Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 20:12
Behavioral task
behavioral1
Sample
22c2c9a00d98dca419a0dd3285b1622eddf585b7e66d588d90d22ab70db80f64.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
General
-
Target
22c2c9a00d98dca419a0dd3285b1622eddf585b7e66d588d90d22ab70db80f64.exe
-
Size
81KB
-
MD5
5795e7d1e5ae624b824c2fe9e3cfd4c0
-
SHA1
20e3134dceec4f5e91e332de5c19382a004bf0d6
-
SHA256
22c2c9a00d98dca419a0dd3285b1622eddf585b7e66d588d90d22ab70db80f64
-
SHA512
d5afc922f75b8d21c16fd1ee581e00770228b81d015c9fb972adfac6b7e753d32c050419f622649e93a18d79b9f497433e6b923db80d2fc622388f0cef557d1e
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6T7QGIC:zhOmTsF93UYfwC6GIoutiTU2HVS63Qg
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
Processes:
resource yara_rule behavioral1/memory/2220-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-139-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2224-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1152-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/760-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/812-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/448-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-500-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1776-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-595-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-706-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1208-744-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-776-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1236-8053-0x0000000077660000-0x000000007777F000-memory.dmp family_blackmoon behavioral1/memory/1236-8325-0x0000000077660000-0x000000007777F000-memory.dmp family_blackmoon behavioral1/memory/1236-14604-0x0000000077780000-0x000000007787A000-memory.dmp family_blackmoon behavioral1/memory/1236-15631-0x0000000077780000-0x000000007787A000-memory.dmp family_blackmoon behavioral1/memory/1236-21353-0x0000000077660000-0x000000007777F000-memory.dmp family_blackmoon behavioral1/memory/1236-27130-0x0000000077660000-0x000000007777F000-memory.dmp family_blackmoon behavioral1/memory/1236-29759-0x0000000077660000-0x000000007777F000-memory.dmp family_blackmoon behavioral1/memory/1236-30347-0x0000000077780000-0x000000007787A000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule C:\ppdpj.exe UPX behavioral1/memory/2220-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2220-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\7xrfrrx.exe UPX behavioral1/memory/1692-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1804-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\hhbnbh.exe UPX C:\nbnhnb.exe UPX behavioral1/memory/2532-34-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2532-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pjdjp.exe UPX behavioral1/memory/2632-42-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2592-44-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rlxllrx.exe UPX C:\thbhnn.exe UPX behavioral1/memory/2700-59-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2732-67-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jpvdj.exe UPX C:\llflflx.exe UPX behavioral1/memory/2604-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2444-76-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7httnt.exe