Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 01:36
Behavioral task
behavioral1
Sample
b498e57dbbd5e2f1a9481a94a641a1e6df2973d360f74561db862e4c1d46d344.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
General
-
Target
b498e57dbbd5e2f1a9481a94a641a1e6df2973d360f74561db862e4c1d46d344.exe
-
Size
402KB
-
MD5
25985fd3475102b520be7c83de9face2
-
SHA1
5cb8225bde3c76766addbe9ac9ca73a8a8f708b5
-
SHA256
b498e57dbbd5e2f1a9481a94a641a1e6df2973d360f74561db862e4c1d46d344
-
SHA512
8bae6976bca71bcf275f3e1b70a013de0669067a5c3c231703c1c6276fac06d3d44185a92bdab3323cdf193efb393454b8ac77cf9d601a967b5dee26d31327f5
-
SSDEEP
6144:kcm4FmowdHoSph3Ymu8wdHoSM05d34iWRbzami3t:y4wFHoS3zuxHoSTd34iWRhi9
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
Processes:
resource yara_rule behavioral1/memory/2192-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2364-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1204-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/576-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1544-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/612-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/612-249-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3008-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/632-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1916-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-519-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/600-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-597-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1444-773-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/3028-781-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-881-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1672-983-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1552-1004-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/892-1129-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2192-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2192-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jjddv.exe UPX behavioral1/memory/2296-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rfrlrff.exe UPX behavioral1/memory/2364-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7bnthh.exe UPX behavioral1/memory/2072-27-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\xrffxrf.exe UPX behavioral1/memory/2628-37-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2072-36-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2628-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\dpjdj.exe UPX behavioral1/memory/2700-50-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vvvpd.exe UPX behavioral1/memory/2556-58-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hhtthh.exe UPX behavioral1/memory/1536-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vpddj.exe UPX \??\c:\rxfxfrl.exe UPX \??\c:\9hbnbb.exe UPX C:\jjppp.exe UPX behavioral1/memory/2820-111-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7nthnb.exe UPX \??\c:\pjvvv.exe UPX \??\c:\lxlrllr.exe UPX \??\c:\hnnbnb.exe UPX behavioral1/memory/2752-158-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\lxrflfx.exe UPX C:\thbttb.exe UPX \??