Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 02:31
Behavioral task
behavioral1
Sample
cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exe
-
Size
76KB
-
MD5
93dc6c2e7aa3b775bf64cac6e5e03866
-
SHA1
95001f63e27fb008d9eb2451ecfb0fa6c148ac21
-
SHA256
cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5
-
SHA512
96cece46559146c3b41522e9fb35f30bdcc054b863605a0972705c9d2380e9aa4692b5b793b64b7bff885a0ae2d6d6de8e83c04e5f3fb1a7c0c3b88003d20812
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE87T:9hOmTsF93UYfwC6GIoutz5yLpOSDRT
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
Processes:
resource yara_rule behavioral1/memory/2420-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-44-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2616-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-46-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2336-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1848-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/324-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1172-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-516-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-709-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-798-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-1052-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/348-1172-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1172-1340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-1465-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2420-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\djdpj.exe UPX behavioral1/memory/1928-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2420-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9xxfxlf.exe UPX C:\9lfrrxf.exe UPX behavioral1/memory/2376-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1608-30-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9bnnbb.exe UPX behavioral1/memory/2780-39-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1928-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9nhbtt.exe UPX C:\ddvpj.exe UPX behavioral1/memory/2616-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7lllrrl.exe UPX C:\pjpvp.exe UPX behavioral1/memory/2336-72-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1016-74-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\1dpdp.exe UPX behavioral1/memory/2640-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ffllrrr.exe UPX behavioral1/memory/2480-92-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tthnbh.exe UPX behavioral1/memory/2480-101-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2964-103-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jjdjv.exe UPX C:\xrflrxl.exe UPX C:\lfrrrxf.exe UPX C:\3tbnhn.exe UPX behavioral1/memory/2148-135-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1764-138-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7btbbh.exe UPX C:\lxrxxfr.exe UPX C:\lfllrrf.exe UPX behavioral1/memory/2452-170-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7thbnn.exe UPX C:\vpppp.exe UPX behavioral1/memory/2644-180-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lfffrrf.exe UPX C:\ffllrxf.exe UPX behavioral1/memory/1848-198-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2812-206-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bbtbnn.exe UPX C:\ddvpd.exe UPX \??