Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 04:54
Behavioral task
behavioral1
Sample
f2a9a1db595671358969501f439fc25dfaa55bd2cc57a2569b384c25d07b1c45.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
f2a9a1db595671358969501f439fc25dfaa55bd2cc57a2569b384c25d07b1c45.exe
-
Size
293KB
-
MD5
b4da601ae5933cefbe458687df7059fb
-
SHA1
2534dda0ffac0124129d7ba7bd2b4cfa7c67a960
-
SHA256
f2a9a1db595671358969501f439fc25dfaa55bd2cc57a2569b384c25d07b1c45
-
SHA512
d832e667a7fedefe8987ab92b0aa19f6022fd348e5017499f6163e33d0bef0fcbd2237e8291ec8354047996c31af034ecc5d514f6f633f0479042ca32fec1de1
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftO1:K4wFHoSQkuUHk1zBR/pMT9XvEhdfk
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2036-1-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1780-16-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2476-26-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2536-40-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2604-36-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2536-42-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1352-49-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2656-65-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2556-75-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1740-95-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2972-92-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2632-111-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/764-128-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2296-137-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1224-146-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1652-166-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1176-183-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2104-202-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1404-226-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1276-230-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1700-252-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/608-289-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2592-328-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2604-341-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2392-343-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2536-355-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2796-394-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1608-396-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1220-414-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/628-488-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/988-532-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1756-617-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2404-661-0x00000000001B0000-0x00000000001E4000-memory.dmp family_blackmoon behavioral1/memory/2404-660-0x00000000001B0000-0x00000000001E4000-memory.dmp family_blackmoon behavioral1/memory/2276-674-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1016-693-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2676-772-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2032-885-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2548-947-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3028-1048-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2144-1101-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1752-1121-0x0000000000230000-0x0000000000264000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2036-1-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x000d000000013adc-5.dat UPX behavioral1/memory/1780-8-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2476-18-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x003400000001431b-19.dat