\c:\5pppp.exe UPX behavioral1/memory/1204-182-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2080-191-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pddvv.exe UPX C:\lxrxlrx.exe UPX behavioral1/memory/576-218-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ffrxllx.exe UPX \??\c:\xflxfxl.exe UPX behavioral1/memory/576-227-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1544-244-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/612-246-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\dvvpd.exe UPX C:\nhhtbn.exe UPX behavioral1/memory/3008-280-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\ddppd.exe UPX \??\c:\hbnhnn.exe UPX behavioral1/memory/2084-347-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2596-355-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2792-368-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2956-401-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1860-433-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2264-402-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/632-470-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2432-376-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2700-348-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2084-340-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2632-327-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2708-314-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1716-307-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\5pjvj.exe UPX \??\c:\ttnbnb.exe UPX \??\c:\lrxfxlf.exe UPX behavioral1/memory/2884-201-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2416-193-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
jjddv.exerfrlrff.exe7bnthh.exexrffxrf.exedpjdj.exevvvpd.exehhtthh.exevpddj.exerxfxfrl.exehnnbtt.exe9hbnbb.exejjppp.exe7nthnb.exepjvvv.exelxlrllr.exehnnbnb.exejppdj.exelxrflfx.exethbttb.exe5pppp.exebhthhb.exepddvv.exelxrxlrx.exeffrxllx.exexflxfxl.exelrxfxlf.exettnbnb.exedvvpd.exenhhtbn.exe5pjvj.exeddppd.exehbnhnn.exethbbnh.exepjddp.exerrfrrrl.exettbtnb.exe5hthbh.exepjvvv.exe9pdvp.exefxrfxrl.exe9xlflfr.exehbtbbb.exepjjpd.exeffxlxfr.exeflfrflf.exebhhntb.exeppjvj.exellflxrl.exexfrlrrf.exehbtttn.exetbbttt.exeddjvv.exerfrrrlr.exerrlxfrx.exehtnhhh.exenbntnn.exe1jvdj.exejvppv.exefrfrxxl.exetnbntt.exe5nnthh.exejdvvd.exedpvpp.exelffffxf.exepid process 2296 jjddv.exe 2364 rfrlrff.exe 2072 7bnthh.exe 2628 xrffxrf.exe 2700 dpjdj.exe 2556 vvvpd.exe 1536 hhtthh.exe 2432 vpddj.exe 2600 rxfxfrl.exe 1724 hnnbtt.exe 2820 9hbnbb.exe 2472 jjppp.exe 2728 7nthnb.exe 1916 pjvvv.exe 2768 lxlrllr.exe 2408 hnnbnb.exe 2752 jppdj.exe 1312 lxrflfx.exe 1204 thbttb.exe 2080 5pppp.exe 2416 bhthhb.exe 2884 pddvv.exe 324 lxrxlrx.exe 576 ffrxllx.exe 620 xflxfxl.exe 1544 lrxfxlf.exe 612 ttnbnb.exe 472 dvvpd.exe 2140 nhhtbn.exe 2360 5pjvj.exe 3008 ddppd.exe 3064 hbnhnn.exe 2984 thbbnh.exe 2208 pjddp.exe 1716 rrfrrrl.exe 2708 ttbtnb.exe 2536 5hthbh.exe 2632 pjvvv.exe 2524 9pdvp.exe 2084 fxrfxrl.exe 2700 9xlflfr.exe 2596 hbtbbb.exe 2792 pjjpd.exe 2464 ffxlxfr.exe 2432 flfrflf.exe 2320 bhhntb.exe 1684 ppjvj.exe 2956 llflxrl.exe 2264 xfrlrrf.exe 1124 hbtttn.exe 2720 tbbttt.exe 1868 ddjvv.exe 1628 rfrrrlr.exe 1860 rrlxfrx.exe 2772 htnhhh.exe 1400 nbntnn.exe 2760 1jvdj.exe 312 jvppv.exe 2088 frfrxxl.exe 632 tnbntt.exe 2228 5nnthh.exe 2416 jdvvd.exe 776 dpvpp.exe 540 lffffxf.exe -
Processes:
resource yara_rule behavioral1/memory/2192-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2192-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjddv.exe upx behavioral1/memory/2296-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfrlrff.exe upx behavioral1/memory/2364-20-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7bnthh.exe upx behavioral1/memory/2072-27-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrffxrf.exe upx behavioral1/memory/2628-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2072-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpjdj.exe upx behavioral1/memory/2700-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvvpd.exe upx behavioral1/memory/2556-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhtthh.exe upx behavioral1/memory/1536-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpddj.exe upx \??\c:\rxfxfrl.exe upx \??\c:\9hbnbb.exe upx C:\jjppp.exe upx behavioral1/memory/2820-111-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7nthnb.exe upx \??\c:\pjvvv.exe upx \??\c:\lxlrllr.exe upx \??\c:\hnnbnb.exe upx behavioral1/memory/2752-158-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxrflfx.exe upx C:\thbttb.exe upx \??\c:\5pppp.exe upx behavioral1/memory/1204-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2080-191-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pddvv.exe upx C:\lxrxlrx.exe upx behavioral1/memory/576-218-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffrxllx.exe upx \??\c:\xflxfxl.exe upx behavioral1/memory/576-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1544-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/612-246-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvvpd.exe upx C:\nhhtbn.exe upx behavioral1/memory/3008-280-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ddppd.exe upx \??\c:\hbnhnn.exe upx behavioral1/memory/2084-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-355-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2792-368-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2956-401-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1860-433-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2264-402-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/632-470-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2432-376-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2700-348-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2084-340-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-327-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1716-307-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5pjvj.exe upx \??\c:\ttnbnb.exe upx \??\c:\lrxfxlf.exe upx behavioral1/memory/2884-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2416-193-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b498e57dbbd5e2f1a9481a94a641a1e6df2973d360f74561db862e4c1d46d344.exejjddv.exerfrlrff.exe7bnthh.exexrffxrf.exedpjdj.exevvvpd.exehhtthh.exevpddj.exerxfxfrl.exehnnbtt.exe9hbnbb.exejjppp.exe7nthnb.exepjvvv.exelxlrllr.exedescription pid process target process PID 2192 wrote to memory of 2296 2192 b498e57dbbd5e2f1a9481a94a641a1e6df2973d360f74561db862e4c1d46d344.exe jjddv.exe PID 2192 wrote to memory of 2296 2192 b498e57dbbd5e2f1a9481a94a641a1e6df2973d360f74561db862e4c1d46d344.exe jjddv.exe PID 2192 wrote to memory of 2296 2192 