\c:\jjvvd.exe UPX behavioral1/memory/2340-224-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tnhnnh.exe UPX \??\c:\tnbtht.exe UPX behavioral1/memory/2340-232-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\ddvpv.exe UPX C:\1dvvj.exe UPX C:\rrlrffl.exe UPX behavioral1/memory/324-266-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nhtthh.exe UPX behavioral1/memory/560-275-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ttnhnn.exe UPX behavioral1/memory/2248-296-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2064-297-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2936-316-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1664-323-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2780-354-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2620-361-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2672-362-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2492-381-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
djdpj.exe9xxfxlf.exe9lfrrxf.exe9bnnbb.exe9nhbtt.exeddvpj.exe7lllrrl.exepjpvp.exe1dpdp.exeffllrrr.exetthnbh.exejjdjv.exexrflrxl.exelfrrrxf.exe3tbnhn.exe7btbbh.exe1dpdp.exelxrxxfr.exelfllrrf.exe7thbnn.exevpppp.exelfffrrf.exeffllrxf.exebbtbnn.exeddvpd.exejjvvd.exetnbtht.exetnhnnh.exeddvpv.exe1dvvj.exerrlrffl.exenhtthh.exettnhnn.exejjjpj.exefxfflrx.exellxfrxl.exebtbbnn.exedpdvp.exejddjj.exexxxxlxr.exetnbhtb.exenhbbhn.exepdjpp.exe9xfrxfl.exebtbhnt.exe9nnbnb.exepjvvj.exexrrxffr.exefxlxxlx.exe7nhhtt.exedvppv.exejdpvv.exelfxfrxl.exenthbbn.exejdjpj.exeddvjd.exefrlxfxl.exenbhttt.exepjddj.exedvddj.exexrrflll.exe1nhnbh.exethnhhb.exedvvdp.exepid process 1928 djdpj.exe 2376 9xxfxlf.exe 1608 9lfrrxf.exe 2780 9bnnbb.exe 2616 9nhbtt.exe 2624 ddvpj.exe 2336 7lllrrl.exe 1016 pjpvp.exe 2640 1dpdp.exe 2480 ffllrrr.exe 2964 tthnbh.exe 1712 jjdjv.exe 2272 xrflrxl.exe 2148 lfrrrxf.exe 1764 3tbnhn.exe 1832 7btbbh.exe 1452 1dpdp.exe 2132 lxrxxfr.exe 2452 lfllrrf.exe 2644 7thbnn.exe 2648 vpppp.exe 1848 lfffrrf.exe 2812 ffllrxf.exe 564 bbtbnn.exe 1040 ddvpd.exe 2340 jjvvd.exe 1992 tnbtht.exe 1604 tnhnnh.exe 2320 ddvpv.exe 324 1dvvj.exe 560 rrlrffl.exe 2208 nhtthh.exe 2016 ttnhnn.exe 2248 jjjpj.exe 2064 fxfflrx.exe 1896 llxfrxl.exe 2936 btbbnn.exe 2948 dpdvp.exe 1664 jddjj.exe 1528 xxxxlxr.exe 1644 tnbhtb.exe 2120 nhbbhn.exe 2780 pdjpp.exe 2620 9xfrxfl.exe 2672 btbhnt.exe 2664 9nnbnb.exe 2492 pjvvj.exe 2732 xrrxffr.exe 2464 fxlxxlx.exe 2532 7nhhtt.exe 2480 dvppv.exe 1740 jdpvv.exe 2440 lfxfrxl.exe 1632 nthbbn.exe 2380 jdjpj.exe 1588 ddvjd.exe 1724 frlxfxl.exe 1832 nbhttt.exe 2536 pjddj.exe 1172 dvddj.exe 2736 xrrflll.exe 2744 1nhnbh.exe 2720 thnhhb.exe 2940 dvvdp.exe -
Processes:
resource yara_rule behavioral1/memory/2420-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djdpj.exe upx behavioral1/memory/1928-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2420-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9xxfxlf.exe upx C:\9lfrrxf.exe upx behavioral1/memory/2376-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1608-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9bnnbb.exe upx behavioral1/memory/2780-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1928-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9nhbtt.exe upx C:\ddvpj.exe upx behavioral1/memory/2616-55-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7lllrrl.exe upx C:\pjpvp.exe upx behavioral1/memory/2336-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1016-74-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1dpdp.exe upx behavioral1/memory/2640-85-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffllrrr.exe upx behavioral1/memory/2480-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tthnbh.exe upx behavioral1/memory/2480-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2964-103-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjdjv.exe upx C:\xrflrxl.exe upx C:\lfrrrxf.exe upx C:\3tbnhn.exe upx behavioral1/memory/2148-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1764-138-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7btbbh.exe upx C:\lxrxxfr.exe upx C:\lfllrrf.exe upx behavioral1/memory/2452-170-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7thbnn.exe upx C:\vpppp.exe upx behavioral1/memory/2644-180-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfffrrf.exe upx C:\ffllrxf.exe upx behavioral1/memory/1848-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-206-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbtbnn.exe upx C:\ddvpd.exe upx \??\c:\jjvvd.exe upx behavioral1/memory/2340-224-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnhnnh.exe upx \??\c:\tnbtht.exe upx behavioral1/memory/2340-232-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ddvpv.exe upx C:\1dvvj.exe upx C:\rrlrffl.exe upx behavioral1/memory/324-266-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhtthh.exe upx behavioral1/memory/560-275-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttnhnn.exe upx behavioral1/memory/2248-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2064-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2936-316-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1664-323-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-354-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2620-361-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2672-362-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2492-381-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exedjdpj.exe9xxfxlf.exe9lfrrxf.exe9bnnbb.exe9nhbtt.exeddvpj.exe7lllrrl.exepjpvp.exe1dpdp.exeffllrrr.exetthnbh.exejjdjv.exexrflrxl.exelfrrrxf.exe3tbnhn.exedescription pid process target process PID 2420 wrote to memory of 1928 2420 cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exe djdpj.exe PID 2420 wrote to memory of 1928 2420 cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exe djdpj.exe PID 2420 wrote to memory of 1928 2420 cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exe djdpj.exe PID 2420 wrote to memory of 1928 2420 cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exe djdpj.exe PID 1928 wrote to memory of 2376 1928 djdpj.exe 9xxfxlf.exe PID 1928 wrote to memory of 2376 1928 djdpj.exe 9xxfxlf.exe PID 1928 wrote to memory of 2376 1928 