Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 22:28
Behavioral task
behavioral1
Sample
52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
General
-
Target
52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exe
-
Size
90KB
-
MD5
1f30a02f9765f1da6dd2a12423f5439d
-
SHA1
3277aa4e2909d813f0cee15b11d75d6d69a9a3a5
-
SHA256
52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410
-
SHA512
4c81bd0f3fa5f8f09c4cb117860c700cf2269bd1f7ef2c635ff8abd58ddb6278a7aa239f275f8de233fef17a4c49d49399f44e2479d77afe52a00ee3106c4977
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpX:8hOmTsF93UYfwC6GIout0fmCiiiXA6mJ
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
Processes:
resource yara_rule behavioral1/memory/2916-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2160-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1772-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/496-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1272-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/472-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1580-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1452-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-330-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2196-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-352-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2364-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2332-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-541-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/856-547-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-577-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/752-660-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1148-712-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-1158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-1232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-1255-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2792-10870-0x0000000077010000-0x000000007710A000-memory.dmp family_blackmoon behavioral1/memory/2792-12783-0x0000000077110000-0x000000007722F000-memory.dmp family_blackmoon behavioral1/memory/2792-14644-0x0000000077010000-0x000000007710A000-memory.dmp family_blackmoon behavioral1/memory/2792-22916-0x0000000077110000-0x000000007722F000-memory.dmp family_blackmoon behavioral1/memory/2792-29872-0x0000000077110000-0x000000007722F000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2916-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ntthnb.exe UPX behavioral1/memory/2916-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2436-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jjdjp.exe UPX behavioral1/memory/2444-16-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2444-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lfffxrr.exe UPX C:\tnbhnn.exe UPX behavioral1/memory/2532-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2536-40-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jdpvj.exe UPX behavioral1/memory/2160-48-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\fxffllx.exe UPX behavioral1/memory/2656-49-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2656-57-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3nhtnt.exe UPX behavioral1/memory/2488-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9ppdv.exe UPX