Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 04:12
Behavioral task
behavioral1
Sample
ebb5bbb495bce255f0c221e4c0f079c2e123ed2cb03411ce1cdfe43dc0fc780e.exe
Resource
win7-20240419-en
windows7-x64
6 signatures
150 seconds
General
-
Target
ebb5bbb495bce255f0c221e4c0f079c2e123ed2cb03411ce1cdfe43dc0fc780e.exe
-
Size
81KB
-
MD5
1ff8e5161eaa6cd08070f07fcec63ecb
-
SHA1
1c666eff9d4966f0ecc0f8b67b1d39289a1331c6
-
SHA256
ebb5bbb495bce255f0c221e4c0f079c2e123ed2cb03411ce1cdfe43dc0fc780e
-
SHA512
59fbd6fd7fe8d3056f7d4338ada41e1ecfe8513ecdff9e06a0c8ef3a581053a0a1a5e29c3954588368a1a323f7063be42525de507921384391e61b300514ed0b
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6T7Q6:zhOmTsF93UYfwC6GIoutiTU2HVS63Q6
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
Processes:
resource yara_rule behavioral1/memory/1312-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1520-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1916-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1408-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/940-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-629-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-696-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2308-719-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-935-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/272-981-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2096-1098-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1256-6160-0x0000000077930000-0x0000000077A2A000-memory.dmp family_blackmoon behavioral1/memory/1256-7236-0x0000000077810000-0x000000007792F000-memory.dmp family_blackmoon behavioral1/memory/1256-27529-0x0000000077810000-0x000000007792F000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/1312-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2488-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jjdjv.exe UPX behavioral1/memory/1312-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2488-16-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7flflff.exe UPX behavioral1/memory/2676-27-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\nhhntb.exe UPX behavioral1/memory/2840-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7dppp.exe UPX behavioral1/memory/2772-40-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xlfrrrr.exe UPX C:\bbtnbn.exe UPX behavioral1/memory/2668-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7nbtbh.exe UPX behavioral1/memory/3028-62-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vpjdj.exe UPX C:\rfrxllx.exe UPX behavioral1/memory/2580-74-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2728-71-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rlflfll.exe UPX \??\c:\nhbhnt.exe UPX behavioral1/memory/3032-87-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\dvvpd.exe UPX C:\fxllrrf.exe UPX behavioral1/memory/2604-102-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9nhtbb.exe UPX behavioral1/memory/2852-110-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3000-111-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5dppv.exe UPX behavioral1/memory/3000-119-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1804-126-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3xrrxff.exe UPX \??