Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 23:13
Behavioral task
behavioral1
Sample
7a072a4df9ecca6f7e3d4952cab616dd745601fcf4098aa04acf8f90e76de3c0.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
General
-
Target
7a072a4df9ecca6f7e3d4952cab616dd745601fcf4098aa04acf8f90e76de3c0.exe
-
Size
441KB
-
MD5
f02f73a168e46e1199b9a90d10aafd42
-
SHA1
7fe494d271a5f482c5e4c7c2073d9a489ab0c2ce
-
SHA256
7a072a4df9ecca6f7e3d4952cab616dd745601fcf4098aa04acf8f90e76de3c0
-
SHA512
82a470adc968adf8c4c1da8e04c8b764b8a7cd2590ac8fbee45ec65ef167314179593b887a00b058f419da5baac17df3db95613031369a18e5f32652c9a15d89
-
SSDEEP
12288:M4wFHoSpg4wFHonR/nPF2LnFL4wF04wFK4wFK4wluy:UrR/nPp
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5380-6-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5892-7-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5892-13-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1584-20-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3596-29-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5384-48-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5012-69-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3892-84-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3460-91-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3636-117-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1744-157-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5088-175-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2056-272-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1188-279-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5392-291-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4732-306-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4732-310-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2592-319-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5748-324-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5748-320-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2592-315-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5460-314-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3076-305-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3796-300-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5392-295-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5204-290-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5568-286-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5160-283-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1188-273-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3760-268-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3620-259-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5008-254-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/6136-246-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5004-240-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4692-235-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4388-231-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2372-226-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2988-224-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4504-215-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3344-210-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1400-205-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5044-197-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/536-189-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5088-182-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5516-177-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1244-168-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5052-162-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/552-150-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5440-143-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5024-135-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2152-133-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3052-122-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4068-110-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5060-104-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5060-99-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3460-96-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3892-90-