Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24-04-2024 23:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a.exe
-
Size
231KB
-
MD5
49d7b57c75c6d10595b8258b5cfc7016
-
SHA1
107cf8a37136e002f796e3b0669cfd9d553877a6
-
SHA256
822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a
-
SHA512
66619d7a1e7c76455694cfd79c3bffc13fa9aea08c25d87fb64bbeff42eb75d7729064ef20e5fb2d4ed2cd546366f1ad602915df685b01f199635f758d77c44a
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIRUohTF/SjSrbzLAuBjfwFOmoFzMvUpGqC5n+M:n3C9BRo/AIuuFSjA8uBjwI7FjpjC5+M
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral1/memory/2884-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/928-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-353-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-393-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-402-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-447-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-499-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/828-500-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/444-515-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-568-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/576-779-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/files/0x00090000000146c0-7.dat UPX behavioral1/memory/2884-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2380-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x00090000000149f5-19.dat UPX behavioral1/files/0x0009000000015018-27.dat UPX behavioral1/memory/3028-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0007000000015605-38.dat UPX behavioral1/memory/2712-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x000a000000015616-49.dat UPX behavioral1/memory/2608-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0009000000015626-59.dat UPX behavioral1/memory/2764-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0009000000015b6f-70.dat UPX behavioral1/files/0x0008000000015c3d-84.dat UPX behavioral1/memory/2516-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0008000000015c52-92.dat UPX behavioral1/files/0x0007000000015c6b-104.dat UPX behavioral1/files/0x0007000000015c78-110.dat UPX behavioral1/files/0x0006000000015c83-119.dat UPX behavioral1/memory/2816-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000015c9f-128.dat UPX behavioral1/files/0x0006000000015cb6-139.dat UPX behavioral1/memory/928-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x00080000000155ed-146.dat UPX behavioral1/files/0x0006000000015cee-166.dat UPX behavioral1/files/0x0006000000015cf6-177.dat UPX behavioral1/files/0x0006000000015cfe-185.dat UPX behavioral1/files/0x0006000000015d07-194.dat UPX behavioral1/memory/2292-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000015d0f-207.dat UPX behavioral1/files/0x0006000000015d1a-214.dat UPX behavioral1/files/0x0006000000015d31-236.dat UPX behavioral1/files/0x0006000000015d98-244.dat UPX behavioral1/memory/2444-246-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000015df1-254.dat UPX behavioral1/memory/2372-237-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2372-235-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2252-226-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000015d27-225.dat UPX behavioral1/memory/1632-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2892-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000015cce-159.dat UPX behavioral1/memory/1624-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2764-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2712-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3064-263-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000015f01-264.dat UPX behavioral1/files/0x0006000000015f7a-273.dat