Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 18:30
Behavioral task
behavioral1
Sample
0936c62ba23c675aaa245d487b8f28d3046f6fb77b1e0584671437f5e565658d.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
0936c62ba23c675aaa245d487b8f28d3046f6fb77b1e0584671437f5e565658d.exe
-
Size
173KB
-
MD5
3ece4476b43edcf916139abe0bbf0a73
-
SHA1
8ac401d89cc97ff0494b89b21ec929dc1d90ad4f
-
SHA256
0936c62ba23c675aaa245d487b8f28d3046f6fb77b1e0584671437f5e565658d
-
SHA512
5f7cb495b0607c23681887dc54902221035cf00ccd7f7a719bcc69d1916b20cd04f271cf5ab240ae0002ffc5e7886a103d421c0636ca1f046d4e149621136e99
-
SSDEEP
3072:6hOmTsF93UYfwC6GIoutQ0tSe5yLpcka62c+8+dRNN7Yk+6C2Wv:6cm4FmowdHoSQ0tH6lCXb7Ybv
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2368-1-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1912-20-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2572-38-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2568-56-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2060-47-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2716-29-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2792-91-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2840-100-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2988-109-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2420-82-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2540-74-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2720-65-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1580-16-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1572-132-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2688-145-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/756-142-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/624-161-0x0000000000250000-0x0000000000282000-memory.dmp family_blackmoon behavioral1/memory/624-160-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1436-179-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1368-198-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2152-211-0x0000000000220000-0x0000000000252000-memory.dmp family_blackmoon behavioral1/memory/1308-246-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2240-263-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1688-267-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2432-307-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2124-308-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2756-328-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1760-393-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2984-406-0x00000000001B0000-0x00000000001E2000-memory.dmp family_blackmoon behavioral1/memory/1216-426-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/992-581-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2740-601-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2064-613-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2400-838-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2916-890-0x0000000000220000-0x0000000000252000-memory.dmp family_blackmoon behavioral1/memory/2632-903-0x0000000000250000-0x0000000000282000-memory.dmp family_blackmoon behavioral1/memory/2676-1013-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2368-1-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x000b00000001226d-7.dat UPX behavioral1/memory/1580-8-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0036000000016c67-18.dat UPX behavioral1/memory/1912-20-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0007000000016d2b-35.dat UPX behavioral1/memory/2572-38-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0007000000016d33-44.dat UPX behavioral1/memory/2568-56-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0007000000016d3b-54.dat UPX