djdpj.exe 9xxfxlf.exe PID 1928 wrote to memory of 2376 1928 djdpj.exe 9xxfxlf.exe PID 2376 wrote to memory of 1608 2376 9xxfxlf.exe 9lfrrxf.exe PID 2376 wrote to memory of 1608 2376 9xxfxlf.exe 9lfrrxf.exe PID 2376 wrote to memory of 1608 2376 9xxfxlf.exe 9lfrrxf.exe PID 2376 wrote to memory of 1608 2376 9xxfxlf.exe 9lfrrxf.exe PID 1608 wrote to memory of 2780 1608 9lfrrxf.exe 9bnnbb.exe PID 1608 wrote to memory of 2780 1608 9lfrrxf.exe 9bnnbb.exe PID 1608 wrote to memory of 2780 1608 9lfrrxf.exe 9bnnbb.exe PID 1608 wrote to memory of 2780 1608 9lfrrxf.exe 9bnnbb.exe PID 2780 wrote to memory of 2616 2780 9bnnbb.exe 9nhbtt.exe PID 2780 wrote to memory of 2616 2780 9bnnbb.exe 9nhbtt.exe PID 2780 wrote to memory of 2616 2780 9bnnbb.exe 9nhbtt.exe PID 2780 wrote to memory of 2616 2780 9bnnbb.exe 9nhbtt.exe PID 2616 wrote to memory of 2624 2616 9nhbtt.exe ddvpj.exe PID 2616 wrote to memory of 2624 2616 9nhbtt.exe ddvpj.exe PID 2616 wrote to memory of 2624 2616 9nhbtt.exe ddvpj.exe PID 2616 wrote to memory of 2624 2616 9nhbtt.exe ddvpj.exe PID 2624 wrote to memory of 2336 2624 ddvpj.exe 7lllrrl.exe PID 2624 wrote to memory of 2336 2624 ddvpj.exe 7lllrrl.exe PID 2624 wrote to memory of 2336 2624 ddvpj.exe 7lllrrl.exe PID 2624 wrote to memory of 2336 2624 ddvpj.exe 7lllrrl.exe PID 2336 wrote to memory of 1016 2336 7lllrrl.exe pjpvp.exe PID 2336 wrote to memory of 1016 2336 7lllrrl.exe pjpvp.exe PID 2336 wrote to memory of 1016 2336 7lllrrl.exe pjpvp.exe PID 2336 wrote to memory of 1016 2336 7lllrrl.exe pjpvp.exe PID 1016 wrote to memory of 2640 1016 pjpvp.exe 1dpdp.exe PID 1016 wrote to memory of 2640 1016 pjpvp.exe 1dpdp.exe PID 1016 wrote to memory of 2640 1016 pjpvp.exe 1dpdp.exe PID 1016 wrote to memory of 2640 1016 pjpvp.exe 1dpdp.exe PID 2640 wrote to memory of 2480 2640 1dpdp.exe ffllrrr.exe PID 2640 wrote to memory of 2480 2640 1dpdp.exe ffllrrr.exe PID 2640 wrote to memory of 2480 2640 1dpdp.exe ffllrrr.exe PID 2640 wrote to memory of 2480 2640 1dpdp.exe ffllrrr.exe PID 2480 wrote to memory of 2964 2480 ffllrrr.exe tthnbh.exe PID 2480 wrote to memory of 2964 2480 ffllrrr.exe tthnbh.exe PID 2480 wrote to memory of 2964 2480 ffllrrr.exe tthnbh.exe PID 2480 wrote to memory of 2964 2480 ffllrrr.exe tthnbh.exe PID 2964 wrote to memory of 1712 2964 tthnbh.exe jjdjv.exe PID 2964 wrote to memory of 1712 2964 tthnbh.exe jjdjv.exe PID 2964 wrote to memory of 1712 2964 tthnbh.exe jjdjv.exe PID 2964 wrote to memory of 1712 2964 tthnbh.exe jjdjv.exe PID 1712 wrote to memory of 2272 1712 jjdjv.exe xrflrxl.exe PID 1712 wrote to memory of 2272 1712 jjdjv.exe xrflrxl.exe PID 1712 wrote to memory of 2272 1712 jjdjv.exe xrflrxl.exe PID 1712 wrote to memory of 2272 1712 jjdjv.exe xrflrxl.exe PID 2272 wrote to memory of 2148 2272 xrflrxl.exe lfrrrxf.exe PID 2272 wrote to memory of 2148 2272 xrflrxl.exe lfrrrxf.exe PID 2272 wrote to memory of 2148 2272 xrflrxl.exe lfrrrxf.exe PID 2272 wrote to memory of 2148 2272 xrflrxl.exe lfrrrxf.exe PID 2148 wrote to memory of 1764 2148 lfrrrxf.exe 3tbnhn.exe PID 2148 wrote to memory of 1764 2148 lfrrrxf.exe 3tbnhn.exe PID 2148 wrote to memory of 1764 2148 lfrrrxf.exe 3tbnhn.exe PID 2148 wrote to memory of 1764 2148 lfrrrxf.exe 