Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 18:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706.exe
-
Size
140KB
-
MD5
1c841dc0ab74cdc42ddf7fc20143e77e
-
SHA1
de7e0b73392718bd530bd8aa111b5dd7fb0b1be4
-
SHA256
0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706
-
SHA512
0184acf36fc978af27af53704bb1cc9eea0d21f1799ebd6fb37bacb64047fa77669eaf99e38109250059e784e13ce1eada8fe5e8edab1ceaee7a95725578c33a
-
SSDEEP
3072:ymb3NkkiQ3mdBjFomR7UsyJC+n0Gsgyek1w:n3C9BRomRph+0GsgyeYw
Malware Config
Signatures
-
Detect Blackmoon payload 33 IoCs
resource yara_rule behavioral1/memory/2852-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1156-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/960-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/276-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-375-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-382-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-385-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1436-469-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-503-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-546-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-555-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-674-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-770-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-855-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/276-1229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 60 IoCs
resource yara_rule behavioral1/memory/2852-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2856-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2292-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2696-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2688-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2688-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2180-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2280-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2924-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2996-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1240-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1976-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1156-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1716-214-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/960-233-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1520-245-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1884-267-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2392-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/276-315-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2852-321-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1616-329-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1508-344-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2668-352-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2476-360-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2712-375-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2660-382-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2728-384-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2588-393-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2728-385-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3000-408-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2052-416-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2824-424-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1436-469-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1980-503-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1088-546-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1788-555-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2744-674-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2700-696-