behavioral1/memory/2060-47-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2716-29-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0008000000016d1a-27.dat UPX behavioral1/files/0x0008000000016d55-72.dat UPX behavioral1/files/0x00060000000175e8-80.dat UPX behavioral1/memory/2792-91-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x00060000000175f4-90.dat UPX behavioral1/memory/2840-100-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0005000000018701-108.dat UPX behavioral1/memory/2988-109-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x00050000000186ff-99.dat UPX behavioral1/files/0x000500000001870d-116.dat UPX behavioral1/memory/2420-82-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2540-74-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2720-65-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0007000000016d44-63.dat UPX behavioral1/memory/1580-16-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0005000000018711-125.dat UPX behavioral1/files/0x000500000001873a-133.dat UPX behavioral1/memory/1572-132-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2688-145-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0005000000018784-143.dat UPX behavioral1/memory/756-142-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/624-152-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x000500000001878b-151.dat UPX behavioral1/memory/624-160-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x00050000000187a2-159.dat UPX behavioral1/files/0x0006000000018b73-169.dat UPX behavioral1/memory/1436-170-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0006000000018bc6-176.dat UPX behavioral1/memory/1436-179-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0006000000018bda-187.dat UPX behavioral1/files/0x00060000000190d6-193.dat UPX behavioral1/memory/1368-198-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0005000000019296-205.dat UPX behavioral1/files/0x0005000000019349-214.dat UPX behavioral1/files/0x00050000000193c5-221.dat UPX behavioral1/files/0x00050000000193d2-230.dat UPX behavioral1/files/0x00050000000193ee-237.dat UPX behavioral1/memory/1308-238-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x000500000001941b-248.dat UPX behavioral1/memory/1308-246-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x000500000001941d-255.dat UPX behavioral1/files/0x0036000000016caf-265.dat UPX behavioral1/memory/2240-263-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/1688-267-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0005000000019437-274.dat UPX behavioral1/files/0x000500000001945f-282.dat UPX behavioral1/memory/2432-307-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2124-308-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2756-327-0x00000000003C0000-0x00000000003F2000-memory.dmp UPX behavioral1/memory/2756-328-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2600-329-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2500-342-0x0000000000400000-0x0000000000432000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1580 ththhn.exe 1912 jdvvp.exe 2716 jvjdp.exe 2572 3rflrrf.exe 2060 lxfflfl.exe 2568 bthhhh.exe 2720 tnbhhh.exe 2540 jddvj.exe 2420 9pjjd.exe 2792 xlxfxrx.exe 2840 7xlflrx.exe 2988 bntnnn.exe 2184 vjdjv.exe 1572 pjvjj.exe 756 fxffffl.exe 2688 thhhnt.exe 624 1pvvv.exe 2796 9fxxfll.exe 1436 5bthnt.exe 2004 rlfxlrx.exe 2308 frfflll.exe 1368 vjddd.exe 2152 jvvvp.exe 1768 pdppd.exe 1072 xrlfxxf.exe 1460 hbnhtb.exe 1308 vjpjj.exe 1668 fxrrffx.exe 2240 htttnn.exe 1688 5jpjj.exe 2332 frlffxf.exe 1576 tbhtbh.exe 340 pddvp.exe 2376 xxfxrxx.exe 2432 httbbh.exe 2124 ttnnnn.exe 2608 pjjdd.exe 2756 rlxxllr.exe 2600 9lxrllr.exe 2616 nbthnn.exe 2500 dppjd.exe 2624 dvjdj.exe 2720 rlfflrx.exe 2476 lfrxffr.exe 2880 nhtbhh.exe 1784 1nbbhn.exe 2484 vpjjj.exe 2848 1fxfrxl.exe 1760 fxllxrx.exe 2984 bbtbhh.exe 1512 nbbhnn.exe 836 vvpvj.exe 1216 lfrxxrf.exe 2112 fxrflxf.exe 1220 9bttbt.exe 1540 pjdjv.exe 2684 ppddj.exe 1048 xrxxffl.exe 2796 lxxxlfl.exe 2008 tnbbtt.exe 2564 5htnnn.exe 3020 pdpdv.exe 1904 dpdjj.exe 1088 xlfxffl.exe -