b498e57dbbd5e2f1a9481a94a641a1e6df2973d360f74561db862e4c1d46d344.exe jjddv.exe PID 2192 wrote to memory of 2296 2192 b498e57dbbd5e2f1a9481a94a641a1e6df2973d360f74561db862e4c1d46d344.exe jjddv.exe PID 2296 wrote to memory of 2364 2296 jjddv.exe rfrlrff.exe PID 2296 wrote to memory of 2364 2296 jjddv.exe rfrlrff.exe PID 2296 wrote to memory of 2364 2296 jjddv.exe rfrlrff.exe PID 2296 wrote to memory of 2364 2296 jjddv.exe rfrlrff.exe PID 2364 wrote to memory of 2072 2364 rfrlrff.exe 7bnthh.exe PID 2364 wrote to memory of 2072 2364 rfrlrff.exe 7bnthh.exe PID 2364 wrote to memory of 2072 2364 rfrlrff.exe 7bnthh.exe PID 2364 wrote to memory of 2072 2364 rfrlrff.exe 7bnthh.exe PID 2072 wrote to memory of 2628 2072 7bnthh.exe xrffxrf.exe PID 2072 wrote to memory of 2628 2072 7bnthh.exe xrffxrf.exe PID 2072 wrote to memory of 2628 2072 7bnthh.exe xrffxrf.exe PID 2072 wrote to memory of 2628 2072 7bnthh.exe xrffxrf.exe PID 2628 wrote to memory of 2700 2628 xrffxrf.exe 9xlflfr.exe PID 2628 wrote to memory of 2700 2628 xrffxrf.exe 9xlflfr.exe PID 2628 wrote to memory of 2700 2628 xrffxrf.exe 9xlflfr.exe PID 2628 wrote to memory of 2700 2628 xrffxrf.exe 9xlflfr.exe PID 2700 wrote to memory of 2556 2700 dpjdj.exe vvvpd.exe PID 2700 wrote to memory of 2556 2700 dpjdj.exe vvvpd.exe PID 2700 wrote to memory of 2556 2700 dpjdj.exe vvvpd.exe PID 2700 wrote to memory of 2556 2700 dpjdj.exe vvvpd.exe PID 2556 wrote to memory of 1536 2556 vvvpd.exe hhtthh.exe PID 2556 wrote to memory of 1536 2556 vvvpd.exe hhtthh.exe PID 2556 wrote to memory of 1536 2556 vvvpd.exe hhtthh.exe PID 2556 wrote to memory of 1536 2556 vvvpd.exe hhtthh.exe PID 1536 wrote to memory of 2432 1536 hhtthh.exe vpddj.exe PID 1536 wrote to memory of 2432 1536 hhtthh.exe vpddj.exe PID 1536 wrote to memory of 2432 1536 hhtthh.exe vpddj.exe PID 1536 wrote to memory of 2432 1536 hhtthh.exe vpddj.exe PID 2432 wrote to memory of 2600 2432 vpddj.exe rxfxfrl.exe PID 2432 wrote to memory of 2600 2432 vpddj.exe rxfxfrl.exe PID 2432 wrote to memory of 2600 2432 vpddj.exe rxfxfrl.exe PID 2432 wrote to memory of 2600 2432 vpddj.exe rxfxfrl.exe PID 2600 wrote to memory of 1724 2600 rxfxfrl.exe hnnbtt.exe PID 2600 wrote to memory of 1724 2600 rxfxfrl.exe hnnbtt.exe PID 2600 wrote to memory of 1724 2600 rxfxfrl.exe hnnbtt.exe PID 2600 wrote to memory of 1724 2600 rxfxfrl.exe hnnbtt.exe PID 1724 wrote to memory of 2820 1724 hnnbtt.exe 9hbnbb.exe PID 1724 wrote to memory of 2820 1724 hnnbtt.exe 9hbnbb.exe PID 1724 wrote to memory of 2820 1724 hnnbtt.exe 9hbnbb.exe PID 1724 wrote to memory of 2820 1724 hnnbtt.exe 9hbnbb.exe PID 2820 wrote to memory of 2472 2820 9hbnbb.exe jjppp.exe PID 2820 wrote to memory of 2472 2820 9hbnbb.exe jjppp.exe PID 2820 wrote to memory of 2472 2820 9hbnbb.exe jjppp.exe PID 2820 wrote to memory of 2472 2820 9hbnbb.exe jjppp.exe PID 2472 wrote to memory of 2728 2472 jjppp.exe 7nthnb.exe PID 2472 wrote to memory of 2728 2472 jjppp.exe 7nthnb.exe PID 2472 wrote to memory of 2728 2472 jjppp.exe 7nthnb.exe PID 2472 wrote to memory of 2728 2472 jjppp.exe 7nthnb.exe PID 2728 wrote to memory of 1916 2728 7nthnb.exe pjvvv.exe PID 2728 wrote to memory of 1916 2728 7nthnb.exe pjvvv.exe PID 2728 wrote to memory of 1916 2728 7nthnb.exe pjvvv.exe PID 2728 wrote to memory of 1916 2728 7nthnb.exe pjvvv.exe PID 1916 wrote to memory