UPX behavioral1/memory/1780-16-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x000e000000014457-27.dat UPX behavioral1/memory/2604-28-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2476-26-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x00070000000144e9-38.dat UPX behavioral1/memory/2536-40-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2604-36-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x00070000000144f1-47.dat UPX behavioral1/memory/1352-49-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x00070000000144f9-55.dat UPX behavioral1/memory/2656-58-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x000700000001459d-66.dat UPX behavioral1/memory/2656-65-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0009000000014677-73.dat UPX behavioral1/memory/2556-75-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0008000000014709-83.dat UPX behavioral1/files/0x000700000001565a-90.dat UPX behavioral1/memory/1740-95-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2972-92-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000015662-100.dat UPX behavioral1/files/0x00060000000158d9-109.dat UPX behavioral1/memory/2632-111-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000015ae3-118.dat UPX behavioral1/memory/764-128-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000015b50-127.dat UPX behavioral1/memory/2296-137-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000015b85-136.dat UPX behavioral1/files/0x0006000000015c9a-144.dat UPX behavioral1/memory/1880-148-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1224-146-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000015ca8-155.dat UPX behavioral1/memory/1652-157-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000015cb1-164.dat UPX behavioral1/memory/1652-166-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000015cc5-174.dat UPX behavioral1/files/0x0006000000015cd2-180.dat UPX behavioral1/memory/1176-183-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000015ce3-191.dat UPX behavioral1/files/0x0006000000015cee-198.dat UPX behavioral1/memory/2104-202-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000015cf8-208.dat UPX behavioral1/files/0x0006000000015d0a-216.dat UPX behavioral1/memory/1404-218-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000015d21-227.dat UPX behavioral1/memory/1404-226-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1276-230-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x003400000001432f-236.dat UPX behavioral1/files/0x0006000000015d39-244.dat UPX behavioral1/memory/1700-252-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000015d59-255.dat UPX behavioral1/memory/2976-254-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000015d61-262.dat UPX behavioral1/files/0x0006000000015d85-269.dat UPX behavioral1/files/0x0006000000015d9c-278.dat UPX behavioral1/files/0x0006000000015f23-286.dat UPX behavioral1/memory/608-289-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1432-295-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1796-308-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2968-315-0x0000000000400000-0x0000000000434000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1780 rfrxxxx.exe 2476 xlrrrrl.exe 2604 7bbbtn.exe 2536 5djjj.exe 1352 rxxrrlf.exe 2656 jvddd.exe 2556 lxlfxxr.exe 2460 tnhbht.exe 2972 pdppp.exe 1740 pdpjp.exe 1020 fxrrrrr.exe 2632 nhttbb.exe 764 1ddpj.exe 2296 lxfllxx.exe 1224 3hnhhh.exe 1880 vpvvv.exe 1652 vddvp.exe 2424 hbhhhb.exe 1176 tnbbbh.exe 3024 rlrffff.exe 2368 htbbnh.exe 2104 5vddd.exe 480 1lfllrl.exe 1404 9tbttt.exe 1276 bnbbhb.exe 2012 dvjpv.exe 1700 1xrxfxf.exe 2976 5htnnn.exe 924 