UPX behavioral1/memory/2444-83-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2368-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tnhnbb.exe UPX behavioral1/memory/2912-95-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pvjvd.exe UPX C:\ddvjd.exe UPX behavioral1/memory/2368-93-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\llfrfrf.exe UPX C:\nnnbnt.exe UPX behavioral1/memory/2780-123-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hhbbht.exe UPX behavioral1/memory/1976-132-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7jjjd.exe UPX C:\lfxlrfr.exe UPX C:\rrlrlrf.exe UPX behavioral1/memory/2224-153-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1432-155-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hhthnn.exe UPX C:\nnhthn.exe UPX C:\pjvjv.exe UPX C:\7dvpd.exe UPX behavioral1/memory/1732-187-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\1xxrrrf.exe UPX C:\tnbntb.exe UPX behavioral1/memory/2104-201-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\bhhttt.exe UPX behavioral1/memory/2404-214-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ddvdp.exe UPX C:\llrlfff.exe UPX behavioral1/memory/1152-222-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bbbhbb.exe UPX behavioral1/memory/1656-232-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tnnnbb.exe UPX behavioral1/memory/1664-239-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tthhnn.exe UPX behavioral1/memory/760-249-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2340-255-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pdvdp.exe UPX behavioral1/memory/2236-262-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3024-278-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2220-284-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2716-295-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
ppdpj.exe7xrfrrx.exehhbnbh.exenbnhnb.exepjdjp.exerlxllrx.exethbhnn.exejpvdj.exellflflx.exe7httnt.exetnhnbb.exepvjvd.exeddvjd.exellfrfrf.exennnbnt.exehhbbht.exe7jjjd.exelfxlrfr.exerrlrlrf.exehhthnn.exennhthn.exepjvjv.exe7dvpd.exe1xxrrrf.exetnbntb.exebhhttt.exeddvdp.exellrlfff.exebbbhbb.exetnnnbb.exetthhnn.exepdvdp.exelxrfflf.exe5llfrrx.exe1bbnbb.exehhhnnn.exe9ddvp.exevpvjj.exe5xrxfrl.exefflrllr.exehhtnbh.exejjppd.exe7ddjp.exerrrxfrl.exebbnbnt.exebhbnhh.exevvdpd.exedpppp.exexrfxllx.exerfllrrx.exetbbtbt.exehhhbnt.exe9pjvv.exelxlfrxl.exetnhnhn.exehbhntb.exevjdpd.exejdpdv.exe7fflxfr.exe9xxfrlr.exenbnthn.exejjdpp.exeppdvp.exexrfflxl.exepid process 1692 ppdpj.exe 1804 7xrfrrx.exe 2532 hhbnbh.exe 2632 nbnhnb.exe 2592 pjdjp.exe 2700 rlxllrx.exe 2732 thbhnn.exe 2604 jpvdj.exe 2444 llflflx.exe 2368 7httnt.exe 2912 tnhnbb.exe 1632 pvjvd.exe 2768 ddvjd.exe 2780 llfrfrf.exe 2328 nnnbnt.exe 1976 hhbbht.exe 2332 7jjjd.exe 2224 lfxlrfr.exe 1432 rrlrlrf.exe 1528 hhthnn.exe 1592 nnhthn.exe 2116 pjvjv.exe 1732 7dvpd.exe 1156 1xxrrrf.exe 2104 tnbntb.exe 2404 bhhttt.exe 1152 ddvdp.exe 2972 llrlfff.exe 1656 bbbhbb.exe 1664 tnnnbb.exe 760 tthhnn.exe 2340 pdvdp.exe 2236 lxrfflf.exe 2304 5llfrrx.exe 3024 1bbnbb.exe 1688 hhhnnn.exe 2220 9ddvp.exe 3016 vpvjj.exe 2716 5xrxfrl.exe 2380 fflrllr.exe 1704 hhtnbh.exe 2984 jjppd.exe 2652 7ddjp.exe 2544 rrrxfrl.exe 2664 bbnbnt.exe 2808 bhbnhh.exe 2688 vvdpd.exe 2576 dpppp.exe 2440 xrfxllx.exe 2456 rfllrrx.exe 2900 tbbtbt.exe 2504 hhhbnt.exe 2368 9pjvv.exe 2616 lxlfrxl.exe 1632 tnhnhn.exe 2760 hbhntb.exe 612 vjdpd.exe 2780 jdpdv.exe 312 7fflxfr.exe 1864 9xxfrlr.exe 812 nbnthn.exe 2164 jjdpp.exe 1580 ppdvp.exe 2908 xrfflxl.exe -