of 2768 1916 pjvvv.exe lxlrllr.exe PID 1916 wrote to memory of 2768 1916 pjvvv.exe lxlrllr.exe PID 1916 wrote to memory of 2768 1916 pjvvv.exe lxlrllr.exe PID 1916 wrote to memory of 2768 1916 pjvvv.exe lxlrllr.exe PID 2768 wrote to memory of 2408 2768 lxlrllr.exe hnnbnb.exe PID 2768 wrote to memory of 2408 2768 lxlrllr.exe hnnbnb.exe PID 2768 wrote to memory of 2408 2768 lxlrllr.exe hnnbnb.exe PID 2768 wrote to memory of 2408 2768 lxlrllr.exe hnnbnb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b498e57dbbd5e2f1a9481a94a641a1e6df2973d360f74561db862e4c1d46d344.exe"C:\Users\Admin\AppData\Local\Temp\b498e57dbbd5e2f1a9481a94a641a1e6df2973d360f74561db862e4c1d46d344.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\jjddv.exec:\jjddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\rfrlrff.exec:\rfrlrff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\7bnthh.exec:\7bnthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\xrffxrf.exec:\xrffxrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\dpjdj.exec:\dpjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vvvpd.exec:\vvvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\hhtthh.exec:\hhtthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\vpddj.exec:\vpddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\rxfxfrl.exec:\rxfxfrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\hnnbtt.exec:\hnnbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\9hbnbb.exec:\9hbnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\jjppp.exec:\jjppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\7nthnb.exec:\7nthnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\pjvvv.exec:\pjvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\lxlrllr.exec:\lxlrllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\hnnbnb.exec:\hnnbnb.exe17⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jppdj.exec:\jppdj.exe18⤵
- Executes dropped EXE
PID:2752 -
\??\c:\lxrflfx.exec:\lxrflfx.exe19⤵
- Executes dropped EXE
PID:1312 -
\??\c:\thbttb.exec:\thbttb.exe20⤵
- Executes dropped EXE
PID:1204 -
\??\c:\5pppp.exec:\5pppp.exe21⤵
- Executes dropped EXE
PID:2080 -
\??\c:\bhthhb.exec:\bhthhb.exe22⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pddvv.exec:\pddvv.exe23⤵
- Executes dropped EXE
PID:2884 -
\??\c:\lxrxlrx.exec:\lxrxlrx.exe24⤵
- Executes dropped EXE
PID:324 -
\??\c:\ffrxllx.exec:\ffrxllx.exe25⤵
- Executes dropped EXE
PID:576 -
\??\c:\xflxfxl.exec:\xflxfxl.exe26⤵
- Executes dropped EXE
PID:620 -
\??\c:\lrxfxlf.exec:\lrxfxlf.exe27⤵
- Executes dropped EXE
PID:1544 -
\??\c:\ttnbnb.exec:\ttnbnb.exe28⤵
- Executes dropped EXE
PID:612 -
\??\c:\dvvpd.exec:\dvvpd.exe29⤵
- Executes dropped EXE
PID:472 -
\??\c:\nhhtbn.exec:\nhhtbn.exe30⤵
- Executes dropped EXE
PID:2140 -
\??\c:\5pjvj.exec:\5pjvj.exe31⤵
- Executes dropped EXE
PID:2360 -
\??\c:\ddppd.exec:\ddppd.exe32⤵
- Executes dropped EXE
PID:3008 -
\??\c:\hbnhnn.exec:\hbnhnn.exe33⤵
- Executes dropped EXE
PID:3064 -
\??\c:\thbbnh.exec:\thbbnh.exe34⤵
- Executes dropped EXE
PID:2984 -
\??\c:\pjddp.exec:\pjddp.exe35⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rrfrrrl.exec:\rrfrrrl.exe36⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ttbtnb.exec:\ttbtnb.exe37⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5hthbh.exec:\5hthbh.exe38⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pjvvv.exec:\pjvvv.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\9pdvp.exec:\9pdvp.exe40⤵