\c:\nhthtb.exe UPX behavioral1/memory/2016-135-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7bbnhn.exe UPX behavioral1/memory/2216-143-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pjvdd.exe UPX behavioral1/memory/2216-151-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7rrlrxf.exe UPX C:\nnhnnt.exe UPX behavioral1/memory/1700-166-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vvdjv.exe UPX C:\jpdpj.exe UPX C:\9lrxflr.exe UPX behavioral1/memory/3064-188-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bttbhh.exe UPX behavioral1/memory/3064-196-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pdjjj.exe UPX C:\vvpdp.exe UPX C:\fxrxrlx.exe UPX C:\nhnnhh.exe UPX behavioral1/memory/1788-225-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9jjdp.exe UPX \??\c:\lxxrrrf.exe UPX behavioral1/memory/1876-240-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rlffxfl.exe UPX behavioral1/memory/1520-254-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3024-271-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2084-287-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1312-288-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1916-294-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1916-300-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2644-311-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
jjdjv.exe7flflff.exenhhntb.exe7dppp.exexlfrrrr.exebbtnbn.exe7nbtbh.exevpjdj.exerfrxllx.exerlflfll.exenhbhnt.exedvvpd.exefxllrrf.exe9nhtbb.exe5dppv.exe3xrrxff.exenhthtb.exe7bbnhn.exepjvdd.exe7rrlrxf.exennhnnt.exevvdjv.exejpdpj.exe9lrxflr.exebttbhh.exepdjjj.exevvpdp.exefxrxrlx.exenhnnhh.exe9jjdp.exelxxrrrf.exerlffxfl.exehnttnn.exepjvvj.exepjdjj.exexrllflf.exexffrfrr.exenhtnbh.exehthhnn.exejdddv.exejvdvd.exe9fxllrf.exexlrxllx.exehttnbb.exejvvvv.exepdppp.exellflrff.exe5xrflrx.exe3tnnhh.exeppdvj.exevpvvj.exexrllrrx.exefxrllll.exebthnnn.exebnbbhb.exepdppv.exe5ddjj.exerlxxflx.exexrlxlrr.exethttnh.exe5bnntb.exejdddv.exelflrffr.exe9xrxffl.exepid process 2488 jjdjv.exe 2840 7flflff.exe 2676 nhhntb.exe 2772 7dppp.exe 2668 xlfrrrr.exe 2352 bbtnbn.exe 3028 7nbtbh.exe 2728 vpjdj.exe 2580 rfrxllx.exe 3032 rlflfll.exe 1660 nhbhnt.exe 2604 dvvpd.exe 2852 fxllrrf.exe 3000 9nhtbb.exe 1804 5dppv.exe 2016 3xrrxff.exe 1864 nhthtb.exe 2216 7bbnhn.exe 324 pjvdd.exe 1700 7rrlrxf.exe 1636 nnhnnt.exe 2056 vvdjv.exe 2928 jpdpj.exe 3064 9lrxflr.exe 1980 bttbhh.exe 1752 pdjjj.exe 2480 vvpdp.exe 688 fxrxrlx.exe 1788 nhnnhh.exe 1936 9jjdp.exe 1876 lxxrrrf.exe 1520 rlffxfl.exe 1836 hnttnn.exe 1768 pjvvj.exe 2156 pjdjj.exe 3024 xrllflf.exe 1828 xffrfrr.exe 2084 nhtnbh.exe 1312 hthhnn.exe 1916 jdddv.exe 2628 jvdvd.exe 2644 9fxllrf.exe 2740 xlrxllx.exe 2768 httnbb.exe 2760 jvvvv.exe 2816 pdppp.exe 2564 llflrff.exe 2700 5xrflrx.exe 2540 3tnnhh.exe 2612 ppdvj.exe 2588 vpvvj.exe 1060 xrllrrx.exe 2524 fxrllll.exe 1660 bthnnn.exe 2784 bnbbhb.exe 2972 pdppv.exe 760 5ddjj.exe 2208 rlxxflx.exe 1704 xrlxlrr.exe 2424 thttnh.exe 2016 5bnntb.exe 1036 jdddv.exe 828 lflrffr.exe 2200 9xrxffl.exe -
Processes:
resource yara_rule behavioral1/memory/1312-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2488-8-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjdjv.exe upx behavioral1/memory/1312-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2488-16-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7flflff.exe upx behavioral1/memory/2676-27-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhhntb.exe upx behavioral1/memory/2840-24-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7dppp.exe upx behavioral1/memory/2772-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlfrrrr.exe upx C:\bbtnbn.exe upx behavioral1/memory/2668-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7nbtbh.exe upx behavioral1/memory/3028-62-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpjdj.exe upx C:\rfrxllx.exe upx behavioral1/memory/2580-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-71-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlflfll.exe upx \??\c:\nhbhnt.exe upx behavioral1/memory/3032-87-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvvpd.exe upx C:\fxllrrf.exe upx behavioral1/memory/2604-102-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9nhtbb.exe upx behavioral1/memory/2852-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3000-111-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5dppv.exe upx behavioral1/memory/3000-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1804-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3xrrxff.exe upx \??\c:\nhthtb.exe upx behavioral1/memory/2016-135-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7bbnhn.exe upx behavioral1/memory/2216-143-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjvdd.exe upx behavioral1/memory/2216-151-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7rrlrxf.exe upx C:\nnhnnt.exe upx behavioral1/memory/1700-166-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvdjv.exe upx C:\jpdpj.exe upx C:\9lrxflr.exe upx behavioral1/memory/3064-188-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bttbhh.exe upx behavioral1/memory/3064-196-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdjjj.exe upx C:\vvpdp.exe upx C:\fxrxrlx.exe upx C:\nhnnhh.exe upx behavioral1/memory/1788-225-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9jjdp.exe upx \??\c:\lxxrrrf.exe upx behavioral1/memory/1876-240-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlffxfl.exe upx behavioral1/memory/1520-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3024-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2084-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1312-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1916-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1916-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-311-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ebb5bbb495bce255f0c221e4c0f079c2e123ed2cb03411ce1cdfe43dc0fc780e.exejjdjv.exe7flflff.exenhhntb.exe7dppp.exexlfrrrr.exebbtnbn.exe7nbtbh.exevpjdj.exerfrxllx.exerlflfll.exenhbhnt.exedvvpd.exefxllrrf.exe9nhtbb.exe5dppv.exedescription pid process target process PID 1312 wrote to memory of 2488 1312 