Processes:
resource yara_rule C:\ppdpj.exe upx behavioral1/memory/2220-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-0-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7xrfrrx.exe upx behavioral1/memory/1692-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1804-24-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhbnbh.exe upx C:\nbnhnb.exe upx behavioral1/memory/2532-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjdjp.exe upx behavioral1/memory/2632-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlxllrx.exe upx C:\thbhnn.exe upx behavioral1/memory/2700-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2732-67-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpvdj.exe upx C:\llflflx.exe upx behavioral1/memory/2604-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2444-76-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7httnt.exe upx behavioral1/memory/2444-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2368-85-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnhnbb.exe upx behavioral1/memory/2912-95-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvjvd.exe upx C:\ddvjd.exe upx behavioral1/memory/2368-93-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llfrfrf.exe upx C:\nnnbnt.exe upx behavioral1/memory/2780-123-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhbbht.exe upx behavioral1/memory/1976-132-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7jjjd.exe upx C:\lfxlrfr.exe upx C:\rrlrlrf.exe upx behavioral1/memory/2224-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1432-155-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhthnn.exe upx C:\nnhthn.exe upx C:\pjvjv.exe upx C:\7dvpd.exe upx behavioral1/memory/1732-187-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1xxrrrf.exe upx C:\tnbntb.exe upx behavioral1/memory/2104-201-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bhhttt.exe upx behavioral1/memory/2404-214-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddvdp.exe upx C:\llrlfff.exe upx behavioral1/memory/1152-222-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbbhbb.exe upx behavioral1/memory/1656-232-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnnbb.exe upx behavioral1/memory/1664-239-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tthhnn.exe upx behavioral1/memory/760-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2340-255-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdvdp.exe upx behavioral1/memory/2236-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3024-278-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2716-295-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