- Executes dropped EXE
PID:2524 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe41⤵
- Executes dropped EXE
PID:2084 -
\??\c:\9xlflfr.exec:\9xlflfr.exe42⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hbtbbb.exec:\hbtbbb.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pjjpd.exec:\pjjpd.exe44⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe45⤵
- Executes dropped EXE
PID:2464 -
\??\c:\flfrflf.exec:\flfrflf.exe46⤵
- Executes dropped EXE
PID:2432 -
\??\c:\bhhntb.exec:\bhhntb.exe47⤵
- Executes dropped EXE
PID:2320 -
\??\c:\ppjvj.exec:\ppjvj.exe48⤵
- Executes dropped EXE
PID:1684 -
\??\c:\llflxrl.exec:\llflxrl.exe49⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xfrlrrf.exec:\xfrlrrf.exe50⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hbtttn.exec:\hbtttn.exe51⤵
- Executes dropped EXE
PID:1124 -
\??\c:\tbbttt.exec:\tbbttt.exe52⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ddjvv.exec:\ddjvv.exe53⤵
- Executes dropped EXE
PID:1868 -
\??\c:\rfrrrlr.exec:\rfrrrlr.exe54⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rrlxfrx.exec:\rrlxfrx.exe55⤵
- Executes dropped EXE
PID:1860 -
\??\c:\htnhhh.exec:\htnhhh.exe56⤵
- Executes dropped EXE
PID:2772 -
\??\c:\nbntnn.exec:\nbntnn.exe57⤵
- Executes dropped EXE
PID:1400 -
\??\c:\1jvdj.exec:\1jvdj.exe58⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jvppv.exec:\jvppv.exe59⤵
- Executes dropped EXE
PID:312 -
\??\c:\frfrxxl.exec:\frfrxxl.exe60⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tnbntt.exec:\tnbntt.exe61⤵
- Executes dropped EXE
PID:632 -
\??\c:\5nnthh.exec:\5nnthh.exe62⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jdvvd.exec:\jdvvd.exe63⤵
- Executes dropped EXE
PID:2416 -
\??\c:\dpvpp.exec:\dpvpp.exe64⤵
- Executes dropped EXE
PID:776 -
\??\c:\lffffxf.exec:\lffffxf.exe65⤵
- Executes dropped EXE
PID:540 -
\??\c:\fxlrfxl.exec:\fxlrfxl.exe66⤵PID:1852
-
\??\c:\hhhntb.exec:\hhhntb.exe67⤵PID:2664
-
\??\c:\jjjvj.exec:\jjjvj.exe68⤵PID:1768
-
\??\c:\pddjv.exec:\pddjv.exe69⤵PID:944
-
\??\c:\rxrfllx.exec:\rxrfllx.exe70⤵PID:1276
-
\??\c:\1nnhhb.exec:\1nnhhb.exe71⤵PID:572
-
\??\c:\ddvpv.exec:\ddvpv.exe72⤵PID:2036
-
\??\c:\xlrllll.exec:\xlrllll.exe73⤵PID:600
-
\??\c:\nntnbn.exec:\nntnbn.exe74⤵PID:3052
-
\??\c:\jdjjp.exec:\jdjjp.exe75⤵PID:1756
-
\??\c:\xrxlxff.exec:\xrxlxff.exe76⤵PID:1592
-
\??\c:\nhbbbn.exec:\nhbbbn.exe77⤵PID:2968
-
\??\c:\9ppvp.exec:\9ppvp.exe78⤵PID:1612
-
\??\c:\lllrxxf.exec:\lllrxxf.exe79⤵PID:1720
-
\??\c:\bbnbhb.exec:\bbnbhb.exe80⤵PID:2300
-
\??\c:\pjdjv.exec:\pjdjv.exe81⤵PID:2356
-
\??\c:\rlrrflx.exec:\rlrrflx.exe82⤵PID:2652
-
\??\c:\5vjvj.exec:\5vjvj.exe83⤵PID:2628
-
\??\c:\fxlxfxx.exec:\fxlxfxx.exe84⤵PID:2560
-
\??\c:\nbhthh.exec:\nbhthh.exe85⤵PID:3012
-
\??\c:\pvdpv.exec:\pvdpv.exe86⤵PID:2800
-
\??\c:\ddjpd.exec:\ddjpd.exe87⤵PID:1620
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe88⤵PID:2448
-
\??\c:\hnnhht.exec:\hnnhht.exe89⤵PID:2792
-
\??\c:\1frflrx.exec:\1frflrx.exe90⤵PID:2464
-
\??\c:\bthnth.exec:\bthnth.exe91⤵PID:2432
-
\??\c:\ddvpv.exec:\ddvpv.exe92⤵PID:1564
-
\??\c:\1jjjd.exec:\1jjjd.exe93⤵PID:1392
-
\??\c:\lxrrrlf.exec:\lxrrrlf.exe94⤵PID:2060
-
\??\c:\btbntn.exec:\btbntn.exe95⤵PID:1912