UPX behavioral1/memory/1768-277-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x00060000000160af-282.dat UPX behavioral1/files/0x0006000000016176-292.dat UPX behavioral1/files/0x0006000000016287-303.dat UPX behavioral1/files/0x0006000000016448-312.dat UPX behavioral1/memory/2996-314-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2620-328-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2620-329-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2752-337-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2788-353-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2728-361-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2932-376-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2932-377-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2804-393-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2796-402-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2660-423-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2380 ppjvj.exe 3028 tnnhbh.exe 2980 1xxlrrx.exe 2712 htntbh.exe 2608 frxrxrr.exe 2764 hnnbth.exe 1624 fxflrxf.exe 2516 nbtbht.exe 2816 ppdjd.exe 2936 ppjjp.exe 2808 xxrxfff.exe 1816 tbthnh.exe 928 lfxflxl.exe 1112 vvjdv.exe 2676 1rfllrx.exe 2892 nhbbhn.exe 1632 1xffrxl.exe 2912 hthbhh.exe 1436 xrllrrf.exe 2292 vpjpj.exe 596 fxlrfxf.exe 2452 9djpv.exe 2252 hbtbhh.exe 2372 pjpvj.exe 2444 fxlxflx.exe 3064 ddjpv.exe 2132 nbhhnh.exe 1768 xrrxxxl.exe 2332 1btthn.exe 2956 frfrxxl.exe 2160 jvppp.exe 2996 lfrrxxl.exe 2708 dvppj.exe 2620 pdddp.exe 2752 xlxxfrx.exe 2788 nnbnnn.exe 2588 bthnnt.exe 2728 7thnbt.exe 2504 3jpjj.exe 2932 nhnntb.exe 1928 vddjp.exe 2804 nbnhnt.exe 2796 xfxrlrl.exe 1168 ttthbb.exe 2544 llflrxr.exe 2660 nhtnbn.exe 2916 jvdpp.exe 1596 ffrrxfl.exe 2572 vpjvd.exe 1600 xlflxfl.exe 1640 tnbntb.exe 2244 rfllrrx.exe 268 1hbbnb.exe 1204 3lxlrxf.exe 484 thbttb.exe 828 xlrrlll.exe 444 bhbhhb.exe 496 1lrflxl.exe 1840 thhbtn.exe 2432 7lfxffr.exe 1156 1bbhnt.exe 2400 7vvdp.exe 2360 nnntbh.exe 2064 xlfxffr.exe -
resource yara_rule behavioral1/memory/2884-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/928-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-329-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-353-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-377-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-402-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-423-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-438-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-447-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1600-454-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-469-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1204-484-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-499-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/828-500-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/444-515-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-530-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-545-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-560-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-568-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-576-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-591-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-606-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-621-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-636-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-665-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-680-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-695-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-710-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-753-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/684-768-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-776-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-779-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-785-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-800-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2380 