C:\pjddp.exe UPX behavioral1/memory/2356-73-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9rlflff.exe UPX behavioral1/memory/2180-81-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nnhhtt.exe UPX behavioral1/memory/2180-89-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1772-91-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\dvvjv.exe UPX C:\1jjdv.exe UPX behavioral1/memory/2680-107-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2528-105-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rrrrflf.exe UPX C:\bbhnnh.exe UPX behavioral1/memory/496-128-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3vppv.exe UPX behavioral1/memory/1968-136-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xflllfx.exe UPX behavioral1/memory/2284-143-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\llrffff.exe UPX C:\5tbntn.exe UPX behavioral1/memory/1272-153-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pjdjd.exe UPX C:\jdddv.exe UPX behavioral1/memory/2744-174-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lfxrrxx.exe UPX C:\bbbhtt.exe UPX behavioral1/memory/2764-182-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\dvvvd.exe UPX C:\pdpjp.exe UPX \??\c:\xrllxxr.exe UPX behavioral1/memory/2556-204-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\1tnbnt.exe UPX behavioral1/memory/3060-215-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\nhnttt.exe UPX behavioral1/memory/832-221-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\dvjjp.exe UPX behavioral1/memory/2200-232-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5fffrlx.exe UPX C:\bhhnhn.exe UPX behavioral1/memory/472-245-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5btthn.exe UPX behavioral1/memory/472-253-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1624-260-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1580-282-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1452-289-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
ntthnb.exejjdjp.exelfffxrr.exetnbhnn.exejdpvj.exefxffllx.exe3nhtnt.exe9ppdv.exepjddp.exe9rlflff.exennhhtt.exedvvjv.exe1jjdv.exerrrrflf.exebbhnnh.exe3vppv.exexflllfx.exellrffff.exe5tbntn.exepjdjd.exejdddv.exelfxrrxx.exebbbhtt.exedvvvd.exepdpjp.exexrllxxr.exe1tnbnt.exenhnttt.exedvjjp.exe5fffrlx.exebhhnhn.exe5btthn.exe1pddd.exerlfxrxf.exe1hnthh.exebbbtnh.exeddppv.exellfrfrl.exetbnhbb.exebhnbbb.exepjpvj.exexrfxxrx.exerllrxxx.exexlflllr.exenbhtbb.exeppvjj.exedvdvd.exexrfrxlr.exe9fxflrf.exe9nhhth.exe5ntttb.exeppjvp.exerrxfxrx.exenbntbn.exetnbnhn.exe7thhtn.exe7dppd.exeppdpp.exe7lxxrrr.exexrrxffx.exe9bbttb.exe5hhtbb.exepvvjv.exe5pvpd.exepid process 2436 ntthnb.exe 2444 jjdjp.exe 2532 lfffxrr.exe 2536 tnbhnn.exe 2160 jdpvj.exe 2656 fxffllx.exe 2488 3nhtnt.exe 2356 9ppdv.exe 2472 pjddp.exe 2180 9rlflff.exe 1772 nnhhtt.exe 2528 dvvjv.exe 2680 1jjdv.exe 1608 rrrrflf.exe 496 bbhnnh.exe 1968 3vppv.exe 2284 xflllfx.exe 1148 llrffff.exe 1272 5tbntn.exe 2040 pjdjd.exe 2744 jdddv.exe 2764 lfxrrxx.exe 1728 bbbhtt.exe 1660 dvvvd.exe 2556 pdpjp.exe 1080 xrllxxr.exe 3060 1tnbnt.exe 832 nhnttt.exe 2200 dvjjp.exe 812 5fffrlx.exe 472 bhhnhn.exe 1624 5btthn.exe 572 1pddd.exe 1536 rlfxrxf.exe 1988 1hnthh.exe 1580 bbbtnh.exe 1920 ddppv.exe 1452 llfrfrl.exe 1684 tbnhbb.exe 1532 bhnbbb.exe 1500 pjpvj.exe 2688 xrfxxrx.exe 2956 rllrxxx.exe 2444 xlflllr.exe 2532 nbhtbb.exe 2196 ppvjj.exe 2576 dvdvd.exe 2388 xrfrxlr.exe 2640 9fxflrf.exe 2364 9nhhth.exe 2428 5ntttb.exe 2356 ppjvp.exe 2472 rrxfxrx.exe 1464 nbntbn.exe 1120 tnbnhn.exe 2592 7thhtn.exe 2528 7dppd.exe 2680 ppdpp.exe 2724 7lxxrrr.exe 1780 xrrxffx.exe 2072 9bbttb.exe 1364 5hhtbb.exe 2120 pvvjv.exe 1280 5pvpd.exe -