-
\??\c:\vdpvd.exec:\vdpvd.exe96⤵PID:1124
-
\??\c:\dpjpj.exec:\dpjpj.exe97⤵PID:1752
-
\??\c:\lxxlfxx.exec:\lxxlfxx.exe98⤵PID:2220
-
\??\c:\hthnhn.exec:\hthnhn.exe99⤵PID:2500
-
\??\c:\dvppv.exec:\dvppv.exe100⤵PID:2408
-
\??\c:\xffxrrf.exec:\xffxrrf.exe101⤵PID:384
-
\??\c:\1bthbh.exec:\1bthbh.exe102⤵PID:1632
-
\??\c:\tbtnnb.exec:\tbtnnb.exe103⤵PID:1444
-
\??\c:\pjjvv.exec:\pjjvv.exe104⤵PID:1204
-
\??\c:\llfrflf.exec:\llfrflf.exe105⤵PID:2216
-
\??\c:\bhthbt.exec:\bhthbt.exe106⤵PID:2888
-
\??\c:\3pppj.exec:\3pppj.exe107⤵PID:676
-
\??\c:\pjvvd.exec:\pjvvd.exe108⤵PID:1496
-
\??\c:\lffflfx.exec:\lffflfx.exe109⤵PID:3028
-
\??\c:\3hbhhn.exec:\3hbhhn.exe110⤵PID:2064
-
\??\c:\9vpvj.exec:\9vpvj.exe111⤵PID:2112
-
\??\c:\ffxlxrl.exec:\ffxlxrl.exe112⤵PID:1324
-
\??\c:\1tnbht.exec:\1tnbht.exe113⤵PID:1816
-
\??\c:\htnhtt.exec:\htnhtt.exe114⤵PID:2608
-
\??\c:\vpjjv.exec:\vpjjv.exe115⤵PID:916
-
\??\c:\frfllxf.exec:\frfllxf.exe116⤵PID:792
-
\??\c:\rfffrrl.exec:\rfffrrl.exe117⤵PID:1844
-
\??\c:\tnbttt.exec:\tnbttt.exe118⤵PID:808
-
\??\c:\vdjjv.exec:\vdjjv.exe119⤵PID:2000
-
\??\c:\xxrrrxf.exec:\xxrrrxf.exe120⤵PID:3064
-
\??\c:\hthtbh.exec:\hthtbh.exe121⤵PID:1592
-
\??\c:\jpppp.exec:\jpppp.exe122⤵PID:2352
-
\??\c:\dpdvd.exec:\dpdvd.exe123⤵PID:1712
-
\??\c:\ttbnht.exec:\ttbnht.exe124⤵PID:2012
-
\??\c:\9vppp.exec:\9vppp.exe125⤵PID:2028
-
\??\c:\9lxflfl.exec:\9lxflfl.exe126⤵PID:2588
-
\??\c:\7bnntt.exec:\7bnntt.exe127⤵PID:2524
-
\??\c:\7dddp.exec:\7dddp.exe128⤵PID:2084
-
\??\c:\lxxfrrf.exec:\lxxfrrf.exe129⤵PID:2388
-
\??\c:\1htnnh.exec:\1htnnh.exe130⤵PID:2544
-
\??\c:\ddvdd.exec:\ddvdd.exe131⤵PID:2444
-
\??\c:\pppdd.exec:\pppdd.exe132⤵PID:2604
-
\??\c:\xxrxrlf.exec:\xxrxrlf.exe133⤵PID:2684
-
\??\c:\hhhtht.exec:\hhhtht.exe134⤵PID:2484
-
\??\c:\ppddp.exec:\ppddp.exe135⤵PID:2932
-
\??\c:\dpppp.exec:\dpppp.exe136⤵PID:2320
-
\??\c:\3rxfffr.exec:\3rxfffr.exe137⤵PID:1724
-
\??\c:\5tttbh.exec:\5tttbh.exe138⤵PID:1032
-
\??\c:\3hnnht.exec:\3hnnht.exe139⤵PID:1936
-
\??\c:\dvdjd.exec:\dvdjd.exe140⤵PID:1640
-
\??\c:\lllxxlf.exec:\lllxxlf.exe141⤵PID:1672
-
\??\c:\bhbnbt.exec:\bhbnbt.exe142⤵PID:1688
-
\??\c:\1pjpj.exec:\1pjpj.exe143⤵PID:2788
-
\??\c:\1jvpd.exec:\1jvpd.exe144⤵PID:1552
-
\??\c:\rxllrxx.exec:\rxllrxx.exe145⤵PID:2772
-
\??\c:\bnnhth.exec:\bnnhth.exe146⤵PID:1436
-
\??\c:\hhhhnb.exec:\hhhhnb.exe147⤵PID:1312
-
\??\c:\dddvp.exec:\dddvp.exe148⤵PID:2348
-
\??\c:\llfxlrf.exec:\llfxlrf.exe149⤵PID:2764
-
\??\c:\3nbhtn.exec:\3nbhtn.exe150⤵PID:2216
-
\??\c:\hbtbtb.exec:\hbtbtb.exe151⤵PID:2888
-
\??\c:\5ppdj.exec:\5ppdj.exe152⤵PID:676
-
\??\c:\vjjjp.exec:\vjjjp.exe153⤵PID:448
-
\??\c:\ffxlrxf.exec:\ffxlrxf.exe154⤵PID:1852
-
\??\c:\hbbthh.exec:\hbbthh.exe155⤵PID:1056
-
\??\c:\jvjjp.exec:\jvjjp.exe156⤵PID:1000
-
\??\c:\vvdjv.exec:\vvdjv.exe157⤵PID:1324
-
\??\c:\fllrlff.exec:\fllrlff.exe158⤵PID:288
-
\??\c:\bbntbb.exec:\bbntbb.exe159⤵PID:1276
-
\??\c:\1hbnbh.exec:\1hbnbh.exe160⤵PID:2336
-
\??\c:\vvvdv.exec:\vvvdv.exe161⤵PID:3044
-
\??\c:\lflrflx.exec:\lflrflx.exe162⤵PID:1844
-
\??\c:\rrxlxlx.exec:\rrxlxlx.exe163⤵PID:892
-
\??\c:\btnhbh.exec:\btnhbh.exe164⤵PID:2000
-
\??\c:\ddjpp.exec:\ddjpp.exe165⤵PID:1584
-
\??\c:\pjvjj.exec:\pjvjj.exe166⤵PID:1748
-
\??\c:\llflllx.exec:\llflllx.exe167⤵PID:2364
-
\??\c:\tnhtnn.exec:\tnhtnn.exe168⤵PID:2540
-
\??\c:\bhtbhn.exec:\bhtbhn.exe169⤵PID:1960