ppvdv.exe 2940 frfxffl.exe 1476 7tnnnh.exe 608 jjppp.exe 1432 5rflffx.exe 2216 bthttb.exe 1796 1tbbtb.exe 2968 vjvdp.exe 2592 lxxflff.exe 1496 fxrlxxf.exe 2604 thhttn.exe 2392 5jvvd.exe 2536 1pjvj.exe 2584 lfrxffl.exe 2428 nhhntt.exe 2396 thnhnt.exe 2432 jdjjp.exe 2448 9vjvv.exe 2796 fxrfrrr.exe 1608 hnbbhh.exe 1504 btbntb.exe 2680 jvddj.exe 1220 rxrfxlf.exe 908 5xlxxxx.exe 1632 7nbthh.exe 2304 vjvvp.exe 304 djpdd.exe 1660 lrrllff.exe 2184 httnnb.exe 1580 thtbtt.exe 1508 pjjvd.exe 1236 fxfllrl.exe 1948 7frlfxx.exe 3024 tbhhnn.exe 628 ntbnhh.exe 2328 vjpjp.exe -
resource yara_rule behavioral1/memory/2036-1-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000d000000013adc-5.dat upx behavioral1/memory/1780-8-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2476-18-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x003400000001431b-19.dat upx behavioral1/memory/1780-16-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000e000000014457-27.dat upx behavioral1/memory/2604-28-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2476-26-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00070000000144e9-38.dat upx behavioral1/memory/2536-40-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2604-36-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00070000000144f1-47.dat upx behavioral1/memory/1352-49-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00070000000144f9-55.dat upx behavioral1/memory/2656-58-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000700000001459d-66.dat upx behavioral1/memory/2656-65-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0009000000014677-73.dat upx behavioral1/memory/2556-75-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0008000000014709-83.dat upx behavioral1/files/0x000700000001565a-90.dat upx behavioral1/memory/1740-95-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2972-92-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015662-100.dat upx behavioral1/files/0x00060000000158d9-109.dat upx behavioral1/memory/2632-111-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015ae3-118.dat upx behavioral1/memory/764-128-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015b50-127.dat upx behavioral1/memory/2296-137-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015b85-136.dat upx behavioral1/files/0x0006000000015c9a-144.dat upx behavioral1/memory/1880-148-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1224-146-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015ca8-155.dat upx behavioral1/memory/1652-157-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015cb1-164.dat upx behavioral1/memory/1652-166-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015cc5-174.dat upx behavioral1/files/0x0006000000015cd2-180.dat upx behavioral1/memory/1176-183-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015ce3-191.dat upx behavioral1/files/0x0006000000015cee-198.dat upx behavioral1/memory/2104-202-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015cf8-208.dat upx behavioral1/files/0x0006000000015d0a-216.dat upx behavioral1/memory/1404-218-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015d21-227.dat upx behavioral1/memory/1404-226-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1276-230-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x003400000001432f-236.dat upx behavioral1/files/0x0006000000015d39-244.dat upx behavioral1/memory/1700-252-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015d59-255.dat upx behavioral1/memory/2976-254-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015d61-262.dat upx behavioral1/files/0x0006000000015d85-269.dat upx behavioral1/files/0x0006000000015d9c-278.dat upx