Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 05:16
Behavioral task
behavioral1
Sample
ee76993b3739e44042d96678fc41d9f3e8410b08cf452e209fdd981091b4f48b.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
ee76993b3739e44042d96678fc41d9f3e8410b08cf452e209fdd981091b4f48b.exe
-
Size
331KB
-
MD5
702cffd0dd752ddd3d14006e3ddda6a6
-
SHA1
d04dfa515f9685286543f105a530efe38565e307
-
SHA256
ee76993b3739e44042d96678fc41d9f3e8410b08cf452e209fdd981091b4f48b
-
SHA512
ec18120c818be759d34b76b00302fa0d949157d53b916b496147d82809aa58a453fbf364fbe48379705aa24c4b325933b0ad71914c9cccfd2feef1ffc1b2b104
-
SSDEEP
3072:LhOmTsF93UYfwC6GIoutHt251UrRE9TTFwT0JOfZKoCdMztr:Lcm4FmowdHoSHt251UriZFwT+aZKNmtr
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2860-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1840-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/816-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1448-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1272-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/532-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1208-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1564-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/860-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/640-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-460-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1944-667-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-706-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-11657-0x0000000076D30000-0x0000000076E4F000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2860-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000a000000014f57-5.dat UPX behavioral1/memory/2860-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1840-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0034000000015662-16.dat UPX behavioral1/files/0x0008000000015b85-22.dat UPX behavioral1/memory/2532-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015c9a-30.dat UPX behavioral1/files/0x0007000000015ca8-37.dat UPX behavioral1/memory/2524-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015cb1-46.dat UPX behavioral1/memory/2524-45-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2684-54-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1536-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015cc5-56.dat UPX behavioral1/files/0x0009000000015ce3-63.dat UPX behavioral1/memory/1536-62-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0008000000016122-70.dat UPX behavioral1/files/0x00060000000163eb-78.dat UPX behavioral1/memory/2468-77-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2444-86-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000164ec-87.dat UPX behavioral1/files/0x0006000000016575-94.dat UPX behavioral1/memory/2452-102-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000167bf-101.dat UPX behavioral1/memory/2640-109-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016a28-110.dat UPX behavioral1/files/0x0006000000016c1f-117.dat UPX behavioral1/memory/1584-118-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016c30-125.dat UPX behavioral1/files/0x0006000000016c38-132.dat UPX behavioral1/memory/2124-133-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016c84-140.dat UPX behavioral1/files/0x0006000000016cb5-147.dat UPX