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2540-704-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/956-727-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1568-770-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1896-855-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2412-884-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1644-899-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2240-914-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1584-929-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2292-958-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2720-966-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2148-974-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2464-989-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2360-1074-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/276-1229-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1508-1265-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1888-1455-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1840-1470-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2320-1478-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/608-1500-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2856 pjvvd.exe 2292 5hntbn.exe 2608 5lrffll.exe 2696 btnbnn.exe 2592 flrlxxf.exe 2728 hbntbh.exe 2688 rxrrrxf.exe 2524 hbhhnn.exe 2180 rlfxxrr.exe 816 1hnhnh.exe 2280 xlxxrll.exe 2536 vjvvp.exe 2924 frflrrx.exe 2996 9vdvv.exe 1660 3xffrrf.exe 2064 dvddd.exe 1240 3thhbb.exe 1976 dvvdp.exe 2724 7nnhhn.exe 1156 fxflxxf.exe 1716 nbnntt.exe 1864 rlfrrfx.exe 960 dvpdj.exe 1360 bnbhht.exe 1520 fxllrfr.exe 1600 nththt.exe 1884 fxrffff.exe 580 hbbhnt.exe 2392 jjdjd.exe 1804 1btttt.exe 1808 vpddd.exe 276 btttbb.exe 2852 7pdvv.exe 1616 lfxxllx.exe 1508 9vjpp.exe 2416 rfrxxxl.exe 2668 pdjjj.exe 2476 frlrlxl.exe 2712 thbhhh.exe 2660 9lxrxxx.exe 2728 5nbbhn.exe 2588 rflffxl.exe 2964 vvdjv.exe 3000 htbbbh.exe 2052 9djdj.exe 2824 bthbhb.exe 2776 jvvdd.exe 1732 xrffllr.exe 2940 7dvvd.exe 2924 fxlxrlf.exe 1560 vpdpv.exe 1436 fxllxxf.exe 1136 9bnntb.exe 2332 nbbttb.exe 320 fxlfllr.exe 1980 jvjpv.exe 1168 tnbbtn.exe 628 3hnttb.exe 2068 fxlrfrr.exe 2296 dpvjv.exe 1912 tntbhh.exe 1088 tbbnbn.exe 2144 pjpvd.exe 1788 vpjjp.exe -
resource yara_rule behavioral1/memory/2852-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1240-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/960-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/276-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-329-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-344-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-375-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-382-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-408-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-424-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-469-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-503-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-546-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-555-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-674-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-696-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-704-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-727-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-770-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-855-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-884-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-899-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-914-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-929-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-958-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-966-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-974-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-989-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-1074-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/276-1229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-1265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-1455-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-1470-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-1478-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/608-1500-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2856 