Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 19:41
Behavioral task
behavioral1
Sample
26813fdd7a793817dba2bfe269f749e5c8d4fb3a3a2814ac49d87c08400985ea.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
26813fdd7a793817dba2bfe269f749e5c8d4fb3a3a2814ac49d87c08400985ea.exe
-
Size
81KB
-
MD5
0fc9354d1908d82a25f65d0297647e85
-
SHA1
9b6ddae41d4b0fc61ef646c5fd9f04b748285ad1
-
SHA256
26813fdd7a793817dba2bfe269f749e5c8d4fb3a3a2814ac49d87c08400985ea
-
SHA512
3f11efd441db45f01f59034a29e450097fa32089735b69dba28d31cff8a59ae8d42d48bb3beb264ba3a503a7f2c936d53b42e31d043461d8f26acb78cebe84cb
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6T7Q2:zhOmTsF93UYfwC6GIoutiTU2HVS63Q2
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
Processes:
resource yara_rule behavioral1/memory/2324-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-114-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2088-113-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2088-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/444-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1352-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1000-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-318-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2380-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/316-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1080-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-597-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/3068-667-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-689-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1808-714-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-9329-0x0000000077790000-0x000000007788A000-memory.dmp family_blackmoon behavioral1/memory/2456-16378-0x0000000077790000-0x000000007788A000-memory.dmp family_blackmoon behavioral1/memory/2456-16961-0x0000000077670000-0x000000007778F000-memory.dmp family_blackmoon behavioral1/memory/2456-17545-0x0000000077670000-0x000000007778F000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2324-1-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5xlxfrl.exe UPX behavioral1/memory/2472-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\llrlfrl.exe UPX behavioral1/memory/2472-14-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tbnbnb.exe UPX behavioral1/memory/1924-22-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2648-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2648-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3rrrxfl.exe UPX C:\3nntht.exe UPX behavioral1/memory/3000-40-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3000-48-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ddvpd.exe UPX behavioral1/memory/2380-49-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vpjvj.exe UPX behavioral1/memory/2380-56-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xxlrfrl.exe UPX C:\5tbhbh.exe UPX behavioral1/memory/2720-71-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\dvjvj.exe UPX behavioral1/memory/1640-82-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2552-80-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vvjvp.exe UPX behavioral1/memory/2000-90-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1640-88-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xlrflff.exe