resource yara_rule behavioral1/memory/2368-1-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x000b00000001226d-7.dat upx behavioral1/memory/1580-8-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0036000000016c67-18.dat upx behavioral1/memory/1912-20-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0007000000016d2b-35.dat upx behavioral1/memory/2572-38-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0007000000016d33-44.dat upx behavioral1/memory/2568-56-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0007000000016d3b-54.dat upx behavioral1/memory/2060-47-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2716-29-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0008000000016d1a-27.dat upx behavioral1/files/0x0008000000016d55-72.dat upx behavioral1/files/0x00060000000175e8-80.dat upx behavioral1/memory/2792-91-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00060000000175f4-90.dat upx behavioral1/memory/2840-100-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0005000000018701-108.dat upx behavioral1/memory/2988-109-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00050000000186ff-99.dat upx behavioral1/files/0x000500000001870d-116.dat upx behavioral1/memory/2420-82-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2540-74-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2720-65-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0007000000016d44-63.dat upx behavioral1/memory/1580-16-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0005000000018711-125.dat upx behavioral1/files/0x000500000001873a-133.dat upx behavioral1/memory/1572-132-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2688-145-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0005000000018784-143.dat upx behavioral1/memory/756-142-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/624-152-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x000500000001878b-151.dat upx behavioral1/memory/624-160-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00050000000187a2-159.dat upx behavioral1/files/0x0006000000018b73-169.dat upx behavioral1/memory/1436-170-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000018bc6-176.dat upx behavioral1/memory/1436-179-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000018bda-187.dat upx behavioral1/files/0x00060000000190d6-193.dat upx behavioral1/memory/1368-198-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0005000000019296-205.dat upx behavioral1/files/0x0005000000019349-214.dat upx behavioral1/memory/2152-211-0x0000000000220000-0x0000000000252000-memory.dmp upx behavioral1/files/0x00050000000193c5-221.dat upx behavioral1/files/0x00050000000193d2-230.dat upx behavioral1/files/0x00050000000193ee-237.dat upx behavioral1/memory/1308-238-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x000500000001941b-248.dat upx behavioral1/memory/1308-246-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x000500000001941d-255.dat upx behavioral1/files/0x0036000000016caf-265.dat upx behavioral1/memory/2240-263-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1688-267-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0005000000019437-274.dat upx behavioral1/files/0x000500000001945f-282.dat upx behavioral1/memory/2432-307-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2124-308-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2756-327-0x00000000003C0000-0x00000000003F2000-memory.dmp