behavioral1/memory/816-148-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016ce0-155.dat UPX behavioral1/files/0x00340000000158d9-162.dat UPX behavioral1/memory/1448-163-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1272-170-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016ced-171.dat UPX behavioral1/files/0x0006000000016cf3-178.dat UPX behavioral1/files/0x0006000000016cfd-186.dat UPX behavioral1/memory/2044-185-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d06-193.dat UPX behavioral1/memory/2184-194-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/532-201-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d10-202.dat UPX behavioral1/files/0x0006000000016d18-209.dat UPX behavioral1/memory/344-216-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d21-217.dat UPX behavioral1/memory/2964-221-0x0000000000220000-0x0000000000247000-memory.dmp UPX behavioral1/files/0x0006000000016d29-225.dat UPX behavioral1/files/0x0006000000016d31-232.dat UPX behavioral1/memory/1540-239-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015c9a-240.dat UPX behavioral1/files/0x0006000000016d81-247.dat UPX behavioral1/memory/1208-254-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1184-265-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2824-272-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2824-278-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2312-289-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1532-292-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2224-298-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2684-345-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1840 dvjjv.exe 2484 7rrfxxf.exe 2532 pvdvv.exe 2676 9fxfrfr.exe 2524 7htbbn.exe 2684 ffxllff.exe 1536 bnhbht.exe 2672 vdpvd.exe 2468 9xrxfxx.exe 2444 5tttbh.exe 108 pdvpd.exe 2452 rxllfrl.exe 2640 nhhbtn.exe 2636 pdjjj.exe 1584 fxlrxxf.exe 2124 nnbhtb.exe 2144 ppppj.exe 816 lxlxxff.exe 1604 hhtthh.exe 1448 dpddp.exe 1272 lfrrrxl.exe 2580 ttbhnt.exe 2044 xrrfrxl.exe 2184 nbnhhh.exe 532 pjvjv.exe 1896 rrxfffx.exe 344 vvjdp.exe 2964 5fxxrrx.exe 1784 thnnnt.exe 1540 3jddj.exe 1700 9fxfrfr.exe 960 3ntnnh.exe 1208 vdvjv.exe 1684 5fxlxfr.exe 1184 7tnhnt.exe 2824 1btthh.exe 988 jjppj.exe 540 1rxfrfr.exe 2312 nhtbnb.exe 2224 lfrfrlx.exe 3060 5btbhh.exe 1988 bbtbnt.exe 2808 jjdjp.exe 2656 llxxffr.exe 2712 xrlxflx.exe 2724 tthnhb.exe 2768 vvvdj.exe 2684 vjdvd.exe 1536 rrflrrf.exe 2424 1bhhbn.exe 2916 thbhth.exe 2884 7jppd.exe 1564 fxllrrf.exe 1852 fxlllll.exe 2616 ttntnt.exe 1944 pjdjp.exe 1020 ddvdd.exe 2492 fxrrffx.exe 1584 xxlfllx.exe 860 hbhtth.exe 2156 dvppv.exe 1612 xrllxxl.exe 640 1xfxrrf.exe 1360 hbttht.exe -
resource yara_rule behavioral1/memory/2860-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000014f57-5.dat upx behavioral1/memory/2860-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1840-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0034000000015662-16.dat upx behavioral1/files/0x0008000000015b85-22.dat upx behavioral1/memory/2532-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015c9a-30.dat upx behavioral1/files/0x0007000000015ca8-37.dat upx behavioral1/memory/2524-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015cb1-46.dat upx behavioral1/memory/2524-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1536-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015cc5-56.dat