Processes:
resource yara_rule behavioral1/memory/2916-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ntthnb.exe upx behavioral1/memory/2916-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2436-9-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjdjp.exe upx behavioral1/memory/2444-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2444-24-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfffxrr.exe upx C:\tnbhnn.exe upx behavioral1/memory/2532-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2536-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdpvj.exe upx behavioral1/memory/2160-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxffllx.exe upx behavioral1/memory/2656-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2656-57-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3nhtnt.exe upx behavioral1/memory/2488-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9ppdv.exe upx C:\pjddp.exe upx behavioral1/memory/2356-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9rlflff.exe upx behavioral1/memory/2180-81-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnhhtt.exe upx behavioral1/memory/2180-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1772-91-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvvjv.exe upx C:\1jjdv.exe upx behavioral1/memory/2680-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2528-105-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrrrflf.exe upx C:\bbhnnh.exe upx behavioral1/memory/496-128-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3vppv.exe upx behavioral1/memory/1968-136-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xflllfx.exe upx behavioral1/memory/2284-143-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llrffff.exe upx C:\5tbntn.exe upx behavioral1/memory/1272-153-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjdjd.exe upx C:\jdddv.exe upx behavioral1/memory/2744-174-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxrrxx.exe upx C:\bbbhtt.exe upx behavioral1/memory/2764-182-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvvvd.exe upx C:\pdpjp.exe upx \??\c:\xrllxxr.exe upx behavioral1/memory/2556-204-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1tnbnt.exe upx behavioral1/memory/3060-215-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhnttt.exe upx behavioral1/memory/832-221-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvjjp.exe upx behavioral1/memory/2200-232-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5fffrlx.exe upx C:\bhhnhn.exe upx behavioral1/memory/472-245-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5btthn.exe upx behavioral1/memory/472-253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1624-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1580-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1452-289-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exentthnb.exejjdjp.exelfffxrr.exetnbhnn.exejdpvj.exefxffllx.exe3nhtnt.exe9ppdv.exepjddp.exe9rlflff.exennhhtt.exedvvjv.exe1jjdv.exerrrrflf.exebbhnnh.exedescription