upx behavioral1/memory/2756-328-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2600-329-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1580 2368 0936c62ba23c675aaa245d487b8f28d3046f6fb77b1e0584671437f5e565658d.exe 28 PID 2368 wrote to memory of 1580 2368 0936c62ba23c675aaa245d487b8f28d3046f6fb77b1e0584671437f5e565658d.exe 28 PID 2368 wrote to memory of 1580 2368 0936c62ba23c675aaa245d487b8f28d3046f6fb77b1e0584671437f5e565658d.exe 28 PID 2368 wrote to memory of 1580 2368 0936c62ba23c675aaa245d487b8f28d3046f6fb77b1e0584671437f5e565658d.exe 28 PID 1580 wrote to memory of 1912 1580 ththhn.exe 29 PID 1580 wrote to memory of 1912 1580 ththhn.exe 29 PID 1580 wrote to memory of 1912 1580 ththhn.exe 29 PID 1580 wrote to memory of 1912 1580 ththhn.exe 29 PID 1912 wrote to memory of 2716 1912 jdvvp.exe 30 PID 1912 wrote to memory of 2716 1912 jdvvp.exe 30 PID 1912 wrote to memory of 2716 1912 jdvvp.exe 30 PID 1912 wrote to memory of 2716 1912 jdvvp.exe 30 PID 2716 wrote to memory of 2572 2716 jvjdp.exe 31 PID 2716 wrote to memory of 2572 2716 jvjdp.exe 31 PID 2716 wrote to memory of 2572 2716 jvjdp.exe 31 PID 2716 wrote to memory of 2572 2716 jvjdp.exe 31 PID 2572 wrote to memory of 2060 2572 3rflrrf.exe 32 PID 2572 wrote to memory of 2060 2572 3rflrrf.exe 32 PID 2572 wrote to memory of 2060 2572 3rflrrf.exe 32 PID 2572 wrote to memory of 2060 2572 3rflrrf.exe 32 PID 2060 wrote to memory of 2568 2060 lxfflfl.exe 33 PID 2060 wrote to memory of 2568 2060 lxfflfl.exe 33 PID 2060 wrote to memory of 2568 2060 lxfflfl.exe 33 PID 2060 wrote to memory of 2568 2060 lxfflfl.exe 33 PID 2568 wrote to memory of 2720 2568 bthhhh.exe 34 PID 2568 wrote to memory of 2720 2568 bthhhh.exe 34 PID 2568 wrote to memory of 2720 2568 bthhhh.exe 34 PID 2568 wrote to memory of 2720 2568 bthhhh.exe 34 PID 2720 wrote to memory of 2540 2720 tnbhhh.exe 35 PID 2720 wrote to memory of 2540 2720 tnbhhh.exe 35 PID 2720 wrote to memory of 2540 2720 tnbhhh.exe 35 PID 2720 wrote to memory of 2540 2720 tnbhhh.exe 35 PID 2540 wrote to memory of 2420 2540 jddvj.exe 36 PID 2540 wrote to memory of 2420 2540 jddvj.exe 36 PID 2540 wrote to memory of 2420 2540 jddvj.exe 36 PID 2540 wrote to memory of 2420 2540 jddvj.exe 36 PID 2420 wrote to memory of 2792 2420 9pjjd.exe 37 PID 2420 wrote to memory of 2792 2420 9pjjd.exe 37 PID 2420 wrote to memory of 2792 2420 9pjjd.exe 37 PID 2420 wrote to memory of 2792 2420 9pjjd.exe 37 PID 2792 wrote to memory of 2840 2792 xlxfxrx.exe 38 PID 2792 wrote to memory of 2840 2792 xlxfxrx.exe 38 PID 2792 wrote to memory of 2840 2792 xlxfxrx.exe 38 PID 2792 wrote to memory of 2840 2792 xlxfxrx.exe 38 PID 2840 wrote to memory of 2988 2840 7xlflrx.exe 39 PID 2840 wrote to memory of 2988 2840 7xlflrx.exe 39 PID 2840 wrote to memory of 2988 2840 7xlflrx.exe 39 PID 2840 wrote to memory of 2988 2840 7xlflrx.exe 39 PID 2988 wrote to memory of 2184 2988 bntnnn.exe 40 PID 2988 wrote to memory of 2184 2988 bntnnn.exe 40 PID 2988 wrote to memory of 2184 2988 bntnnn.exe 40 PID 2988 wrote to memory of 2184 2988 bntnnn.exe 40 PID 2184 wrote to memory of 1572 2184 vjdjv.exe 41 PID 2184 wrote to memory of 1572 2184 vjdjv.exe 41 PID 2184 wrote to memory of 1572 2184 vjdjv.exe 41 PID 2184 wrote to memory of 1572 2184 vjdjv.exe 41 PID 1572 wrote to memory of 756 1572 pjvjj.exe 42 PID 1572 wrote to memory of 756 1572 pjvjj.exe 42 PID 1572 wrote to memory of 756 1572 pjvjj.exe 42 PID 1572 wrote to memory of 756 1572 pjvjj.exe 42 PID 756 wrote to memory of 2688 756 fxffffl.exe 43 PID 756 wrote to memory of 2688 756 fxffffl.exe 43 PID 756 wrote to memory of 2688 756 fxffffl.exe 43 PID 756 wrote to