ebb5bbb495bce255f0c221e4c0f079c2e123ed2cb03411ce1cdfe43dc0fc780e.exe jjdjv.exe PID 1312 wrote to memory of 2488 1312 ebb5bbb495bce255f0c221e4c0f079c2e123ed2cb03411ce1cdfe43dc0fc780e.exe jjdjv.exe PID 1312 wrote to memory of 2488 1312 ebb5bbb495bce255f0c221e4c0f079c2e123ed2cb03411ce1cdfe43dc0fc780e.exe jjdjv.exe PID 1312 wrote to memory of 2488 1312 ebb5bbb495bce255f0c221e4c0f079c2e123ed2cb03411ce1cdfe43dc0fc780e.exe jjdjv.exe PID 2488 wrote to memory of 2840 2488 jjdjv.exe 7flflff.exe PID 2488 wrote to memory of 2840 2488 jjdjv.exe 7flflff.exe PID 2488 wrote to memory of 2840 2488 jjdjv.exe 7flflff.exe PID 2488 wrote to memory of 2840 2488 jjdjv.exe 7flflff.exe PID 2840 wrote to memory of 2676 2840 7flflff.exe nhhntb.exe PID 2840 wrote to memory of 2676 2840 7flflff.exe nhhntb.exe PID 2840 wrote to memory of 2676 2840 7flflff.exe nhhntb.exe PID 2840 wrote to memory of 2676 2840 7flflff.exe nhhntb.exe PID 2676 wrote to memory of 2772 2676 nhhntb.exe 7dppp.exe PID 2676 wrote to memory of 2772 2676 nhhntb.exe 7dppp.exe PID 2676 wrote to memory of 2772 2676 nhhntb.exe 7dppp.exe PID 2676 wrote to memory of 2772 2676 nhhntb.exe 7dppp.exe PID 2772 wrote to memory of 2668 2772 7dppp.exe xlfrrrr.exe PID 2772 wrote to memory of 2668 2772 7dppp.exe xlfrrrr.exe PID 2772 wrote to memory of 2668 2772 7dppp.exe xlfrrrr.exe PID 2772 wrote to memory of 2668 2772 7dppp.exe xlfrrrr.exe PID 2668 wrote to memory of 2352 2668 xlfrrrr.exe bbtnbn.exe PID 2668 wrote to memory of 2352 2668 xlfrrrr.exe bbtnbn.exe PID 2668 wrote to memory of 2352 2668 xlfrrrr.exe bbtnbn.exe PID 2668 wrote to memory of 2352 2668 xlfrrrr.exe bbtnbn.exe PID 2352 wrote to memory of 3028 2352 bbtnbn.exe 7nbtbh.exe PID 2352 wrote to memory of 3028 2352 bbtnbn.exe 7nbtbh.exe PID 2352 wrote to memory of 3028 2352 bbtnbn.exe 7nbtbh.exe PID 2352 wrote to memory of 3028 2352 bbtnbn.exe 7nbtbh.exe PID 3028 wrote to memory of 2728 3028 7nbtbh.exe vpjdj.exe PID 3028 wrote to memory of 2728 3028 7nbtbh.exe vpjdj.exe PID 3028 wrote to memory of 2728 3028 7nbtbh.exe vpjdj.exe PID 3028 wrote to memory of 2728 3028 7nbtbh.exe vpjdj.exe PID 2728 wrote to memory of 2580 2728 vpjdj.exe rfrxllx.exe PID 2728 wrote to memory of 2580 2728 vpjdj.exe rfrxllx.exe PID 2728 wrote to memory of 2580 2728 vpjdj.exe rfrxllx.exe PID 2728 wrote to memory of 2580 2728 vpjdj.exe rfrxllx.exe PID 2580 wrote to memory of 3032 2580 rfrxllx.exe rlflfll.exe PID 2580 wrote to memory of 3032 2580 rfrxllx.exe rlflfll.exe PID 2580 wrote to memory of 3032 2580 rfrxllx.exe rlflfll.exe PID 2580 wrote to memory of 3032 2580 rfrxllx.exe rlflfll.exe PID 3032 wrote to memory of 1660 3032 rlflfll.exe nhbhnt.exe PID 3032 wrote to memory of 1660 3032 rlflfll.exe nhbhnt.exe PID 3032 wrote to memory of 1660 3032 rlflfll.exe nhbhnt.exe PID 3032 wrote to memory of 1660 3032 rlflfll.exe nhbhnt.exe PID 1660 wrote to memory of 2604 1660 nhbhnt.exe dvvpd.exe PID 1660 wrote to memory of 2604 1660 nhbhnt.exe dvvpd.exe PID 1660 wrote to memory of 2604 1660 nhbhnt.exe dvvpd.exe PID 1660 wrote to memory of 2604 1660 nhbhnt.exe dvvpd.exe PID 2604 wrote to memory of 2852 2604 dvvpd.exe fxllrrf.exe PID 2604 wrote to memory of 2852 2604 