pid process target process PID 2916 wrote to memory of 2436 2916 52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exe ntthnb.exe PID 2916 wrote to memory of 2436 2916 52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exe ntthnb.exe PID 2916 wrote to memory of 2436 2916 52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exe ntthnb.exe PID 2916 wrote to memory of 2436 2916 52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exe ntthnb.exe PID 2436 wrote to memory of 2444 2436 ntthnb.exe jjdjp.exe PID 2436 wrote to memory of 2444 2436 ntthnb.exe jjdjp.exe PID 2436 wrote to memory of 2444 2436 ntthnb.exe jjdjp.exe PID 2436 wrote to memory of 2444 2436 ntthnb.exe jjdjp.exe PID 2444 wrote to memory of 2532 2444 jjdjp.exe lfffxrr.exe PID 2444 wrote to memory of 2532 2444 jjdjp.exe lfffxrr.exe PID 2444 wrote to memory of 2532 2444 jjdjp.exe lfffxrr.exe PID 2444 wrote to memory of 2532 2444 jjdjp.exe lfffxrr.exe PID 2532 wrote to memory of 2536 2532 lfffxrr.exe tnbhnn.exe PID 2532 wrote to memory of 2536 2532 lfffxrr.exe tnbhnn.exe PID 2532 wrote to memory of 2536 2532 lfffxrr.exe tnbhnn.exe PID 2532 wrote to memory of 2536 2532 lfffxrr.exe tnbhnn.exe PID 2536 wrote to memory of 2160 2536 tnbhnn.exe jdpvj.exe PID 2536 wrote to memory of 2160 2536 tnbhnn.exe jdpvj.exe PID 2536 wrote to memory of 2160 2536 tnbhnn.exe jdpvj.exe PID 2536 wrote to memory of 2160 2536 tnbhnn.exe jdpvj.exe PID 2160 wrote to memory of 2656 2160 jdpvj.exe fxffllx.exe PID 2160 wrote to memory of 2656 2160 jdpvj.exe fxffllx.exe PID 2160 wrote to memory of 2656 2160 jdpvj.exe fxffllx.exe PID 2160 wrote to memory of 2656 2160 jdpvj.exe fxffllx.exe PID 2656 wrote to memory of 2488 2656 fxffllx.exe 3nhtnt.exe PID 2656 wrote to memory of 2488 2656 fxffllx.exe 3nhtnt.exe PID 2656 wrote to memory of 2488 2656 fxffllx.exe 3nhtnt.exe PID 2656 wrote to memory of 2488 2656 fxffllx.exe 3nhtnt.exe PID 2488 wrote to memory of 2356 2488 3nhtnt.exe 9ppdv.exe PID 2488 wrote to memory of 2356 2488 3nhtnt.exe 9ppdv.exe PID 2488 wrote to memory of 2356 2488 3nhtnt.exe 9ppdv.exe PID 2488 wrote to memory of 2356 2488 3nhtnt.exe 9ppdv.exe PID 2356 wrote to memory of 2472 2356 9ppdv.exe pjddp.exe PID 2356 wrote to memory of 2472 2356 9ppdv.exe pjddp.exe PID 2356 wrote to memory of 2472 2356 9ppdv.exe pjddp.exe PID 2356 wrote to memory of 2472 2356 9ppdv.exe pjddp.exe PID 2472 wrote to memory of 2180 2472 pjddp.exe 9rlflff.exe PID 2472 wrote to memory of 2180 2472 pjddp.exe 9rlflff.exe PID 2472 wrote to memory of 2180 2472 pjddp.exe 9rlflff.exe PID 2472 wrote to memory of 2180 2472 pjddp.exe 9rlflff.exe PID 2180 wrote to memory of 1772 2180 9rlflff.exe nnhhtt.exe PID 2180 wrote to memory of 1772 2180 9rlflff.exe nnhhtt.exe PID 2180 wrote to memory of 1772 2180 9rlflff.exe nnhhtt.exe PID 2180 wrote to memory of 1772 2180 9rlflff.exe nnhhtt.exe PID 1772 wrote to memory of 2528 1772 nnhhtt.exe dvvjv.exe PID 1772 wrote to memory of 2528 1772 nnhhtt.exe dvvjv.exe PID 1772 wrote to memory of 2528 1772 nnhhtt.exe dvvjv.exe PID 1772 wrote to memory of 2528 1772 nnhhtt.exe dvvjv.exe PID 2528 wrote to memory of 2680 2528 dvvjv.exe 1jjdv.exe PID 2528 wrote to memory of 2680 2528 dvvjv.exe 1jjdv.exe PID 2528 wrote to memory of 2680 2528 dvvjv.exe 1jjdv.exe PID 2528 wrote to memory of 2680 