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5216-83-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5432-77-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5012-63-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3140-62-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3140-56-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/960-55-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/960-49-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/5380-6-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5892-13-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/1584-20-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3596-29-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/files/0x000700000002341b-41.dat UPX behavioral2/memory/5384-48-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5012-69-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3892-84-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3460-91-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/files/0x0007000000023424-101.dat UPX behavioral2/memory/3636-111-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3636-117-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/files/0x0007000000023429-137.dat UPX behavioral2/memory/1744-157-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/files/0x000700000002342e-163.dat UPX behavioral2/memory/5088-175-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/files/0x0007000000023434-200.dat UPX behavioral2/memory/5004-236-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/6136-241-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5704-260-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/2056-272-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/1188-279-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5392-291-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3796-296-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3076-301-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/4732-306-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/4732-310-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/2592-319-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5748-324-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5748-320-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/2592-315-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5460-314-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3076-305-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3796-300-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5392-295-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5204-290-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5568-286-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5160-283-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5160-276-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3760-268-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3760-263-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3620-259-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3620-255-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5008-254-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5008-250-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/6136-246-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/1956-244-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5004-240-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/4692-235-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/4388-231-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/4388-227-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/2372-226-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/2988-224-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/2988-217-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/files/0x0009000000023414-216.dat UPX behavioral2/memory/4504-215-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3344-210-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/files/0x0007000000023435-208.dat UPX behavioral2/memory/1400-205-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3344-202-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5044-197-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/files/0x0007000000023433-194.dat UPX behavioral2/memory/5044-190-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/536-189-0x0000000000400000-0x000000000048C000-memory.dmp UPX -