2852 0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706.exe 28 PID 2852 wrote to memory of 2856 2852 0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706.exe 28 PID 2852 wrote to memory of 2856 2852 0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706.exe 28 PID 2852 wrote to memory of 2856 2852 0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706.exe 28 PID 2856 wrote to memory of 2292 2856 pjvvd.exe 29 PID 2856 wrote to memory of 2292 2856 pjvvd.exe 29 PID 2856 wrote to memory of 2292 2856 pjvvd.exe 29 PID 2856 wrote to memory of 2292 2856 pjvvd.exe 29 PID 2292 wrote to memory of 2608 2292 5hntbn.exe 30 PID 2292 wrote to memory of 2608 2292 5hntbn.exe 30 PID 2292 wrote to memory of 2608 2292 5hntbn.exe 30 PID 2292 wrote to memory of 2608 2292 5hntbn.exe 30 PID 2608 wrote to memory of 2696 2608 5lrffll.exe 31 PID 2608 wrote to memory of 2696 2608 5lrffll.exe 31 PID 2608 wrote to memory of 2696 2608 5lrffll.exe 31 PID 2608 wrote to memory of 2696 2608 5lrffll.exe 31 PID 2696 wrote to memory of 2592 2696 btnbnn.exe 32 PID 2696 wrote to memory of 2592 2696 btnbnn.exe 32 PID 2696 wrote to memory of 2592 2696 btnbnn.exe 32 PID 2696 wrote to memory of 2592 2696 btnbnn.exe 32 PID 2592 wrote to memory of 2728 2592 flrlxxf.exe 33 PID 2592 wrote to memory of 2728 2592 flrlxxf.exe 33 PID 2592 wrote to memory of 2728 2592 flrlxxf.exe 33 PID 2592 wrote to memory of 2728 2592 flrlxxf.exe 33 PID 2728 wrote to memory of 2688 2728 hbntbh.exe 34 PID 2728 wrote to memory of 2688 2728 hbntbh.exe 34 PID 2728 wrote to memory of 2688 2728 hbntbh.exe 34 PID 2728 wrote to memory of 2688 2728 hbntbh.exe 34 PID 2688 wrote to memory of 2524 2688 rxrrrxf.exe 35 PID 2688 wrote to memory of 2524 2688 rxrrrxf.exe 35 PID 2688 wrote to memory of 2524 2688 rxrrrxf.exe 35 PID 2688 wrote to memory of 2524 2688 rxrrrxf.exe 35 PID 2524 wrote to memory of 2180 2524 hbhhnn.exe 36 PID 2524 wrote to memory of 2180 2524 hbhhnn.exe 36 PID 2524 wrote to memory of 2180 2524 hbhhnn.exe 36 PID 2524 wrote to memory of 2180 2524 hbhhnn.exe 36 PID 2180 wrote to memory of 816 2180 rlfxxrr.exe 37 PID 2180 wrote to memory of 816 2180 rlfxxrr.exe 37 PID 2180 wrote to memory of 816 2180 rlfxxrr.exe 37 PID 2180 wrote to memory of 816 2180 rlfxxrr.exe 37 PID 816 wrote to memory of 2280 816 1hnhnh.exe 38 PID 816 wrote to memory of 2280 816 1hnhnh.exe 38 PID 816 wrote to memory of 2280 816 1hnhnh.exe 38 PID 816 wrote to memory of 2280 816 1hnhnh.exe 38 PID 2280 wrote to memory of 2536 2280 xlxxrll.exe 39 PID 2280 wrote to memory of 2536 2280 xlxxrll.exe 39 PID 2280 wrote to memory of 2536 2280 xlxxrll.exe 39 PID 2280 wrote to memory of 2536 2280 xlxxrll.exe 39 PID 2536 wrote to memory of 2924 2536 vjvvp.exe 40 PID 2536 wrote to memory of 2924 2536 vjvvp.exe 40 PID 2536 wrote to memory of 2924 2536 vjvvp.exe 40 PID 2536 wrote to memory of 2924 2536 vjvvp.exe 40 PID 2924 wrote to memory of 2996 2924 frflrrx.exe 41 PID 2924 wrote to memory of 2996 2924 frflrrx.exe 41 PID 2924 wrote to memory of 2996 2924 frflrrx.exe 41 PID 2924 wrote to memory of 2996 2924 frflrrx.exe 41 PID 2996 wrote to memory of 1660 2996 9vdvv.exe 42 PID 2996 wrote to memory of 1660 2996 9vdvv.exe 42 PID 2996 wrote to