2528 dvvjv.exe 1jjdv.exe PID 2680 wrote to memory of 1608 2680 1jjdv.exe rrrrflf.exe PID 2680 wrote to memory of 1608 2680 1jjdv.exe rrrrflf.exe PID 2680 wrote to memory of 1608 2680 1jjdv.exe rrrrflf.exe PID 2680 wrote to memory of 1608 2680 1jjdv.exe rrrrflf.exe PID 1608 wrote to memory of 496 1608 rrrrflf.exe bbhnnh.exe PID 1608 wrote to memory of 496 1608 rrrrflf.exe bbhnnh.exe PID 1608 wrote to memory of 496 1608 rrrrflf.exe bbhnnh.exe PID 1608 wrote to memory of 496 1608 rrrrflf.exe bbhnnh.exe PID 496 wrote to memory of 1968 496 bbhnnh.exe 3vppv.exe PID 496 wrote to memory of 1968 496 bbhnnh.exe 3vppv.exe PID 496 wrote to memory of 1968 496 bbhnnh.exe 3vppv.exe PID 496 wrote to memory of 1968 496 bbhnnh.exe 3vppv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exe"C:\Users\Admin\AppData\Local\Temp\52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\ntthnb.exec:\ntthnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\jjdjp.exec:\jjdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\lfffxrr.exec:\lfffxrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\tnbhnn.exec:\tnbhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\jdpvj.exec:\jdpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\fxffllx.exec:\fxffllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\3nhtnt.exec:\3nhtnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\9ppdv.exec:\9ppdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\pjddp.exec:\pjddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\9rlflff.exec:\9rlflff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\nnhhtt.exec:\nnhhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\dvvjv.exec:\dvvjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\1jjdv.exec:\1jjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\rrrrflf.exec:\rrrrflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\bbhnnh.exec:\bbhnnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:496 -
\??\c:\3vppv.exec:\3vppv.exe17⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xflllfx.exec:\xflllfx.exe18⤵
- Executes dropped EXE
PID:2284 -
\??\c:\llrffff.exec:\llrffff.exe19⤵
- Executes dropped EXE
PID:1148 -
\??\c:\5tbntn.exec:\5tbntn.exe20⤵
- Executes dropped EXE
PID:1272 -
\??\c:\pjdjd.exec:\pjdjd.exe21⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jdddv.exec:\jdddv.exe22⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lfxrrxx.exec:\lfxrrxx.exe23⤵
- Executes dropped EXE
PID:2764 -
\??\c:\bbbhtt.exec:\bbbhtt.exe24⤵
- Executes dropped EXE
PID:1728 -
\??\c:\dvvvd.exec:\dvvvd.exe25⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pdpjp.exec:\pdpjp.exe26⤵
- Executes dropped EXE
PID:2556 -
\??\c:\xrllxxr.exec:\xrllxxr.exe27⤵
- Executes dropped EXE
PID:1080 -
\??\c:\1tnbnt.exec:\1tnbnt.exe28⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nhnttt.exec:\nhnttt.exe29⤵
- Executes dropped EXE
PID:832 -
\??\c:\dvjjp.exec:\dvjjp.exe30⤵
- Executes dropped EXE
PID:2200 -
\??\c:\5fffrlx.exec:\5fffrlx.exe31⤵
- Executes dropped EXE
PID:812 -
\??\c:\bhhnhn.exec:\bhhnhn.exe32⤵
- Executes dropped EXE
PID:472 -
\??\c:\5btthn.exec:\5btthn.exe33⤵
- Executes dropped EXE
PID:1624 -
\??\c:\1pddd.exec:\1pddd.exe34⤵
- Executes dropped EXE
PID:572 -
\??\c:\rlfxrxf.exec:\rlfxrxf.exe35⤵
- Executes dropped EXE
PID:1536 -