22c2c9a00d98dca419a0dd3285b1622eddf585b7e66d588d90d22ab70db80f64.exeppdpj.exe7xrfrrx.exehhbnbh.exenbnhnb.exepjdjp.exerlxllrx.exethbhnn.exejpvdj.exellflflx.exe7httnt.exetnhnbb.exepvjvd.exeddvjd.exellfrfrf.exennnbnt.exedescription pid process target process PID 2220 wrote to memory of 1692 2220 22c2c9a00d98dca419a0dd3285b1622eddf585b7e66d588d90d22ab70db80f64.exe ppdpj.exe PID 2220 wrote to memory of 1692 2220 22c2c9a00d98dca419a0dd3285b1622eddf585b7e66d588d90d22ab70db80f64.exe ppdpj.exe PID 2220 wrote to memory of 1692 2220 22c2c9a00d98dca419a0dd3285b1622eddf585b7e66d588d90d22ab70db80f64.exe ppdpj.exe PID 2220 wrote to memory of 1692 2220 22c2c9a00d98dca419a0dd3285b1622eddf585b7e66d588d90d22ab70db80f64.exe ppdpj.exe PID 1692 wrote to memory of 1804 1692 ppdpj.exe 7xrfrrx.exe PID 1692 wrote to memory of 1804 1692 ppdpj.exe 7xrfrrx.exe PID 1692 wrote to memory of 1804 1692 ppdpj.exe 7xrfrrx.exe PID 1692 wrote to memory of 1804 1692 ppdpj.exe 7xrfrrx.exe PID 1804 wrote to memory of 2532 1804 7xrfrrx.exe hhbnbh.exe PID 1804 wrote to memory of 2532 1804 7xrfrrx.exe hhbnbh.exe PID 1804 wrote to memory of 2532 1804 7xrfrrx.exe hhbnbh.exe PID 1804 wrote to memory of 2532 1804 7xrfrrx.exe hhbnbh.exe PID 2532 wrote to memory of 2632 2532 hhbnbh.exe nbnhnb.exe PID 2532 wrote to memory of 2632 2532 hhbnbh.exe nbnhnb.exe PID 2532 wrote to memory of 2632 2532 hhbnbh.exe nbnhnb.exe PID 2532 wrote to memory of 2632 2532 hhbnbh.exe nbnhnb.exe PID 2632 wrote to memory of 2592 2632 nbnhnb.exe pjdjp.exe PID 2632 wrote to memory of 2592 2632 nbnhnb.exe pjdjp.exe PID 2632 wrote to memory of 2592 2632 nbnhnb.exe pjdjp.exe PID 2632 wrote to memory of 2592 2632 nbnhnb.exe pjdjp.exe PID 2592 wrote to memory of 2700 2592 pjdjp.exe rlxllrx.exe PID 2592 wrote to memory of 2700 2592 pjdjp.exe rlxllrx.exe PID 2592 wrote to memory of 2700 2592 pjdjp.exe rlxllrx.exe PID 2592 wrote to memory of 2700 2592 pjdjp.exe rlxllrx.exe PID 2700 wrote to memory of 2732 2700 rlxllrx.exe thbhnn.exe PID 2700 wrote to memory of 2732 2700 rlxllrx.exe thbhnn.exe PID 2700 wrote to memory of 2732 2700 rlxllrx.exe thbhnn.exe PID 2700 wrote to memory of 2732 2700 rlxllrx.exe thbhnn.exe PID 2732 wrote to memory of 2604 2732 thbhnn.exe jpvdj.exe PID 2732 wrote to memory of 2604 2732 thbhnn.exe jpvdj.exe PID 2732 wrote to memory of 2604 2732 thbhnn.exe jpvdj.exe PID 2732 wrote to memory of 2604 2732 thbhnn.exe jpvdj.exe PID 2604 wrote to memory of 2444 2604 jpvdj.exe llflflx.exe PID 2604 wrote to memory of 2444 2604 jpvdj.exe llflflx.exe PID 2604 wrote to memory of 2444 2604 jpvdj.exe llflflx.exe PID 2604 wrote to memory of 2444 2604 jpvdj.exe llflflx.exe PID 2444 wrote to memory of 2368 2444 llflflx.exe 7httnt.exe PID 2444 wrote to memory of 2368 2444 llflflx.exe 7httnt.exe PID 2444 wrote to memory of 2368 2444 llflflx.exe 7httnt.exe PID 2444 wrote to memory of 2368 2444 llflflx.exe 7httnt.exe PID 2368 wrote to memory of 2912 2368 7httnt.exe tnhnbb.exe PID 2368 wrote to memory of 2912 2368 7httnt.exe tnhnbb.exe PID 2368 wrote to memory of 2912 2368 7httnt.exe tnhnbb.exe PID 2368 wrote to memory of 2912 2368 7httnt.exe tnhnbb.exe PID 2912 wrote to memory of 1632 2912 tnhnbb.exe pvjvd.exe PID 2912 wrote to memory of 1632 2912 tnhnbb.exe pvjvd.exe PID 2912 wrote to memory of 1632 2912 tnhnbb.exe pvjvd.exe PID 2912 wrote to memory of 1632 2912 tnhnbb.exe pvjvd.exe PID 1632 wrote to memory of 2768 1632 pvjvd.exe ddvjd.exe PID 1632 wrote to memory of 2768 1632 pvjvd.exe ddvjd.exe PID 1632 wrote to memory of 2768 1632 pvjvd.exe ddvjd.exe PID 1632 wrote to memory of 2768 1632 pvjvd.exe ddvjd.exe PID 2768 wrote to memory of 2780 2768 ddvjd.exe llfrfrf.exe PID 2768 wrote to memory of 2780 2768 ddvjd.exe llfrfrf.exe PID 2768 wrote to memory of 2780 2768 ddvjd.exe llfrfrf.exe