PID 2004 wrote to memory of 948 2004 bhnnbt.exe 43 PID 2004 wrote to memory of 948 2004 bhnnbt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec4b5e48d83a3d3aab124272a2f95f69236c0196246bff691c8df95cbb65052b.exe"C:\Users\Admin\AppData\Local\Temp\ec4b5e48d83a3d3aab124272a2f95f69236c0196246bff691c8df95cbb65052b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\btbhth.exec:\btbhth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\9pdjj.exec:\9pdjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\1lrllff.exec:\1lrllff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\tbhnnh.exec:\tbhnnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\thnnnh.exec:\thnnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\3vdvp.exec:\3vdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\vpvjd.exec:\vpvjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\7flffxr.exec:\7flffxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\tbhbnh.exec:\tbhbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\nbhbtn.exec:\nbhbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\pdjjj.exec:\pdjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\jpvvp.exec:\jpvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\1lxrfxx.exec:\1lxrfxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\1btnnt.exec:\1btnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\bhnnbt.exec:\bhnnbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\vjddp.exec:\vjddp.exe17⤵
- Executes dropped EXE
PID:948 -
\??\c:\jvvvp.exec:\jvvvp.exe18⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5fxrrll.exec:\5fxrrll.exe19⤵
- Executes dropped EXE
PID:1728 -
\??\c:\flrrrrr.exec:\flrrrrr.exe20⤵
- Executes dropped EXE
PID:2180 -
\??\c:\3bhnhh.exec:\3bhnhh.exe21⤵
- Executes dropped EXE
PID:320 -
\??\c:\tnbttn.exec:\tnbttn.exe22⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jppvd.exec:\jppvd.exe23⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rrffxxl.exec:\rrffxxl.exe24⤵
- Executes dropped EXE
PID:1872 -
\??\c:\rxfflfx.exec:\rxfflfx.exe25⤵
- Executes dropped EXE
PID:2136 -
\??\c:\htnbtt.exec:\htnbtt.exe26⤵
- Executes dropped EXE
PID:704 -
\??\c:\nbbthh.exec:\nbbthh.exe27⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jvdjp.exec:\jvdjp.exe28⤵
- Executes dropped EXE
PID:2340 -
\??\c:\5vjpp.exec:\5vjpp.exe29⤵
- Executes dropped EXE
PID:340 -
\??\c:\3lxlfff.exec:\3lxlfff.exe30⤵
- Executes dropped EXE
PID:1876 -
\??\c:\xffllll.exec:\xffllll.exe31⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nhhhnt.exec:\nhhhnt.exe32⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dpjjp.exec:\dpjjp.exe33⤵
- Executes dropped EXE
PID:2064 -
\??\c:\frrllff.exec:\frrllff.exe34⤵
- Executes dropped EXE
PID:3056 -
\??\c:\llxfflf.exec:\llxfflf.exe35⤵
- Executes dropped EXE
PID:2412 -
\??\c:\btbthb.exec:\btbthb.exe36⤵
- Executes dropped EXE
PID:2996 -
\??\c:\htbbbb.exec:\htbbbb.exe37⤵
- Executes dropped EXE
PID:1732 -
\??\c:\5pvvd.exec:\5pvvd.exe38⤵
- Executes dropped EXE
PID:2208 -
\??\c:\djdjp.exec:\djdjp.exe39⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xlrfffx.exec:\xlrfffx.exe40⤵PID:1584
-
\??\c:\frlrfff.exec:\frlrfff.exe41⤵
- Executes dropped EXE
PID:1588 -
\??\c:\9pvdj.exec:\9pvdj.exe42⤵
- Executes dropped EXE
PID:2268 -
\??\c:\pdjvd.exec:\pdjvd.exe43⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xlfxxrr.exec:\xlfxxrr.exe44⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lrflxrr.exec:\lrflxrr.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\3htttt.exec:\3htttt.exe46⤵
- Executes dropped EXE
PID:2668 -
\??\c:\1bttbn.exec:\1bttbn.exe47⤵
- Executes dropped EXE
PID:2564 -
\??\c:\pvjdj.exec:\pvjdj.exe48⤵
- Executes dropped EXE
PID:2704 -
\??\c:\7dppj.exec:\7dppj.exe49⤵
- Executes dropped EXE
PID:2680 -