upx behavioral1/files/0x0009000000015ce3-63.dat upx behavioral1/memory/1536-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016122-70.dat upx behavioral1/files/0x00060000000163eb-78.dat upx behavioral1/memory/2468-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2444-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000164ec-87.dat upx behavioral1/files/0x0006000000016575-94.dat upx behavioral1/memory/2452-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000167bf-101.dat upx behavioral1/memory/2640-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016a28-110.dat upx behavioral1/files/0x0006000000016c1f-117.dat upx behavioral1/memory/1584-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c30-125.dat upx behavioral1/files/0x0006000000016c38-132.dat upx behavioral1/memory/2124-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c84-140.dat upx behavioral1/files/0x0006000000016cb5-147.dat upx behavioral1/memory/816-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ce0-155.dat upx behavioral1/files/0x00340000000158d9-162.dat upx behavioral1/memory/1448-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1272-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ced-171.dat upx behavioral1/files/0x0006000000016cf3-178.dat upx behavioral1/files/0x0006000000016cfd-186.dat upx behavioral1/memory/2044-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d06-193.dat upx behavioral1/memory/2184-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/532-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d10-202.dat upx behavioral1/files/0x0006000000016d18-209.dat upx behavioral1/memory/344-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d21-217.dat upx behavioral1/memory/2964-221-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000016d29-225.dat upx behavioral1/files/0x0006000000016d31-232.dat upx behavioral1/memory/1540-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015c9a-240.dat upx behavioral1/files/0x0006000000016d81-247.dat upx behavioral1/memory/1208-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1184-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-278-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2312-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1532-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2224-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-345-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2860 wrote to memory of 1840 2860 ee76993b3739e44042d96678fc41d9f3e8410b08cf452e209fdd981091b4f48b.exe 28 PID 2860 wrote to memory of 1840 2860 ee76993b3739e44042d96678fc41d9f3e8410b08cf452e209fdd981091b4f48b.exe 28 PID 2860 wrote to memory of 1840 2860 ee76993b3739e44042d96678fc41d9f3e8410b08cf452e209fdd981091b4f48b.exe 28 PID 2860 wrote to memory of 1840 2860 ee76993b3739e44042d96678fc41d9f3e8410b08cf452e209fdd981091b4f48b.exe 28 PID 1840 wrote to memory of 2484 1840 dvjjv.exe 29 PID 1840 wrote to memory of 2484 1840 dvjjv.exe 29 PID 1840 wrote to memory of 2484 1840 dvjjv.exe 29 PID 1840 wrote to memory of 2484 1840 dvjjv.exe 29 PID 2484 wrote to memory of 2532 2484 7rrfxxf.exe 30 PID 2484 wrote to memory of 2532 2484 7rrfxxf.exe 30 PID 2484 wrote to memory of 2532 2484 7rrfxxf.exe 30 PID 2484 wrote to memory of 2532 2484 7rrfxxf.exe 30 PID 2532 wrote to memory of 2676 2532 