\??\c:\1hnthh.exec:\1hnthh.exe36⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bbbtnh.exec:\bbbtnh.exe37⤵
- Executes dropped EXE
PID:1580 -
\??\c:\ddppv.exec:\ddppv.exe38⤵
- Executes dropped EXE
PID:1920 -
\??\c:\llfrfrl.exec:\llfrfrl.exe39⤵
- Executes dropped EXE
PID:1452 -
\??\c:\tbnhbb.exec:\tbnhbb.exe40⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bhnbbb.exec:\bhnbbb.exe41⤵
- Executes dropped EXE
PID:1532 -
\??\c:\pjpvj.exec:\pjpvj.exe42⤵
- Executes dropped EXE
PID:1500 -
\??\c:\xrfxxrx.exec:\xrfxxrx.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\rllrxxx.exec:\rllrxxx.exe44⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xlflllr.exec:\xlflllr.exe45⤵
- Executes dropped EXE
PID:2444 -
\??\c:\nbhtbb.exec:\nbhtbb.exe46⤵
- Executes dropped EXE
PID:2532 -
\??\c:\ppvjj.exec:\ppvjj.exe47⤵
- Executes dropped EXE
PID:2196 -
\??\c:\dvdvd.exec:\dvdvd.exe48⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xrfrxlr.exec:\xrfrxlr.exe49⤵
- Executes dropped EXE
PID:2388 -
\??\c:\9fxflrf.exec:\9fxflrf.exe50⤵
- Executes dropped EXE
PID:2640 -
\??\c:\9nhhth.exec:\9nhhth.exe51⤵
- Executes dropped EXE
PID:2364 -
\??\c:\5ntttb.exec:\5ntttb.exe52⤵
- Executes dropped EXE
PID:2428 -
\??\c:\ppjvp.exec:\ppjvp.exe53⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rrxfxrx.exec:\rrxfxrx.exe54⤵
- Executes dropped EXE
PID:2472 -
\??\c:\nbntbn.exec:\nbntbn.exe55⤵
- Executes dropped EXE
PID:1464 -
\??\c:\tnbnhn.exec:\tnbnhn.exe56⤵
- Executes dropped EXE
PID:1120 -
\??\c:\7thhtn.exec:\7thhtn.exe57⤵
- Executes dropped EXE
PID:2592 -
\??\c:\7dppd.exec:\7dppd.exe58⤵
- Executes dropped EXE
PID:2528 -
\??\c:\ppdpp.exec:\ppdpp.exe59⤵
- Executes dropped EXE
PID:2680 -
\??\c:\7lxxrrr.exec:\7lxxrrr.exe60⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xrrxffx.exec:\xrrxffx.exe61⤵
- Executes dropped EXE
PID:1780 -
\??\c:\9bbttb.exec:\9bbttb.exe62⤵
- Executes dropped EXE
PID:2072 -
\??\c:\5hhtbb.exec:\5hhtbb.exe63⤵
- Executes dropped EXE
PID:1364 -
\??\c:\pvvjv.exec:\pvvjv.exe64⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5pvpd.exec:\5pvpd.exe65⤵
- Executes dropped EXE
PID:1280 -
\??\c:\xrflllr.exec:\xrflllr.exe66⤵PID:2112
-
\??\c:\7lrlrlr.exec:\7lrlrlr.exe67⤵PID:1272
-
\??\c:\htbhnn.exec:\htbhnn.exe68⤵PID:2728
-
\??\c:\5hbhnn.exec:\5hbhnn.exe69⤵PID:2008
-
\??\c:\thtbbt.exec:\thtbbt.exe70⤵PID:2744
-
\??\c:\jvjjv.exec:\jvjjv.exe71⤵PID:2184
-
\??\c:\pjjdd.exec:\pjjdd.exe72⤵PID:2760
-
\??\c:\1flrxxf.exec:\1flrxxf.exe73⤵PID:2392
-
\??\c:\7rxrrrx.exec:\7rxrrrx.exe74⤵PID:2332
-
\??\c:\hhnbtt.exec:\hhnbtt.exe75⤵PID:3048
-
\??\c:\5hntbb.exec:\5hntbb.exe76⤵PID:1252
-
\??\c:\3jvjp.exec:\3jvjp.exe77⤵PID:896
-
\??\c:\7llrrrf.exec:\7llrrrf.exe78⤵PID:2664
-
\??\c:\thnnnn.exec:\thnnnn.exe79⤵PID:2960
-
\??\c:\btttbt.exec:\btttbt.exe80⤵PID:1224
-
\??\c:\dvjpv.exec:\dvjpv.exe81⤵PID:1816
-
\??\c:\9vdvv.exec:\9vdvv.exe82⤵PID:1888
-
\??\c:\lxxxlrr.exec:\lxxxlrr.exe83⤵PID:1692
-
\??\c:\nhtbbh.exec:\nhtbbh.exe84⤵PID:472
-
\??\c:\3hbhhh.exec:\3hbhhh.exe85⤵PID:1964
-
\??\c:\jvvvp.exec:\jvvvp.exe86⤵PID:344
-
\??\c:\9dddd.exec:\9dddd.exe87⤵PID:856
-
\??\c:\fxxflxf.exec:\fxxflxf.exe88⤵PID:2216
-
\??\c:\9btnbb.exec:\9btnbb.exe89⤵PID:2312
-
\??\c:\nhnbnn.exec:\nhnbnn.exe90⤵PID:1436
-
\??\c:\hbnhhb.exec:\hbnhhb.exe91⤵PID:1876
-
\??\c:\vpdjp.exec:\vpdjp.exe92⤵PID:2924
-
\??\c:\9ddjd.exec:\9ddjd.exe93⤵PID:328
-
\??\c:\rfxrrrx.exec:\rfxrrrx.exe94⤵PID:3040