-
\??\c:\5dppv.exec:\5dppv.exe170⤵PID:2648
-
\??\c:\llrflff.exec:\llrflff.exe171⤵PID:2620
-
\??\c:\lfrxlfr.exec:\lfrxlfr.exe172⤵PID:2656
-
\??\c:\thttbh.exec:\thttbh.exe173⤵PID:3056
-
\??\c:\dpdjv.exec:\dpdjv.exe174⤵PID:2456
-
\??\c:\7pjdd.exec:\7pjdd.exe175⤵PID:2488
-
\??\c:\fxxxflx.exec:\fxxxflx.exe176⤵PID:2612
-
\??\c:\bbhhnn.exec:\bbhhnn.exe177⤵PID:2448
-
\??\c:\bnhhtt.exec:\bnhhtt.exe178⤵PID:2792
-
\??\c:\dpvdd.exec:\dpvdd.exe179⤵PID:2464
-
\??\c:\9jjjj.exec:\9jjjj.exe180⤵PID:2824
-
\??\c:\5frflrx.exec:\5frflrx.exe181⤵PID:2964
-
\??\c:\5vvjd.exec:\5vvjd.exe182⤵PID:2320
-
\??\c:\pjvjd.exec:\pjvjd.exe183⤵PID:1392
-
\??\c:\xrllxxr.exec:\xrllxxr.exe184⤵PID:2840
-
\??\c:\5htbbb.exec:\5htbbb.exe185⤵PID:1920
-
\??\c:\7nhtbn.exec:\7nhtbn.exe186⤵PID:1640
-
\??\c:\5vddj.exec:\5vddj.exe187⤵PID:1672
-
\??\c:\xxrlxxl.exec:\xxrlxxl.exe188⤵PID:1688
-
\??\c:\9rrxxfr.exec:\9rrxxfr.exe189⤵PID:3040
-
\??\c:\hbnhhb.exec:\hbnhhb.exe190⤵PID:2256
-
\??\c:\pjpdv.exec:\pjpdv.exe191⤵PID:2152
-
\??\c:\rxxrllf.exec:\rxxrllf.exe192⤵PID:1732
-
\??\c:\xlxffxr.exec:\xlxffxr.exe193⤵PID:1520
-
\??\c:\btttbn.exec:\btttbn.exe194⤵PID:2876
-
\??\c:\ppvpj.exec:\ppvpj.exe195⤵PID:908
-
\??\c:\djjvd.exec:\djjvd.exe196⤵PID:1760
-
\??\c:\xrxrxll.exec:\xrxrxll.exe197⤵PID:588
-
\??\c:\tbhbtt.exec:\tbhbtt.exe198⤵PID:1780
-
\??\c:\ttbnbb.exec:\ttbnbb.exe199⤵PID:3028
-
\??\c:\9pvjv.exec:\9pvjv.exe200⤵PID:2276
-
\??\c:\flxlrfx.exec:\flxlrfx.exe201⤵PID:620
-
\??\c:\rlrfrfx.exec:\rlrfrfx.exe202⤵PID:1768
-
\??\c:\nttnth.exec:\nttnth.exe203⤵PID:1932
-
\??\c:\jpjpd.exec:\jpjpd.exe204⤵PID:928
-
\??\c:\vddvj.exec:\vddvj.exe205⤵PID:2036
-
\??\c:\fllxrrx.exec:\fllxrrx.exe206⤵PID:552
-
\??\c:\hnnbbn.exec:\hnnbbn.exe207⤵PID:1668
-
\??\c:\vvvpv.exec:\vvvpv.exe208⤵PID:2396
-
\??\c:\vvpvj.exec:\vvpvj.exe209⤵PID:896
-
\??\c:\lxfxfrf.exec:\lxfxfrf.exe210⤵PID:2000
-
\??\c:\xrlflxf.exec:\xrlflxf.exe211⤵PID:1616
-
\??\c:\hhhbnn.exec:\hhhbnn.exe212⤵PID:1728
-
\??\c:\vddpd.exec:\vddpd.exe213⤵PID:1712
-
\??\c:\llfxflx.exec:\llfxflx.exe214⤵PID:1956
-
\??\c:\fxlflfx.exec:\fxlflfx.exe215⤵PID:2072
-
\??\c:\htbhtt.exec:\htbhtt.exe216⤵PID:2356
-
\??\c:\ddjvj.exec:\ddjvj.exe217⤵PID:2028
-
\??\c:\lfffxlx.exec:\lfffxlx.exe218⤵PID:2588
-
\??\c:\ttbbbh.exec:\ttbbbh.exe219⤵PID:2084
-
\??\c:\7nnbht.exec:\7nnbht.exe220⤵PID:2556
-
\??\c:\7pjjp.exec:\7pjjp.exe221⤵PID:2460
-
\??\c:\ffxxllx.exec:\ffxxllx.exe222⤵PID:2700
-
\??\c:\lxfrxlx.exec:\lxfrxlx.exe223⤵PID:1256
-
\??\c:\1btthn.exec:\1btthn.exe224⤵PID:2948
-
\??\c:\hbbhht.exec:\hbbhht.exe225⤵PID:2504
-
\??\c:\dvjjp.exec:\dvjjp.exe226⤵PID:2816
-
\??\c:\frlrrrx.exec:\frlrrrx.exe227⤵PID:2992
-
\??\c:\3bnbtt.exec:\3bnbtt.exe228⤵PID:2528
-
\??\c:\httbnn.exec:\httbnn.exe229⤵PID:2508
-
\??\c:\dvvjp.exec:\dvvjp.exe230⤵PID:2044
-
\??\c:\rxxlxlf.exec:\rxxlxlf.exe231⤵PID:1940
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe232⤵PID:2316
-
\??\c:\thnhhb.exec:\thnhhb.exe233⤵PID:1752
-
\??\c:\pppjd.exec:\pppjd.exe234⤵PID:2500
-
\??\c:\1rxllrx.exec:\1rxllrx.exe235⤵PID:2408
-
\??\c:\3xrrffl.exec:\3xrrffl.exe236⤵PID:384
-
\??\c:\tnhtbb.exec:\tnhtbb.exe237⤵PID:1908
-
\??\c:\vpjjp.exec:\vpjjp.exe238⤵PID:1444
-
\??\c:\vdpdd.exec:\vdpdd.exe239⤵PID:2224
-
\??\c:\rrrfxfx.exec:\rrrfxfx.exe240⤵PID:1808
-
\??\c:\bhnnhn.exec:\bhnnhn.exe241⤵PID:1396
-
\??\c:\vdjpd.exec:\vdjpd.exe242⤵PID:772