UPX C:\htnhth.exe UPX behavioral1/memory/2932-104-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hhbhtb.exe UPX behavioral1/memory/2088-116-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ppjpp.exe UPX behavioral1/memory/1692-122-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rxrxrrl.exe UPX behavioral1/memory/2624-132-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2136-131-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ttnntb.exe UPX C:\jdpvd.exe UPX C:\pjdpp.exe UPX C:\9lfrflr.exe UPX behavioral1/memory/2884-161-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\btnnth.exe UPX behavioral1/memory/1312-176-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hntnnt.exe UPX behavioral1/memory/2288-178-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2288-184-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pjvjd.exe UPX C:\rrflrxl.exe UPX C:\rlfrllr.exe UPX C:\btbbnb.exe UPX behavioral1/memory/2352-206-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vppvp.exe UPX behavioral1/memory/2512-214-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/444-222-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rlrxrfl.exe UPX C:\rlffrrx.exe UPX behavioral1/memory/2164-226-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7tttnt.exe UPX behavioral1/memory/1352-241-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\djddp.exe UPX behavioral1/memory/1056-247-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jjvjj.exe UPX behavioral1/memory/3028-261-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3028-267-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
5xlxfrl.exellrlfrl.exetbnbnb.exe3rrrxfl.exe3nntht.exeddvpd.exevpjvj.exexxlrfrl.exe5tbhbh.exedvjvj.exevvjvp.exexlrflff.exehtnhth.exehhbhtb.exeppjpp.exerxrxrrl.exettnntb.exejdpvd.exepjdpp.exe9lfrflr.exebtnnth.exehntnnt.exepjvjd.exerrflrxl.exerlfrllr.exebtbbnb.exevppvp.exerlrxrfl.exerlffrrx.exe7tttnt.exedjddp.exejjvjj.exerxlllfl.exetthnth.exebtnhtt.exedjvjp.exe3ffxxll.exefrllfxx.exenhtbhh.exe7vvdv.exe7jvpp.exerlrrxxl.exehbbntb.exenbtbhb.exejdpvj.exevjvvd.exerlflxxf.exelrlrlrf.exe9ffflxr.exe3hhntn.exebhnhhn.exejjvdp.exexrlxrxl.exe3rlxlrf.exe1hbtbn.exennnnhh.exe3ddpd.exepddpj.exe9xrrrrf.exetthntb.exenhhtbn.exepvjpd.exevvvjv.exethhnth.exepid process 2472 5xlxfrl.exe 1924 llrlfrl.exe 2648 tbnbnb.exe 2704 3rrrxfl.exe 3000 3nntht.exe 2380 ddvpd.exe 2748 vpjvj.exe 2720 xxlrfrl.exe 2552 5tbhbh.exe 1640 dvjvj.exe 2000 vvjvp.exe 2932 xlrflff.exe 2088 htnhth.exe 1692 hhbhtb.exe 2136 ppjpp.exe 2624 rxrxrrl.exe 2856 ttnntb.exe 1800 jdpvd.exe 2884 pjdpp.exe 1952 9lfrflr.exe 1312 btnnth.exe 2288 hntnnt.exe 1220 pjvjd.exe 2104 rrflrxl.exe 2352 rlfrllr.exe 2512 btbbnb.exe 444 vppvp.exe 2164 rlrxrfl.exe 1944 rlffrrx.exe 1352 7tttnt.exe 1056 djddp.exe 928 jjvjj.exe 3028 rxlllfl.exe 1696 tthnth.exe 1000 btnhtt.exe 2272 djvjp.exe 2284 3ffxxll.exe 2840 frllfxx.exe 856 nhtbhh.exe 2260 7vvdv.exe 2980 7jvpp.exe 1588 rlrrxxl.exe 2664 hbbntb.exe 2648 nbtbhb.exe 2704 jdpvj.exe 2564 vjvvd.exe 2716 rlflxxf.exe 2380 lrlrlrf.exe 304 9ffflxr.exe 1928 3hhntn.exe 2588 bhnhhn.exe 1440 jjvdp.exe 2724 xrlxrxl.exe 1520 3rlxlrf.exe 2168 1hbtbn.exe 3044 nnnnhh.exe 1996 3ddpd.exe 3064 pddpj.exe 2896 9xrrrrf.exe 1792 tthntb.exe 1628 nhhtbn.exe 1268 pvjpd.exe 1960 vvvjv.exe 2812 thhnth.exe -
Processes:
resource yara_rule behavioral1/memory/2324-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5xlxfrl.exe upx behavioral1/memory/2472-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llrlfrl.exe upx behavioral1/memory/2472-14-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbnbnb.exe upx behavioral1/memory/1924-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-32-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3rrrxfl.exe upx C:\3nntht.exe upx behavioral1/memory/3000-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3000-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddvpd.exe upx behavioral1/memory/2380-49-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpjvj.exe upx behavioral1/memory/2380-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxlrfrl.exe upx C:\5tbhbh.exe upx behavioral1/memory/2720-71-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvjvj.exe upx behavioral1/memory/1640-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2552-80-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvjvp.exe upx behavioral1/memory/2000-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1640-88-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlrflff.exe upx C:\htnhth.exe upx behavioral1/memory/2932-104-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhbhtb.exe upx behavioral1/memory/2088-116-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppjpp.exe upx behavioral1/memory/1692-122-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxrxrrl.exe upx behavioral1/memory/2624-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2136-131-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttnntb.exe upx C:\jdpvd.exe upx C:\pjdpp.exe upx C:\9lfrflr.exe upx behavioral1/memory/2884-161-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btnnth.exe upx behavioral1/memory/1312-176-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hntnnt.exe upx behavioral1/memory/2288-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2288-184-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjvjd.exe upx C:\rrflrxl.exe upx C:\rlfrllr.exe upx C:\btbbnb.exe upx behavioral1/memory/2352-206-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vppvp.exe upx behavioral1/memory/2512-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/444-222-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlrxrfl.exe upx C:\rlffrrx.exe upx behavioral1/memory/2164-226-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7tttnt.exe upx behavioral1/memory/1352-241-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djddp.exe upx behavioral1/memory/1056-247-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjvjj.exe upx behavioral1/memory/3028-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3028-267-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
