Analysis
-
max time kernel
27s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-04-2024 20:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72.exe
-
Size
91KB
-
MD5
b0573313ea87ba4ffa8dbabc73c2ddec
-
SHA1
4d857eb401184bb32e633ad59feca52a887ac997
-
SHA256
28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72
-
SHA512
7c0cb628d1e73edcd21dab9405698081821c99bc75b0d390212b0cfdd72216bf139343e56dd1115be1451341e9b8b8f4d92cfddd630f6abfe1807913e71c7b3c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/21S:ymb3NkkiQ3mdBjFo73PYP1lri3K8GA
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral1/memory/2612-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1184-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/452-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/356-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-409-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-439-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-448-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-482-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-501-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-703-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-835-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 59 IoCs
resource yara_rule behavioral1/memory/2612-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2612-1-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1652-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1184-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2532-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2796-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2556-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2556-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2960-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2192-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2504-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2740-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2032-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1284-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1980-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3016-215-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1656-217-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/452-228-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/812-255-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/356-273-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2076-292-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2076-294-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1800-314-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1040-312-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2500-400-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2500-399-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2264-409-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2724-416-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1944-439-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2200-447-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2200-448-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2272-463-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1808-482-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/536-501-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2464-510-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1324-525-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3048-540-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1552-555-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2144-584-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/472-592-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2948-600-