behavioral1/files/0x0006000000015f23-286.dat upx behavioral1/memory/608-289-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1432-295-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1796-308-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2968-315-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1780 2036 f2a9a1db595671358969501f439fc25dfaa55bd2cc57a2569b384c25d07b1c45.exe 28 PID 2036 wrote to memory of 1780 2036 f2a9a1db595671358969501f439fc25dfaa55bd2cc57a2569b384c25d07b1c45.exe 28 PID 2036 wrote to memory of 1780 2036 f2a9a1db595671358969501f439fc25dfaa55bd2cc57a2569b384c25d07b1c45.exe 28 PID 2036 wrote to memory of 1780 2036 f2a9a1db595671358969501f439fc25dfaa55bd2cc57a2569b384c25d07b1c45.exe 28 PID 1780 wrote to memory of 2476 1780 rfrxxxx.exe 29 PID 1780 wrote to memory of 2476 1780 rfrxxxx.exe 29 PID 1780 wrote to memory of 2476 1780 rfrxxxx.exe 29 PID 1780 wrote to memory of 2476 1780 rfrxxxx.exe 29 PID 2476 wrote to memory of 2604 2476 xlrrrrl.exe 30 PID 2476 wrote to memory of 2604 2476 xlrrrrl.exe 30 PID 2476 wrote to memory of 2604 2476 xlrrrrl.exe 30 PID 2476 wrote to memory of 2604 2476 xlrrrrl.exe 30 PID 2604 wrote to memory of 2536 2604 7bbbtn.exe 31 PID 2604 wrote to memory of 2536 2604 7bbbtn.exe 31 PID 2604 wrote to memory of 2536 2604 7bbbtn.exe 31 PID 2604 wrote to memory of 2536 2604 7bbbtn.exe 31 PID 2536 wrote to memory of 1352 2536 5djjj.exe 32 PID 2536 wrote to memory of 1352 2536 5djjj.exe 32 PID 2536 wrote to memory of 1352 2536 5djjj.exe 32 PID 2536 wrote to memory of 1352 2536 5djjj.exe 32 PID 1352 wrote to memory of 2656 1352 rxxrrlf.exe 33 PID 1352 wrote to memory of 2656 1352 rxxrrlf.exe 33 PID 1352 wrote to memory of 2656 1352 rxxrrlf.exe 33 PID 1352 wrote to memory of 2656 1352 rxxrrlf.exe 33 PID 2656 wrote to memory of 2556 2656 jvddd.exe 34 PID 2656 wrote to memory of 2556 2656 jvddd.exe 34 PID 2656 wrote to memory of 2556 2656 jvddd.exe 34 PID 2656 wrote to memory of 2556 2656 jvddd.exe 34 PID 2556 wrote to memory of 2460 2556 lxlfxxr.exe 35 PID 2556 wrote to memory of 2460 2556 lxlfxxr.exe 35 PID 2556 wrote to memory of 2460 2556 lxlfxxr.exe 35 PID 2556 wrote to memory of 2460 2556 lxlfxxr.exe 35 PID 2460 wrote to memory of 2972 2460 tnhbht.exe 36 PID 2460 wrote to memory of 2972 2460 tnhbht.exe 36 PID 2460 wrote to memory of 2972 2460 tnhbht.exe 36 PID 2460 wrote to memory of 2972 2460 tnhbht.exe 36 PID 2972 wrote to memory of 1740 2972 pdppp.exe 37 PID 2972 wrote to memory of 1740 2972 pdppp.exe 37 PID 2972 wrote to memory of 1740 2972 pdppp.exe 37 PID 2972 wrote to memory of 1740 2972 pdppp.exe 37 PID 1740 wrote to memory of 1020 1740 pdpjp.exe 38 PID 1740 wrote to memory of 1020 1740 pdpjp.exe 38 PID 1740 wrote to memory of 1020 1740 pdpjp.exe 38 PID 1740 wrote to memory of 1020 1740 pdpjp.exe 38 PID 1020 wrote to memory of 2632 1020 fxrrrrr.exe 39 PID 1020 wrote to memory of 2632 1020 fxrrrrr.exe 39 PID 1020 wrote to memory of 2632 1020 fxrrrrr.exe 39 PID 1020 wrote to memory of 2632 1020 fxrrrrr.exe 39 PID 2632 wrote to memory of 764 2632 nhttbb.exe 40 PID 2632 wrote to memory of 764 2632 nhttbb.exe 40 PID 2632 wrote to memory of 764 2632 nhttbb.exe 40 PID 2632 wrote to memory of 764 2632 nhttbb.exe 40 PID 764 wrote to memory of 2296 764 1ddpj.exe 41 PID 764 wrote to memory of 2296 764 1ddpj.exe 41 PID 764 wrote to memory of 2296 764 1ddpj.exe 41 PID 764 wrote to memory of 2296 764 1ddpj.exe 41 PID 2296 wrote to memory of 1224 2296 lxfllxx.exe 42 PID 2296 wrote to memory of 1224 2296 lxfllxx.exe 42 PID 2296 wrote to memory of 1224 2296 lxfllxx.exe 42 PID 2296 wrote to memory of 1224 2296 lxfllxx.exe 42 PID 1224 wrote to memory of 1880 1224 3hnhhh.exe 43 PID 1224 wrote to memory of 1880 1224 3hnhhh.exe 43 PID 1224 wrote to memory of 1880 1224 3hnhhh.exe 43 PID 1224 wrote to memory of 1880 1224 3hnhhh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2a9a1db595671358969501f439fc25dfaa55bd2cc57a2569b384c25d07b1c45.exe"C:\Users\Admin\AppData\Local\Temp\f2a9a1db595671358969501f439fc25dfaa55bd2cc57a2569b384c25d07b1c45.