26813fdd7a793817dba2bfe269f749e5c8d4fb3a3a2814ac49d87c08400985ea.exe5xlxfrl.exellrlfrl.exetbnbnb.exe3rrrxfl.exe3nntht.exeddvpd.exevpjvj.exexxlrfrl.exe5tbhbh.exedvjvj.exevvjvp.exexlrflff.exehtnhth.exehhbhtb.exeppjpp.exedescription pid process target process PID 2324 wrote to memory of 2472 2324 26813fdd7a793817dba2bfe269f749e5c8d4fb3a3a2814ac49d87c08400985ea.exe 5xlxfrl.exe PID 2324 wrote to memory of 2472 2324 26813fdd7a793817dba2bfe269f749e5c8d4fb3a3a2814ac49d87c08400985ea.exe 5xlxfrl.exe PID 2324 wrote to memory of 2472 2324 26813fdd7a793817dba2bfe269f749e5c8d4fb3a3a2814ac49d87c08400985ea.exe 5xlxfrl.exe PID 2324 wrote to memory of 2472 2324 26813fdd7a793817dba2bfe269f749e5c8d4fb3a3a2814ac49d87c08400985ea.exe 5xlxfrl.exe PID 2472 wrote to memory of 1924 2472 5xlxfrl.exe llrlfrl.exe PID 2472 wrote to memory of 1924 2472 5xlxfrl.exe llrlfrl.exe PID 2472 wrote to memory of 1924 2472 5xlxfrl.exe llrlfrl.exe PID 2472 wrote to memory of 1924 2472 5xlxfrl.exe llrlfrl.exe PID 1924 wrote to memory of 2648 1924 llrlfrl.exe tbnbnb.exe PID 1924 wrote to memory of 2648 1924 llrlfrl.exe tbnbnb.exe PID 1924 wrote to memory of 2648 1924 llrlfrl.exe tbnbnb.exe PID 1924 wrote to memory of 2648 1924 llrlfrl.exe tbnbnb.exe PID 2648 wrote to memory of 2704 2648 tbnbnb.exe 3rrrxfl.exe PID 2648 wrote to memory of 2704 2648 tbnbnb.exe 3rrrxfl.exe PID 2648 wrote to memory of 2704 2648 tbnbnb.exe 3rrrxfl.exe PID 2648 wrote to memory of 2704 2648 tbnbnb.exe 3rrrxfl.exe PID 2704 wrote to memory of 3000 2704 3rrrxfl.exe 3nntht.exe PID 2704 wrote to memory of 3000 2704 3rrrxfl.exe 3nntht.exe PID 2704 wrote to memory of 3000 2704 3rrrxfl.exe 3nntht.exe PID 2704 wrote to memory of 3000 2704 3rrrxfl.exe 3nntht.exe PID 3000 wrote to memory of 2380 3000 3nntht.exe ddvpd.exe PID 3000 wrote to memory of 2380 3000 3nntht.exe ddvpd.exe PID 3000 wrote to memory of 2380 3000 3nntht.exe ddvpd.exe PID 3000 wrote to memory of 2380 3000 3nntht.exe ddvpd.exe PID 2380 wrote to memory of 2748 2380 ddvpd.exe vpjvj.exe PID 2380 wrote to memory of 2748 2380 ddvpd.exe vpjvj.exe PID 2380 wrote to memory of 2748 2380 ddvpd.exe vpjvj.exe PID 2380 wrote to memory of 2748 2380 ddvpd.exe vpjvj.exe PID 2748 wrote to memory of 2720 2748 vpjvj.exe xxlrfrl.exe PID 2748 wrote to memory of 2720 2748 vpjvj.exe xxlrfrl.exe PID 2748 wrote to memory of 2720 2748 vpjvj.exe xxlrfrl.exe PID 2748 wrote to memory of 2720 2748 vpjvj.exe xxlrfrl.exe PID 2720 wrote to memory of 2552 2720 xxlrfrl.exe 5tbhbh.exe PID 2720 wrote to memory of 2552 2720 xxlrfrl.exe 5tbhbh.exe PID 2720 wrote to memory of 2552 2720 xxlrfrl.exe 5tbhbh.exe PID 2720 wrote to memory of 2552 2720 xxlrfrl.exe 5tbhbh.exe PID 2552 wrote to memory of 1640 2552 5tbhbh.exe dvjvj.exe PID 2552 wrote to memory of 1640 2552 5tbhbh.exe dvjvj.exe PID 2552 wrote to memory of 1640 2552 5tbhbh.exe dvjvj.exe PID 2552 wrote to memory of 1640 2552 5tbhbh.exe dvjvj.exe PID 1640 wrote to memory of 2000 1640 dvjvj.exe vvjvp.exe PID 1640 wrote to memory of 2000 1640 dvjvj.exe vvjvp.exe PID 1640 wrote to memory of 2000 1640 dvjvj.exe vvjvp.exe PID 1640 wrote to memory of 2000 1640 dvjvj.exe vvjvp.exe PID 2000 wrote to memory of 2932 2000 vvjvp.exe xlrflff.exe PID 2000 wrote to memory of 2932 2000 vvjvp.exe xlrflff.exe PID 2000 wrote to memory of 2932 2000 vvjvp.exe xlrflff.exe PID 2000 wrote to memory of 2932 2000 vvjvp.exe xlrflff.exe PID 2932 wrote to memory of 2088 2932 xlrflff.exe htnhth.exe PID 2932 wrote to memory of 2088 2932 xlrflff.exe htnhth.exe PID 2932 wrote to memory of 2088 2932 xlrflff.exe htnhth.exe PID 2932 wrote to memory of 2088 2932 xlrflff.exe htnhth.exe PID 2088 wrote to memory of 1692 2088 htnhth.exe hhbhtb.exe PID 2088 wrote to memory of 1692 2088 htnhth.exe hhbhtb.exe PID 2088 wrote to memory of 1692 2088 htnhth.exe hhbhtb.exe PID 2088 wrote