3tbnhn.exe PID 1764 wrote to memory of 1832 1764 3tbnhn.exe 7btbbh.exe PID 1764 wrote to memory of 1832 1764 3tbnhn.exe 7btbbh.exe PID 1764 wrote to memory of 1832 1764 3tbnhn.exe 7btbbh.exe PID 1764 wrote to memory of 1832 1764 3tbnhn.exe 7btbbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exe"C:\Users\Admin\AppData\Local\Temp\cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\djdpj.exec:\djdpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\9xxfxlf.exec:\9xxfxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\9lfrrxf.exec:\9lfrrxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\9bnnbb.exec:\9bnnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\9nhbtt.exec:\9nhbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ddvpj.exec:\ddvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\7lllrrl.exec:\7lllrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\pjpvp.exec:\pjpvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\1dpdp.exec:\1dpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\ffllrrr.exec:\ffllrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\tthnbh.exec:\tthnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\jjdjv.exec:\jjdjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\xrflrxl.exec:\xrflrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\3tbnhn.exec:\3tbnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\7btbbh.exec:\7btbbh.exe17⤵
- Executes dropped EXE
PID:1832 -
\??\c:\1dpdp.exec:\1dpdp.exe18⤵
- Executes dropped EXE
PID:1452 -
\??\c:\lxrxxfr.exec:\lxrxxfr.exe19⤵
- Executes dropped EXE
PID:2132 -
\??\c:\lfllrrf.exec:\lfllrrf.exe20⤵
- Executes dropped EXE
PID:2452 -
\??\c:\7thbnn.exec:\7thbnn.exe21⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vpppp.exec:\vpppp.exe22⤵
- Executes dropped EXE
PID:2648 -
\??\c:\lfffrrf.exec:\lfffrrf.exe23⤵
- Executes dropped EXE
PID:1848 -
\??\c:\ffllrxf.exec:\ffllrxf.exe24⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bbtbnn.exec:\bbtbnn.exe25⤵
- Executes dropped EXE
PID:564 -
\??\c:\ddvpd.exec:\ddvpd.exe26⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jjvvd.exec:\jjvvd.exe27⤵
- Executes dropped EXE
PID:2340 -
\??\c:\tnbtht.exec:\tnbtht.exe28⤵
- Executes dropped EXE
PID:1992 -
\??\c:\tnhnnh.exec:\tnhnnh.exe29⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ddvpv.exec:\ddvpv.exe30⤵
- Executes dropped EXE
PID:2320 -
\??\c:\1dvvj.exec:\1dvvj.exe31⤵
- Executes dropped EXE
PID:324 -
\??\c:\rrlrffl.exec:\rrlrffl.exe32⤵
- Executes dropped EXE
PID:560 -
\??\c:\nhtthh.exec:\nhtthh.exe33⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ttnhnn.exec:\ttnhnn.exe34⤵
- Executes dropped EXE
PID:2016 -
\??\c:\jjjpj.exec:\jjjpj.exe35⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fxfflrx.exec:\fxfflrx.exe36⤵
- Executes dropped EXE
PID:2064 -
\??\c:\llxfrxl.exec:\llxfrxl.exe37⤵
- Executes dropped EXE
PID:1896 -
\??\c:\btbbnn.exec:\btbbnn.exe38⤵
- Executes dropped EXE
PID:2936 -
\??\c:\dpdvp.exec:\dpdvp.exe39⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jddjj.exec:\jddjj.exe40⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xxxxlxr.exec:\xxxxlxr.exe41⤵
- Executes dropped EXE
PID:1528 -
\??\c:\tnbhtb.exec:\tnbhtb.exe42⤵