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2068-608-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2580-644-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2884-673-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2756-702-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2756-703-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2900-718-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1628-733-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1440-741-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2112-749-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2084-764-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2276-779-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2044-794-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1496-809-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3068-825-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1768-835-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1252-841-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2172-856-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1652 1rxxxxx.exe 1184 pdjdp.exe 2532 nbnhtn.exe 2796 3xffxxr.exe 2556 9pdpj.exe 2960 jvddj.exe 2192 3lxxlff.exe 2504 xlrrxrf.exe 2264 1dvdd.exe 2740 thnhbt.exe 2864 llfffff.exe 2032 5dvdd.exe 1608 hbnnnb.exe 2496 frrfrxx.exe 1284 3hbnbh.exe 1980 1fxfrlx.exe 2524 7vjvv.exe 1796 7lxlrlr.exe 1744 7tbhbt.exe 1044 fxrxlll.exe 3016 hbnntt.exe 1656 frxlllr.exe 452 7thntb.exe 3040 rrflfrl.exe 1552 nbtttn.exe 812 pvddd.exe 356 ttbnnb.exe 684 dpvpj.exe 780 ntntnn.exe 2076 jdvpp.exe 1040 lxllrxl.exe 1800 5jddp.exe 2340 lfrfxxf.exe 2536 jdpdj.exe 2632 7bhhhb.exe 2788 nbhbnh.exe 1752 rfrrllf.exe 2796 vjpdp.exe 2688 1nnhht.exe 2540 pjvvv.exe 2316 1tnbnn.exe 2892 rlflrrf.exe 2488 7httbt.exe 2500 pjvdj.exe 2264 lfrlrrr.exe 2724 jvdjj.exe 1668 rlxfflx.exe 1944 bhtnbb.exe 2300 jvjdp.exe 2200 httttn.exe 1320 7jvpj.exe 2272 9lxflrf.exe 2276 7pddj.exe 1808 lrrrfll.exe 2044 vvdjv.exe 536 fxffrfl.exe 1496 1tbbhb.exe 2464 llxxxll.exe 1844 jvjvd.exe 1324 flllllf.exe 3044 dpdvd.exe 3048 rfxfrlf.exe 760 1bhbhb.exe 1552 pdpvd.exe -
resource yara_rule behavioral1/memory/2612-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/452-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/356-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-399-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-409-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-439-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-447-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-448-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-463-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-482-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-501-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-510-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1324-525-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-540-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-555-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-584-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/472-592-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-600-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-608-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-644-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-673-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-702-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-703-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-718-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-733-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-741-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-749-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-764-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-779-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-794-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-809-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-825-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-835-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-841-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-856-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2612 