to memory of 1692 2088 htnhth.exe hhbhtb.exe PID 1692 wrote to memory of 2136 1692 hhbhtb.exe ppjpp.exe PID 1692 wrote to memory of 2136 1692 hhbhtb.exe ppjpp.exe PID 1692 wrote to memory of 2136 1692 hhbhtb.exe ppjpp.exe PID 1692 wrote to memory of 2136 1692 hhbhtb.exe ppjpp.exe PID 2136 wrote to memory of 2624 2136 ppjpp.exe rxrxrrl.exe PID 2136 wrote to memory of 2624 2136 ppjpp.exe rxrxrrl.exe PID 2136 wrote to memory of 2624 2136 ppjpp.exe rxrxrrl.exe PID 2136 wrote to memory of 2624 2136 ppjpp.exe rxrxrrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26813fdd7a793817dba2bfe269f749e5c8d4fb3a3a2814ac49d87c08400985ea.exe"C:\Users\Admin\AppData\Local\Temp\26813fdd7a793817dba2bfe269f749e5c8d4fb3a3a2814ac49d87c08400985ea.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\5xlxfrl.exec:\5xlxfrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\llrlfrl.exec:\llrlfrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\tbnbnb.exec:\tbnbnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\3rrrxfl.exec:\3rrrxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\3nntht.exec:\3nntht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\ddvpd.exec:\ddvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\vpjvj.exec:\vpjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\xxlrfrl.exec:\xxlrfrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\5tbhbh.exec:\5tbhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\dvjvj.exec:\dvjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\vvjvp.exec:\vvjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\xlrflff.exec:\xlrflff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\htnhth.exec:\htnhth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\hhbhtb.exec:\hhbhtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\ppjpp.exec:\ppjpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\rxrxrrl.exec:\rxrxrrl.exe17⤵
- Executes dropped EXE
PID:2624 -
\??\c:\ttnntb.exec:\ttnntb.exe18⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jdpvd.exec:\jdpvd.exe19⤵
- Executes dropped EXE
PID:1800 -
\??\c:\pjdpp.exec:\pjdpp.exe20⤵
- Executes dropped EXE
PID:2884 -
\??\c:\9lfrflr.exec:\9lfrflr.exe21⤵
- Executes dropped EXE
PID:1952 -
\??\c:\btnnth.exec:\btnnth.exe22⤵
- Executes dropped EXE
PID:1312 -
\??\c:\hntnnt.exec:\hntnnt.exe23⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pjvjd.exec:\pjvjd.exe24⤵
- Executes dropped EXE
PID:1220 -
\??\c:\rrflrxl.exec:\rrflrxl.exe25⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rlfrllr.exec:\rlfrllr.exe26⤵
- Executes dropped EXE
PID:2352 -
\??\c:\btbbnb.exec:\btbbnb.exe27⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vppvp.exec:\vppvp.exe28⤵
- Executes dropped EXE
PID:444 -
\??\c:\rlrxrfl.exec:\rlrxrfl.exe29⤵
- Executes dropped EXE
PID:2164 -
\??\c:\rlffrrx.exec:\rlffrrx.exe30⤵
- Executes dropped EXE
PID:1944 -
\??\c:\7tttnt.exec:\7tttnt.exe31⤵
- Executes dropped EXE
PID:1352 -
\??\c:\djddp.exec:\djddp.exe32⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jjvjj.exec:\jjvjj.exe33⤵
- Executes dropped EXE
PID:928 -
\??\c:\rxlllfl.exec:\rxlllfl.exe34⤵
- Executes dropped EXE
PID:3028 -
\??\c:\tthnth.exec:\tthnth.exe35⤵
- Executes dropped EXE
PID:1696 -
\??\c:\btnhtt.exec:\btnhtt.exe36⤵
- Executes dropped EXE
PID:1000 -
\??\c:\djvjp.exec:\djvjp.exe37⤵