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\rfrxxxx.exec:\rfrxxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\xlrrrrl.exec:\xlrrrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\7bbbtn.exec:\7bbbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\5djjj.exec:\5djjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\rxxrrlf.exec:\rxxrrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\jvddd.exec:\jvddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\tnhbht.exec:\tnhbht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\pdppp.exec:\pdppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\pdpjp.exec:\pdpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\nhttbb.exec:\nhttbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\1ddpj.exec:\1ddpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\lxfllxx.exec:\lxfllxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\3hnhhh.exec:\3hnhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\vpvvv.exec:\vpvvv.exe17⤵
- Executes dropped EXE
PID:1880 -
\??\c:\vddvp.exec:\vddvp.exe18⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hbhhhb.exec:\hbhhhb.exe19⤵
- Executes dropped EXE
PID:2424 -
\??\c:\tnbbbh.exec:\tnbbbh.exe20⤵
- Executes dropped EXE
PID:1176 -
\??\c:\rlrffff.exec:\rlrffff.exe21⤵
- Executes dropped EXE
PID:3024 -
\??\c:\htbbnh.exec:\htbbnh.exe22⤵
- Executes dropped EXE
PID:2368 -
\??\c:\5vddd.exec:\5vddd.exe23⤵
- Executes dropped EXE
PID:2104 -
\??\c:\1lfllrl.exec:\1lfllrl.exe24⤵
- Executes dropped EXE
PID:480 -
\??\c:\9tbttt.exec:\9tbttt.exe25⤵
- Executes dropped EXE
PID:1404 -
\??\c:\bnbbhb.exec:\bnbbhb.exe26⤵
- Executes dropped EXE
PID:1276 -
\??\c:\dvjpv.exec:\dvjpv.exe27⤵
- Executes dropped EXE
PID:2012 -
\??\c:\1xrxfxf.exec:\1xrxfxf.exe28⤵
- Executes dropped EXE
PID:1700 -
\??\c:\5htnnn.exec:\5htnnn.exe29⤵
- Executes dropped EXE
PID:2976 -
\??\c:\ppvdv.exec:\ppvdv.exe30⤵
- Executes dropped EXE
PID:924 -
\??\c:\frfxffl.exec:\frfxffl.exe31⤵
- Executes dropped EXE
PID:2940 -
\??\c:\7tnnnh.exec:\7tnnnh.exe32⤵
- Executes dropped EXE
PID:1476 -
\??\c:\jjppp.exec:\jjppp.exe33⤵
- Executes dropped EXE
PID:608 -
\??\c:\5rflffx.exec:\5rflffx.exe34⤵
- Executes dropped EXE
PID:1432 -
\??\c:\bthttb.exec:\bthttb.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\1tbbtb.exec:\1tbbtb.exe36⤵
- Executes dropped EXE
PID:1796 -
\??\c:\vjvdp.exec:\vjvdp.exe37⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lxxflff.exec:\lxxflff.exe38⤵
- Executes dropped EXE
PID:2592 -
\??\c:\fxrlxxf.exec:\fxrlxxf.exe39⤵
- Executes dropped EXE
PID:1496 -
\??\c:\thhttn.exec:\thhttn.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\5jvvd.exec:\5jvvd.exe41⤵
- Executes dropped EXE
PID:2392 -
\??\c:\1pjvj.exec:\1pjvj.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\lfrxffl.exec:\lfrxffl.exe43⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nhhntt.exec:\nhhntt.exe44⤵
- Executes dropped EXE
PID:2428 -
\??\c:\thnhnt.exec:\thnhnt.exe45⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jdjjp.exec:\jdjjp.exe46⤵
- Executes dropped EXE
PID:2432 -
\??\c:\9vjvv.exec:\9vjvv.exe47⤵
- Executes dropped EXE
PID:2448 -
\??\c:\fxrfrrr.exec:\fxrfrrr.exe48⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hnbbhh.exec:\hnbbhh.exe49⤵
- Executes dropped EXE
PID:1608 -