2884 822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a.exe 28 PID 2884 wrote to memory of 2380 2884 822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a.exe 28 PID 2884 wrote to memory of 2380 2884 822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a.exe 28 PID 2884 wrote to memory of 2380 2884 822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a.exe 28 PID 2380 wrote to memory of 3028 2380 ppjvj.exe 29 PID 2380 wrote to memory of 3028 2380 ppjvj.exe 29 PID 2380 wrote to memory of 3028 2380 ppjvj.exe 29 PID 2380 wrote to memory of 3028 2380 ppjvj.exe 29 PID 3028 wrote to memory of 2980 3028 tnnhbh.exe 30 PID 3028 wrote to memory of 2980 3028 tnnhbh.exe 30 PID 3028 wrote to memory of 2980 3028 tnnhbh.exe 30 PID 3028 wrote to memory of 2980 3028 tnnhbh.exe 30 PID 2980 wrote to memory of 2712 2980 1xxlrrx.exe 31 PID 2980 wrote to memory of 2712 2980 1xxlrrx.exe 31 PID 2980 wrote to memory of 2712 2980 1xxlrrx.exe 31 PID 2980 wrote to memory of 2712 2980 1xxlrrx.exe 31 PID 2712 wrote to memory of 2608 2712 htntbh.exe 32 PID 2712 wrote to memory of 2608 2712 htntbh.exe 32 PID 2712 wrote to memory of 2608 2712 htntbh.exe 32 PID 2712 wrote to memory of 2608 2712 htntbh.exe 32 PID 2608 wrote to memory of 2764 2608 frxrxrr.exe 33 PID 2608 wrote to memory of 2764 2608 frxrxrr.exe 33 PID 2608 wrote to memory of 2764 2608 frxrxrr.exe 33 PID 2608 wrote to memory of 2764 2608 frxrxrr.exe 33 PID 2764 wrote to memory of 1624 2764 hnnbth.exe 34 PID 2764 wrote to memory of 1624 2764 hnnbth.exe 34 PID 2764 wrote to memory of 1624 2764 hnnbth.exe 34 PID 2764 wrote to memory of 1624 2764 hnnbth.exe 34 PID 1624 wrote to memory of 2516 1624 fxflrxf.exe 35 PID 1624 wrote to memory of 2516 1624 fxflrxf.exe 35 PID 1624 wrote to memory of 2516 1624 fxflrxf.exe 35 PID 1624 wrote to memory of 2516 1624 fxflrxf.exe 35 PID 2516 wrote to memory of 2816 2516 nbtbht.exe 36 PID 2516 wrote to memory of 2816 2516 nbtbht.exe 36 PID 2516 wrote to memory of 2816 2516 nbtbht.exe 36 PID 2516 wrote to memory of 2816 2516 nbtbht.exe 36 PID 2816 wrote to memory of 2936 2816 ppdjd.exe 37 PID 2816 wrote to memory of 2936 2816 ppdjd.exe 37 PID 2816 wrote to memory of 2936 2816 ppdjd.exe 37 PID 2816 wrote to memory of 2936 2816 ppdjd.exe 37 PID 2936 wrote to memory of 2808 2936 ppjjp.exe 38 PID 2936 wrote to memory of 2808 2936 ppjjp.exe 38 PID 2936 wrote to memory of 2808 2936 ppjjp.exe 38 PID 2936 wrote to memory of 2808 2936 ppjjp.exe 38 PID 2808 wrote to memory of 1816 2808 xxrxfff.exe 39 PID 2808 wrote to memory of 1816 2808 xxrxfff.exe 39 PID 2808 wrote to memory of 1816 2808 xxrxfff.exe 39 PID 2808 wrote to memory of 1816 2808 xxrxfff.exe 39 PID 1816 wrote to memory of 928 1816 tbthnh.exe 40 PID 1816 wrote to memory of 928 1816 tbthnh.exe 40 PID 1816 wrote to memory of 928 1816 tbthnh.exe 40 PID 1816 wrote to memory of 928 1816 tbthnh.exe 40 PID 928 wrote to memory of 1112 928 lfxflxl.exe 41 PID 928 wrote to memory of 1112 928 lfxflxl.exe 41 PID 928 wrote to memory of 1112 928 lfxflxl.exe 41 PID 928 wrote to memory of 1112 928 lfxflxl.exe 41 PID 1112 wrote to memory of 2676 1112 vvjdv.exe 42 PID 1112 wrote to memory of 2676 1112 vvjdv.exe 42 PID 1112 wrote to memory of 2676 1112 vvjdv.exe 42 PID 1112 wrote to memory of 2676 1112 vvjdv.exe 42 PID 2676 wrote to memory of 2892 2676 1rfllrx.exe 43 PID 2676 wrote to memory of 2892 2676 1rfllrx.exe 43 PID 2676 wrote