- Executes dropped EXE
PID:2272 -
\??\c:\3ffxxll.exec:\3ffxxll.exe38⤵
- Executes dropped EXE
PID:2284 -
\??\c:\frllfxx.exec:\frllfxx.exe39⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nhtbhh.exec:\nhtbhh.exe40⤵
- Executes dropped EXE
PID:856 -
\??\c:\7vvdv.exec:\7vvdv.exe41⤵
- Executes dropped EXE
PID:2260 -
\??\c:\7jvpp.exec:\7jvpp.exe42⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe43⤵
- Executes dropped EXE
PID:1588 -
\??\c:\hbbntb.exec:\hbbntb.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nbtbhb.exec:\nbtbhb.exe45⤵
- Executes dropped EXE
PID:2648 -
\??\c:\jdpvj.exec:\jdpvj.exe46⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vjvvd.exec:\vjvvd.exe47⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rlflxxf.exec:\rlflxxf.exe48⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lrlrlrf.exec:\lrlrlrf.exe49⤵
- Executes dropped EXE
PID:2380 -
\??\c:\9ffflxr.exec:\9ffflxr.exe50⤵
- Executes dropped EXE
PID:304 -
\??\c:\3hhntn.exec:\3hhntn.exe51⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bhnhhn.exec:\bhnhhn.exe52⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jjvdp.exec:\jjvdp.exe53⤵
- Executes dropped EXE
PID:1440 -
\??\c:\xrlxrxl.exec:\xrlxrxl.exe54⤵
- Executes dropped EXE
PID:2724 -
\??\c:\3rlxlrf.exec:\3rlxlrf.exe55⤵
- Executes dropped EXE
PID:1520 -
\??\c:\1hbtbn.exec:\1hbtbn.exe56⤵
- Executes dropped EXE
PID:2168 -
\??\c:\nnnnhh.exec:\nnnnhh.exe57⤵
- Executes dropped EXE
PID:3044 -
\??\c:\3ddpd.exec:\3ddpd.exe58⤵
- Executes dropped EXE
PID:1996 -
\??\c:\pddpj.exec:\pddpj.exe59⤵
- Executes dropped EXE
PID:3064 -
\??\c:\9xrrrrf.exec:\9xrrrrf.exe60⤵
- Executes dropped EXE
PID:2896 -
\??\c:\tthntb.exec:\tthntb.exe61⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nhhtbn.exec:\nhhtbn.exe62⤵
- Executes dropped EXE
PID:1628 -
\??\c:\pvjpd.exec:\pvjpd.exe63⤵
- Executes dropped EXE
PID:1268 -
\??\c:\vvvjv.exec:\vvvjv.exe64⤵
- Executes dropped EXE
PID:1960 -
\??\c:\thhnth.exec:\thhnth.exe65⤵
- Executes dropped EXE
PID:2812 -
\??\c:\hbtbhn.exec:\hbtbhn.exe66⤵PID:532
-
\??\c:\5vvvd.exec:\5vvvd.exe67⤵PID:1192
-
\??\c:\3xxlxrf.exec:\3xxlxrf.exe68⤵PID:1952
-
\??\c:\rlrlrrl.exec:\rlrlrrl.exe69⤵PID:2052
-
\??\c:\rlffxxl.exec:\rlffxxl.exe70⤵PID:316
-
\??\c:\bnnhnt.exec:\bnnhnt.exe71⤵PID:1244
-
\??\c:\7bbtbh.exec:\7bbtbh.exe72⤵PID:684
-
\??\c:\djpdv.exec:\djpdv.exe73⤵PID:2536
-
\??\c:\lrlrfxx.exec:\lrlrfxx.exe74⤵PID:608
-
\??\c:\lllxlxl.exec:\lllxlxl.exe75⤵PID:704
-
\??\c:\1bbhth.exec:\1bbhth.exe76⤵PID:2496
-
\??\c:\nbthhh.exec:\nbthhh.exe77⤵PID:1092
-
\??\c:\vpdpd.exec:\vpdpd.exe78⤵PID:1080
-
\??\c:\vvjjj.exec:\vvjjj.exe79⤵PID:1544
-
\??\c:\xlxllfl.exec:\xlxllfl.exe80⤵PID:1944
-
\??\c:\1hhthn.exec:\1hhthn.exe81⤵PID:1384
-
\??\c:\tnttnt.exec:\tnttnt.exe82⤵PID:1824
-
\??\c:\bbtthb.exec:\bbtthb.exe83⤵PID:2336
-
\??\c:\djjvp.exec:\djjvp.exe84⤵PID:1772
-
\??\c:\fxrrffl.exec:\fxrrffl.exe85⤵PID:1732
-
\??\c:\fxllrxf.exec:\fxllrxf.exe86⤵PID:2108
-
\??\c:\nhthtb.exec:\nhthtb.exe87⤵PID:1988
-
\??\c:\7hhtth.exec:\7hhtth.exe88⤵PID:2244
-
\??\c:\jdvjp.exec:\jdvjp.exe89⤵PID:1688
-
\??\c:\7flxlfx.exec:\7flxlfx.exe90⤵PID:2264
-
\??\c:\lllfrxl.exec:\lllfrxl.exe91⤵PID:2840
-
\??\c:\lxrlxlf.exec:\lxrlxlf.exe92⤵PID:1264
-
\??\c:\bthnnt.exec:\bthnnt.exe93⤵PID:2360
-
\??\c:\pjddv.exec:\pjddv.exe94⤵PID:1924
-
\??\c:\5vvjp.exec:\5vvjp.exe95⤵PID:1704
