Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 21:08
Behavioral task
behavioral1
Sample
4b9c87680a17c6a9f7ef96b5807c257051cafc0f5715d6cb7ff85a774db098ed.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
4b9c87680a17c6a9f7ef96b5807c257051cafc0f5715d6cb7ff85a774db098ed.exe
-
Size
360KB
-
MD5
a9ee6d3710b88fc903b824e7216e5d03
-
SHA1
6d21283c921f58f42525ecee21653e52c2f0e6f8
-
SHA256
4b9c87680a17c6a9f7ef96b5807c257051cafc0f5715d6cb7ff85a774db098ed
-
SHA512
96fde38791ed4ad4eeb04cf857b51966bf0d8ae3f8a51e5349964b4cd390ea5a3e71a0b08af90cdeb458a112285f343f4a55ae891c7da842fd7d057d3bcaaad3
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwu1b26X1wjhtSizj3:R4wFHoSHYHUrAwqzc5
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2924-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2076-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1424-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-168-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2392-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/932-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1364-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1516-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1236-537-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-673-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-853-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-872-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-1216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-8292-0x0000000076E40000-0x0000000076F5F000-memory.dmp family_blackmoon behavioral1/memory/2200-12824-0x0000000076E40000-0x0000000076F5F000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2924-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000b0000000160cc-5.dat UPX behavioral1/memory/3024-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0033000000016813-14.dat UPX behavioral1/memory/3028-15-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000016c42-22.dat UPX behavioral1/memory/3028-23-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000016c8c-30.dat UPX behavioral1/memory/1728-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000016cb2-38.dat UPX behavioral1/memory/2884-39-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000016ce4-46.dat UPX behavioral1/memory/2720-48-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2884-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0009000000016cfd-57.dat UPX behavioral1/memory/2456-56-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3008-65-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2456-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000700000001739d-63.dat UPX behavioral1/files/0x00060000000173e5-73.dat UPX behavioral1/memory/3008-72-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000600000001744c-80.dat UPX behavioral1/memory/2492-82-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2492-89-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000175ac-88.dat UPX behavioral1/files/0x00060000000175b2-96.dat UPX behavioral1/memory/2076-97-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1424-98-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000175b8-106.dat UPX behavioral1/memory/1424-105-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x001500000001863c-116.dat UPX