\??\c:\btbntb.exec:\btbntb.exe50⤵
- Executes dropped EXE
PID:1504 -
\??\c:\jvddj.exec:\jvddj.exe51⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rxrfxlf.exec:\rxrfxlf.exe52⤵
- Executes dropped EXE
PID:1220 -
\??\c:\5xlxxxx.exec:\5xlxxxx.exe53⤵
- Executes dropped EXE
PID:908 -
\??\c:\7nbthh.exec:\7nbthh.exe54⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vjvvp.exec:\vjvvp.exe55⤵
- Executes dropped EXE
PID:2304 -
\??\c:\djpdd.exec:\djpdd.exe56⤵
- Executes dropped EXE
PID:304 -
\??\c:\lrrllff.exec:\lrrllff.exe57⤵
- Executes dropped EXE
PID:1660 -
\??\c:\httnnb.exec:\httnnb.exe58⤵
- Executes dropped EXE
PID:2184 -
\??\c:\thtbtt.exec:\thtbtt.exe59⤵
- Executes dropped EXE
PID:1580 -
\??\c:\pjjvd.exec:\pjjvd.exe60⤵
- Executes dropped EXE
PID:1508 -
\??\c:\fxfllrl.exec:\fxfllrl.exe61⤵
- Executes dropped EXE
PID:1236 -
\??\c:\7frlfxx.exec:\7frlfxx.exe62⤵
- Executes dropped EXE
PID:1948 -
\??\c:\tbhhnn.exec:\tbhhnn.exe63⤵
- Executes dropped EXE
PID:3024 -
\??\c:\ntbnhh.exec:\ntbnhh.exe64⤵
- Executes dropped EXE
PID:628 -
\??\c:\vjpjp.exec:\vjpjp.exe65⤵
- Executes dropped EXE
PID:2328 -
\??\c:\5fllfxx.exec:\5fllfxx.exe66⤵PID:1148
-
\??\c:\xlrrxll.exec:\xlrrxll.exe67⤵PID:576
-
\??\c:\3bnbbt.exec:\3bnbbt.exe68⤵PID:1992
-
\??\c:\1nbnhb.exec:\1nbnhb.exe69⤵PID:2776
-
\??\c:\jvddd.exec:\jvddd.exe70⤵PID:840
-
\??\c:\lfrxfxf.exec:\lfrxfxf.exe71⤵PID:988
-
\??\c:\7xxllxx.exec:\7xxllxx.exe72⤵PID:1884
-
\??\c:\9bbnnh.exec:\9bbnnh.exe73⤵PID:956
-
\??\c:\5thbbb.exec:\5thbbb.exe74⤵PID:2976
-
\??\c:\dppdv.exec:\dppdv.exe75⤵PID:1668
-
\??\c:\9dvdj.exec:\9dvdj.exe76⤵PID:2936
-
\??\c:\1frlflx.exec:\1frlflx.exe77⤵PID:1208
-
\??\c:\rxxxxrr.exec:\rxxxxrr.exe78⤵PID:1412
-
\??\c:\1bhtbt.exec:\1bhtbt.exe79⤵PID:896
-
\??\c:\tbnbbt.exec:\tbnbbt.exe80⤵PID:2056
-
\??\c:\pdvjj.exec:\pdvjj.exe81⤵PID:832
-
\??\c:\llffffr.exec:\llffffr.exe82⤵PID:2028
-
\??\c:\frrrfxx.exec:\frrrfxx.exe83⤵PID:2696
-
\??\c:\7htnnh.exec:\7htnnh.exe84⤵PID:2636
-
\??\c:\vppvv.exec:\vppvv.exe85⤵PID:1756
-
\??\c:\3jppd.exec:\3jppd.exe86⤵PID:2512
-
\??\c:\frfffxf.exec:\frfffxf.exe87⤵PID:2652
-
\??\c:\bhbbbn.exec:\bhbbbn.exe88⤵PID:2672
-
\??\c:\tbbhnt.exec:\tbbhnt.exe89⤵PID:2600
-
\??\c:\vpdjp.exec:\vpdjp.exe90⤵PID:2584
-
\??\c:\9llrrrx.exec:\9llrrrx.exe91⤵PID:2404
-
\??\c:\fxlxflf.exec:\fxlxflf.exe92⤵PID:2400
-
\??\c:\thnntt.exec:\thnntt.exe93⤵PID:876
-
\??\c:\vjpjp.exec:\vjpjp.exe94⤵PID:2276
-
\??\c:\dvpvj.exec:\dvpvj.exe95⤵PID:2796
-
\??\c:\xrlfffl.exec:\xrlfffl.exe96⤵PID:1016
-
\??\c:\rllxfff.exec:\rllxfff.exe97⤵PID:1500
-
\??\c:\thnbhb.exec:\thnbhb.exe98⤵PID:2484
-
\??\c:\jdpvj.exec:\jdpvj.exe99⤵PID:808
-
\??\c:\1djpp.exec:\1djpp.exe100⤵PID:240
-
\??\c:\lfxrffr.exec:\lfxrffr.exe101⤵PID:1212
-
\??\c:\xlrxllx.exec:\xlrxllx.exe102⤵PID:1648
-
\??\c:\nbhhnh.exec:\nbhhnh.exe103⤵PID:1732
-
\??\c:\pjpvv.exec:\pjpvv.exe104⤵PID:2768
-
\??\c:\jjdpv.exec:\jjdpv.exe105⤵PID:3016
-
\??\c:\xlxxrrx.exec:\xlxxrrx.exe106⤵PID:1580
-
\??\c:\nbbttn.exec:\nbbttn.exe107⤵PID:2944
-
\??\c:\9vjjv.exec:\9vjjv.exe108⤵PID:1952
-
\??\c:\7vjvj.exec:\7vjvj.exe109⤵PID:2676
-
\??\c:\frxrlfl.exec:\frxrlfl.exe110⤵PID:2076
-
\??\c:\rlxlflx.exec:\rlxlflx.exe111⤵PID:624
-
\??\c:\hbnnhh.exec:\hbnnhh.exe112⤵PID:324
-
\??\c:\nbnthh.exec:\nbnthh.exe113⤵PID:480
-
\??\c:\ppdvp.exec:\ppdvp.exe114⤵PID:564
-
\??\c:\lxllrrx.exec:\lxllrrx.exe115⤵PID:836
-
\??\c:\rfrllxx.exec:\rfrllxx.exe116⤵PID:980
-
\??\c:\bbnbnn.exec:\bbnbnn.exe117⤵PID:1288
-
\??\c:\hhttnn.exec:\hhttnn.exe118⤵PID:1676
-
\??\c:\vvdpv.exec:\vvdpv.exe119⤵PID:2360
-
\??\c:\xrrfrll.exec:\xrrfrll.exe120⤵PID:2024
-
\??\c:\rlrrffl.exec:\rlrrffl.exe121⤵PID:636
-
\??\c:\7ttntn.exec:\7ttntn.exe122⤵PID:2940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-