memory of 1660 2996 9vdvv.exe 42 PID 2996 wrote to memory of 1660 2996 9vdvv.exe 42 PID 1660 wrote to memory of 2064 1660 3xffrrf.exe 43 PID 1660 wrote to memory of 2064 1660 3xffrrf.exe 43 PID 1660 wrote to memory of 2064 1660 3xffrrf.exe 43 PID 1660 wrote to memory of 2064 1660 3xffrrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706.exe"C:\Users\Admin\AppData\Local\Temp\0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\pjvvd.exec:\pjvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\5hntbn.exec:\5hntbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\5lrffll.exec:\5lrffll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\btnbnn.exec:\btnbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\flrlxxf.exec:\flrlxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\hbntbh.exec:\hbntbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rxrrrxf.exec:\rxrrrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\hbhhnn.exec:\hbhhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\rlfxxrr.exec:\rlfxxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\1hnhnh.exec:\1hnhnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\xlxxrll.exec:\xlxxrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\vjvvp.exec:\vjvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\frflrrx.exec:\frflrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\9vdvv.exec:\9vdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\3xffrrf.exec:\3xffrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\dvddd.exec:\dvddd.exe17⤵
- Executes dropped EXE
PID:2064 -
\??\c:\3thhbb.exec:\3thhbb.exe18⤵
- Executes dropped EXE
PID:1240 -
\??\c:\dvvdp.exec:\dvvdp.exe19⤵
- Executes dropped EXE
PID:1976 -
\??\c:\7nnhhn.exec:\7nnhhn.exe20⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fxflxxf.exec:\fxflxxf.exe21⤵
- Executes dropped EXE
PID:1156 -
\??\c:\nbnntt.exec:\nbnntt.exe22⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rlfrrfx.exec:\rlfrrfx.exe23⤵
- Executes dropped EXE
PID:1864 -
\??\c:\dvpdj.exec:\dvpdj.exe24⤵
- Executes dropped EXE
PID:960 -
\??\c:\bnbhht.exec:\bnbhht.exe25⤵
- Executes dropped EXE
PID:1360 -
\??\c:\fxllrfr.exec:\fxllrfr.exe26⤵
- Executes dropped EXE
PID:1520 -
\??\c:\nththt.exec:\nththt.exe27⤵
- Executes dropped EXE
PID:1600 -
\??\c:\fxrffff.exec:\fxrffff.exe28⤵
- Executes dropped EXE
PID:1884 -
\??\c:\hbbhnt.exec:\hbbhnt.exe29⤵
- Executes dropped EXE
PID:580 -
\??\c:\jjdjd.exec:\jjdjd.exe30⤵
- Executes dropped EXE
PID:2392 -
\??\c:\1btttt.exec:\1btttt.exe31⤵
- Executes dropped EXE
PID:1804 -
\??\c:\vpddd.exec:\vpddd.exe32⤵
- Executes dropped EXE
PID:1808 -
\??\c:\btttbb.exec:\btttbb.exe33⤵
- Executes dropped EXE
PID:276 -
\??\c:\7pdvv.exec:\7pdvv.exe34⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lfxxllx.exec:\lfxxllx.exe35⤵
- Executes dropped EXE
PID:1616 -
\??\c:\9vjpp.exec:\9vjpp.exe36⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rfrxxxl.exec:\rfrxxxl.exe37⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pdjjj.exec:\pdjjj.exe38⤵
- Executes dropped EXE
PID:2668 -
\??\c:\frlrlxl.exec:\frlrlxl.exe39⤵
- Executes dropped EXE
PID:2476 -
\??\c:\thbhhh.exec:\thbhhh.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\9lxrxxx.exec:\9lxrxxx.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\5nbbhn.exec:\5nbbhn.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rflffxl.exec:\rflffxl.exe43⤵
- Executes dropped EXE
PID:2588 -
\??\c:\vvdjv.exec:\vvdjv.exe44⤵
- Executes dropped EXE
PID:2964 -
\??\c:\htbbbh.exec:\htbbbh.exe45⤵
- Executes dropped EXE
PID:3000 -
\??\c:\9djdj.exec:\9djdj.exe46⤵
- Executes dropped EXE
PID:2052 -
\??\c:\bthbhb.exec:\bthbhb.exe47⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jvvdd.exec:\jvvdd.exe48⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xrffllr.exec:\xrffllr.exe49⤵