memory of 2688 756 fxffffl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0936c62ba23c675aaa245d487b8f28d3046f6fb77b1e0584671437f5e565658d.exe"C:\Users\Admin\AppData\Local\Temp\0936c62ba23c675aaa245d487b8f28d3046f6fb77b1e0584671437f5e565658d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\ththhn.exec:\ththhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\jdvvp.exec:\jdvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\jvjdp.exec:\jvjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\3rflrrf.exec:\3rflrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\lxfflfl.exec:\lxfflfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\bthhhh.exec:\bthhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\tnbhhh.exec:\tnbhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jddvj.exec:\jddvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\9pjjd.exec:\9pjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\xlxfxrx.exec:\xlxfxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\7xlflrx.exec:\7xlflrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\bntnnn.exec:\bntnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\vjdjv.exec:\vjdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\pjvjj.exec:\pjvjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\fxffffl.exec:\fxffffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\thhhnt.exec:\thhhnt.exe17⤵
- Executes dropped EXE
PID:2688 -
\??\c:\1pvvv.exec:\1pvvv.exe18⤵
- Executes dropped EXE
PID:624 -
\??\c:\9fxxfll.exec:\9fxxfll.exe19⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5bthnt.exec:\5bthnt.exe20⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rlfxlrx.exec:\rlfxlrx.exe21⤵
- Executes dropped EXE
PID:2004 -
\??\c:\frfflll.exec:\frfflll.exe22⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vjddd.exec:\vjddd.exe23⤵
- Executes dropped EXE
PID:1368 -
\??\c:\jvvvp.exec:\jvvvp.exe24⤵
- Executes dropped EXE
PID:2152 -
\??\c:\pdppd.exec:\pdppd.exe25⤵
- Executes dropped EXE
PID:1768 -
\??\c:\xrlfxxf.exec:\xrlfxxf.exe26⤵
- Executes dropped EXE
PID:1072 -
\??\c:\hbnhtb.exec:\hbnhtb.exe27⤵
- Executes dropped EXE
PID:1460 -
\??\c:\vjpjj.exec:\vjpjj.exe28⤵
- Executes dropped EXE
PID:1308 -
\??\c:\fxrrffx.exec:\fxrrffx.exe29⤵
- Executes dropped EXE
PID:1668 -
\??\c:\htttnn.exec:\htttnn.exe30⤵
- Executes dropped EXE
PID:2240 -
\??\c:\5jpjj.exec:\5jpjj.exe31⤵
- Executes dropped EXE
PID:1688 -
\??\c:\frlffxf.exec:\frlffxf.exe32⤵
- Executes dropped EXE
PID:2332 -
\??\c:\tbhtbh.exec:\tbhtbh.exe33⤵
- Executes dropped EXE
PID:1576 -
\??\c:\pddvp.exec:\pddvp.exe34⤵
- Executes dropped EXE
PID:340 -
\??\c:\xxfxrxx.exec:\xxfxrxx.exe35⤵
- Executes dropped EXE
PID:2376 -
\??\c:\httbbh.exec:\httbbh.exe36⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ttnnnn.exec:\ttnnnn.exe37⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pjjdd.exec:\pjjdd.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rlxxllr.exec:\rlxxllr.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\9lxrllr.exec:\9lxrllr.exe40⤵
- Executes dropped EXE
PID:2600 -
\??\c:\nbthnn.exec:\nbthnn.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\dppjd.exec:\dppjd.exe42⤵
- Executes dropped EXE
PID:2500 -
\??\c:\dvjdj.exec:\dvjdj.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rlfflrx.exec:\rlfflrx.exe44⤵
- Executes dropped EXE
PID:2720 -
\??\c:\lfrxffr.exec:\lfrxffr.exe45⤵
- Executes dropped EXE
PID:2476 -
\??\c:\nhtbhh.exec:\nhtbhh.exe46⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1nbbhn.exec:\1nbbhn.exe47⤵
- Executes dropped EXE
PID:1784 -
\??\c:\vpjjj.exec:\vpjjj.exe48⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1fxfrxl.exec:\1fxfrxl.exe49⤵
- Executes dropped EXE
PID:2848 -