Executes dropped EXE 13 IoCs
pid Process 5892 7rrrlrl.exe 1584 hnnhnh.exe 4020 dppjv.exe 3596 vjjjd.exe 1820 lfffxxr.exe 5384 9xlxrfx.exe 960 jvppj.exe 3140 3pjjd.exe 5012 xrllffx.exe 5432 rrrllll.exe 5216 hhnnnt.exe 3892 5pjdv.exe 3460 rrrlfxx.exe -
resource yara_rule behavioral2/memory/5380-0-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5380-6-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5892-7-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5892-13-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1584-20-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3596-29-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000700000002341b-41.dat upx behavioral2/memory/5384-48-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5012-69-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3892-84-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3460-91-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023424-101.dat upx behavioral2/memory/3636-111-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3636-117-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023429-137.dat upx behavioral2/memory/1744-157-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000700000002342e-163.dat upx behavioral2/memory/5088-175-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023434-200.dat upx behavioral2/memory/5004-236-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/6136-241-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5704-260-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2056-272-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1188-279-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5392-291-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3796-296-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3076-301-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4732-306-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4732-310-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2592-319-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5748-324-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5748-320-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2592-315-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5460-314-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3076-305-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3796-300-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5392-295-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5204-290-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5568-286-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5160-283-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5160-276-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1188-273-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3760-268-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3760-263-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3620-259-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3620-255-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5008-254-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5008-250-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/6136-246-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1956-244-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5004-240-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4692-235-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4388-231-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4388-227-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2372-226-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2988-224-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2372-221-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2988-217-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0009000000023414-216.dat upx behavioral2/memory/4504-215-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3344-210-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023435-208.dat upx