behavioral1/memory/2960-115-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2840-114-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2960-123-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0009000000018640-122.dat UPX behavioral1/files/0x000500000001865a-132.dat UPX behavioral1/memory/2752-131-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00050000000186c1-138.dat UPX behavioral1/files/0x00050000000186d3-145.dat UPX behavioral1/memory/2408-153-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0005000000018700-152.dat UPX behavioral1/files/0x000500000001874a-160.dat UPX behavioral1/memory/2600-161-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1524-171-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0033000000016a6f-170.dat UPX behavioral1/files/0x000500000001874c-178.dat UPX behavioral1/files/0x0006000000018bba-184.dat UPX behavioral1/files/0x00050000000191eb-191.dat UPX behavioral1/files/0x00050000000191ed-198.dat UPX behavioral1/files/0x0005000000019223-205.dat UPX behavioral1/files/0x0005000000019227-212.dat UPX behavioral1/files/0x0005000000019233-219.dat UPX behavioral1/memory/2392-226-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0005000000019235-228.dat UPX behavioral1/files/0x0005000000019248-235.dat UPX behavioral1/files/0x0005000000019254-242.dat UPX behavioral1/files/0x0005000000019331-250.dat UPX behavioral1/memory/932-261-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1696-267-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1696-273-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1364-274-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1364-280-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3032-296-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1600-302-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3024 vddjd.exe 3028 3rlxlfl.exe 3056 jjdjd.exe 1728 rrfxlrf.exe 2884 fxlfllr.exe 2720 7vvvj.exe 2456 frflxxl.exe 3008 nnnnnh.exe 2420 1pdjj.exe 2492 7nbthh.exe 2076 thttbh.exe 1424 rfrxlrf.exe 2840 nhntbb.exe 2960 7lrrrxx.exe 2752 nthhth.exe 1680 jjvdp.exe 1672 7dvdj.exe 2408 5hbtnn.exe 2600 jjvjv.exe 344 llxflrx.exe 1524 fxrrffl.exe 2008 1ttbnt.exe 500 jdvvp.exe 2308 3bntbn.exe 2892 vpvvd.exe 636 fxfrrxl.exe 1944 bttnbb.exe 2392 dvjdp.exe 1416 lxfflll.exe 1248 ppjdd.exe 568 5xlxllr.exe 1056 tnnbbn.exe 932 ppjjd.exe 1316 rlxfffx.exe 1696 lffxlll.exe 1364 pjvvj.exe 296 pjdjj.exe 812 rlrlxfx.exe 1932 5bhbtb.exe 3032 vdpdj.exe 1600 lxlxrfx.exe 2608 1bhtbn.exe 3028 thnnht.exe 1640 dpvvd.exe 2632 5fxfrrx.exe 2572 nnhntt.exe 2552 7dvjd.exe 3064 vvppp.exe 2536 lxrrxxx.exe 2556 7hbnth.exe 2464 nhnnnn.exe 2436 pjvdp.exe 2484 rrlrxff.exe 2492 5tthnn.exe 2952 pjpjv.exe 2824 jppdv.exe 2856 fxrxlrf.exe 2980 nhtnbh.exe 2836 vddvd.exe 1860 xrfxffr.exe 2696 bthntn.exe 1968 hbnhnt.exe 308 vvjdp.exe 2664 rlrxxrf.exe -
resource yara_rule behavioral1/memory/2924-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b0000000160cc-5.dat upx behavioral1/memory/3024-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0033000000016813-14.dat upx behavioral1/memory/3028-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c42-22.dat upx behavioral1/memory/3028-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c8c-30.dat upx behavioral1/memory/1728-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cb2-38.dat upx behavioral1/memory/2884-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016ce4-46.dat upx