- Executes dropped EXE
PID:1644 -
\??\c:\nhbbhn.exec:\nhbbhn.exe43⤵
- Executes dropped EXE
PID:2120 -
\??\c:\pdjpp.exec:\pdjpp.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9xfrxfl.exec:\9xfrxfl.exe45⤵
- Executes dropped EXE
PID:2620 -
\??\c:\btbhnt.exec:\btbhnt.exe46⤵
- Executes dropped EXE
PID:2672 -
\??\c:\9nnbnb.exec:\9nnbnb.exe47⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pjvvj.exec:\pjvvj.exe48⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xrrxffr.exec:\xrrxffr.exe49⤵
- Executes dropped EXE
PID:2732 -
\??\c:\fxlxxlx.exec:\fxlxxlx.exe50⤵
- Executes dropped EXE
PID:2464 -
\??\c:\7nhhtt.exec:\7nhhtt.exe51⤵
- Executes dropped EXE
PID:2532 -
\??\c:\dvppv.exec:\dvppv.exe52⤵
- Executes dropped EXE
PID:2480 -
\??\c:\jdpvv.exec:\jdpvv.exe53⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe54⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nthbbn.exec:\nthbbn.exe55⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jdjpj.exec:\jdjpj.exe56⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ddvjd.exec:\ddvjd.exe57⤵
- Executes dropped EXE
PID:1588 -
\??\c:\frlxfxl.exec:\frlxfxl.exe58⤵
- Executes dropped EXE
PID:1724 -
\??\c:\nbhttt.exec:\nbhttt.exe59⤵
- Executes dropped EXE
PID:1832 -
\??\c:\pjddj.exec:\pjddj.exe60⤵
- Executes dropped EXE
PID:2536 -
\??\c:\dvddj.exec:\dvddj.exe61⤵
- Executes dropped EXE
PID:1172 -
\??\c:\xrrflll.exec:\xrrflll.exe62⤵
- Executes dropped EXE
PID:2736 -
\??\c:\1nhnbh.exec:\1nhnbh.exe63⤵
- Executes dropped EXE
PID:2744 -
\??\c:\thnhhb.exec:\thnhhb.exe64⤵
- Executes dropped EXE
PID:2720 -
\??\c:\dvvdp.exec:\dvvdp.exe65⤵
- Executes dropped EXE
PID:2940 -
\??\c:\5fxxrlr.exec:\5fxxrlr.exe66⤵PID:536
-
\??\c:\rrxxfrl.exec:\rrxxfrl.exe67⤵PID:1152
-
\??\c:\nnntth.exec:\nnntth.exe68⤵PID:2412
-
\??\c:\ddvvv.exec:\ddvvv.exe69⤵PID:3048
-
\??\c:\rlrxflx.exec:\rlrxflx.exe70⤵PID:1048
-
\??\c:\7frlxxf.exec:\7frlxxf.exe71⤵PID:612
-
\??\c:\htnbnn.exec:\htnbnn.exe72⤵PID:1292
-
\??\c:\5tnnth.exec:\5tnnth.exe73⤵PID:1784
-
\??\c:\ddppv.exec:\ddppv.exe74⤵PID:2004
-
\??\c:\rlfrffx.exec:\rlfrffx.exe75⤵PID:2952
-
\??\c:\rlrxlrr.exec:\rlrxlrr.exe76⤵PID:348
-
\??\c:\tntttt.exec:\tntttt.exe77⤵PID:2188
-
\??\c:\nhhthh.exec:\nhhthh.exe78⤵PID:2244
-
\??\c:\jjdvd.exec:\jjdvd.exe79⤵PID:1212
-
\??\c:\ddvvv.exec:\ddvvv.exe80⤵PID:2060
-
\??\c:\xlrlrrf.exec:\xlrlrrf.exe81⤵PID:2248
-
\??\c:\bhbnbn.exec:\bhbnbn.exe82⤵PID:2396
-
\??\c:\hhttbh.exec:\hhttbh.exe83⤵PID:1928
-
\??\c:\pjvvj.exec:\pjvvj.exe84⤵PID:2376
-
\??\c:\frrffll.exec:\frrffll.exe85⤵PID:1652
-
\??\c:\lxxfrrf.exec:\lxxfrrf.exe86⤵PID:2184
-
\??\c:\bhnntt.exec:\bhnntt.exe87⤵PID:1732
-
\??\c:\jvjvj.exec:\jvjvj.exe88⤵PID:2400
-
\??\c:\dvddj.exec:\dvddj.exe89⤵PID:2688
-
\??\c:\lxrxxfl.exec:\lxrxxfl.exe90⤵PID:2888
-
\??\c:\xlrrrxf.exec:\xlrrrxf.exe91⤵PID:2620
-
\??\c:\nhnhtn.exec:\nhnhtn.exe92⤵PID:3052
-
\??\c:\bthhbt.exec:\bthhbt.exe93⤵PID:2840
-
\??\c:\7vddp.exec:\7vddp.exe94⤵PID:2140
-
\??\c:\rrllxfx.exec:\rrllxfx.exe95⤵PID:2520
-
\??\c:\nhnnbn.exec:\nhnnbn.exe96⤵PID:2508
-
\??\c:\3bttnt.exec:\3bttnt.exe97⤵PID:2484
-
\??\c:\jdvjp.exec:\jdvjp.exe98⤵PID:2972
-
\??\c:\pjppp.exec:\pjppp.exe99⤵PID:1780
-
\??\c:\1jvdj.exec:\1jvdj.exe100⤵PID:1580
-
\??\c:\xffllrl.exec:\xffllrl.exe101⤵PID:1356