-
\??\c:\vpdpv.exec:\vpdpv.exe96⤵PID:2128
-
\??\c:\rfxflxf.exec:\rfxflxf.exe97⤵PID:2764
-
\??\c:\9flrffx.exec:\9flrffx.exe98⤵PID:2688
-
\??\c:\bhtnhn.exec:\bhtnhn.exe99⤵PID:2836
-
\??\c:\jjjjp.exec:\jjjjp.exe100⤵PID:2716
-
\??\c:\3djdp.exec:\3djdp.exe101⤵PID:2880
-
\??\c:\llrxxlf.exec:\llrxxlf.exe102⤵PID:304
-
\??\c:\lxflxrx.exec:\lxflxrx.exe103⤵PID:2576
-
\??\c:\3nhthn.exec:\3nhthn.exe104⤵PID:2604
-
\??\c:\nnbbhn.exec:\nnbbhn.exe105⤵PID:1440
-
\??\c:\pjdjj.exec:\pjdjj.exe106⤵PID:2544
-
\??\c:\pjjvd.exec:\pjjvd.exe107⤵PID:1520
-
\??\c:\rrxfxfr.exec:\rrxfxfr.exe108⤵PID:3068
-
\??\c:\lllxxlf.exec:\lllxxlf.exe109⤵PID:1596
-
\??\c:\bnhnbh.exec:\bnhnbh.exe110⤵PID:2032
-
\??\c:\7ppvd.exec:\7ppvd.exe111⤵PID:2936
-
\??\c:\dvpdd.exec:\dvpdd.exe112⤵PID:2896
-
\??\c:\lxfxxfx.exec:\lxfxxfx.exe113⤵PID:1712
-
\??\c:\7rrfxff.exec:\7rrfxff.exe114⤵PID:2892
-
\??\c:\tnbhtt.exec:\tnbhtt.exe115⤵PID:1448
-
\??\c:\hhbhnn.exec:\hhbhnn.exe116⤵PID:1960
-
\??\c:\jpjpp.exec:\jpjpp.exe117⤵PID:1808
-
\??\c:\dvpvj.exec:\dvpvj.exe118⤵PID:1812
-
\??\c:\frllxrl.exec:\frllxrl.exe119⤵PID:1872
-
\??\c:\lflrllf.exec:\lflrllf.exe120⤵PID:1952
-
\??\c:\nnbhtb.exec:\nnbhtb.exe121⤵PID:2100
-
\??\c:\pjvjp.exec:\pjvjp.exe122⤵PID:2064
-
\??\c:\pvvpv.exec:\pvvpv.exe123⤵PID:2060
-
\??\c:\9ffrfrx.exec:\9ffrfrx.exe124⤵PID:2740
-
\??\c:\hhthhn.exec:\hhthhn.exe125⤵PID:1624
-
\??\c:\1bbbnn.exec:\1bbbnn.exe126⤵PID:2308
-
\??\c:\dddjp.exec:\dddjp.exe127⤵PID:1136
-
\??\c:\jdjdv.exec:\jdjdv.exe128⤵PID:1160
-
\??\c:\xlflrff.exec:\xlflrff.exe129⤵PID:2164
-
\??\c:\xrxllff.exec:\xrxllff.exe130⤵PID:1028
-
\??\c:\1nhtbb.exec:\1nhtbb.exe131⤵PID:1344
-
\??\c:\7thhtt.exec:\7thhtt.exe132⤵PID:1868
-
\??\c:\1vpvd.exec:\1vpvd.exe133⤵PID:2256
-
\??\c:\jjjpv.exec:\jjjpv.exe134⤵PID:1056
-
\??\c:\llxxrrx.exec:\llxxrrx.exe135⤵PID:868
-
\??\c:\9llxllf.exec:\9llxllf.exe136⤵PID:3028
-
\??\c:\9bbnbb.exec:\9bbnbb.exe137⤵PID:1936
-
\??\c:\vvdjd.exec:\vvdjd.exe138⤵PID:904
-
\??\c:\1dvpd.exec:\1dvpd.exe139⤵PID:2012
-
\??\c:\lrxflll.exec:\lrxflll.exe140⤵PID:1864
-
\??\c:\frxfllr.exec:\frxfllr.exe141⤵PID:1684
-
\??\c:\hhntnn.exec:\hhntnn.exe142⤵PID:1676
-
\??\c:\7btbnn.exec:\7btbnn.exe143⤵PID:2848
-
\??\c:\7jjvj.exec:\7jjvj.exe144⤵PID:1584
-
\??\c:\9xrxllx.exec:\9xrxllx.exe145⤵PID:2004
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe146⤵PID:2768
-
\??\c:\hbnntb.exec:\hbnntb.exe147⤵PID:2784
-
\??\c:\5nhhhb.exec:\5nhhhb.exe148⤵PID:2712
-
\??\c:\bthnnb.exec:\bthnnb.exe149⤵PID:2808
-
\??\c:\jddpj.exec:\jddpj.exe150⤵PID:2844
-
\??\c:\1rrffrr.exec:\1rrffrr.exe151⤵PID:2596
-
\??\c:\rrrrrfx.exec:\rrrrrfx.exe152⤵PID:2776
-
\??\c:\nhntbh.exec:\nhntbh.exe153⤵PID:2556
-
\??\c:\hbnnbt.exec:\hbnnbt.exe154⤵PID:2676
-
\??\c:\vpppv.exec:\vpppv.exe155⤵PID:2076
-
\??\c:\7vjjj.exec:\7vjjj.exe156⤵PID:1668
-
\??\c:\xlfxxxl.exec:\xlfxxxl.exe157⤵PID:2820
-
\??\c:\llfffrf.exec:\llfffrf.exe158⤵PID:2956
-
\??\c:\btbhhh.exec:\btbhhh.exe159⤵PID:2092
-
\??\c:\5hthht.exec:\5hthht.exe160⤵PID:1596
-
\??\c:\vdvjj.exec:\vdvjj.exe161⤵PID:3064
-
\??\c:\flfrrfx.exec:\flfrrfx.exe162⤵PID:2656
-
\??\c:\xlxfrlr.exec:\xlxfrlr.exe163⤵PID:2800
-
\??\c:\tnthbh.exec:\tnthbh.exe164⤵PID:1628
-
\??\c:\bbbtnt.exec:\bbbtnt.exe165⤵PID:1804
-
\??\c:\jdpdj.exec:\jdpdj.exe166⤵PID:2928
-
\??\c:\vppdd.exec:\vppdd.exe167⤵PID:1604
-
\??\c:\llrxfff.exec:\llrxfff.exe168⤵PID:1808
-