\??\c:\fxllxrx.exec:\fxllxrx.exe50⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bbtbhh.exec:\bbtbhh.exe51⤵
- Executes dropped EXE
PID:2984 -
\??\c:\nbbhnn.exec:\nbbhnn.exe52⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vvpvj.exec:\vvpvj.exe53⤵
- Executes dropped EXE
PID:836 -
\??\c:\lfrxxrf.exec:\lfrxxrf.exe54⤵
- Executes dropped EXE
PID:1216 -
\??\c:\fxrflxf.exec:\fxrflxf.exe55⤵
- Executes dropped EXE
PID:2112 -
\??\c:\9bttbt.exec:\9bttbt.exe56⤵
- Executes dropped EXE
PID:1220 -
\??\c:\pjdjv.exec:\pjdjv.exe57⤵
- Executes dropped EXE
PID:1540 -
\??\c:\ppddj.exec:\ppddj.exe58⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xrxxffl.exec:\xrxxffl.exe59⤵
- Executes dropped EXE
PID:1048 -
\??\c:\lxxxlfl.exec:\lxxxlfl.exe60⤵
- Executes dropped EXE
PID:2796 -
\??\c:\tnbbtt.exec:\tnbbtt.exe61⤵
- Executes dropped EXE
PID:2008 -
\??\c:\5htnnn.exec:\5htnnn.exe62⤵
- Executes dropped EXE
PID:2564 -
\??\c:\pdpdv.exec:\pdpdv.exe63⤵
- Executes dropped EXE
PID:3020 -
\??\c:\dpdjj.exec:\dpdjj.exe64⤵
- Executes dropped EXE
PID:1904 -
\??\c:\xlfxffl.exec:\xlfxffl.exe65⤵
- Executes dropped EXE
PID:1088 -
\??\c:\3llffxf.exec:\3llffxf.exe66⤵PID:1852
-
\??\c:\9btbhh.exec:\9btbhh.exe67⤵PID:2920
-
\??\c:\htbtbn.exec:\htbtbn.exe68⤵PID:2092
-
\??\c:\3jvdd.exec:\3jvdd.exe69⤵PID:1660
-
\??\c:\pddvd.exec:\pddvd.exe70⤵PID:1568
-
\??\c:\rlxxffl.exec:\rlxxffl.exe71⤵PID:1004
-
\??\c:\bthtbb.exec:\bthtbb.exe72⤵PID:336
-
\??\c:\thbbnb.exec:\thbbnb.exe73⤵PID:856
-
\??\c:\7jddd.exec:\7jddd.exe74⤵PID:600
-
\??\c:\djjpp.exec:\djjpp.exe75⤵PID:2400
-
\??\c:\lxxrrxx.exec:\lxxrrxx.exe76⤵PID:2788
-
\??\c:\1rffllr.exec:\1rffllr.exe77⤵PID:2276
-
\??\c:\bthhhh.exec:\bthhhh.exe78⤵PID:2944
-
\??\c:\5pjpd.exec:\5pjpd.exe79⤵PID:992
-
\??\c:\5vjpd.exec:\5vjpd.exe80⤵PID:2384
-
\??\c:\3xllrxf.exec:\3xllrxf.exe81⤵PID:2416
-
\??\c:\lfrxffl.exec:\lfrxffl.exe82⤵PID:2124
-
\??\c:\tnbhtn.exec:\tnbhtn.exe83⤵PID:2740
-
\??\c:\hbhbbn.exec:\hbhbbn.exe84⤵PID:2064
-
\??\c:\ddvdv.exec:\ddvdv.exe85⤵PID:2904
-
\??\c:\xxlllrr.exec:\xxlllrr.exe86⤵PID:2600
-
\??\c:\xrxxlrx.exec:\xrxxlrx.exe87⤵PID:2692
-
\??\c:\tnhhhn.exec:\tnhhhn.exe88⤵PID:2592
-
\??\c:\3ntthh.exec:\3ntthh.exe89⤵PID:2428
-
\??\c:\1jvvp.exec:\1jvvp.exe90⤵PID:2580
-
\??\c:\dvddp.exec:\dvddp.exe91⤵PID:2204
-
\??\c:\llxrxrx.exec:\llxrxrx.exe92⤵PID:2828
-
\??\c:\rrfllll.exec:\rrfllll.exe93⤵PID:2804
-
\??\c:\nhthhn.exec:\nhthhn.exe94⤵PID:2856
-
\??\c:\ppddd.exec:\ppddd.exe95⤵PID:2860
-
\??\c:\pddjp.exec:\pddjp.exe96⤵PID:1760
-
\??\c:\9fxrxrx.exec:\9fxrxrx.exe97⤵PID:1232
-
\??\c:\rrflflx.exec:\rrflflx.exe98⤵PID:1512
-
\??\c:\nhtbhb.exec:\nhtbhb.exe99⤵PID:2664
-
\??\c:\3btnbt.exec:\3btnbt.exe100⤵PID:760
-
\??\c:\jdpdd.exec:\jdpdd.exe101⤵PID:568
-
\??\c:\ppjdj.exec:\ppjdj.exe102⤵PID:1312
-
\??\c:\jvjjp.exec:\jvjjp.exe103⤵PID:972
-
\??\c:\lxlrrrf.exec:\lxlrrrf.exe104⤵PID:1416
-
\??\c:\5bntbn.exec:\5bntbn.exe105⤵PID:1492
-
\??\c:\tnhhnh.exec:\tnhhnh.exe106⤵PID:2956
-
\??\c:\7vpvd.exec:\7vpvd.exe107⤵PID:2252
-
\??\c:\jdvdd.exec:\jdvdd.exe108⤵PID:2020
-
\??\c:\fxlllrx.exec:\fxlllrx.exe109⤵PID:3020
-
\??\c:\3lxffrr.exec:\3lxffrr.exe110⤵PID:1904
-
\??\c:\5nbhnt.exec:\5nbhnt.exe111⤵PID:1088
-
\??\c:\7hbnnh.exec:\7hbnnh.exe112⤵PID:2056
-
\??\c:\jvppd.exec:\jvppd.exe113⤵PID:2920
-
\??\c:\5pddv.exec:\5pddv.exe114⤵PID:2092
-
\??\c:\fflrlll.exec:\fflrlll.exe115⤵PID:948
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe116⤵PID:3060
-
\??\c:\nhbbhn.exec:\nhbbhn.exe117⤵PID:844
-
\??\c:\jdpvd.exec:\jdpvd.exe118⤵PID:2108
-
\??\c:\vpvvd.exec:\vpvvd.exe119⤵PID:856
-
\??\c:\pjvdd.exec:\pjvdd.exe120⤵PID:1840
-
\??\c:\9frxfff.exec:\9frxfff.exe121⤵PID:2400
-
\??\c:\9flfxxr.exec:\9flfxxr.exe122⤵PID:1652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-