pvdvv.exe 31 PID 2532 wrote to memory of 2676 2532 pvdvv.exe 31 PID 2532 wrote to memory of 2676 2532 pvdvv.exe 31 PID 2532 wrote to memory of 2676 2532 pvdvv.exe 31 PID 2676 wrote to memory of 2524 2676 9fxfrfr.exe 32 PID 2676 wrote to memory of 2524 2676 9fxfrfr.exe 32 PID 2676 wrote to memory of 2524 2676 9fxfrfr.exe 32 PID 2676 wrote to memory of 2524 2676 9fxfrfr.exe 32 PID 2524 wrote to memory of 2684 2524 7htbbn.exe 33 PID 2524 wrote to memory of 2684 2524 7htbbn.exe 33 PID 2524 wrote to memory of 2684 2524 7htbbn.exe 33 PID 2524 wrote to memory of 2684 2524 7htbbn.exe 33 PID 2684 wrote to memory of 1536 2684 ffxllff.exe 34 PID 2684 wrote to memory of 1536 2684 ffxllff.exe 34 PID 2684 wrote to memory of 1536 2684 ffxllff.exe 34 PID 2684 wrote to memory of 1536 2684 ffxllff.exe 34 PID 1536 wrote to memory of 2672 1536 bnhbht.exe 35 PID 1536 wrote to memory of 2672 1536 bnhbht.exe 35 PID 1536 wrote to memory of 2672 1536 bnhbht.exe 35 PID 1536 wrote to memory of 2672 1536 bnhbht.exe 35 PID 2672 wrote to memory of 2468 2672 vdpvd.exe 36 PID 2672 wrote to memory of 2468 2672 vdpvd.exe 36 PID 2672 wrote to memory of 2468 2672 vdpvd.exe 36 PID 2672 wrote to memory of 2468 2672 vdpvd.exe 36 PID 2468 wrote to memory of 2444 2468 9xrxfxx.exe 37 PID 2468 wrote to memory of 2444 2468 9xrxfxx.exe 37 PID 2468 wrote to memory of 2444 2468 9xrxfxx.exe 37 PID 2468 wrote to memory of 2444 2468 9xrxfxx.exe 37 PID 2444 wrote to memory of 108 2444 5tttbh.exe 38 PID 2444 wrote to memory of 108 2444 5tttbh.exe 38 PID 2444 wrote to memory of 108 2444 5tttbh.exe 38 PID 2444 wrote to memory of 108 2444 5tttbh.exe 38 PID 108 wrote to memory of 2452 108 pdvpd.exe 39 PID 108 wrote to memory of 2452 108 pdvpd.exe 39 PID 108 wrote to memory of 2452 108 pdvpd.exe 39 PID 108 wrote to memory of 2452 108 pdvpd.exe 39 PID 2452 wrote to memory of 2640 2452 rxllfrl.exe 40 PID 2452 wrote to memory of 2640 2452 rxllfrl.exe 40 PID 2452 wrote to memory of 2640 2452 rxllfrl.exe 40 PID 2452 wrote to memory of 2640 2452 rxllfrl.exe 40 PID 2640 wrote to memory of 2636 2640 nhhbtn.exe 41 PID 2640 wrote to memory of 2636 2640 nhhbtn.exe 41 PID 2640 wrote to memory of 2636 2640 nhhbtn.exe 41 PID 2640 wrote to memory of 2636 2640 nhhbtn.exe 41 PID 2636 wrote to memory of 1584 2636 pdjjj.exe 42 PID 2636 wrote to memory of 1584 2636 pdjjj.exe 42 PID 2636 wrote to memory of 1584 2636 pdjjj.exe 42 PID 2636 wrote to memory of 1584 2636 pdjjj.exe 42 PID 1584 wrote to memory of 2124 1584 fxlrxxf.exe 43 PID 1584 wrote to memory of 2124 1584 fxlrxxf.exe 43 PID 1584 wrote to memory of 2124 1584 fxlrxxf.exe 43 PID 1584 wrote to memory of 2124 1584 fxlrxxf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee76993b3739e44042d96678fc41d9f3e8410b08cf452e209fdd981091b4f48b.exe"C:\Users\Admin\AppData\Local\Temp\ee76993b3739e44042d96678fc41d9f3e8410b08cf452e209fdd981091b4f48b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\dvjjv.exec:\dvjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\7rrfxxf.exec:\7rrfxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\pvdvv.exec:\pvdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\9fxfrfr.exec:\9fxfrfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\7htbbn.exec:\7htbbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\ffxllff.exec:\ffxllff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