behavioral2/memory/1400-205-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1400-203-0x0000000000400000-0x000000000048C000-memory.dmp upx -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 5380 wrote to memory of 5892 5380 7a072a4df9ecca6f7e3d4952cab616dd745601fcf4098aa04acf8f90e76de3c0.exe 82 PID 5380 wrote to memory of 5892 5380 7a072a4df9ecca6f7e3d4952cab616dd745601fcf4098aa04acf8f90e76de3c0.exe 82 PID 5380 wrote to memory of 5892 5380 7a072a4df9ecca6f7e3d4952cab616dd745601fcf4098aa04acf8f90e76de3c0.exe 82 PID 5892 wrote to memory of 1584 5892 7rrrlrl.exe 83 PID 5892 wrote to memory of 1584 5892 7rrrlrl.exe 83 PID 5892 wrote to memory of 1584 5892 7rrrlrl.exe 83 PID 1584 wrote to memory of 4020 1584 hnnhnh.exe 84 PID 1584 wrote to memory of 4020 1584 hnnhnh.exe 84 PID 1584 wrote to memory of 4020 1584 hnnhnh.exe 84 PID 4020 wrote to memory of 3596 4020 dppjv.exe 85 PID 4020 wrote to memory of 3596 4020 dppjv.exe 85 PID 4020 wrote to memory of 3596 4020 dppjv.exe 85 PID 3596 wrote to memory of 1820 3596 vjjjd.exe 86 PID 3596 wrote to memory of 1820 3596 vjjjd.exe 86 PID 3596 wrote to memory of 1820 3596 vjjjd.exe 86 PID 1820 wrote to memory of 5384 1820 lfffxxr.exe 87 PID 1820 wrote to memory of 5384 1820 lfffxxr.exe 87 PID 1820 wrote to memory of 5384 1820 lfffxxr.exe 87 PID 5384 wrote to memory of 960 5384 9xlxrfx.exe 88 PID 5384 wrote to memory of 960 5384 9xlxrfx.exe 88 PID 5384 wrote to memory of 960 5384 9xlxrfx.exe 88 PID 960 wrote to memory of 3140 960 jvppj.exe 89 PID 960 wrote to memory of 3140 960 jvppj.exe 89 PID 960 wrote to memory of 3140 960 jvppj.exe 89 PID 3140 wrote to memory of 5012 3140 3pjjd.exe 91 PID 3140 wrote to memory of 5012 3140 3pjjd.exe 91 PID 3140 wrote to memory of 5012 3140 3pjjd.exe 91 PID 5012 wrote to memory of 5432 5012 xrllffx.exe 92 PID 5012 wrote to memory of 5432 5012 xrllffx.exe 92 PID 5012 wrote to memory of 5432 5012 xrllffx.exe 92 PID 5432 wrote to memory of 5216 5432 rrrllll.exe 1425 PID 5432 wrote to memory of 5216 5432 rrrllll.exe 1425 PID 5432 wrote to memory of 5216 5432 rrrllll.exe 1425 PID 5216 wrote to memory of 3892 5216 hhnnnt.exe 95 PID 5216 wrote to memory of 3892 5216 hhnnnt.exe 95 PID 5216 wrote to memory of 3892 5216 hhnnnt.exe 95 PID 3892 wrote to memory of 3460 3892 5pjdv.exe 96 PID 3892 wrote to memory of 3460 3892 5pjdv.exe 96 PID 3892 wrote to memory of 3460 3892 5pjdv.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a072a4df9ecca6f7e3d4952cab616dd745601fcf4098aa04acf8f90e76de3c0.exe"C:\Users\Admin\AppData\Local\Temp\7a072a4df9ecca6f7e3d4952cab616dd745601fcf4098aa04acf8f90e76de3c0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5380 -
\??\c:\7rrrlrl.exec:\7rrrlrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
\??\c:\hnnhnh.exec:\hnnhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\dppjv.exec:\dppjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\vjjjd.exec:\vjjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\lfffxxr.exec:\lfffxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\9xlxrfx.exec:\9xlxrfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
\??\c:\jvppj.exec:\jvppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\3pjjd.exec:\3pjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\xrllffx.exec:\xrllffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\rrrllll.exec:\rrrllll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
\??\c:\hhnnnt.exec:\hhnnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
\??\c:\5pjdv.exec:\5pjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\rrrlfxx.exec:\rrrlfxx.exe14⤵
- Executes dropped EXE
PID:3460 -
\??\c:\hbhbbb.exec:\hbhbbb.exe15⤵PID:5060
-
\??\c:\nnbtnh.exec:\nnbtnh.exe16⤵PID:4068
-
\??\c:\jdpjd.exec:\jdpjd.exe17⤵PID:3636
-
\??\c:\lxxxfff.exec:\lxxxfff.exe18⤵PID:3052
-
\??\c:\nhbhtn.exec:\nhbhtn.exe19⤵PID:2152
-
\??\c:\7dddj.exec:\7dddj.exe20⤵PID:5024
-
\??\c:\lxfxfll.exec:\lxfxfll.exe21⤵PID:5440
-
\??\c:\rxfxxxf.exec:\rxfxxxf.exe22⤵PID:552
-
\??\c:\hhbhhb.exec:\hhbhhb.exe23⤵PID:1744
-
\??\c:\vppjd.exec:\vppjd.exe24⤵PID:5052
-
\??\c:\lffxffx.exec:\lffxffx.exe25⤵PID:1244
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe26⤵PID:5516
-
\??\c:\bhtnnn.exec:\bhtnnn.exe27⤵PID:5088
-
\??\c:\jjvpj.exec:\jjvpj.exe28⤵PID:536
-