-
\??\c:\9nbnbh.exec:\9nbnbh.exe102⤵PID:1616
-
\??\c:\bthnbt.exec:\bthnbt.exe103⤵PID:1764
-
\??\c:\dvdpv.exec:\dvdpv.exe104⤵PID:2176
-
\??\c:\vdjvv.exec:\vdjvv.exe105⤵PID:1456
-
\??\c:\3lrfrxr.exec:\3lrfrxr.exe106⤵PID:1320
-
\??\c:\lfrxllr.exec:\lfrxllr.exe107⤵PID:2044
-
\??\c:\3bntbh.exec:\3bntbh.exe108⤵PID:1160
-
\??\c:\dpvpv.exec:\dpvpv.exe109⤵PID:2804
-
\??\c:\pjddj.exec:\pjddj.exe110⤵PID:2748
-
\??\c:\lfrlxxl.exec:\lfrlxxl.exe111⤵PID:2720
-
\??\c:\9lxlrrl.exec:\9lxlrrl.exe112⤵PID:264
-
\??\c:\9nnhnt.exec:\9nnhnt.exe113⤵PID:872
-
\??\c:\hbbhnn.exec:\hbbhnn.exe114⤵PID:1568
-
\??\c:\fxffrrx.exec:\fxffrrx.exe115⤵PID:792
-
\??\c:\fxflrff.exec:\fxflrff.exe116⤵PID:1964
-
\??\c:\nhbhbb.exec:\nhbhbb.exe117⤵PID:868
-
\??\c:\vpddp.exec:\vpddp.exe118⤵PID:952
-
\??\c:\jjvpv.exec:\jjvpv.exe119⤵PID:356
-
\??\c:\7xxfllr.exec:\7xxfllr.exe120⤵PID:900
-
\??\c:\lxlllfr.exec:\lxlllfr.exe121⤵PID:2320
-
\??\c:\hbbthh.exec:\hbbthh.exe122⤵PID:2236
-
\??\c:\btnbth.exec:\btnbth.exe123⤵PID:560
-
\??\c:\5vjdj.exec:\5vjdj.exe124⤵PID:2260
-
\??\c:\xlrxllr.exec:\xlrxllr.exe125⤵PID:1808
-
\??\c:\7xlxrrf.exec:\7xlxrrf.exe126⤵PID:1620
-
\??\c:\thnhht.exec:\thnhht.exe127⤵PID:2984
-
\??\c:\jvpdd.exec:\jvpdd.exe128⤵PID:2052
-
\??\c:\jddjp.exec:\jddjp.exe129⤵PID:1948
-
\??\c:\fxlxlrf.exec:\fxlxlrf.exe130⤵PID:3004
-
\??\c:\5bthbh.exec:\5bthbh.exe131⤵PID:2368
-
\??\c:\hbhhtt.exec:\hbhhtt.exe132⤵PID:1884
-
\??\c:\1pjdp.exec:\1pjdp.exe133⤵PID:3032
-
\??\c:\1fflrrr.exec:\1fflrrr.exe134⤵PID:1644
-
\??\c:\fxfflrf.exec:\fxfflrf.exe135⤵PID:2120
-
\??\c:\1nhthn.exec:\1nhthn.exe136⤵PID:2780
-
\??\c:\tnnbhn.exec:\tnnbhn.exe137⤵PID:2696
-
\??\c:\dvjpv.exec:\dvjpv.exe138⤵PID:2768
-
\??\c:\jdpvj.exec:\jdpvj.exe139⤵PID:2756
-
\??\c:\xrrrxxr.exec:\xrrrxxr.exe140⤵PID:2704
-
\??\c:\nhtbhh.exec:\nhtbhh.exe141⤵PID:2580
-
\??\c:\nhtbhh.exec:\nhtbhh.exe142⤵PID:2476
-
\??\c:\1nhtbb.exec:\1nhtbb.exe143⤵PID:2464
-
\??\c:\jdppd.exec:\jdppd.exe144⤵PID:2540
-
\??\c:\jddvd.exec:\jddvd.exe145⤵PID:2964
-
\??\c:\5rlrxfx.exec:\5rlrxfx.exe146⤵PID:2972
-
\??\c:\hbhtbb.exec:\hbhtbb.exe147⤵PID:1780
-
\??\c:\nhtbth.exec:\nhtbth.exe148⤵PID:2144
-
\??\c:\pdppd.exec:\pdppd.exe149⤵PID:1360
-
\??\c:\dpvvv.exec:\dpvvv.exe150⤵PID:1424
-
\??\c:\rlffflr.exec:\rlffflr.exe151⤵PID:1520
-
\??\c:\3lxlxxf.exec:\3lxlxxf.exe152⤵PID:1512
-
\??\c:\hhtthn.exec:\hhtthn.exe153⤵PID:1280
-
\??\c:\dpdpv.exec:\dpdpv.exe154⤵PID:2568
-
\??\c:\dppdp.exec:\dppdp.exe155⤵PID:2716
-
\??\c:\fffxrfl.exec:\fffxrfl.exe156⤵PID:2860
-
\??\c:\rflfllx.exec:\rflfllx.exe157⤵PID:2736
-
\??\c:\9bbbbt.exec:\9bbbbt.exe158⤵PID:2644
-
\??\c:\btbnnb.exec:\btbnnb.exe159⤵PID:2864
-
\??\c:\3jddj.exec:\3jddj.exe160⤵PID:2812
-
\??\c:\llffrlf.exec:\llffrlf.exe161⤵PID:1312
-
\??\c:\ffxlxlr.exec:\ffxlxlr.exe162⤵PID:2796
-
\??\c:\thtbhh.exec:\thtbhh.exe163⤵PID:1436
-
\??\c:\bthbbb.exec:\bthbbb.exe164⤵PID:1208
-
\??\c:\vpjvd.exec:\vpjvd.exe165⤵PID:1048
-
\??\c:\vpddd.exec:\vpddd.exe166⤵PID:1256
-
\??\c:\5lflffr.exec:\5lflffr.exe167⤵PID:316
-
\??\c:\tnhhtt.exec:\tnhhtt.exe168⤵PID:880
-
\??\c:\nhbthn.exec:\nhbthn.exe169⤵PID:2088
-
\??\c:\frfffxl.exec:\frfffxl.exe170⤵PID:348
-
\??\c:\3fllrxr.exec:\3fllrxr.exe171⤵PID:2040
-
\??\c:\nhhnnt.exec:\nhhnnt.exe172⤵PID:2228