wrote to memory of 1652 2612 28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72.exe 28 PID 2612 wrote to memory of 1652 2612 28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72.exe 28 PID 2612 wrote to memory of 1652 2612 28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72.exe 28 PID 2612 wrote to memory of 1652 2612 28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72.exe 28 PID 1652 wrote to memory of 1184 1652 1rxxxxx.exe 29 PID 1652 wrote to memory of 1184 1652 1rxxxxx.exe 29 PID 1652 wrote to memory of 1184 1652 1rxxxxx.exe 29 PID 1652 wrote to memory of 1184 1652 1rxxxxx.exe 29 PID 1184 wrote to memory of 2532 1184 pdjdp.exe 30 PID 1184 wrote to memory of 2532 1184 pdjdp.exe 30 PID 1184 wrote to memory of 2532 1184 pdjdp.exe 30 PID 1184 wrote to memory of 2532 1184 pdjdp.exe 30 PID 2532 wrote to memory of 2796 2532 nbnhtn.exe 31 PID 2532 wrote to memory of 2796 2532 nbnhtn.exe 31 PID 2532 wrote to memory of 2796 2532 nbnhtn.exe 31 PID 2532 wrote to memory of 2796 2532 nbnhtn.exe 31 PID 2796 wrote to memory of 2556 2796 3xffxxr.exe 32 PID 2796 wrote to memory of 2556 2796 3xffxxr.exe 32 PID 2796 wrote to memory of 2556 2796 3xffxxr.exe 32 PID 2796 wrote to memory of 2556 2796 3xffxxr.exe 32 PID 2556 wrote to memory of 2960 2556 9pdpj.exe 33 PID 2556 wrote to memory of 2960 2556 9pdpj.exe 33 PID 2556 wrote to memory of 2960 2556 9pdpj.exe 33 PID 2556 wrote to memory of 2960 2556 9pdpj.exe 33 PID 2960 wrote to memory of 2192 2960 jvddj.exe 34 PID 2960 wrote to memory of 2192 2960 jvddj.exe 34 PID 2960 wrote to memory of 2192 2960 jvddj.exe 34 PID 2960 wrote to memory of 2192 2960 jvddj.exe 34 PID 2192 wrote to memory of 2504 2192 3lxxlff.exe 35 PID 2192 wrote to memory of 2504 2192 3lxxlff.exe 35 PID 2192 wrote to memory of 2504 2192 3lxxlff.exe 35 PID 2192 wrote to memory of 2504 2192 3lxxlff.exe 35 PID 2504 wrote to memory of 2264 2504 xlrrxrf.exe 36 PID 2504 wrote to memory of 2264 2504 xlrrxrf.exe 36 PID 2504 wrote to memory of 2264 2504 xlrrxrf.exe 36 PID 2504 wrote to memory of 2264 2504 xlrrxrf.exe 36 PID 2264 wrote to memory of 2740 2264 1dvdd.exe 37 PID 2264 wrote to memory of 2740 2264 1dvdd.exe 37 PID 2264 wrote to memory of 2740 2264 1dvdd.exe 37 PID 2264 wrote to memory of 2740 2264 1dvdd.exe 37 PID 2740 wrote to memory of 2864 2740 thnhbt.exe 38 PID 2740 wrote to memory of 2864 2740 thnhbt.exe 38 PID 2740 wrote to memory of 2864 2740 thnhbt.exe 38 PID 2740 wrote to memory of 2864 2740 thnhbt.exe 38 PID 2864 wrote to memory of 2032 2864 llfffff.exe 39 PID 2864 wrote to memory of 2032 2864 llfffff.exe 39 PID 2864 wrote to memory of 2032 2864 llfffff.exe 39 PID 2864 wrote to memory of 2032 2864 llfffff.exe 39 PID 2032 wrote to memory of 1608 2032 5dvdd.exe 40 PID 2032 wrote to memory of 1608 2032 5dvdd.exe 40 PID 2032 wrote to memory of 1608 2032 5dvdd.exe 40 PID 2032 wrote to memory of 1608 2032 5dvdd.exe 40 PID 1608 wrote to memory of 2496 1608 hbnnnb.exe 41 PID 1608 wrote to memory of 2496 1608 hbnnnb.exe 41 PID 1608 wrote to memory of 2496 1608 hbnnnb.exe 41 PID 1608 wrote to memory of 2496 1608 hbnnnb.exe 41 PID 2496 wrote to memory of 1284 2496 frrfrxx.exe 42 PID 2496 wrote to memory of 1284 2496 frrfrxx.exe 42 PID 2496 wrote to memory of 1284 2496 frrfrxx.exe 42 PID 2496 wrote to memory of 