PID 2768 wrote to memory of 2780 2768 ddvjd.exe llfrfrf.exe PID 2780 wrote to memory of 2328 2780 llfrfrf.exe nnnbnt.exe PID 2780 wrote to memory of 2328 2780 llfrfrf.exe nnnbnt.exe PID 2780 wrote to memory of 2328 2780 llfrfrf.exe nnnbnt.exe PID 2780 wrote to memory of 2328 2780 llfrfrf.exe nnnbnt.exe PID 2328 wrote to memory of 1976 2328 nnnbnt.exe hhbbht.exe PID 2328 wrote to memory of 1976 2328 nnnbnt.exe hhbbht.exe PID 2328 wrote to memory of 1976 2328 nnnbnt.exe hhbbht.exe PID 2328 wrote to memory of 1976 2328 nnnbnt.exe hhbbht.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22c2c9a00d98dca419a0dd3285b1622eddf585b7e66d588d90d22ab70db80f64.exe"C:\Users\Admin\AppData\Local\Temp\22c2c9a00d98dca419a0dd3285b1622eddf585b7e66d588d90d22ab70db80f64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\ppdpj.exec:\ppdpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\7xrfrrx.exec:\7xrfrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\hhbnbh.exec:\hhbnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\nbnhnb.exec:\nbnhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\pjdjp.exec:\pjdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rlxllrx.exec:\rlxllrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\thbhnn.exec:\thbhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\jpvdj.exec:\jpvdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\llflflx.exec:\llflflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\7httnt.exec:\7httnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\tnhnbb.exec:\tnhnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\pvjvd.exec:\pvjvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\ddvjd.exec:\ddvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\llfrfrf.exec:\llfrfrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nnnbnt.exec:\nnnbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\hhbbht.exec:\hhbbht.exe17⤵
- Executes dropped EXE
PID:1976 -
\??\c:\7jjjd.exec:\7jjjd.exe18⤵
- Executes dropped EXE
PID:2332 -
\??\c:\lfxlrfr.exec:\lfxlrfr.exe19⤵
- Executes dropped EXE
PID:2224 -
\??\c:\rrlrlrf.exec:\rrlrlrf.exe20⤵
- Executes dropped EXE
PID:1432 -
\??\c:\hhthnn.exec:\hhthnn.exe21⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nnhthn.exec:\nnhthn.exe22⤵
- Executes dropped EXE
PID:1592 -
\??\c:\pjvjv.exec:\pjvjv.exe23⤵
- Executes dropped EXE
PID:2116 -
\??\c:\7dvpd.exec:\7dvpd.exe24⤵
- Executes dropped EXE
PID:1732 -
\??\c:\1xxrrrf.exec:\1xxrrrf.exe25⤵
- Executes dropped EXE
PID:1156 -
\??\c:\tnbntb.exec:\tnbntb.exe26⤵
- Executes dropped EXE
PID:2104 -
\??\c:\bhhttt.exec:\bhhttt.exe27⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ddvdp.exec:\ddvdp.exe28⤵
- Executes dropped EXE
PID:1152 -
\??\c:\llrlfff.exec:\llrlfff.exe29⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bbbhbb.exec:\bbbhbb.exe30⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tnnnbb.exec:\tnnnbb.exe31⤵
- Executes dropped EXE
PID:1664 -
\??\c:\tthhnn.exec:\tthhnn.exe32⤵
- Executes dropped EXE
PID:760 -
\??\c:\pdvdp.exec:\pdvdp.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\lxrfflf.exec:\lxrfflf.exe34⤵
- Executes dropped EXE
PID:2236 -
\??\c:\5llfrrx.exec:\5llfrrx.exe35⤵
- Executes dropped EXE
PID:2304 -
\??\c:\1bbnbb.exec:\1bbnbb.exe36⤵
- Executes dropped EXE
PID:3024 -
\??\c:\hhhnnn.exec:\hhhnnn.exe37⤵