to memory of 2892 2676 1rfllrx.exe 43 PID 2676 wrote to memory of 2892 2676 1rfllrx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a.exe"C:\Users\Admin\AppData\Local\Temp\822f6565e35bdf9f5a3b6fe7b847aa6d5c00dfb616bc9d6cfdf022d306bda74a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\ppjvj.exec:\ppjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\tnnhbh.exec:\tnnhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\1xxlrrx.exec:\1xxlrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\htntbh.exec:\htntbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\frxrxrr.exec:\frxrxrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\hnnbth.exec:\hnnbth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\fxflrxf.exec:\fxflrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\nbtbht.exec:\nbtbht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\ppdjd.exec:\ppdjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\ppjjp.exec:\ppjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\xxrxfff.exec:\xxrxfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\tbthnh.exec:\tbthnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\lfxflxl.exec:\lfxflxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\vvjdv.exec:\vvjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\1rfllrx.exec:\1rfllrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\nhbbhn.exec:\nhbbhn.exe17⤵
- Executes dropped EXE
PID:2892 -
\??\c:\1xffrxl.exec:\1xffrxl.exe18⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hthbhh.exec:\hthbhh.exe19⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xrllrrf.exec:\xrllrrf.exe20⤵
- Executes dropped EXE
PID:1436 -
\??\c:\vpjpj.exec:\vpjpj.exe21⤵
- Executes dropped EXE
PID:2292 -
\??\c:\fxlrfxf.exec:\fxlrfxf.exe22⤵
- Executes dropped EXE
PID:596 -
\??\c:\9djpv.exec:\9djpv.exe23⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hbtbhh.exec:\hbtbhh.exe24⤵
- Executes dropped EXE
PID:2252 -
\??\c:\pjpvj.exec:\pjpvj.exe25⤵
- Executes dropped EXE
PID:2372 -
\??\c:\fxlxflx.exec:\fxlxflx.exe26⤵
- Executes dropped EXE
PID:2444 -
\??\c:\ddjpv.exec:\ddjpv.exe27⤵
- Executes dropped EXE
PID:3064 -
\??\c:\nbhhnh.exec:\nbhhnh.exe28⤵
- Executes dropped EXE
PID:2132 -
\??\c:\xrrxxxl.exec:\xrrxxxl.exe29⤵
- Executes dropped EXE
PID:1768 -
\??\c:\1btthn.exec:\1btthn.exe30⤵
- Executes dropped EXE
PID:2332 -
\??\c:\frfrxxl.exec:\frfrxxl.exe31⤵
- Executes dropped EXE
PID:2956 -
\??\c:\jvppp.exec:\jvppp.exe32⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe33⤵
- Executes dropped EXE
PID:2996 -
\??\c:\dvppj.exec:\dvppj.exe34⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pdddp.exec:\pdddp.exe35⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xlxxfrx.exec:\xlxxfrx.exe36⤵
- Executes dropped EXE
PID:2752 -
\??\c:\nnbnnn.exec:\nnbnnn.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\bthnnt.exec:\bthnnt.exe38⤵
- Executes dropped EXE
PID:2588 -
\??\c:\7thnbt.exec:\7thnbt.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\3jpjj.exec:\3jpjj.exe40⤵
- Executes dropped EXE
PID:2504 -
\??\c:\nhnntb.exec:\nhnntb.exe41⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vddjp.exec:\vddjp.exe42⤵
- Executes dropped EXE
PID:1928 -
\??\c:\nbnhnt.exec:\nbnhnt.exe43⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xfxrlrl.exec:\xfxrlrl.exe44⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ttthbb.exec:\ttthbb.exe45⤵
- Executes dropped EXE
PID:1168 -
\??\c:\llflrxr.exec:\llflrxr.exe46⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nhtnbn.exec:\nhtnbn.exe47⤵
- Executes dropped EXE
PID:2660 -
\??\c:\jvdpp.exec:\jvdpp.exe48⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ffrrxfl.exec:\ffrrxfl.exe49⤵
- Executes dropped EXE
PID:1596 -