1284 2496 frrfrxx.exe 42 PID 1284 wrote to memory of 1980 1284 3hbnbh.exe 43 PID 1284 wrote to memory of 1980 1284 3hbnbh.exe 43 PID 1284 wrote to memory of 1980 1284 3hbnbh.exe 43 PID 1284 wrote to memory of 1980 1284 3hbnbh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72.exe"C:\Users\Admin\AppData\Local\Temp\28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\1rxxxxx.exec:\1rxxxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\pdjdp.exec:\pdjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\nbnhtn.exec:\nbnhtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\3xffxxr.exec:\3xffxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\9pdpj.exec:\9pdpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\jvddj.exec:\jvddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\3lxxlff.exec:\3lxxlff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\xlrrxrf.exec:\xlrrxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\1dvdd.exec:\1dvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\thnhbt.exec:\thnhbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\llfffff.exec:\llfffff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\5dvdd.exec:\5dvdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\hbnnnb.exec:\hbnnnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\frrfrxx.exec:\frrfrxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\3hbnbh.exec:\3hbnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\1fxfrlx.exec:\1fxfrlx.exe17⤵
- Executes dropped EXE
PID:1980 -
\??\c:\7vjvv.exec:\7vjvv.exe18⤵
- Executes dropped EXE
PID:2524 -
\??\c:\7lxlrlr.exec:\7lxlrlr.exe19⤵
- Executes dropped EXE
PID:1796 -
\??\c:\7tbhbt.exec:\7tbhbt.exe20⤵
- Executes dropped EXE
PID:1744 -
\??\c:\fxrxlll.exec:\fxrxlll.exe21⤵
- Executes dropped EXE
PID:1044 -
\??\c:\hbnntt.exec:\hbnntt.exe22⤵
- Executes dropped EXE
PID:3016 -
\??\c:\frxlllr.exec:\frxlllr.exe23⤵
- Executes dropped EXE
PID:1656 -
\??\c:\7thntb.exec:\7thntb.exe24⤵
- Executes dropped EXE
PID:452 -
\??\c:\rrflfrl.exec:\rrflfrl.exe25⤵
- Executes dropped EXE
PID:3040 -
\??\c:\nbtttn.exec:\nbtttn.exe26⤵
- Executes dropped EXE
PID:1552 -
\??\c:\pvddd.exec:\pvddd.exe27⤵
- Executes dropped EXE
PID:812 -
\??\c:\ttbnnb.exec:\ttbnnb.exe28⤵
- Executes dropped EXE
PID:356 -
\??\c:\dpvpj.exec:\dpvpj.exe29⤵
- Executes dropped EXE
PID:684 -
\??\c:\ntntnn.exec:\ntntnn.exe30⤵
- Executes dropped EXE
PID:780 -
\??\c:\jdvpp.exec:\jdvpp.exe31⤵
- Executes dropped EXE
PID:2076 -
\??\c:\lxllrxl.exec:\lxllrxl.exe32⤵
- Executes dropped EXE
PID:1040 -
\??\c:\5jddp.exec:\5jddp.exe33⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lfrfxxf.exec:\lfrfxxf.exe34⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jdpdj.exec:\jdpdj.exe35⤵
- Executes dropped EXE
PID:2536 -
\??\c:\7bhhhb.exec:\7bhhhb.exe36⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nbhbnh.exec:\nbhbnh.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rfrrllf.exec:\rfrrllf.exe38⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vjpdp.exec:\vjpdp.exe39⤵
- Executes dropped EXE
PID:2796 -
\??\c:\1nnhht.exec:\1nnhht.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pjvvv.exec:\pjvvv.exe41⤵
- Executes dropped EXE
PID:2540 -
\??\c:\1tnbnn.exec:\1tnbnn.exe42⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rlflrrf.exec:\rlflrrf.exe43⤵
- Executes dropped EXE
PID:2892 -
\??\c:\7httbt.exec:\7httbt.exe44⤵
- Executes dropped EXE
PID:2488 -
\??\c:\pjvdj.exec:\pjvdj.exe45⤵
- Executes dropped EXE
PID:2500 -
\??\c:\lfrlrrr.exec:\lfrlrrr.exe46⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jvdjj.exec:\jvdjj.exe47⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rlxfflx.exec:\rlxfflx.exe48⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bhtnbb.exec:\bhtnbb.exe49⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jvjdp.exec:\jvjdp.exe50⤵