- Executes dropped EXE
PID:1688 -
\??\c:\9ddvp.exec:\9ddvp.exe38⤵
- Executes dropped EXE
PID:2220 -
\??\c:\vpvjj.exec:\vpvjj.exe39⤵
- Executes dropped EXE
PID:3016 -
\??\c:\5xrxfrl.exec:\5xrxfrl.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\fflrllr.exec:\fflrllr.exe41⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hhtnbh.exec:\hhtnbh.exe42⤵
- Executes dropped EXE
PID:1704 -
\??\c:\jjppd.exec:\jjppd.exe43⤵
- Executes dropped EXE
PID:2984 -
\??\c:\7ddjp.exec:\7ddjp.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rrrxfrl.exec:\rrrxfrl.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bbnbnt.exec:\bbnbnt.exe46⤵
- Executes dropped EXE
PID:2664 -
\??\c:\bhbnhh.exec:\bhbnhh.exe47⤵
- Executes dropped EXE
PID:2808 -
\??\c:\vvdpd.exec:\vvdpd.exe48⤵
- Executes dropped EXE
PID:2688 -
\??\c:\dpppp.exec:\dpppp.exe49⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xrfxllx.exec:\xrfxllx.exe50⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rfllrrx.exec:\rfllrrx.exe51⤵
- Executes dropped EXE
PID:2456 -
\??\c:\tbbtbt.exec:\tbbtbt.exe52⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hhhbnt.exec:\hhhbnt.exe53⤵
- Executes dropped EXE
PID:2504 -
\??\c:\9pjvv.exec:\9pjvv.exe54⤵
- Executes dropped EXE
PID:2368 -
\??\c:\lxlfrxl.exec:\lxlfrxl.exe55⤵
- Executes dropped EXE
PID:2616 -
\??\c:\tnhnhn.exec:\tnhnhn.exe56⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hbhntb.exec:\hbhntb.exe57⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vjdpd.exec:\vjdpd.exe58⤵
- Executes dropped EXE
PID:612 -
\??\c:\jdpdv.exec:\jdpdv.exe59⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7fflxfr.exec:\7fflxfr.exe60⤵
- Executes dropped EXE
PID:312 -
\??\c:\9xxfrlr.exec:\9xxfrlr.exe61⤵
- Executes dropped EXE
PID:1864 -
\??\c:\nbnthn.exec:\nbnthn.exe62⤵
- Executes dropped EXE
PID:812 -
\??\c:\jjdpp.exec:\jjdpp.exe63⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ppdvp.exec:\ppdvp.exe64⤵
- Executes dropped EXE
PID:1580 -
\??\c:\xrfflxl.exec:\xrfflxl.exe65⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hhbhtb.exec:\hhbhtb.exe66⤵PID:2200
-
\??\c:\tnntbb.exec:\tnntbb.exe67⤵PID:2536
-
\??\c:\vvjvd.exec:\vvjvd.exe68⤵PID:1592
-
\??\c:\vvjjp.exec:\vvjjp.exe69⤵PID:1760
-
\??\c:\7xlxlrx.exec:\7xlxlrx.exe70⤵PID:2152
-
\??\c:\lfffllr.exec:\lfffllr.exe71⤵PID:2840
-
\??\c:\7ttnbt.exec:\7ttnbt.exe72⤵PID:384
-
\??\c:\nhttbb.exec:\nhttbb.exe73⤵PID:1504
-
\??\c:\1htthh.exec:\1htthh.exe74⤵PID:540
-
\??\c:\pjdpd.exec:\pjdpd.exe75⤵PID:2404
-
\??\c:\vjpdj.exec:\vjpdj.exe76⤵PID:448
-
\??\c:\rlfxrrf.exec:\rlfxrrf.exe77⤵PID:3040
-
\??\c:\lffflxr.exec:\lffflxr.exe78⤵PID:2988
-
\??\c:\bthbbt.exec:\bthbbt.exe79⤵PID:1776
-
\??\c:\tnnhtt.exec:\tnnhtt.exe80⤵PID:892
-
\??\c:\thtbbh.exec:\thtbbh.exe81⤵PID:2300
-
\??\c:\dvpdj.exec:\dvpdj.exe82⤵PID:1728
-
\??\c:\lxlflfl.exec:\lxlflfl.exe83⤵PID:3032
-
\??\c:\rlxlxxf.exec:\rlxlxxf.exe84⤵PID:2816
-
\??\c:\flrfxrf.exec:\flrfxrf.exe85⤵PID:3012
-
\??\c:\7ttbhb.exec:\7ttbhb.exe86⤵PID:2012
-
\??\c:\nbnnnh.exec:\nbnnnh.exe87⤵PID:2040
-
\??\c:\9djdd.exec:\9djdd.exe88⤵PID:1932
-
\??\c:\frxlrxl.exec:\frxlrxl.exe89⤵PID:2180
-
\??\c:\lfrfrff.exec:\lfrfrff.exe90⤵PID:2068
-
\??\c:\9bnhhb.exec:\9bnhhb.exe91⤵PID:768
-
\??\c:\bntthn.exec:\bntthn.exe92⤵PID:2176
-
\??\c:\pjvvv.exec:\pjvvv.exe93⤵PID:1704
-
\??\c:\rlrxlrr.exec:\rlrxlrr.exe94⤵PID:2984
-