behavioral1/memory/2720-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2884-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016cfd-57.dat upx behavioral1/memory/2456-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3008-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2456-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001739d-63.dat upx behavioral1/files/0x00060000000173e5-73.dat upx behavioral1/memory/3008-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001744c-80.dat upx behavioral1/memory/2492-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2492-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175ac-88.dat upx behavioral1/files/0x00060000000175b2-96.dat upx behavioral1/memory/2076-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1424-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175b8-106.dat upx behavioral1/memory/1424-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001500000001863c-116.dat upx behavioral1/memory/2960-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2960-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000018640-122.dat upx behavioral1/files/0x000500000001865a-132.dat upx behavioral1/memory/2752-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186c1-138.dat upx behavioral1/files/0x00050000000186d3-145.dat upx behavioral1/memory/2408-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018700-152.dat upx behavioral1/files/0x000500000001874a-160.dat upx behavioral1/memory/2600-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1524-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0033000000016a6f-170.dat upx behavioral1/files/0x000500000001874c-178.dat upx behavioral1/files/0x0006000000018bba-184.dat upx behavioral1/files/0x00050000000191eb-191.dat upx behavioral1/files/0x00050000000191ed-198.dat upx behavioral1/files/0x0005000000019223-205.dat upx behavioral1/files/0x0005000000019227-212.dat upx behavioral1/files/0x0005000000019233-219.dat upx behavioral1/memory/2392-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019235-228.dat upx behavioral1/files/0x0005000000019248-235.dat upx behavioral1/files/0x0005000000019254-242.dat upx behavioral1/files/0x0005000000019331-250.dat upx behavioral1/memory/932-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1696-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1696-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1364-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1364-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3032-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1600-302-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2924 wrote to memory of 3024 2924 4b9c87680a17c6a9f7ef96b5807c257051cafc0f5715d6cb7ff85a774db098ed.exe 28 PID 2924 wrote to memory of 3024 2924 4b9c87680a17c6a9f7ef96b5807c257051cafc0f5715d6cb7ff85a774db098ed.exe 28 PID 2924 wrote to memory of 3024 2924 4b9c87680a17c6a9f7ef96b5807c257051cafc0f5715d6cb7ff85a774db098ed.exe 28 PID 2924 wrote to memory of 3024 2924 4b9c87680a17c6a9f7ef96b5807c257051cafc0f5715d6cb7ff85a774db098ed.exe 28 PID 3024 wrote to memory of 3028 3024 vddjd.exe 29 PID 3024 wrote to memory of 3028 3024 vddjd.exe 29 PID 3024 wrote to memory of 3028 3024 vddjd.exe 29 PID 3024 wrote to memory of 3028 3024 vddjd.exe 29 PID 3028 wrote to memory of 3056 3028 3rlxlfl.exe 30 PID 3028 wrote to memory of 3056 3028 3rlxlfl.exe 30 PID 3028 wrote to memory of 3056 3028 3rlxlfl.exe 30 