\??\c:\vpjvd.exec:\vpjvd.exe50⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xlflxfl.exec:\xlflxfl.exe51⤵
- Executes dropped EXE
PID:1600 -
\??\c:\tnbntb.exec:\tnbntb.exe52⤵
- Executes dropped EXE
PID:1640 -
\??\c:\rfllrrx.exec:\rfllrrx.exe53⤵
- Executes dropped EXE
PID:2244 -
\??\c:\1hbbnb.exec:\1hbbnb.exe54⤵
- Executes dropped EXE
PID:268 -
\??\c:\3lxlrxf.exec:\3lxlrxf.exe55⤵
- Executes dropped EXE
PID:1204 -
\??\c:\thbttb.exec:\thbttb.exe56⤵
- Executes dropped EXE
PID:484 -
\??\c:\xlrrlll.exec:\xlrrlll.exe57⤵
- Executes dropped EXE
PID:828 -
\??\c:\bhbhhb.exec:\bhbhhb.exe58⤵
- Executes dropped EXE
PID:444 -
\??\c:\1lrflxl.exec:\1lrflxl.exe59⤵
- Executes dropped EXE
PID:496 -
\??\c:\thhbtn.exec:\thhbtn.exe60⤵
- Executes dropped EXE
PID:1840 -
\??\c:\7lfxffr.exec:\7lfxffr.exe61⤵
- Executes dropped EXE
PID:2432 -
\??\c:\1bbhnt.exec:\1bbhnt.exe62⤵
- Executes dropped EXE
PID:1156 -
\??\c:\7vvdp.exec:\7vvdp.exe63⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nnntbh.exec:\nnntbh.exe64⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xlfxffr.exec:\xlfxffr.exe65⤵
- Executes dropped EXE
PID:2064 -
\??\c:\nnnnbb.exec:\nnnnbb.exe66⤵PID:2132
-
\??\c:\rlrxlrf.exec:\rlrxlrf.exe67⤵PID:1768
-
\??\c:\nnhbhh.exec:\nnhbhh.exe68⤵PID:2948
-
\??\c:\vvvdd.exec:\vvvdd.exe69⤵PID:1592
-
\??\c:\bthbhn.exec:\bthbhn.exe70⤵PID:2088
-
\??\c:\jdppv.exec:\jdppv.exe71⤵PID:2584
-
\??\c:\lffxlfr.exec:\lffxlfr.exe72⤵PID:2616
-
\??\c:\jdpvj.exec:\jdpvj.exe73⤵PID:2756
-
\??\c:\5fllrxf.exec:\5fllrxf.exe74⤵PID:2620
-
\??\c:\dvjpd.exec:\dvjpd.exe75⤵PID:2712
-
\??\c:\xrrlxrf.exec:\xrrlxrf.exe76⤵PID:2592
-
\??\c:\vvpvd.exec:\vvpvd.exe77⤵PID:2596
-
\??\c:\hhbbhn.exec:\hhbbhn.exe78⤵PID:1624
-
\??\c:\vdpvv.exec:\vdpvv.exe79⤵PID:2044
-
\??\c:\rlxflll.exec:\rlxflll.exe80⤵PID:1848
-
\??\c:\tnttbh.exec:\tnttbh.exe81⤵PID:1036
-
\??\c:\vvvvd.exec:\vvvvd.exe82⤵PID:2348
-
\??\c:\bbnbhh.exec:\bbnbhh.exe83⤵PID:1816
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe84⤵PID:1320
-
\??\c:\btntbb.exec:\btntbb.exe85⤵PID:2656
-
\??\c:\9rrfflr.exec:\9rrfflr.exe86⤵PID:932
-
\??\c:\ttbhth.exec:\ttbhth.exe87⤵PID:1784
-
\??\c:\xrfflrx.exec:\xrfflrx.exe88⤵PID:2412
-
\??\c:\btbhnn.exec:\btbhnn.exe89⤵PID:2944
-
\??\c:\pjvvj.exec:\pjvvj.exe90⤵PID:2300
-
\??\c:\fxxxffr.exec:\fxxxffr.exe91⤵PID:1968
-
\??\c:\ddvdj.exec:\ddvdj.exe92⤵PID:688
-
\??\c:\5xlfllx.exec:\5xlfllx.exe93⤵PID:684
-
\??\c:\jdpdp.exec:\jdpdp.exe94⤵PID:576
-
\??\c:\5vjjv.exec:\5vjjv.exe95⤵PID:1656
-
\??\c:\bththh.exec:\bththh.exe96⤵PID:1916
-
\??\c:\rlxrxfl.exec:\rlxrxfl.exe97⤵PID:3044
-
\??\c:\9btbbb.exec:\9btbbb.exe98⤵PID:2212
-
\??\c:\dpdpv.exec:\dpdpv.exe99⤵PID:2444
-
\??\c:\7xxxlll.exec:\7xxxlll.exe100⤵PID:2016
-
\??\c:\1bnnnh.exec:\1bnnnh.exe101⤵PID:1652
-
\??\c:\1rlrxfr.exec:\1rlrxfr.exe102⤵PID:2232
-
\??\c:\xxrfxfl.exec:\xxrfxfl.exe103⤵PID:3064
-
\??\c:\tnbbhn.exec:\tnbbhn.exe104⤵PID:2004
-
\??\c:\flfxffl.exec:\flfxffl.exe105⤵PID:2320
-
\??\c:\hthbhh.exec:\hthbhh.exe106⤵PID:2952
-
\??\c:\3xxllff.exec:\3xxllff.exe107⤵PID:3032
-
\??\c:\btnthh.exec:\btnthh.exe108⤵PID:2380
-
\??\c:\pdddj.exec:\pdddj.exe109⤵PID:2160
-
\??\c:\9bttbh.exec:\9bttbh.exe110⤵PID:2824
-
\??\c:\bbthtt.exec:\bbthtt.exe111⤵PID:2716
-
\??\c:\rrxflrx.exec:\rrxflrx.exe112⤵PID:2720
-
\??\c:\nntbbb.exec:\nntbbb.exe113⤵PID:2640
-
\??\c:\dvjpd.exec:\dvjpd.exe114⤵PID:2608
-
\??\c:\bnbtbb.exec:\bnbtbb.exe115⤵PID:2552
-
\??\c:\3pdjp.exec:\3pdjp.exe116⤵PID:2924
-
\??\c:\frrxfxx.exec:\frrxfxx.exe117⤵PID:2036
-
\??\c:\5hbbnn.exec:\5hbbnn.exe118⤵PID:1624
-
\??\c:\dvjpd.exec:\dvjpd.exe119⤵PID:2936
-
\??\c:\hbbbtb.exec:\hbbbtb.exe120⤵PID:1848
-
\??\c:\bnttbt.exec:\bnttbt.exe121⤵PID:2164
-
\??\c:\vpppv.exec:\vpppv.exe122⤵PID:2072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-