\??\c:\rrxlxfx.exec:\rrxlxfx.exe95⤵PID:2580
-
\??\c:\hhhttt.exec:\hhhttt.exe96⤵PID:2620
-
\??\c:\nhhthn.exec:\nhhthn.exe97⤵PID:2684
-
\??\c:\7vdjj.exec:\7vdjj.exe98⤵PID:2468
-
\??\c:\jvddj.exec:\jvddj.exe99⤵PID:2732
-
\??\c:\rlxffxl.exec:\rlxffxl.exe100⤵PID:2576
-
\??\c:\9rfffxf.exec:\9rfffxf.exe101⤵PID:2360
-
\??\c:\tnhtbb.exec:\tnhtbb.exe102⤵PID:2696
-
\??\c:\hhhbbb.exec:\hhhbbb.exe103⤵PID:2900
-
\??\c:\5pdjj.exec:\5pdjj.exe104⤵PID:2720
-
\??\c:\jjjvd.exec:\jjjvd.exe105⤵PID:2744
-
\??\c:\dpvpd.exec:\dpvpd.exe106⤵PID:2740
-
\??\c:\fxfrxff.exec:\fxfrxff.exe107⤵PID:1628
-
\??\c:\lfrrxrx.exec:\lfrrxrx.exe108⤵PID:2760
-
\??\c:\hthhbb.exec:\hthhbb.exe109⤵PID:1984
-
\??\c:\htbbhh.exec:\htbbhh.exe110⤵PID:2780
-
\??\c:\5thbhn.exec:\5thbhn.exe111⤵PID:556
-
\??\c:\jdpvv.exec:\jdpvv.exe112⤵PID:1864
-
\??\c:\vvpjj.exec:\vvpjj.exe113⤵PID:2172
-
\??\c:\dvjjp.exec:\dvjjp.exe114⤵PID:472
-
\??\c:\1llfffl.exec:\1llfffl.exe115⤵PID:2140
-
\??\c:\rlxfrlx.exec:\rlxfrlx.exe116⤵PID:1524
-
\??\c:\bbhnbt.exec:\bbhnbt.exe117⤵PID:1192
-
\??\c:\3bbttt.exec:\3bbttt.exe118⤵PID:1436
-
\??\c:\vdppv.exec:\vdppv.exe119⤵PID:2024
-
\??\c:\3dpvv.exec:\3dpvv.exe120⤵PID:2128
-
\??\c:\dvvvv.exec:\dvvvv.exe121⤵PID:2672
-
\??\c:\rlxxffx.exec:\rlxxffx.exe122⤵PID:1156
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe123⤵PID:2832
-
\??\c:\xrxxffl.exec:\xrxxffl.exe124⤵PID:1208
-
\??\c:\btbhnn.exec:\btbhnn.exe125⤵PID:540
-
\??\c:\5htntt.exec:\5htntt.exe126⤵PID:1360
-
\??\c:\dpddp.exec:\dpddp.exe127⤵PID:1368
-
\??\c:\xfffxfx.exec:\xfffxfx.exe128⤵PID:3060
-
\??\c:\fflxxrl.exec:\fflxxrl.exe129⤵PID:1996
-
\??\c:\xxrfllx.exec:\xxrfllx.exe130⤵PID:1736
-
\??\c:\hbbhtb.exec:\hbbhtb.exe131⤵PID:904
-
\??\c:\1bnnhh.exec:\1bnnhh.exe132⤵PID:2296
-
\??\c:\ppjvj.exec:\ppjvj.exe133⤵PID:1588
-
\??\c:\jjdpp.exec:\jjdpp.exe134⤵PID:2236
-
\??\c:\pdpjj.exec:\pdpjj.exe135⤵PID:2000
-
\??\c:\xrxxflx.exec:\xrxxflx.exe136⤵PID:2960
-
\??\c:\nhbhbh.exec:\nhbhbh.exe137⤵PID:3008
-
\??\c:\pjvdv.exec:\pjvdv.exe138⤵PID:1188
-
\??\c:\ppppv.exec:\ppppv.exe139⤵PID:1804
-
\??\c:\llfxlxr.exec:\llfxlxr.exe140⤵PID:2220
-
\??\c:\bhnthh.exec:\bhnthh.exe141⤵PID:1576
-
\??\c:\dvjjp.exec:\dvjjp.exe142⤵PID:1604
-
\??\c:\tnbhnn.exec:\tnbhnn.exe143⤵PID:2112
-
\??\c:\bbnnbt.exec:\bbnnbt.exe144⤵PID:2624
-
\??\c:\1pjvv.exec:\1pjvv.exe145⤵PID:2568
-
\??\c:\9vvjj.exec:\9vvjj.exe146⤵PID:2992
-
\??\c:\rfxrffl.exec:\rfxrffl.exe147⤵PID:2632
-
\??\c:\xrxxffr.exec:\xrxxffr.exe148⤵PID:2824
-
\??\c:\hhhnth.exec:\hhhnth.exe149⤵PID:2608
-
\??\c:\hhbbhn.exec:\hhbbhn.exe150⤵PID:2348
-
\??\c:\5hhnnb.exec:\5hhnnb.exe151⤵PID:2472
-
\??\c:\ddjpd.exec:\ddjpd.exe152⤵PID:2560
-
\??\c:\ppjdp.exec:\ppjdp.exe153⤵PID:2360
-
\??\c:\lrrllrx.exec:\lrrllrx.exe154⤵PID:2484
-
\??\c:\llflxfr.exec:\llflxfr.exe155⤵PID:2900
-
\??\c:\rrfxrrx.exec:\rrfxrrx.exe156⤵PID:2784
-
\??\c:\nhtthh.exec:\nhtthh.exe157⤵PID:2744
-
\??\c:\tthtbb.exec:\tthtbb.exe158⤵PID:1972
-
\??\c:\1ppjj.exec:\1ppjj.exe159⤵PID:1628
-
\??\c:\pppvj.exec:\pppvj.exe160⤵PID:2760
-
\??\c:\rxrfrlr.exec:\rxrfrlr.exe161⤵PID:1984
-
\??\c:\flxlxlr.exec:\flxlxlr.exe162⤵PID:2780
-
\??\c:\3ntntb.exec:\3ntntb.exe163⤵PID:2328
-
\??\c:\nnhhbh.exec:\nnhhbh.exe164⤵PID:2332
-
\??\c:\7pvvp.exec:\7pvvp.exe165⤵PID:1636
-
\??\c:\1vpdd.exec:\1vpdd.exe166⤵PID:1580
-
\??\c:\7rfxffr.exec:\7rfxffr.exe167⤵PID:1528
-
\??\c:\flfrlxr.exec:\flfrlxr.exe168⤵PID:348