-
\??\c:\fxxfllr.exec:\fxxfllr.exe95⤵PID:2788
-
\??\c:\5htbhb.exec:\5htbhb.exe96⤵PID:2952
-
\??\c:\tnbntb.exec:\tnbntb.exe97⤵PID:2496
-
\??\c:\3bbhtt.exec:\3bbhtt.exe98⤵PID:2456
-
\??\c:\3pvdd.exec:\3pvdd.exe99⤵PID:2504
-
\??\c:\dvjvv.exec:\dvjvv.exe100⤵PID:2160
-
\??\c:\rlrfrrf.exec:\rlrfrrf.exe101⤵PID:2516
-
\??\c:\rxlflrx.exec:\rxlflrx.exe102⤵PID:2388
-
\??\c:\nhtnbt.exec:\nhtnbt.exe103⤵PID:2488
-
\??\c:\tnnttt.exec:\tnnttt.exe104⤵PID:2652
-
\??\c:\vdjvd.exec:\vdjvd.exe105⤵PID:2520
-
\??\c:\5vjjp.exec:\5vjjp.exe106⤵PID:2896
-
\??\c:\jddpp.exec:\jddpp.exe107⤵PID:1648
-
\??\c:\7fxflrr.exec:\7fxflrr.exe108⤵PID:752
-
\??\c:\xrxllfl.exec:\xrxllfl.exe109⤵PID:1120
-
\??\c:\btbnnn.exec:\btbnnn.exe110⤵PID:2600
-
\??\c:\nbhbbh.exec:\nbhbbh.exe111⤵PID:2700
-
\??\c:\jvdpd.exec:\jvdpd.exe112⤵PID:1776
-
\??\c:\lxrrlfr.exec:\lxrrlfr.exe113⤵PID:1584
-
\??\c:\lflfllx.exec:\lflfllx.exe114⤵PID:356
-
\??\c:\btbbhh.exec:\btbbhh.exe115⤵PID:288
-
\??\c:\bbhbbb.exec:\bbhbbb.exe116⤵PID:1204
-
\??\c:\dpvdp.exec:\dpvdp.exe117⤵PID:2080
-
\??\c:\ddppd.exec:\ddppd.exe118⤵PID:1148
-
\??\c:\rfrfllr.exec:\rfrfllr.exe119⤵PID:2112
-
\??\c:\xrffrxf.exec:\xrffrxf.exe120⤵PID:1360
-
\??\c:\3pjvj.exec:\3pjvj.exe121⤵PID:2780
-
\??\c:\1jddv.exec:\1jddv.exe122⤵PID:2008
-
\??\c:\vpppv.exec:\vpppv.exe123⤵PID:2744
-
\??\c:\9rlfxxf.exec:\9rlfxxf.exe124⤵PID:2324
-
\??\c:\tthhnn.exec:\tthhnn.exe125⤵PID:2760
-
\??\c:\hbhhhb.exec:\hbhhhb.exe126⤵PID:2392
-
\??\c:\pdjvv.exec:\pdjvv.exe127⤵PID:692
-
\??\c:\dpvdd.exec:\dpvdd.exe128⤵PID:2816
-
\??\c:\pjvdp.exec:\pjvdp.exe129⤵PID:1252
-
\??\c:\7llrrrr.exec:\7llrrrr.exe130⤵PID:2084
-
\??\c:\xrllrxl.exec:\xrllrxl.exe131⤵PID:1048
-
\??\c:\5btntt.exec:\5btntt.exe132⤵PID:412
-
\??\c:\5nbttb.exec:\5nbttb.exe133⤵PID:1224
-
\??\c:\pdjpd.exec:\pdjpd.exe134⤵PID:1816
-
\??\c:\jdjpv.exec:\jdjpv.exe135⤵PID:1888
-
\??\c:\lllrfxf.exec:\lllrfxf.exe136⤵PID:2912
-
\??\c:\lrlxfxx.exec:\lrlxfxx.exe137⤵PID:984
-
\??\c:\hbhthh.exec:\hbhthh.exe138⤵PID:680
-
\??\c:\httnnn.exec:\httnnn.exe139⤵PID:1812
-
\??\c:\pdvdj.exec:\pdvdj.exe140⤵PID:1248
-
\??\c:\jdppj.exec:\jdppj.exe141⤵PID:1592
-
\??\c:\1pvjp.exec:\1pvjp.exe142⤵PID:1580
-
\??\c:\fxlxllx.exec:\fxlxllx.exe143⤵PID:1916
-
\??\c:\fxfflxf.exec:\fxfflxf.exe144⤵PID:748
-
\??\c:\9thbnt.exec:\9thbnt.exe145⤵PID:1524
-
\??\c:\hthttt.exec:\hthttt.exe146⤵PID:1528
-
\??\c:\pjvjj.exec:\pjvjj.exe147⤵PID:2096
-
\??\c:\jjjpj.exec:\jjjpj.exe148⤵PID:2688
-
\??\c:\1rfrflr.exec:\1rfrflr.exe149⤵PID:2788
-
\??\c:\rlflxxf.exec:\rlflxxf.exe150⤵PID:2952
-
\??\c:\hbthtt.exec:\hbthtt.exe151⤵PID:2496
-
\??\c:\3tnttt.exec:\3tnttt.exe152⤵PID:2636
-
\??\c:\vjpvj.exec:\vjpvj.exe153⤵PID:2736
-
\??\c:\vpvvd.exec:\vpvvd.exe154⤵PID:2160
-
\??\c:\xlxrrlr.exec:\xlxrrlr.exe155⤵PID:2516
-
\??\c:\thhntt.exec:\thhntt.exe156⤵PID:2524
-
\??\c:\1nnnbh.exec:\1nnnbh.exe157⤵PID:2488
-
\??\c:\dpdpd.exec:\dpdpd.exe158⤵PID:2652
-
\??\c:\jdvpp.exec:\jdvpp.exe159⤵PID:852
-
\??\c:\5fxlrrf.exec:\5fxlrrf.exe160⤵PID:2404
-
\??\c:\5rfrxrr.exec:\5rfrxrr.exe161⤵PID:1948
-
\??\c:\bttnhn.exec:\bttnhn.exe162⤵PID:2612
-
\??\c:\1vjjv.exec:\1vjjv.exe163⤵PID:1120
-
\??\c:\jjvpv.exec:\jjvpv.exe164⤵PID:1324
-
\??\c:\vpddj.exec:\vpddj.exe165⤵PID:2700
-
\??\c:\frrrxfr.exec:\frrrxfr.exe166⤵PID:1488
-
\??\c:\nbbbhh.exec:\nbbbhh.exe167⤵PID:2116
-
\??\c:\1bbnbh.exec:\1bbnbh.exe168⤵PID:496
-