\??\c:\3flflll.exec:\3flflll.exe29⤵PID:5044
-
\??\c:\9nntnn.exec:\9nntnn.exe30⤵PID:1400
-
\??\c:\bttntt.exec:\bttntt.exe31⤵PID:3344
-
\??\c:\djjjd.exec:\djjjd.exe32⤵PID:4504
-
\??\c:\tttthh.exec:\tttthh.exe33⤵PID:2988
-
\??\c:\3dpjp.exec:\3dpjp.exe34⤵PID:2372
-
\??\c:\xlxlxrx.exec:\xlxlxrx.exe35⤵PID:4388
-
\??\c:\rlffxxr.exec:\rlffxxr.exe36⤵PID:4692
-
\??\c:\5ntnbb.exec:\5ntnbb.exe37⤵PID:5004
-
\??\c:\rflrffr.exec:\rflrffr.exe38⤵PID:6136
-
\??\c:\htttnn.exec:\htttnn.exe39⤵PID:1956
-
\??\c:\jvvpj.exec:\jvvpj.exe40⤵PID:5008
-
\??\c:\xllfxxr.exec:\xllfxxr.exe41⤵PID:3620
-
\??\c:\rrxxlxf.exec:\rrxxlxf.exe42⤵PID:5704
-
\??\c:\thhbtt.exec:\thhbtt.exe43⤵PID:3760
-
\??\c:\9fxrllf.exec:\9fxrllf.exe44⤵PID:2056
-
\??\c:\xrlffrr.exec:\xrlffrr.exe45⤵PID:1188
-
\??\c:\hnhtnh.exec:\hnhtnh.exe46⤵PID:5160
-
\??\c:\pjjdv.exec:\pjjdv.exe47⤵PID:5568
-
\??\c:\5pppj.exec:\5pppj.exe48⤵PID:5204
-
\??\c:\7rxrrrl.exec:\7rxrrrl.exe49⤵PID:5392
-
\??\c:\lfflffx.exec:\lfflffx.exe50⤵PID:3796
-
\??\c:\jvddv.exec:\jvddv.exe51⤵PID:3076
-
\??\c:\llxrfxl.exec:\llxrfxl.exe52⤵PID:4732
-
\??\c:\3ntnhh.exec:\3ntnhh.exe53⤵PID:5460
-
\??\c:\vvjdv.exec:\vvjdv.exe54⤵PID:2592
-
\??\c:\5dppp.exec:\5dppp.exe55⤵PID:5748
-
\??\c:\fflrlrr.exec:\fflrlrr.exe56⤵PID:3700
-
\??\c:\nhbtbt.exec:\nhbtbt.exe57⤵PID:1152
-
\??\c:\tbhnhn.exec:\tbhnhn.exe58⤵PID:5716
-
\??\c:\dppjd.exec:\dppjd.exe59⤵PID:1272
-
\??\c:\lrlxxxx.exec:\lrlxxxx.exe60⤵PID:3500
-
\??\c:\nhhnbt.exec:\nhhnbt.exe61⤵PID:6072
-
\??\c:\vvjdp.exec:\vvjdp.exe62⤵PID:4828
-
\??\c:\pddvp.exec:\pddvp.exe63⤵PID:4944
-
\??\c:\lxrrlfx.exec:\lxrrlfx.exe64⤵PID:4472
-
\??\c:\ntthth.exec:\ntthth.exe65⤵PID:2688
-
\??\c:\djvjv.exec:\djvjv.exe66⤵PID:3232
-
\??\c:\9ddvd.exec:\9ddvd.exe67⤵PID:4412
-
\??\c:\llfrfxl.exec:\llfrfxl.exe68⤵PID:1668
-
\??\c:\htnhbb.exec:\htnhbb.exe69⤵PID:1676
-
\??\c:\dpdvp.exec:\dpdvp.exe70⤵PID:4236
-
\??\c:\5lrrlrl.exec:\5lrrlrl.exe71⤵PID:960
-
\??\c:\thbtnh.exec:\thbtnh.exe72⤵PID:4304
-
\??\c:\pjpjp.exec:\pjpjp.exe73⤵PID:3696
-
\??\c:\1ffxfxf.exec:\1ffxfxf.exe74⤵PID:3444
-
\??\c:\hbbbnb.exec:\hbbbnb.exe75⤵PID:1848
-
\??\c:\5httnh.exec:\5httnh.exe76⤵PID:3892
-
\??\c:\9rxxrrr.exec:\9rxxrrr.exe77⤵PID:3320
-
\??\c:\fxrlllf.exec:\fxrlllf.exe78⤵PID:4216
-
\??\c:\7bhtnn.exec:\7bhtnn.exe79⤵PID:5320
-
\??\c:\9ppdp.exec:\9ppdp.exe80⤵PID:4432
-
\??\c:\jjjjv.exec:\jjjjv.exe81⤵PID:2924
-
\??\c:\rfllrxl.exec:\rfllrxl.exe82⤵PID:2392
-
\??\c:\xrllllf.exec:\xrllllf.exe83⤵PID:5804
-
\??\c:\bhtbnb.exec:\bhtbnb.exe84⤵PID:2948
-
\??\c:\vdjjd.exec:\vdjjd.exe85⤵PID:1752
-
\??\c:\ddpdv.exec:\ddpdv.exe86⤵PID:5768
-
\??\c:\1ffxrlf.exec:\1ffxrlf.exe87⤵PID:5780
-
\??\c:\7nnhhb.exec:\7nnhhb.exe88⤵PID:4440
-
\??\c:\tttttt.exec:\tttttt.exe89⤵PID:5088
-
\??\c:\5pppd.exec:\5pppd.exe90⤵PID:1048
-
\??\c:\fllxlxl.exec:\fllxlxl.exe91⤵PID:1400
-
\??\c:\rffffxx.exec:\rffffxx.exe92⤵PID:4568
-
\??\c:\nhtbhb.exec:\nhtbhb.exe93⤵PID:4536
-
\??\c:\9ppjd.exec:\9ppjd.exe94⤵PID:1264
-
\??\c:\djpvp.exec:\djpvp.exe95⤵PID:1144
-
\??\c:\flrllll.exec:\flrllll.exe96⤵PID:5428
-
\??\c:\bbttnh.exec:\bbttnh.exe97⤵PID:2192
-
\??\c:\bnbbtt.exec:\bnbbtt.exe98⤵PID:5116
-
\??\c:\djvvd.exec:\djvvd.exe99⤵PID:4808
-
\??\c:\xxfflff.exec:\xxfflff.exe100⤵PID:5660
-
\??\c:\rflfxrl.exec:\rflfxrl.exe101⤵PID:4300
-
\??\c:\htnhhh.exec:\htnhhh.exe102⤵PID:4128
-
\??\c:\dddvv.exec:\dddvv.exe103⤵PID:4528
-
\??\c:\dppjj.exec:\dppjj.exe104⤵PID:5444
-
\??\c:\fllllff.exec:\fllllff.exe105⤵PID:4612
-
\??\c:\rrlfrrf.exec:\rrlfrrf.exe106⤵PID:2280
-
\??\c:\bnnhbt.exec:\bnnhbt.exe107⤵PID:1696
-
\??\c:\bhhhhh.exec:\bhhhhh.exe108⤵PID:1896
-
\??\c:\pjdvj.exec:\pjdvj.exe109⤵PID:1436
-
\??\c:\5fxxrrr.exec:\5fxxrrr.exe110⤵PID:1228
-
\??\c:\5lfxrlf.exec:\5lfxrlf.exe111⤵PID:2736
-
\??\c:\bthhbb.exec:\bthhbb.exe112⤵PID:2692
-
\??\c:\dvddd.exec:\dvddd.exe113⤵PID:2580
-
\??\c:\pvppv.exec:\pvppv.exe114⤵PID:5272
-
\??\c:\rffxrlf.exec:\rffxrlf.exe115⤵PID:2196
-
\??\c:\tnnhbb.exec:\tnnhbb.exe116⤵PID:3348
-
\??\c:\thnnbb.exec:\thnnbb.exe117⤵PID:3840
-
\??\c:\jpppp.exec:\jpppp.exe118⤵PID:4852
-
\??\c:\1rrllll.exec:\1rrllll.exe119⤵PID:4980
-
\??\c:\1rlllll.exec:\1rlllll.exe120⤵PID:1868
-
\??\c:\nhbbtn.exec:\nhbbtn.exe121⤵PID:2072
-
\??\c:\5dpjd.exec:\5dpjd.exe122⤵PID:5380
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-