PID 3028 wrote to memory of 3056 3028 3rlxlfl.exe 30 PID 3056 wrote to memory of 1728 3056 jjdjd.exe 31 PID 3056 wrote to memory of 1728 3056 jjdjd.exe 31 PID 3056 wrote to memory of 1728 3056 jjdjd.exe 31 PID 3056 wrote to memory of 1728 3056 jjdjd.exe 31 PID 1728 wrote to memory of 2884 1728 rrfxlrf.exe 32 PID 1728 wrote to memory of 2884 1728 rrfxlrf.exe 32 PID 1728 wrote to memory of 2884 1728 rrfxlrf.exe 32 PID 1728 wrote to memory of 2884 1728 rrfxlrf.exe 32 PID 2884 wrote to memory of 2720 2884 fxlfllr.exe 33 PID 2884 wrote to memory of 2720 2884 fxlfllr.exe 33 PID 2884 wrote to memory of 2720 2884 fxlfllr.exe 33 PID 2884 wrote to memory of 2720 2884 fxlfllr.exe 33 PID 2720 wrote to memory of 2456 2720 7vvvj.exe 34 PID 2720 wrote to memory of 2456 2720 7vvvj.exe 34 PID 2720 wrote to memory of 2456 2720 7vvvj.exe 34 PID 2720 wrote to memory of 2456 2720 7vvvj.exe 34 PID 2456 wrote to memory of 3008 2456 frflxxl.exe 35 PID 2456 wrote to memory of 3008 2456 frflxxl.exe 35 PID 2456 wrote to memory of 3008 2456 frflxxl.exe 35 PID 2456 wrote to memory of 3008 2456 frflxxl.exe 35 PID 3008 wrote to memory of 2420 3008 nnnnnh.exe 36 PID 3008 wrote to memory of 2420 3008 nnnnnh.exe 36 PID 3008 wrote to memory of 2420 3008 nnnnnh.exe 36 PID 3008 wrote to memory of 2420 3008 nnnnnh.exe 36 PID 2420 wrote to memory of 2492 2420 1pdjj.exe 37 PID 2420 wrote to memory of 2492 2420 1pdjj.exe 37 PID 2420 wrote to memory of 2492 2420 1pdjj.exe 37 PID 2420 wrote to memory of 2492 2420 1pdjj.exe 37 PID 2492 wrote to memory of 2076 2492 7nbthh.exe 38 PID 2492 wrote to memory of 2076 2492 7nbthh.exe 38 PID 2492 wrote to memory of 2076 2492 7nbthh.exe 38 PID 2492 wrote to memory of 2076 2492 7nbthh.exe 38 PID 2076 wrote to memory of 1424 2076 thttbh.exe 39 PID 2076 wrote to memory of 1424 2076 thttbh.exe 39 PID 2076 wrote to memory of 1424 2076 thttbh.exe 39 PID 2076 wrote to memory of 1424 2076 thttbh.exe 39 PID 1424 wrote to memory of 2840 1424 rfrxlrf.exe 40 PID 1424 wrote to memory of 2840 1424 rfrxlrf.exe 40 PID 1424 wrote to memory of 2840 1424 rfrxlrf.exe 40 PID 1424 wrote to memory of 2840 1424 rfrxlrf.exe 40 PID 2840 wrote to memory of 2960 2840 nhntbb.exe 41 PID 2840 wrote to memory of 2960 2840 nhntbb.exe 41 PID 2840 wrote to memory of 2960 2840 nhntbb.exe 41 PID 2840 wrote to memory of 2960 2840 nhntbb.exe 41 PID 2960 wrote to memory of 2752 2960 7lrrrxx.exe 42 PID 2960 wrote to memory of 2752 2960 7lrrrxx.exe 42 PID 2960 wrote to memory of 2752 2960 7lrrrxx.exe 42 PID 2960 wrote to memory of 2752 2960 7lrrrxx.exe 42 PID 2752 wrote to memory of 1680 2752 nthhth.exe 43 PID 2752 wrote to memory of 1680 2752 nthhth.exe 43 PID 2752 wrote to memory of 1680 2752 nthhth.exe 43 PID 2752 wrote to memory of 1680 2752 nthhth.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b9c87680a17c6a9f7ef96b5807c257051cafc0f5715d6cb7ff85a774db098ed.exe"C:\Users\Admin\AppData\Local\Temp\4b9c87680a17c6a9f7ef96b5807c257051cafc0f5715d6cb7ff85a774db098ed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\vddjd.exec:\vddjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\3rlxlfl.exec:\3rlxlfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\jjdjd.exec:\jjdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\rrfxlrf.exec:\rrfxlrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\fxlfllr.exec:\fxlfllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\7vvvj