\??\c:\pvddj.exec:\pvddj.exe50⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rfxflff.exec:\rfxflff.exe51⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rxffrfr.exec:\rxffrfr.exe52⤵
- Executes dropped EXE
PID:2188 -
\??\c:\htbbtt.exec:\htbbtt.exe53⤵
- Executes dropped EXE
PID:2752 -
\??\c:\3tbnhb.exec:\3tbnhb.exe54⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vjpjd.exec:\vjpjd.exe55⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vpjvv.exec:\vpjvv.exe56⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rfrrlfr.exec:\rfrrlfr.exe57⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lfxrrrx.exec:\lfxrrrx.exe58⤵
- Executes dropped EXE
PID:940 -
\??\c:\thbhbb.exec:\thbhbb.exe59⤵
- Executes dropped EXE
PID:2040 -
\??\c:\7bttbt.exec:\7bttbt.exe60⤵
- Executes dropped EXE
PID:1980 -
\??\c:\hbttnh.exec:\hbttnh.exe61⤵
- Executes dropped EXE
PID:944 -
\??\c:\pdjjd.exec:\pdjjd.exe62⤵
- Executes dropped EXE
PID:1180 -
\??\c:\3vvvd.exec:\3vvvd.exe63⤵
- Executes dropped EXE
PID:1752 -
\??\c:\frffxxr.exec:\frffxxr.exe64⤵
- Executes dropped EXE
PID:808 -
\??\c:\fxflxxl.exec:\fxflxxl.exe65⤵
- Executes dropped EXE
PID:1728 -
\??\c:\vvppj.exec:\vvppj.exe66⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xlfflff.exec:\xlfflff.exe67⤵PID:2740
-
\??\c:\btnttb.exec:\btnttb.exe68⤵PID:2876
-
\??\c:\3ppjd.exec:\3ppjd.exe69⤵PID:2100
-
\??\c:\jvvvj.exec:\jvvvj.exe70⤵PID:2736
-
\??\c:\3ffxrrr.exec:\3ffxrrr.exe71⤵PID:536
-
\??\c:\fllfxxl.exec:\fllfxxl.exe72⤵PID:1968
-
\??\c:\ththtt.exec:\ththtt.exe73⤵PID:668
-
\??\c:\7htttb.exec:\7htttb.exe74⤵PID:704
-
\??\c:\5tbnnn.exec:\5tbnnn.exe75⤵PID:700
-
\??\c:\9jdpv.exec:\9jdpv.exe76⤵PID:1936
-
\??\c:\9dpvd.exec:\9dpvd.exe77⤵PID:340
-
\??\c:\lfxlrxf.exec:\lfxlrxf.exe78⤵PID:1876
-
\??\c:\rflllfr.exec:\rflllfr.exe79⤵PID:936
-
\??\c:\tnhnbh.exec:\tnhnbh.exe80⤵PID:1792
-
\??\c:\3nbtbt.exec:\3nbtbt.exe81⤵PID:2088
-
\??\c:\pdvdp.exec:\pdvdp.exe82⤵PID:1452
-
\??\c:\pdpvv.exec:\pdpvv.exe83⤵PID:3036
-
\??\c:\flffllr.exec:\flffllr.exe84⤵PID:1864
-
\??\c:\7frxfxx.exec:\7frxfxx.exe85⤵PID:1016
-
\??\c:\7llxxxr.exec:\7llxxxr.exe86⤵PID:2304
-
\??\c:\7nhbhb.exec:\7nhbhb.exe87⤵PID:2976
-
\??\c:\hbtbth.exec:\hbtbth.exe88⤵PID:2296
-
\??\c:\djvpp.exec:\djvpp.exe89⤵PID:1700
-
\??\c:\pdpjp.exec:\pdpjp.exe90⤵PID:2844
-
\??\c:\frfxlll.exec:\frfxlll.exe91⤵PID:2852
-
\??\c:\lrlxfrx.exec:\lrlxfrx.exe92⤵PID:2796
-
\??\c:\thhhtb.exec:\thhhtb.exe93⤵PID:2536
-
\??\c:\nbhnhh.exec:\nbhnhh.exe94⤵PID:2240
-
\??\c:\dpvvj.exec:\dpvvj.exe95⤵PID:2664
-
\??\c:\5pdjp.exec:\5pdjp.exe96⤵PID:2584
-
\??\c:\3pdvv.exec:\3pdvv.exe97⤵PID:2460
-
\??\c:\rfxffxf.exec:\rfxffxf.exe98⤵PID:2760
-
\??\c:\fxfrxxr.exec:\fxfrxxr.exe99⤵PID:2676
-
\??\c:\bnhntt.exec:\bnhntt.exe100⤵PID:2544
-
\??\c:\ttntbn.exec:\ttntbn.exe101⤵PID:2604
-
\??\c:\7djdv.exec:\7djdv.exe102⤵PID:2884
-
\??\c:\vjdpp.exec:\vjdpp.exe103⤵PID:2328
-
\??\c:\3ppdd.exec:\3ppdd.exe104⤵PID:2480
-
\??\c:\5xfrrll.exec:\5xfrrll.exe105⤵PID:2484
-
\??\c:\rllxllx.exec:\rllxllx.exe106⤵PID:1932
-
\??\c:\nbtntb.exec:\nbtntb.exe107⤵PID:1904
-
\??\c:\1bnbhn.exec:\1bnbhn.exe108⤵PID:2020
-
\??\c:\bbtbht.exec:\bbtbht.exe109⤵PID:2004
-
\??\c:\vpdjp.exec:\vpdjp.exe110⤵PID:1980
-
\??\c:\vdjdd.exec:\vdjdd.exe111⤵PID:2408
-
\??\c:\lxrxxxr.exec:\lxrxxxr.exe112⤵PID:2152
-
\??\c:\7lrlrlf.exec:\7lrlrlf.exe113⤵PID:1572
-
\??\c:\1hbhnn.exec:\1hbhnn.exe114⤵PID:1536
-
\??\c:\5bnnhh.exec:\5bnnhh.exe115⤵PID:1668
-
\??\c:\htbnnn.exec:\htbnnn.exe116⤵PID:2756
-
\??\c:\pvpjp.exec:\pvpjp.exe117⤵PID:2984
-
\??\c:\pdjdj.exec:\pdjdj.exe118⤵PID:2764
-
\??\c:\frrrxrx.exec:\frrrxrx.exe119⤵PID:2612
-
\??\c:\3lrlxrl.exec:\3lrlxrl.exe120⤵PID:2880
-
\??\c:\frxffxx.exec:\frxffxx.exe121⤵PID:2056
-
\??\c:\thtthh.exec:\thtthh.exe122⤵PID:1296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-