dvvpd.exe fxllrrf.exe PID 2604 wrote to memory of 2852 2604 dvvpd.exe fxllrrf.exe PID 2604 wrote to memory of 2852 2604 dvvpd.exe fxllrrf.exe PID 2852 wrote to memory of 3000 2852 fxllrrf.exe 9nhtbb.exe PID 2852 wrote to memory of 3000 2852 fxllrrf.exe 9nhtbb.exe PID 2852 wrote to memory of 3000 2852 fxllrrf.exe 9nhtbb.exe PID 2852 wrote to memory of 3000 2852 fxllrrf.exe 9nhtbb.exe PID 3000 wrote to memory of 1804 3000 9nhtbb.exe 5dppv.exe PID 3000 wrote to memory of 1804 3000 9nhtbb.exe 5dppv.exe PID 3000 wrote to memory of 1804 3000 9nhtbb.exe 5dppv.exe PID 3000 wrote to memory of 1804 3000 9nhtbb.exe 5dppv.exe PID 1804 wrote to memory of 2016 1804 5dppv.exe 3xrrxff.exe PID 1804 wrote to memory of 2016 1804 5dppv.exe 3xrrxff.exe PID 1804 wrote to memory of 2016 1804 5dppv.exe 3xrrxff.exe PID 1804 wrote to memory of 2016 1804 5dppv.exe 3xrrxff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebb5bbb495bce255f0c221e4c0f079c2e123ed2cb03411ce1cdfe43dc0fc780e.exe"C:\Users\Admin\AppData\Local\Temp\ebb5bbb495bce255f0c221e4c0f079c2e123ed2cb03411ce1cdfe43dc0fc780e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\jjdjv.exec:\jjdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\7flflff.exec:\7flflff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\nhhntb.exec:\nhhntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\7dppp.exec:\7dppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\xlfrrrr.exec:\xlfrrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\bbtnbn.exec:\bbtnbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\7nbtbh.exec:\7nbtbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\vpjdj.exec:\vpjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rfrxllx.exec:\rfrxllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\rlflfll.exec:\rlflfll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\nhbhnt.exec:\nhbhnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\dvvpd.exec:\dvvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\fxllrrf.exec:\fxllrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\9nhtbb.exec:\9nhtbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\5dppv.exec:\5dppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\3xrrxff.exec:\3xrrxff.exe17⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nhthtb.exec:\nhthtb.exe18⤵
- Executes dropped EXE
PID:1864 -
\??\c:\7bbnhn.exec:\7bbnhn.exe19⤵
- Executes dropped EXE
PID:2216 -
\??\c:\pjvdd.exec:\pjvdd.exe20⤵
- Executes dropped EXE
PID:324 -
\??\c:\7rrlrxf.exec:\7rrlrxf.exe21⤵
- Executes dropped EXE
PID:1700 -
\??\c:\nnhnnt.exec:\nnhnnt.exe22⤵
- Executes dropped EXE
PID:1636 -
\??\c:\vvdjv.exec:\vvdjv.exe23⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jpdpj.exec:\jpdpj.exe24⤵
- Executes dropped EXE
PID:2928 -
\??\c:\9lrxflr.exec:\9lrxflr.exe25⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bttbhh.exec:\bttbhh.exe26⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pdjjj.exec:\pdjjj.exe27⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vvpdp.exec:\vvpdp.exe28⤵
- Executes dropped EXE
PID:2480 -
\??\c:\fxrxrlx.exec:\fxrxrlx.exe29⤵
- Executes dropped EXE
PID:688 -
\??\c:\nhnnhh.exec:\nhnnhh.exe30⤵