-
\??\c:\5dpvd.exec:\5dpvd.exe173⤵PID:800
-
\??\c:\flxrxrr.exec:\flxrxrr.exe174⤵PID:1704
-
\??\c:\5nhbnn.exec:\5nhbnn.exe175⤵PID:2060
-
\??\c:\vjdpv.exec:\vjdpv.exe176⤵PID:2932
-
\??\c:\jdvdj.exec:\jdvdj.exe177⤵PID:2396
-
\??\c:\xrxfrxf.exec:\xrxfrxf.exe178⤵PID:2872
-
\??\c:\hbntbb.exec:\hbntbb.exe179⤵PID:2376
-
\??\c:\tnbthn.exec:\tnbthn.exe180⤵PID:1636
-
\??\c:\9vpjv.exec:\9vpjv.exe181⤵PID:2612
-
\??\c:\ddvvv.exec:\ddvvv.exe182⤵PID:2684
-
\??\c:\rlxllfl.exec:\rlxllfl.exe183⤵PID:2688
-
\??\c:\xrxflfl.exec:\xrxflfl.exe184⤵PID:2572
-
\??\c:\hbttbb.exec:\hbttbb.exe185⤵PID:2628
-
\??\c:\vdjjp.exec:\vdjjp.exe186⤵PID:2576
-
\??\c:\3jvvv.exec:\3jvvv.exe187⤵PID:2880
-
\??\c:\rrfxxfl.exec:\rrfxxfl.exe188⤵PID:2692
-
\??\c:\lxflxfr.exec:\lxflxfr.exe189⤵PID:2520
-
\??\c:\bhbbnh.exec:\bhbbnh.exe190⤵PID:2636
-
\??\c:\1hhtnn.exec:\1hhtnn.exe191⤵PID:1444
-
\??\c:\jdvdj.exec:\jdvdj.exe192⤵PID:2516
-
\??\c:\lfxrrxf.exec:\lfxrrxf.exe193⤵PID:1548
-
\??\c:\rrrlxlf.exec:\rrrlxlf.exe194⤵PID:1780
-
\??\c:\5hbbnn.exec:\5hbbnn.exe195⤵PID:296
-
\??\c:\5bntbb.exec:\5bntbb.exe196⤵PID:1616
-
\??\c:\btnnbb.exec:\btnnbb.exe197⤵PID:1764
-
\??\c:\dddjp.exec:\dddjp.exe198⤵PID:2176
-
\??\c:\fxlfxxf.exec:\fxlfxxf.exe199⤵PID:1832
-
\??\c:\9xllrrr.exec:\9xllrrr.exe200⤵PID:2536
-
\??\c:\bnbhnn.exec:\bnbhnn.exe201⤵PID:1684
-
\??\c:\nhnnhh.exec:\nhnnhh.exe202⤵PID:1172
-
\??\c:\ppjpv.exec:\ppjpv.exe203⤵PID:2648
-
\??\c:\jdpdd.exec:\jdpdd.exe204⤵PID:2804
-
\??\c:\rfffllr.exec:\rfffllr.exe205⤵PID:2748
-
\??\c:\rllfllr.exec:\rllfllr.exe206⤵PID:2980
-
\??\c:\hbhhbb.exec:\hbhhbb.exe207⤵PID:784
-
\??\c:\hntnhn.exec:\hntnhn.exe208⤵PID:1312
-
\??\c:\5dpdp.exec:\5dpdp.exe209⤵PID:812
-
\??\c:\xfxxllf.exec:\xfxxllf.exe210⤵PID:2912
-
\??\c:\5xrxflr.exec:\5xrxflr.exe211⤵PID:2340
-
\??\c:\btbhnn.exec:\btbhnn.exe212⤵PID:952
-
\??\c:\vpvdv.exec:\vpvdv.exe213⤵PID:1904
-
\??\c:\1jdjp.exec:\1jdjp.exe214⤵PID:1220
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe215⤵PID:1744
-
\??\c:\rrrxfll.exec:\rrrxfll.exe216⤵PID:2344
-
\??\c:\3bnhnt.exec:\3bnhnt.exe217⤵PID:948
-
\??\c:\btntbb.exec:\btntbb.exe218⤵PID:1044
-
\??\c:\1dvjv.exec:\1dvjv.exe219⤵PID:892
-
\??\c:\lrrlfff.exec:\lrrlfff.exe220⤵PID:1432
-
\??\c:\rfllrlx.exec:\rfllrlx.exe221⤵PID:1620
-
\??\c:\bhttbn.exec:\bhttbn.exe222⤵PID:2420
-
\??\c:\djpdd.exec:\djpdd.exe223⤵PID:2052
-
\??\c:\xrxfrfl.exec:\xrxfrfl.exe224⤵PID:1736
-
\??\c:\7llrfrx.exec:\7llrfrx.exe225⤵PID:2992
-
\??\c:\bthtbb.exec:\bthtbb.exe226⤵PID:1008
-
\??\c:\vjdvj.exec:\vjdvj.exe227⤵PID:3060
-
\??\c:\ddppp.exec:\ddppp.exe228⤵PID:1732
-
\??\c:\xrrfrxf.exec:\xrrfrxf.exe229⤵PID:1644
-
\??\c:\nnhthn.exec:\nnhthn.exe230⤵PID:2680
-
\??\c:\bnbhhb.exec:\bnbhhb.exe231⤵PID:2780
-
\??\c:\vpvvd.exec:\vpvvd.exe232⤵PID:2624
-
\??\c:\pvdpp.exec:\pvdpp.exe233⤵PID:2620
-
\??\c:\xrllrrx.exec:\xrllrrx.exe234⤵PID:2756
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe235⤵PID:2604
-
\??\c:\1hhhhn.exec:\1hhhhn.exe236⤵PID:2732
-
\??\c:\9nhhht.exec:\9nhhht.exe237⤵PID:2392
-
\??\c:\dvjdp.exec:\dvjdp.exe238⤵PID:2508
-
\??\c:\vpppv.exec:\vpppv.exe239⤵PID:2968
-
\??\c:\llfrlxl.exec:\llfrlxl.exe240⤵PID:2264
-
\??\c:\fxfxffr.exec:\fxfxffr.exe241⤵PID:2440
-
\??\c:\5htnbn.exec:\5htnbn.exe242⤵PID:1632