.exec:\7vvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\frflxxl.exec:\frflxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\nnnnnh.exec:\nnnnnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\1pdjj.exec:\1pdjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\7nbthh.exec:\7nbthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\thttbh.exec:\thttbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\rfrxlrf.exec:\rfrxlrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\nhntbb.exec:\nhntbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\7lrrrxx.exec:\7lrrrxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\nthhth.exec:\nthhth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\jjvdp.exec:\jjvdp.exe17⤵
- Executes dropped EXE
PID:1680 -
\??\c:\7dvdj.exec:\7dvdj.exe18⤵
- Executes dropped EXE
PID:1672 -
\??\c:\5hbtnn.exec:\5hbtnn.exe19⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jjvjv.exec:\jjvjv.exe20⤵
- Executes dropped EXE
PID:2600 -
\??\c:\llxflrx.exec:\llxflrx.exe21⤵
- Executes dropped EXE
PID:344 -
\??\c:\fxrrffl.exec:\fxrrffl.exe22⤵
- Executes dropped EXE
PID:1524 -
\??\c:\1ttbnt.exec:\1ttbnt.exe23⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jdvvp.exec:\jdvvp.exe24⤵
- Executes dropped EXE
PID:500 -
\??\c:\3bntbn.exec:\3bntbn.exe25⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vpvvd.exec:\vpvvd.exe26⤵
- Executes dropped EXE
PID:2892 -
\??\c:\fxfrrxl.exec:\fxfrrxl.exe27⤵
- Executes dropped EXE
PID:636 -
\??\c:\bttnbb.exec:\bttnbb.exe28⤵
- Executes dropped EXE
PID:1944 -
\??\c:\dvjdp.exec:\dvjdp.exe29⤵
- Executes dropped EXE
PID:2392 -
\??\c:\lxfflll.exec:\lxfflll.exe30⤵
- Executes dropped EXE
PID:1416 -
\??\c:\ppjdd.exec:\ppjdd.exe31⤵
- Executes dropped EXE
PID:1248 -
\??\c:\5xlxllr.exec:\5xlxllr.exe32⤵
- Executes dropped EXE
PID:568 -
\??\c:\tnnbbn.exec:\tnnbbn.exe33⤵
- Executes dropped EXE
PID:1056 -
\??\c:\ppjjd.exec:\ppjjd.exe34⤵
- Executes dropped EXE
PID:932 -
\??\c:\rlxfffx.exec:\rlxfffx.exe35⤵
- Executes dropped EXE
PID:1316 -
\??\c:\lffxlll.exec:\lffxlll.exe36⤵
- Executes dropped EXE
PID:1696 -
\??\c:\pjvvj.exec:\pjvvj.exe37⤵
- Executes dropped EXE
PID:1364 -
\??\c:\pjdjj.exec:\pjdjj.exe38⤵
- Executes dropped EXE
PID:296 -
\??\c:\rlrlxfx.exec:\rlrlxfx.exe39⤵
- Executes dropped EXE
PID:812 -
\??\c:\5bhbtb.exec:\5bhbtb.exe40⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vdpdj.exec:\vdpdj.exe41⤵
- Executes dropped EXE
PID:3032 -
\??\c:\lxlxrfx.exec:\lxlxrfx.exe42⤵
- Executes dropped EXE
PID:1600 -
\??\c:\1bhtbn.exec:\1bhtbn.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\thnnht.exec:\thnnht.exe44⤵
- Executes dropped EXE
PID:3028 -
\??\c:\dpvvd.exec:\dpvvd.exe45⤵
- Executes dropped EXE
PID:1640 -
\??\c:\5fxfrrx.exec:\5fxfrrx.exe46⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nnhntt.exec:\nnhntt.exe47⤵
- Executes dropped EXE
PID:2572 -
\??\c:\7dvjd.exec:\7dvjd.exe48⤵
- Executes dropped EXE
PID:2552 -
\??\c:\vvppp.exec:\vvppp.exe49⤵
- Executes dropped EXE
PID:3064 -
\??\c:\lxrrxxx.exec:\lxrrxxx.exe50⤵
- Executes dropped EXE
PID:2536 -
\??\c:\7hbnth.exec:\7hbnth.exe51⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nhnnnn.exec:\nhnnnn.exe52⤵
- Executes dropped EXE
PID:2464 -
\??\c:\pjvdp.exec:\pjvdp.exe53⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rrlrxff.exec:\rrlrxff.exe54⤵
- Executes dropped EXE
PID:2484 -