- Executes dropped EXE
PID:1788 -
\??\c:\9jjdp.exec:\9jjdp.exe31⤵
- Executes dropped EXE
PID:1936 -
\??\c:\lxxrrrf.exec:\lxxrrrf.exe32⤵
- Executes dropped EXE
PID:1876 -
\??\c:\rlffxfl.exec:\rlffxfl.exe33⤵
- Executes dropped EXE
PID:1520 -
\??\c:\hnttnn.exec:\hnttnn.exe34⤵
- Executes dropped EXE
PID:1836 -
\??\c:\pjvvj.exec:\pjvvj.exe35⤵
- Executes dropped EXE
PID:1768 -
\??\c:\pjdjj.exec:\pjdjj.exe36⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xrllflf.exec:\xrllflf.exe37⤵
- Executes dropped EXE
PID:3024 -
\??\c:\xffrfrr.exec:\xffrfrr.exe38⤵
- Executes dropped EXE
PID:1828 -
\??\c:\nhtnbh.exec:\nhtnbh.exe39⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hthhnn.exec:\hthhnn.exe40⤵
- Executes dropped EXE
PID:1312 -
\??\c:\jdddv.exec:\jdddv.exe41⤵
- Executes dropped EXE
PID:1916 -
\??\c:\jvdvd.exec:\jvdvd.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\9fxllrf.exec:\9fxllrf.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\xlrxllx.exec:\xlrxllx.exe44⤵
- Executes dropped EXE
PID:2740 -
\??\c:\httnbb.exec:\httnbb.exe45⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jvvvv.exec:\jvvvv.exe46⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pdppp.exec:\pdppp.exe47⤵
- Executes dropped EXE
PID:2816 -
\??\c:\llflrff.exec:\llflrff.exe48⤵
- Executes dropped EXE
PID:2564 -
\??\c:\5xrflrx.exec:\5xrflrx.exe49⤵
- Executes dropped EXE
PID:2700 -
\??\c:\3tnnhh.exec:\3tnnhh.exe50⤵
- Executes dropped EXE
PID:2540 -
\??\c:\ppdvj.exec:\ppdvj.exe51⤵
- Executes dropped EXE
PID:2612 -
\??\c:\vpvvj.exec:\vpvvj.exe52⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xrllrrx.exec:\xrllrrx.exe53⤵
- Executes dropped EXE
PID:1060 -
\??\c:\fxrllll.exec:\fxrllll.exe54⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bthnnn.exec:\bthnnn.exe55⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bnbbhb.exec:\bnbbhb.exe56⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pdppv.exec:\pdppv.exe57⤵
- Executes dropped EXE
PID:2972 -
\??\c:\5ddjj.exec:\5ddjj.exe58⤵
- Executes dropped EXE
PID:760 -
\??\c:\rlxxflx.exec:\rlxxflx.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xrlxlrr.exec:\xrlxlrr.exe60⤵
- Executes dropped EXE
PID:1704 -
\??\c:\thttnh.exec:\thttnh.exe61⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5bnntb.exec:\5bnntb.exe62⤵
- Executes dropped EXE
PID:2016 -
\??\c:\jdddv.exec:\jdddv.exe63⤵
- Executes dropped EXE
PID:1036 -
\??\c:\lflrffr.exec:\lflrffr.exe64⤵
- Executes dropped EXE
PID:828 -
\??\c:\9xrxffl.exec:\9xrxffl.exe65⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nbhthn.exec:\nbhthn.exe66⤵PID:1732
-
\??\c:\bnbbbb.exec:\bnbbbb.exe67⤵PID:1700
-
\??\c:\1pdjj.exec:\1pdjj.exe68⤵PID:1272
-
\??\c:\5vjvd.exec:\5vjvd.exe69⤵PID:1432
-
\??\c:\rlxrrxf.exec:\rlxrrxf.exe70⤵PID:2516
-
\??\c:\3rlrllx.exec:\3rlrllx.exe71⤵PID:2444
-
\??\c:\ttnttt.exec:\ttnttt.exe72⤵PID:2460
-
\??\c:\hthnnn.exec:\hthnnn.exe73⤵PID:664
-
\??\c:\vjppd.exec:\vjppd.exe74⤵PID:568
-
\??\c:\lxxfflr.exec:\lxxfflr.exe75⤵PID:1408
-
\??\c:\5xfrffr.exec:\5xfrffr.exe76⤵PID:956
-
\??\c:\btnttn.exec:\btnttn.exe77⤵PID:1600
-
\??\c:\7hhhnh.exec:\7hhhnh.exe78⤵PID:940
-
\??\c:\jdvdd.exec:\jdvdd.exe79⤵PID:1788