- Executes dropped EXE
PID:1732 -
\??\c:\7dvvd.exec:\7dvvd.exe50⤵
- Executes dropped EXE
PID:2940 -
\??\c:\fxlxrlf.exec:\fxlxrlf.exe51⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vpdpv.exec:\vpdpv.exe52⤵
- Executes dropped EXE
PID:1560 -
\??\c:\fxllxxf.exec:\fxllxxf.exe53⤵
- Executes dropped EXE
PID:1436 -
\??\c:\9bnntb.exec:\9bnntb.exe54⤵
- Executes dropped EXE
PID:1136 -
\??\c:\nbbttb.exec:\nbbttb.exe55⤵
- Executes dropped EXE
PID:2332 -
\??\c:\fxlfllr.exec:\fxlfllr.exe56⤵
- Executes dropped EXE
PID:320 -
\??\c:\jvjpv.exec:\jvjpv.exe57⤵
- Executes dropped EXE
PID:1980 -
\??\c:\tnbbtn.exec:\tnbbtn.exe58⤵
- Executes dropped EXE
PID:1168 -
\??\c:\3hnttb.exec:\3hnttb.exe59⤵
- Executes dropped EXE
PID:628 -
\??\c:\fxlrfrr.exec:\fxlrfrr.exe60⤵
- Executes dropped EXE
PID:2068 -
\??\c:\dpvjv.exec:\dpvjv.exe61⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tntbhh.exec:\tntbhh.exe62⤵
- Executes dropped EXE
PID:1912 -
\??\c:\tbbnbn.exec:\tbbnbn.exe63⤵
- Executes dropped EXE
PID:1088 -
\??\c:\pjpvd.exec:\pjpvd.exe64⤵
- Executes dropped EXE
PID:2144 -
\??\c:\vpjjp.exec:\vpjjp.exe65⤵
- Executes dropped EXE
PID:1788 -
\??\c:\3pjpd.exec:\3pjpd.exe66⤵PID:1520
-
\??\c:\rlxxlrr.exec:\rlxxlrr.exe67⤵PID:1600
-
\??\c:\7xrxflx.exec:\7xrxflx.exe68⤵PID:2880
-
\??\c:\vpvvp.exec:\vpvvp.exe69⤵PID:1704
-
\??\c:\tnbbhn.exec:\tnbbhn.exe70⤵PID:2648
-
\??\c:\lfxrxff.exec:\lfxrxff.exe71⤵PID:1492
-
\??\c:\xrflrrr.exec:\xrflrrr.exe72⤵PID:3016
-
\??\c:\dppjj.exec:\dppjj.exe73⤵PID:2000
-
\??\c:\tnbntb.exec:\tnbntb.exe74⤵PID:2752
-
\??\c:\lxxxflx.exec:\lxxxflx.exe75⤵PID:3020
-
\??\c:\jpjvp.exec:\jpjvp.exe76⤵PID:2340
-
\??\c:\jvvpp.exec:\jvvpp.exe77⤵PID:2596
-
\??\c:\nhhntb.exec:\nhhntb.exe78⤵PID:2100
-
\??\c:\xlxfrll.exec:\xlxfrll.exe79⤵PID:2416
-
\??\c:\9vjpv.exec:\9vjpv.exe80⤵PID:2148
-
\??\c:\thtttb.exec:\thtttb.exe81⤵PID:2744
-
\??\c:\bhbbnn.exec:\bhbbnn.exe82⤵PID:2976
-
\??\c:\fxllrfl.exec:\fxllrfl.exe83⤵PID:2532
-
\??\c:\5fflxxf.exec:\5fflxxf.exe84⤵PID:2488
-
\??\c:\3dvpj.exec:\3dvpj.exe85⤵PID:2700
-
\??\c:\fflrxxl.exec:\fflrxxl.exe86⤵PID:2540
-
\??\c:\pvjvp.exec:\pvjvp.exe87⤵PID:2160
-
\??\c:\xxlxlrx.exec:\xxlxlrx.exe88⤵PID:2568
-
\??\c:\pppvj.exec:\pppvj.exe89⤵PID:956
-
\??\c:\frrrxrx.exec:\frrrxrx.exe90⤵PID:2848
-
\??\c:\ttbhtb.exec:\ttbhtb.exe91⤵PID:2980
-
\??\c:\lfffrxl.exec:\lfffrxl.exe92⤵PID:2948
-
\??\c:\nnhbth.exec:\nnhbth.exe93⤵PID:2168
-
\??\c:\7xrxlrf.exec:\7xrxlrf.exe94⤵PID:1568
-
\??\c:\hththn.exec:\hththn.exe95⤵PID:1436
-
\??\c:\vvjjp.exec:\vvjjp.exe96⤵PID:2836
-
\??\c:\rlxfrlf.exec:\rlxfrlf.exe97⤵PID:2332
-
\??\c:\9ppdv.exec:\9ppdv.exe98⤵PID:688
-
\??\c:\rrlxllr.exec:\rrlxllr.exe99⤵PID:1980
-
\??\c:\dpjjv.exec:\dpjjv.exe100⤵PID:112
-
\??\c:\fxlrfrr.exec:\fxlrfrr.exe101⤵PID:1576
-
\??\c:\5vpvd.exec:\5vpvd.exe102⤵PID:1796
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe103⤵PID:1112
-
\??\c:\pjdvj.exec:\pjdvj.exe104⤵PID:1144
-
\??\c:\hbntbb.exec:\hbntbb.exe105⤵PID:2176
-
\??\c:\9pvvv.exec:\9pvvv.exe106⤵PID:1896
-
\??\c:\tnbbbt.exec:\tnbbbt.exe107⤵PID:2252
-
\??\c:\3pjvv.exec:\3pjvv.exe108⤵PID:772
-
\??\c:\xxlxfxl.exec:\xxlxfxl.exe109⤵PID:640
-
\??\c:\jvpvp.exec:\jvpvp.exe110⤵PID:696
-
\??\c:\rlrrrrf.exec:\rlrrrrf.exe111⤵PID:2412
-
\??\c:\bthhtt.exec:\bthhtt.exe112⤵PID:964
-
\??\c:\llrrrfx.exec:\llrrrfx.exe113⤵PID:1644
-
\??\c:\nhntnt.exec:\nhntnt.exe114⤵PID:1492
-
\??\c:\xlxxxff.exec:\xlxxxff.exe115⤵PID:2240
-
\??\c:\tnbbnh.exec:\tnbbnh.exe116⤵PID:1592
-
\??\c:\vpdjj.exec:\vpdjj.exe117⤵PID:1584
-
\??\c:\rfxxxxf.exec:\rfxxxxf.exe118⤵PID:2852
-
\??\c:\pjdjp.exec:\pjdjp.exe119⤵PID:1580
-
\??\c:\5rxrlxf.exec:\5rxrlxf.exe120⤵PID:3064
-
\??\c:\bnnnnb.exec:\bnnnnb.exe121⤵PID:2292
-
\??\c:\dvpvv.exec:\dvpvv.exe122⤵PID:2720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-