\??\c:\ppvvj.exec:\ppvvj.exe169⤵PID:288
-
\??\c:\lllfxrf.exec:\lllfxrf.exe170⤵PID:1264
-
\??\c:\xrlrrrr.exec:\xrlrrrr.exe171⤵PID:1280
-
\??\c:\hnbbnn.exec:\hnbbnn.exe172⤵PID:2012
-
\??\c:\nhnnth.exec:\nhnnth.exe173⤵PID:1028
-
\??\c:\jddvd.exec:\jddvd.exe174⤵PID:1360
-
\??\c:\xrxflfr.exec:\xrxflfr.exe175⤵PID:2772
-
\??\c:\fxffllx.exec:\fxffllx.exe176⤵PID:2140
-
\??\c:\bbtbbh.exec:\bbtbbh.exe177⤵PID:1728
-
\??\c:\tnbthn.exec:\tnbthn.exe178⤵PID:2272
-
\??\c:\jddjj.exec:\jddjj.exe179⤵PID:668
-
\??\c:\dvpjp.exec:\dvpjp.exe180⤵PID:480
-
\??\c:\lxfrlfl.exec:\lxfrlfl.exe181⤵PID:1668
-
\??\c:\9nbhnt.exec:\9nbhnt.exe182⤵PID:3008
-
\??\c:\tntthn.exec:\tntthn.exe183⤵PID:2980
-
\??\c:\jddjd.exec:\jddjd.exe184⤵PID:332
-
\??\c:\7xflrxl.exec:\7xflrxl.exe185⤵PID:2188
-
\??\c:\fflfrrl.exec:\fflfrrl.exe186⤵PID:2200
-
\??\c:\ntttbt.exec:\ntttbt.exe187⤵PID:952
-
\??\c:\vvvvp.exec:\vvvvp.exe188⤵PID:1996
-
\??\c:\pjjjv.exec:\pjjjv.exe189⤵PID:1888
-
\??\c:\xrfllrf.exec:\xrfllrf.exe190⤵PID:2912
-
\??\c:\nhhbhb.exec:\nhhbhb.exe191⤵PID:984
-
\??\c:\jdvjd.exec:\jdvjd.exe192⤵PID:1536
-
\??\c:\fxxffxf.exec:\fxxffxf.exe193⤵PID:2984
-
\??\c:\fxlfllx.exec:\fxlfllx.exe194⤵PID:2176
-
\??\c:\pvjdp.exec:\pvjdp.exe195⤵PID:2076
-
\??\c:\frrrlff.exec:\frrrlff.exe196⤵PID:1636
-
\??\c:\9rlxflr.exec:\9rlxflr.exe197⤵PID:1452
-
\??\c:\btttht.exec:\btttht.exe198⤵PID:1640
-
\??\c:\nhbhbh.exec:\nhbhbh.exe199⤵PID:624
-
\??\c:\pjvdp.exec:\pjvdp.exe200⤵PID:2548
-
\??\c:\9lfrxfr.exec:\9lfrxfr.exe201⤵PID:2492
-
\??\c:\rlfrffr.exec:\rlfrffr.exe202⤵PID:2444
-
\??\c:\bhnntb.exec:\bhnntb.exe203⤵PID:2532
-
\??\c:\9hnbnb.exec:\9hnbnb.exe204⤵PID:2644
-
\??\c:\dvppj.exec:\dvppj.exe205⤵PID:2964
-
\??\c:\5fxlrfr.exec:\5fxlrfr.exe206⤵PID:2376
-
\??\c:\5xlrllr.exec:\5xlrllr.exe207⤵PID:2668
-
\??\c:\5nnnbh.exec:\5nnnbh.exe208⤵PID:2516
-
\??\c:\tnhttt.exec:\tnhttt.exe209⤵PID:2524
-
\??\c:\jjjpj.exec:\jjjpj.exe210⤵PID:1632
-
\??\c:\vpjdd.exec:\vpjdd.exe211⤵PID:2652
-
\??\c:\3lrxxlx.exec:\3lrxxlx.exe212⤵PID:2616
-
\??\c:\1rfflrr.exec:\1rfflrr.exe213⤵PID:2472
-
\??\c:\nnthbh.exec:\nnthbh.exe214⤵PID:1756
-
\??\c:\3tntht.exec:\3tntht.exe215⤵PID:2592
-
\??\c:\9vvvv.exec:\9vvvv.exe216⤵PID:2600
-
\??\c:\jddpd.exec:\jddpd.exe217⤵PID:1776
-
\??\c:\frflfxx.exec:\frflfxx.exe218⤵PID:2716
-
\??\c:\lfxlfxf.exec:\lfxlfxf.exe219⤵PID:1780
-
\??\c:\tnbhbh.exec:\tnbhbh.exe220⤵PID:2132
-
\??\c:\hbtbbb.exec:\hbtbbb.exe221⤵PID:1204
-
\??\c:\ppvdj.exec:\ppvdj.exe222⤵PID:2080
-
\??\c:\ppvjd.exec:\ppvjd.exe223⤵PID:2732
-
\??\c:\9ffflrf.exec:\9ffflrf.exe224⤵PID:2028
-
\??\c:\7xrrlxf.exec:\7xrrlxf.exe225⤵PID:2852
-
\??\c:\hhtbtb.exec:\hhtbtb.exe226⤵PID:2584
-
\??\c:\1htthh.exec:\1htthh.exe227⤵PID:2448
-
\??\c:\vjjvv.exec:\vjjvv.exe228⤵PID:2904
-
\??\c:\jdvpj.exec:\jdvpj.exe229⤵PID:2324
-
\??\c:\3rlxflr.exec:\3rlxflr.exe230⤵PID:2760
-
\??\c:\7xllrxx.exec:\7xllrxx.exe231⤵PID:740
-
\??\c:\thtbbt.exec:\thtbbt.exe232⤵PID:1940
-
\??\c:\nbhbbh.exec:\nbhbbh.exe233⤵PID:692
-
\??\c:\3pddj.exec:\3pddj.exe234⤵PID:1468
-
\??\c:\7dpdp.exec:\7dpdp.exe235⤵PID:832
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe236⤵PID:1188
-
\??\c:\bbnbnt.exec:\bbnbnt.exe237⤵PID:2976
-
\??\c:\nhnnbt.exec:\nhnnbt.exe238⤵PID:1308
-
\??\c:\vvpdv.exec:\vvpdv.exe239⤵PID:2820
-
\??\c:\jvvpv.exec:\jvvpv.exe240⤵PID:1688
-
\??\c:\fxrfxlr.exec:\fxrfxlr.exe241⤵PID:600
-
\??\c:\frrrrff.exec:\frrrrff.exe242⤵PID:2936