\bnhbht.exec:\bnhbht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\vdpvd.exec:\vdpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\9xrxfxx.exec:\9xrxfxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\5tttbh.exec:\5tttbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\pdvpd.exec:\pdvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\rxllfrl.exec:\rxllfrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\nhhbtn.exec:\nhhbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\pdjjj.exec:\pdjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\nnbhtb.exec:\nnbhtb.exe17⤵
- Executes dropped EXE
PID:2124 -
\??\c:\ppppj.exec:\ppppj.exe18⤵
- Executes dropped EXE
PID:2144 -
\??\c:\lxlxxff.exec:\lxlxxff.exe19⤵
- Executes dropped EXE
PID:816 -
\??\c:\hhtthh.exec:\hhtthh.exe20⤵
- Executes dropped EXE
PID:1604 -
\??\c:\dpddp.exec:\dpddp.exe21⤵
- Executes dropped EXE
PID:1448 -
\??\c:\lfrrrxl.exec:\lfrrrxl.exe22⤵
- Executes dropped EXE
PID:1272 -
\??\c:\ttbhnt.exec:\ttbhnt.exe23⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xrrfrxl.exec:\xrrfrxl.exe24⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nbnhhh.exec:\nbnhhh.exe25⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pjvjv.exec:\pjvjv.exe26⤵
- Executes dropped EXE
PID:532 -
\??\c:\rrxfffx.exec:\rrxfffx.exe27⤵
- Executes dropped EXE
PID:1896 -
\??\c:\vvjdp.exec:\vvjdp.exe28⤵
- Executes dropped EXE
PID:344 -
\??\c:\5fxxrrx.exec:\5fxxrrx.exe29⤵
- Executes dropped EXE
PID:2964 -
\??\c:\thnnnt.exec:\thnnnt.exe30⤵
- Executes dropped EXE
PID:1784 -
\??\c:\3jddj.exec:\3jddj.exe31⤵
- Executes dropped EXE
PID:1540 -
\??\c:\9fxfrfr.exec:\9fxfrfr.exe32⤵
- Executes dropped EXE
PID:1700 -
\??\c:\3ntnnh.exec:\3ntnnh.exe33⤵
- Executes dropped EXE
PID:960 -
\??\c:\vdvjv.exec:\vdvjv.exe34⤵
- Executes dropped EXE
PID:1208 -
\??\c:\5fxlxfr.exec:\5fxlxfr.exe35⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7tnhnt.exec:\7tnhnt.exe36⤵
- Executes dropped EXE
PID:1184 -
\??\c:\1btthh.exec:\1btthh.exe37⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jjppj.exec:\jjppj.exe38⤵
- Executes dropped EXE
PID:988 -
\??\c:\1rxfrfr.exec:\1rxfrfr.exe39⤵
- Executes dropped EXE
PID:540 -
\??\c:\nhtbnb.exec:\nhtbnb.exe40⤵
- Executes dropped EXE
PID:2312 -
\??\c:\hbtbhn.exec:\hbtbhn.exe41⤵PID:1532
-
\??\c:\lfrfrlx.exec:\lfrfrlx.exe42⤵
- Executes dropped EXE
PID:2224 -
\??\c:\5btbhh.exec:\5btbhh.exe43⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bbtbnt.exec:\bbtbnt.exe44⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jjdjp.exec:\jjdjp.exe45⤵
- Executes dropped EXE
PID:2808 -
\??\c:\llxxffr.exec:\llxxffr.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xrlxflx.exec:\xrlxflx.exe47⤵
- Executes dropped EXE
PID:2712 -
\??\c:\tthnhb.exec:\tthnhb.exe48⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vvvdj.exec:\vvvdj.exe49⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vjdvd.exec:\vjdvd.exe50⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rrflrrf.exec:\rrflrrf.exe51⤵
- Executes dropped EXE
PID:1536 -
\??\c:\1bhhbn.exec:\1bhhbn.exe52⤵
- Executes dropped EXE
PID:2424 -
\??\c:\thbhth.exec:\thbhth.exe53⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7jppd.exec:\7jppd.exe54⤵
- Executes dropped EXE
PID:2884 -
\??\c:\fxllrrf.exec:\fxllrrf.exe55⤵
- Executes dropped EXE
PID:1564 -