\??\c:\lfrxrxl.exec:\lfrxrxl.exe169⤵PID:628
-
\??\c:\hnbtbh.exec:\hnbtbh.exe170⤵PID:1764
-
\??\c:\hhthbt.exec:\hhthbt.exe171⤵PID:2148
-
\??\c:\vpdpv.exec:\vpdpv.exe172⤵PID:672
-
\??\c:\xxxxrrx.exec:\xxxxrrx.exe173⤵PID:2904
-
\??\c:\xxrllfx.exec:\xxrllfx.exe174⤵PID:2296
-
\??\c:\tbnhht.exec:\tbnhht.exe175⤵PID:3020
-
\??\c:\ntbbht.exec:\ntbbht.exe176⤵PID:592
-
\??\c:\vvjdj.exec:\vvjdj.exe177⤵PID:608
-
\??\c:\9xrxflr.exec:\9xrxflr.exe178⤵PID:328
-
\??\c:\1xfrfff.exec:\1xfrfff.exe179⤵PID:1748
-
\??\c:\hhtttt.exec:\hhtttt.exe180⤵PID:1888
-
\??\c:\hbttbb.exec:\hbttbb.exe181⤵PID:1600
-
\??\c:\9btbnn.exec:\9btbnn.exe182⤵PID:944
-
\??\c:\pvppd.exec:\pvppd.exe183⤵PID:1832
-
\??\c:\rlxfrll.exec:\rlxfrll.exe184⤵PID:2256
-
\??\c:\tbtntn.exec:\tbtntn.exe185⤵PID:2420
-
\??\c:\jvjpj.exec:\jvjpj.exe186⤵PID:2984
-
\??\c:\9ddvd.exec:\9ddvd.exe187⤵PID:564
-
\??\c:\ffrlxxr.exec:\ffrlxxr.exe188⤵PID:1580
-
\??\c:\bbtthh.exec:\bbtthh.exe189⤵PID:2388
-
\??\c:\vjvpp.exec:\vjvpp.exe190⤵PID:2448
-
\??\c:\rlfrlxr.exec:\rlfrlxr.exe191⤵PID:2196
-
\??\c:\xrlrlxx.exec:\xrlrlxx.exe192⤵PID:2456
-
\??\c:\1hnnbh.exec:\1hnnbh.exe193⤵PID:2972
-
\??\c:\nnnntb.exec:\nnnntb.exe194⤵PID:2176
-
\??\c:\rxxrlrr.exec:\rxxrlrr.exe195⤵PID:2292
-
\??\c:\ttnhbn.exec:\ttnhbn.exe196⤵PID:2660
-
\??\c:\tttbbb.exec:\tttbbb.exe197⤵PID:2004
-
\??\c:\pjdjd.exec:\pjdjd.exe198⤵PID:2300
-
\??\c:\vpdjj.exec:\vpdjj.exe199⤵PID:2752
-
\??\c:\5llxfrl.exec:\5llxfrl.exe200⤵PID:2096
-
\??\c:\lxlxrrf.exec:\lxlxrrf.exe201⤵PID:2796
-
\??\c:\tnbtnn.exec:\tnbtnn.exe202⤵PID:2836
-
\??\c:\3nnnnb.exec:\3nnnnb.exe203⤵PID:2716
-
\??\c:\9pjpj.exec:\9pjpj.exe204⤵PID:2572
-
\??\c:\xlrxlrx.exec:\xlrxlrx.exe205⤵PID:2560
-
\??\c:\xxfrflr.exec:\xxfrflr.exe206⤵PID:2204
-
\??\c:\1bnthh.exec:\1bnthh.exe207⤵PID:2588
-
\??\c:\jjjdp.exec:\jjjdp.exe208⤵PID:2940
-
\??\c:\vvpvd.exec:\vvpvd.exe209⤵PID:3060
-
\??\c:\rrrlrrf.exec:\rrrlrrf.exe210⤵PID:2000
-
\??\c:\ffxrfrx.exec:\ffxrfrx.exe211⤵PID:2340
-
\??\c:\thtbnh.exec:\thtbnh.exe212⤵PID:2072
-
\??\c:\hhbhtb.exec:\hhbhtb.exe213⤵PID:1328
-
\??\c:\jdjdp.exec:\jdjdp.exe214⤵PID:1660
-
\??\c:\5pppd.exec:\5pppd.exe215⤵PID:2208
-
\??\c:\9rlxrxl.exec:\9rlxrxl.exe216⤵PID:2876
-
\??\c:\3lxxfrf.exec:\3lxxfrf.exe217⤵PID:2968
-
\??\c:\bbtnht.exec:\bbtnht.exe218⤵PID:2732
-
\??\c:\nhhnbh.exec:\nhhnbh.exe219⤵PID:852
-
\??\c:\dpdvp.exec:\dpdvp.exe220⤵PID:1504
-
\??\c:\1jddj.exec:\1jddj.exe221⤵PID:1340
-
\??\c:\9lrlxlf.exec:\9lrlxlf.exe222⤵PID:1312
-
\??\c:\llxfrfl.exec:\llxfrfl.exe223⤵PID:2148
-
\??\c:\hbbthn.exec:\hbbthn.exe224⤵PID:1244
-
\??\c:\hntnnb.exec:\hntnnb.exe225⤵PID:1956
-
\??\c:\pvjdj.exec:\pvjdj.exe226⤵PID:2104
-
\??\c:\flrxrfl.exec:\flrxrfl.exe227⤵PID:2352
-
\??\c:\xflllxr.exec:\xflllxr.exe228⤵PID:1524
-
\??\c:\nhbtbb.exec:\nhbtbb.exe229⤵PID:2308
-
\??\c:\5nnbhn.exec:\5nnbhn.exe230⤵PID:2116
-
\??\c:\ppvjp.exec:\ppvjp.exe231⤵PID:1092
-
\??\c:\vpjvd.exec:\vpjvd.exe232⤵PID:444
-
\??\c:\7lrxffr.exec:\7lrxffr.exe233⤵PID:2484
-
\??\c:\fffrfrl.exec:\fffrfrl.exe234⤵PID:1032
-
\??\c:\1bnbnt.exec:\1bnbnt.exe235⤵PID:1868
-
\??\c:\btnhnt.exec:\btnhnt.exe236⤵PID:1020
-
\??\c:\1jjvd.exec:\1jjvd.exe237⤵PID:2256
-
\??\c:\pjjdj.exec:\pjjdj.exe238⤵PID:868
-
\??\c:\llfrflx.exec:\llfrflx.exe239⤵PID:2984
-
\??\c:\rlfrflx.exec:\rlfrflx.exe240⤵PID:1068
-
\??\c:\hntnnh.exec:\hntnnh.exe241⤵PID:2024
-
\??\c:\jddpv.exec:\jddpv.exe242⤵PID:832