-
\??\c:\hhbbht.exec:\hhbbht.exe169⤵PID:2388
-
\??\c:\nhbtbn.exec:\nhbtbn.exe170⤵PID:1592
-
\??\c:\dpddp.exec:\dpddp.exe171⤵PID:2272
-
\??\c:\dvjpd.exec:\dvjpd.exe172⤵PID:2152
-
\??\c:\xxfxfxf.exec:\xxfxfxf.exe173⤵PID:1952
-
\??\c:\lfrflxl.exec:\lfrflxl.exe174⤵PID:912
-
\??\c:\xlflrrl.exec:\xlflrrl.exe175⤵PID:1128
-
\??\c:\bnntbt.exec:\bnntbt.exe176⤵PID:1152
-
\??\c:\5ntbht.exec:\5ntbht.exe177⤵PID:1556
-
\??\c:\1jvvd.exec:\1jvvd.exe178⤵PID:2972
-
\??\c:\1jvvd.exec:\1jvvd.exe179⤵PID:1772
-
\??\c:\7flrfrx.exec:\7flrfrx.exe180⤵PID:1756
-
\??\c:\rfrxlrx.exec:\rfrxlrx.exe181⤵PID:1664
-
\??\c:\7bnbnt.exec:\7bnbnt.exe182⤵PID:1616
-
\??\c:\hbtbhn.exec:\hbtbhn.exe183⤵PID:1660
-
\??\c:\1jvvv.exec:\1jvvv.exe184⤵PID:2340
-
\??\c:\pjvdj.exec:\pjvdj.exe185⤵PID:2052
-
\??\c:\pdddp.exec:\pdddp.exe186⤵PID:2948
-
\??\c:\xlrrxxf.exec:\xlrrxxf.exe187⤵PID:2376
-
\??\c:\tthntt.exec:\tthntt.exe188⤵PID:1404
-
\??\c:\7nttht.exec:\7nttht.exe189⤵PID:880
-
\??\c:\9jjjv.exec:\9jjjv.exe190⤵PID:1692
-
\??\c:\dvvvj.exec:\dvvvj.exe191⤵PID:3028
-
\??\c:\fxxfrxx.exec:\fxxfrxx.exe192⤵PID:1712
-
\??\c:\btttbh.exec:\btttbh.exe193⤵PID:2380
-
\??\c:\hbhtbb.exec:\hbhtbb.exe194⤵PID:1708
-
\??\c:\vpjdp.exec:\vpjdp.exe195⤵PID:1340
-
\??\c:\rrflxlx.exec:\rrflxlx.exe196⤵PID:2628
-
\??\c:\rlxlffr.exec:\rlxlffr.exe197⤵PID:2548
-
\??\c:\9hbtbb.exec:\9hbtbb.exe198⤵PID:2596
-
\??\c:\nhnbhn.exec:\nhnbhn.exe199⤵PID:2600
-
\??\c:\djpdv.exec:\djpdv.exe200⤵PID:2688
-
\??\c:\vvvdj.exec:\vvvdj.exe201⤵PID:2452
-
\??\c:\llrrflx.exec:\llrrflx.exe202⤵PID:2604
-
\??\c:\5fxlflx.exec:\5fxlflx.exe203⤵PID:2708
-
\??\c:\1dvjd.exec:\1dvjd.exe204⤵PID:2560
-
\??\c:\3pjjp.exec:\3pjjp.exe205⤵PID:356
-
\??\c:\xrllrxf.exec:\xrllrxf.exe206⤵PID:2516
-
\??\c:\xlrrxfr.exec:\xlrrxfr.exe207⤵PID:2720
-
\??\c:\tthnhn.exec:\tthnhn.exe208⤵PID:2912
-
\??\c:\hhhbnn.exec:\hhhbnn.exe209⤵PID:2744
-
\??\c:\vvdjd.exec:\vvdjd.exe210⤵PID:2788
-
\??\c:\jdvdp.exec:\jdvdp.exe211⤵PID:1848
-
\??\c:\9hbtbh.exec:\9hbtbh.exe212⤵PID:2216
-
\??\c:\5jjvd.exec:\5jjvd.exe213⤵PID:1700
-
\??\c:\1pjdj.exec:\1pjdj.exe214⤵PID:2196
-
\??\c:\jjdpp.exec:\jjdpp.exe215⤵PID:2328
-
\??\c:\1xflrxr.exec:\1xflrxr.exe216⤵PID:1864
-
\??\c:\rxrxflf.exec:\rxrxflf.exe217⤵PID:1432
-
\??\c:\9bntnt.exec:\9bntnt.exe218⤵PID:2908
-
\??\c:\hthhtb.exec:\hthhtb.exe219⤵PID:3000
-
\??\c:\vvvdv.exec:\vvvdv.exe220⤵PID:2256
-
\??\c:\pjjjd.exec:\pjjjd.exe221⤵PID:2096
-
\??\c:\rfrxxxf.exec:\rfrxxxf.exe222⤵PID:2536
-
\??\c:\bhnhbb.exec:\bhnhbb.exe223⤵PID:1260
-
\??\c:\bbtbhn.exec:\bbtbhn.exe224⤵PID:2672
-
\??\c:\pvjpv.exec:\pvjpv.exe225⤵PID:2080
-
\??\c:\vjjjp.exec:\vjjjp.exe226⤵PID:1380
-
\??\c:\lrrxffl.exec:\lrrxffl.exe227⤵PID:2836
-
\??\c:\3xrxllx.exec:\3xrxllx.exe228⤵PID:3068
-
\??\c:\htnntb.exec:\htnntb.exe229⤵PID:648
-
\??\c:\bhbbhh.exec:\bhbbhh.exe230⤵PID:1368
-
\??\c:\bhbbhn.exec:\bhbbhn.exe231⤵PID:3040
-
\??\c:\vpjjp.exec:\vpjjp.exe232⤵PID:3004
-
\??\c:\vpjvj.exec:\vpjvj.exe233⤵PID:1664
-
\??\c:\frfxlrx.exec:\frfxlrx.exe234⤵PID:904
-
\??\c:\fxlxfrx.exec:\fxlxfrx.exe235⤵PID:1660
-
\??\c:\htnhth.exec:\htnhth.exe236⤵PID:3032
-
\??\c:\nhtbnt.exec:\nhtbnt.exe237⤵PID:1140
-
\??\c:\5jvdd.exec:\5jvdd.exe238⤵PID:2948
-
\??\c:\dvddj.exec:\dvddj.exe239⤵PID:2304
-
\??\c:\pppjp.exec:\pppjp.exe240⤵PID:2084
-
\??\c:\3llxlxr.exec:\3llxlxr.exe241⤵PID:2316
-
\??\c:\fxllrrf.exec:\fxllrrf.exe242⤵PID:3016