\??\c:\fxlllll.exec:\fxlllll.exe56⤵
- Executes dropped EXE
PID:1852 -
\??\c:\ttntnt.exec:\ttntnt.exe57⤵
- Executes dropped EXE
PID:2616 -
\??\c:\pjdjp.exec:\pjdjp.exe58⤵
- Executes dropped EXE
PID:1944 -
\??\c:\ddvdd.exec:\ddvdd.exe59⤵
- Executes dropped EXE
PID:1020 -
\??\c:\fxrrffx.exec:\fxrrffx.exe60⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xxlfllx.exec:\xxlfllx.exe61⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hbhtth.exec:\hbhtth.exe62⤵
- Executes dropped EXE
PID:860 -
\??\c:\dvppv.exec:\dvppv.exe63⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xrllxxl.exec:\xrllxxl.exe64⤵
- Executes dropped EXE
PID:1612 -
\??\c:\1xfxrrf.exec:\1xfxrrf.exe65⤵
- Executes dropped EXE
PID:640 -
\??\c:\hbttht.exec:\hbttht.exe66⤵
- Executes dropped EXE
PID:1360 -
\??\c:\5nbtbb.exec:\5nbtbb.exe67⤵PID:852
-
\??\c:\vpjpd.exec:\vpjpd.exe68⤵PID:2092
-
\??\c:\xrffrrx.exec:\xrffrrx.exe69⤵PID:2072
-
\??\c:\hhbhnt.exec:\hhbhnt.exe70⤵PID:320
-
\??\c:\5tbhbb.exec:\5tbhbb.exe71⤵PID:1260
-
\??\c:\5dpvd.exec:\5dpvd.exe72⤵PID:2100
-
\??\c:\pdppv.exec:\pdppv.exe73⤵PID:556
-
\??\c:\rrrfrxr.exec:\rrrfrxr.exe74⤵PID:3032
-
\??\c:\fllrflx.exec:\fllrflx.exe75⤵PID:2356
-
\??\c:\nnhhnt.exec:\nnhhnt.exe76⤵PID:448
-
\??\c:\vvpdp.exec:\vvpdp.exe77⤵PID:884
-
\??\c:\ddvjv.exec:\ddvjv.exe78⤵PID:996
-
\??\c:\7fffflx.exec:\7fffflx.exe79⤵PID:2060
-
\??\c:\1frrlxr.exec:\1frrlxr.exe80⤵PID:1748
-
\??\c:\tnbbnt.exec:\tnbbnt.exe81⤵PID:876
-
\??\c:\pjvjv.exec:\pjvjv.exe82⤵PID:1700
-
\??\c:\ppjpd.exec:\ppjpd.exe83⤵PID:960
-
\??\c:\rrfrxfr.exec:\rrfrxfr.exe84⤵PID:1208
-
\??\c:\tnbhth.exec:\tnbhth.exe85⤵PID:2668
-
\??\c:\hbnthh.exec:\hbnthh.exe86⤵PID:3004
-
\??\c:\3jdpv.exec:\3jdpv.exe87⤵PID:1640
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe88⤵PID:2256
-
\??\c:\bhhnbn.exec:\bhhnbn.exe89⤵PID:1428
-
\??\c:\hthbhb.exec:\hthbhb.exe90⤵PID:2924
-
\??\c:\jjppd.exec:\jjppd.exe91⤵PID:1736
-
\??\c:\llffrxl.exec:\llffrxl.exe92⤵PID:2500
-
\??\c:\xfxfxxl.exec:\xfxfxxl.exe93⤵PID:2496
-
\??\c:\hhttbh.exec:\hhttbh.exe94⤵PID:2484
-
\??\c:\bbtnhn.exec:\bbtnhn.exe95⤵PID:2548
-
\??\c:\ppjpd.exec:\ppjpd.exe96⤵PID:2796
-
\??\c:\xxrfrrf.exec:\xxrfrrf.exe97⤵PID:2552
-
\??\c:\9frrxfl.exec:\9frrxfl.exe98⤵PID:2220
-
\??\c:\bnntbn.exec:\bnntbn.exe99⤵PID:2428
-
\??\c:\dvjpj.exec:\dvjpj.exe100⤵PID:2396
-
\??\c:\jjdpv.exec:\jjdpv.exe101⤵PID:2324
-
\??\c:\7lflrxl.exec:\7lflrxl.exe102⤵PID:2720
-
\??\c:\bnhntt.exec:\bnhntt.exe103⤵PID:2232
-
\??\c:\tbbhbt.exec:\tbbhbt.exe104⤵PID:2408
-
\??\c:\vjpdd.exec:\vjpdd.exe105⤵PID:2888
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe106⤵PID:2368
-
\??\c:\lfrxffr.exec:\lfrxffr.exe107⤵PID:108
-
\??\c:\7hnntt.exec:\7hnntt.exe108⤵PID:2628
-
\??\c:\dpvvd.exec:\dpvvd.exe109⤵PID:1944
-
\??\c:\jdvdd.exec:\jdvdd.exe110⤵PID:1248
-
\??\c:\lxrlrrx.exec:\lxrlrrx.exe111⤵PID:812
-
\??\c:\xrfxxrl.exec:\xrfxxrl.exe112⤵PID:1744
-
\??\c:\5hnbht.exec:\5hnbht.exe113⤵PID:2120
-
\??\c:\3djjp.exec:\3djjp.exe114⤵PID:2160
-
\??\c:\1dpdv.exec:\1dpdv.exe115⤵PID:2128
-
\??\c:\rlrrxfx.exec:\rlrrxfx.exe116⤵PID:2732
-
\??\c:\hhtbhn.exec:\hhtbhn.exe117⤵PID:844
-
\??\c:\9tnntt.exec:\9tnntt.exe118⤵PID:2896
-
\??\c:\7vvvd.exec:\7vvvd.exe119⤵PID:2756
-
\??\c:\rfxflfr.exec:\rfxflfr.exe120⤵PID:2892
-
\??\c:\5hbthn.exec:\5hbthn.exe121⤵PID:2480
-
\??\c:\ntnntb.exec:\ntnntb.exe122⤵PID:2112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-