- Executes dropped EXE
PID:2300 -
\??\c:\httttn.exec:\httttn.exe51⤵
- Executes dropped EXE
PID:2200 -
\??\c:\7jvpj.exec:\7jvpj.exe52⤵
- Executes dropped EXE
PID:1320 -
\??\c:\9lxflrf.exec:\9lxflrf.exe53⤵
- Executes dropped EXE
PID:2272 -
\??\c:\7pddj.exec:\7pddj.exe54⤵
- Executes dropped EXE
PID:2276 -
\??\c:\lrrrfll.exec:\lrrrfll.exe55⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vvdjv.exec:\vvdjv.exe56⤵
- Executes dropped EXE
PID:2044 -
\??\c:\fxffrfl.exec:\fxffrfl.exe57⤵
- Executes dropped EXE
PID:536 -
\??\c:\1tbbhb.exec:\1tbbhb.exe58⤵
- Executes dropped EXE
PID:1496 -
\??\c:\llxxxll.exec:\llxxxll.exe59⤵
- Executes dropped EXE
PID:2464 -
\??\c:\jvjvd.exec:\jvjvd.exe60⤵
- Executes dropped EXE
PID:1844 -
\??\c:\flllllf.exec:\flllllf.exe61⤵
- Executes dropped EXE
PID:1324 -
\??\c:\dpdvd.exec:\dpdvd.exe62⤵
- Executes dropped EXE
PID:3044 -
\??\c:\rfxfrlf.exec:\rfxfrlf.exe63⤵
- Executes dropped EXE
PID:3048 -
\??\c:\1bhbhb.exec:\1bhbhb.exe64⤵
- Executes dropped EXE
PID:760 -
\??\c:\pdpvd.exec:\pdpvd.exe65⤵
- Executes dropped EXE
PID:1552 -
\??\c:\fxxflrx.exec:\fxxflrx.exe66⤵PID:872
-
\??\c:\7ttbbt.exec:\7ttbbt.exe67⤵PID:1712
-
\??\c:\tntthn.exec:\tntthn.exe68⤵PID:2092
-
\??\c:\dpdjj.exec:\dpdjj.exe69⤵PID:2144
-
\??\c:\lxlxfxx.exec:\lxlxfxx.exe70⤵PID:472
-
\??\c:\thbbhb.exec:\thbbhb.exe71⤵PID:2948
-
\??\c:\lxffrxx.exec:\lxffrxx.exe72⤵PID:2068
-
\??\c:\3xxxxrx.exec:\3xxxxrx.exe73⤵PID:1800
-
\??\c:\vjjpv.exec:\vjjpv.exe74⤵PID:2984
-
\??\c:\9vjdj.exec:\9vjdj.exe75⤵PID:2572
-
\??\c:\bnbttt.exec:\bnbttt.exe76⤵PID:1572
-
\??\c:\5vjjj.exec:\5vjjj.exe77⤵PID:2580
-
\??\c:\xffxfff.exec:\xffxfff.exe78⤵PID:2552
-
\??\c:\vjvvv.exec:\vjvvv.exe79⤵PID:2728
-
\??\c:\xrffrrr.exec:\xrffrrr.exe80⤵PID:2448
-
\??\c:\5hhhnh.exec:\5hhhnh.exe81⤵PID:2884
-
\??\c:\lrfllfl.exec:\lrfllfl.exe82⤵PID:2960
-
\??\c:\nbnnbt.exec:\nbnnbt.exe83⤵PID:1640
-
\??\c:\7pvdp.exec:\7pvdp.exe84⤵PID:2676
-
\??\c:\thtthh.exec:\thtthh.exe85⤵PID:2756
-
\??\c:\jvjpp.exec:\jvjpp.exe86⤵PID:2868
-
\??\c:\fxfrrrr.exec:\fxfrrrr.exe87⤵PID:2900
-
\??\c:\nbnttn.exec:\nbnttn.exe88⤵PID:1940
-
\??\c:\flrrrrr.exec:\flrrrrr.exe89⤵PID:1628
-
\??\c:\7thhtn.exec:\7thhtn.exe90⤵PID:1440
-
\??\c:\dvjdp.exec:\dvjdp.exe91⤵PID:2112
-
\??\c:\xlffrrx.exec:\xlffrrx.exe92⤵PID:2216
-
\??\c:\pjvvd.exec:\pjvvd.exe93⤵PID:2084
-
\??\c:\fxrfllx.exec:\fxrfllx.exe94⤵PID:1684
-
\??\c:\vvpdp.exec:\vvpdp.exe95⤵PID:2276
-
\??\c:\rlfllxf.exec:\rlfllxf.exe96⤵PID:560
-
\??\c:\bbtnbb.exec:\bbtnbb.exe97⤵PID:2044
-
\??\c:\3fxfrrf.exec:\3fxfrrf.exe98⤵PID:988
-
\??\c:\jvjpv.exec:\jvjpv.exe99⤵PID:1496
-
\??\c:\5xlllfl.exec:\5xlllfl.exe100⤵PID:336
-
\??\c:\dvpdv.exec:\dvpdv.exe101⤵PID:3068
-
\??\c:\7xrxffl.exec:\7xrxffl.exe102⤵PID:1768
-
\??\c:\ppvvp.exec:\ppvvp.exe103⤵PID:1252
-
\??\c:\lfllrrx.exec:\lfllrrx.exe104⤵PID:764
-
\??\c:\7bnthh.exec:\7bnthh.exe105⤵PID:2172
-
\??\c:\frxfxxf.exec:\frxfxxf.exe106⤵PID:320
-
\??\c:\nnnbbn.exec:\nnnbbn.exe107⤵PID:552
-
\??\c:\dpjjv.exec:\dpjjv.exe108⤵PID:2016
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe109⤵PID:604
-
\??\c:\dvdjd.exec:\dvdjd.exe110⤵PID:1676
-
\??\c:\rfrxlrx.exec:\rfrxlrx.exe111⤵PID:2852
-
\??\c:\hbtbbb.exec:\hbtbbb.exe112⤵PID:2288
-
\??\c:\jdpvp.exec:\jdpvp.exe113⤵PID:2116
-
\??\c:\1rflxxl.exec:\1rflxxl.exe114⤵PID:1184
-
\??\c:\jvddd.exec:\jvddd.exe115⤵PID:2584
-
\??\c:\9xrfxfr.exec:\9xrfxfr.exe116⤵PID:2644
-
\??\c:\1htbht.exec:\1htbht.exe117⤵PID:2704
-
\??\c:\9llfllr.exec:\9llfllr.exe118⤵PID:2696
-
\??\c:\httbhh.exec:\httbhh.exe119⤵PID:2600
-
\??\c:\7pjpd.exec:\7pjpd.exe120⤵PID:2480
-
\??\c:\7nbhhn.exec:\7nbhhn.exe121⤵PID:2540
-
\??\c:\dpvvd.exec:\dpvvd.exe122⤵PID:1632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-