\??\c:\5tthnn.exec:\5tthnn.exe55⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pjpjv.exec:\pjpjv.exe56⤵
- Executes dropped EXE
PID:2952 -
\??\c:\jppdv.exec:\jppdv.exe57⤵
- Executes dropped EXE
PID:2824 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe58⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nhtnbh.exec:\nhtnbh.exe59⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vddvd.exec:\vddvd.exe60⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xrfxffr.exec:\xrfxffr.exe61⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bthntn.exec:\bthntn.exe62⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hbnhnt.exec:\hbnhnt.exe63⤵
- Executes dropped EXE
PID:1968 -
\??\c:\vvjdp.exec:\vvjdp.exe64⤵
- Executes dropped EXE
PID:308 -
\??\c:\rlrxxrf.exec:\rlrxxrf.exe65⤵
- Executes dropped EXE
PID:2664 -
\??\c:\thtnnh.exec:\thtnnh.exe66⤵PID:1664
-
\??\c:\1hhttb.exec:\1hhttb.exe67⤵PID:2784
-
\??\c:\vjpdp.exec:\vjpdp.exe68⤵PID:1168
-
\??\c:\7fxfxxr.exec:\7fxfxxr.exe69⤵PID:1268
-
\??\c:\hbnhtt.exec:\hbnhtt.exe70⤵PID:1516
-
\??\c:\pjpvj.exec:\pjpvj.exe71⤵PID:2100
-
\??\c:\5vvpv.exec:\5vvpv.exe72⤵PID:2400
-
\??\c:\frffffl.exec:\frffffl.exe73⤵PID:500
-
\??\c:\bthhbh.exec:\bthhbh.exe74⤵PID:2308
-
\??\c:\7bbhth.exec:\7bbhth.exe75⤵PID:2900
-
\??\c:\pjppp.exec:\pjppp.exe76⤵PID:2892
-
\??\c:\ffllrrf.exec:\ffllrrf.exe77⤵PID:2304
-
\??\c:\7ntntt.exec:\7ntntt.exe78⤵PID:1828
-
\??\c:\bttbht.exec:\bttbht.exe79⤵PID:3048
-
\??\c:\jjjjd.exec:\jjjjd.exe80⤵PID:2368
-
\??\c:\7xrrrrx.exec:\7xrrrrx.exe81⤵PID:1568
-
\??\c:\hhtbnb.exec:\hhtbnb.exe82⤵PID:1868
-
\??\c:\5pddd.exec:\5pddd.exe83⤵PID:568
-
\??\c:\ddvvp.exec:\ddvvp.exe84⤵PID:2912
-
\??\c:\rlfrfxx.exec:\rlfrfxx.exe85⤵PID:1236
-
\??\c:\7bbbnt.exec:\7bbbnt.exe86⤵PID:2332
-
\??\c:\5jvjj.exec:\5jvjj.exe87⤵PID:2208
-
\??\c:\fxxxlfl.exec:\fxxxlfl.exe88⤵PID:1508
-
\??\c:\bbhnbt.exec:\bbhnbt.exe89⤵PID:1684
-
\??\c:\7thbnn.exec:\7thbnn.exe90⤵PID:2216
-
\??\c:\jddjv.exec:\jddjv.exe91⤵PID:2932
-
\??\c:\llrlrfx.exec:\llrlrfx.exe92⤵PID:1596
-
\??\c:\rrlrflx.exec:\rrlrflx.exe93⤵PID:2504
-
\??\c:\1btbtt.exec:\1btbtt.exe94⤵PID:2064
-
\??\c:\jddvd.exec:\jddvd.exe95⤵PID:2740
-
\??\c:\jpjdv.exec:\jpjdv.exe96⤵PID:2564
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe97⤵PID:2548
-
\??\c:\7nhhbn.exec:\7nhhbn.exe98⤵PID:2544
-
\??\c:\bttnnt.exec:\bttnnt.exe99⤵PID:2748
-
\??\c:\pppvp.exec:\pppvp.exe100⤵PID:2552
-
\??\c:\fllrrlr.exec:\fllrrlr.exe101⤵PID:2444
-
\??\c:\1bbbnb.exec:\1bbbnb.exe102⤵PID:2456
-
\??\c:\nhtbnt.exec:\nhtbnt.exe103⤵PID:3040
-
\??\c:\dvjpd.exec:\dvjpd.exe104⤵PID:3008
-
\??\c:\lrxllfl.exec:\lrxllfl.exe105⤵PID:2540
-
\??\c:\xrlrxfx.exec:\xrlrxfx.exe106⤵PID:2496
-
\??\c:\bthhtb.exec:\bthhtb.exe107⤵PID:2644
-
\??\c:\1tnthh.exec:\1tnthh.exe108⤵PID:3012
-
\??\c:\7ppvv.exec:\7ppvv.exe109⤵PID:2964
-
\??\c:\lfxlxlr.exec:\lfxlxlr.exe110⤵PID:2788
-
\??\c:\lxlrxxf.exec:\lxlrxxf.exe111⤵PID:2460
-
\??\c:\ttnbhh.exec:\ttnbhh.exe112⤵PID:2960
-
\??\c:\5ppjp.exec:\5ppjp.exe113⤵PID:2596
-
\??\c:\vppdj.exec:\vppdj.exe114⤵PID:1864
-
\??\c:\3rxlllx.exec:\3rxlllx.exe115⤵PID:2396
-
\??\c:\3bnbht.exec:\3bnbht.exe116⤵PID:1532
-
\??\c:\1tbnnb.exec:\1tbnnb.exe117⤵PID:2688
-
\??\c:\djdjp.exec:\djdjp.exe118⤵PID:2508
-
\??\c:\1pvjj.exec:\1pvjj.exe119⤵PID:2108
-
\??\c:\fffrfrr.exec:\fffrfrr.exe120⤵PID:2516
-
\??\c:\rxfrfrr.exec:\rxfrfrr.exe121⤵PID:2000
-
\??\c:\tthnhb.exec:\tthnhb.exe122⤵PID:1264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-