-
\??\c:\1vjjj.exec:\1vjjj.exe80⤵PID:284
-
\??\c:\xrrrrrf.exec:\xrrrrrf.exe81⤵PID:852
-
\??\c:\9fflxxl.exec:\9fflxxl.exe82⤵PID:2080
-
\??\c:\5bbhnn.exec:\5bbhnn.exe83⤵PID:3012
-
\??\c:\nbnnbb.exec:\nbnnbb.exe84⤵PID:1100
-
\??\c:\vjvdp.exec:\vjvdp.exe85⤵PID:1404
-
\??\c:\ddvvd.exec:\ddvvd.exe86⤵PID:1516
-
\??\c:\frffxfl.exec:\frffxfl.exe87⤵PID:1244
-
\??\c:\3frfxxx.exec:\3frfxxx.exe88⤵PID:2312
-
\??\c:\5hhtbb.exec:\5hhtbb.exe89⤵PID:1584
-
\??\c:\7nhnhb.exec:\7nhnhb.exe90⤵PID:1712
-
\??\c:\jdpdd.exec:\jdpdd.exe91⤵PID:1608
-
\??\c:\vvvvj.exec:\vvvvj.exe92⤵PID:2408
-
\??\c:\xlrxxlr.exec:\xlrxxlr.exe93⤵PID:2640
-
\??\c:\lxfxfxf.exec:\lxfxfxf.exe94⤵PID:2676
-
\??\c:\ffrxflx.exec:\ffrxflx.exe95⤵PID:2288
-
\??\c:\9tthtt.exec:\9tthtt.exe96⤵PID:2696
-
\??\c:\1thnnt.exec:\1thnnt.exe97⤵PID:2828
-
\??\c:\pjvpp.exec:\pjvpp.exe98⤵PID:2672
-
\??\c:\ppjjp.exec:\ppjjp.exe99⤵PID:2648
-
\??\c:\3rfxlrx.exec:\3rfxlrx.exe100⤵PID:2548
-
\??\c:\xrxfxxl.exec:\xrxfxxl.exe101⤵PID:2704
-
\??\c:\9nhbtt.exec:\9nhbtt.exe102⤵PID:2980
-
\??\c:\hhtthh.exec:\hhtthh.exe103⤵PID:2764
-
\??\c:\dvjdd.exec:\dvjdd.exe104⤵PID:2020
-
\??\c:\pjddv.exec:\pjddv.exe105⤵PID:2792
-
\??\c:\xlfrfll.exec:\xlfrfll.exe106⤵PID:608
-
\??\c:\xlxxllr.exec:\xlxxllr.exe107⤵PID:2856
-
\??\c:\btntbh.exec:\btntbh.exe108⤵PID:2336
-
\??\c:\1bhhnt.exec:\1bhhnt.exe109⤵PID:3000
-
\??\c:\pdjpp.exec:\pdjpp.exe110⤵PID:1200
-
\??\c:\ppvvv.exec:\ppvvv.exe111⤵PID:1032
-
\??\c:\1rlrxxl.exec:\1rlrxxl.exe112⤵PID:1064
-
\??\c:\xrlxxff.exec:\xrlxxff.exe113⤵PID:2448
-
\??\c:\9nhntt.exec:\9nhntt.exe114⤵PID:1764
-
\??\c:\hhtnnt.exec:\hhtnnt.exe115⤵PID:2212
-
\??\c:\vvpvj.exec:\vvpvj.exe116⤵PID:324
-
\??\c:\pjdpv.exec:\pjdpv.exe117⤵PID:2300
-
\??\c:\frllrxl.exec:\frllrxl.exe118⤵PID:2116
-
\??\c:\nbnthn.exec:\nbnthn.exe119⤵PID:2308
-
\??\c:\bbnbbh.exec:\bbnbbh.exe120⤵PID:3060
-
\??\c:\dpddj.exec:\dpddj.exe121⤵PID:1536
-
\??\c:\pdpvj.exec:\pdpvj.exe122⤵PID:2140
-
\??\c:\rrffrrf.exec:\rrffrrf.exe123⤵PID:2460
-
\??\c:\frlrllx.exec:\frlrllx.exe124⤵PID:2500
-
\??\c:\tnhtnt.exec:\tnhtnt.exe125⤵PID:820
-
\??\c:\btbhtb.exec:\btbhtb.exe126⤵PID:1152
-
\??\c:\vppvp.exec:\vppvp.exe127⤵PID:1228
-
\??\c:\5ppvd.exec:\5ppvd.exe128⤵PID:748
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe129⤵PID:1784
-
\??\c:\fxllxxl.exec:\fxllxxl.exe130⤵PID:3036
-
\??\c:\htnthh.exec:\htnthh.exe131⤵PID:824
-
\??\c:\ttnhnh.exec:\ttnhnh.exe132⤵PID:3040
-
\??\c:\5vpdp.exec:\5vpdp.exe133⤵PID:920
-
\??\c:\vvpjj.exec:\vvpjj.exe134⤵PID:1836
-
\??\c:\rflrrrx.exec:\rflrrrx.exe135⤵PID:2932
-
\??\c:\llfxlxl.exec:\llfxlxl.exe136⤵PID:1100
-
\??\c:\9tnnbb.exec:\9tnnbb.exe137⤵PID:2328
-
\??\c:\pdpvj.exec:\pdpvj.exe138⤵PID:2964
-
\??\c:\jvppp.exec:\jvppp.exe139⤵PID:2236
-
\??\c:\lrxxxrf.exec:\lrxxxrf.exe140⤵PID:1744
-
\??\c:\3rrflrx.exec:\3rrflrx.exe141⤵PID:2096
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe142⤵PID:3056
-
\??\c:\bhhbtt.exec:\bhhbtt.exe143⤵PID:2416
-
\??\c:\jdjpd.exec:\jdjpd.exe144⤵PID:2752
-
\??\c:\jdpvv.exec:\jdpvv.exe145⤵PID:2692
-
\??\c:\dpjvj.exec:\dpjvj.exe146⤵PID:2768
-
\??\c:\fxrxfxl.exec:\fxrxfxl.exe147⤵PID:2772
-
\??\c:\tnbhbt.exec:\tnbhbt.exe148⤵PID:2816
-
\??\c:\1tthth.exec:\1tthth.exe149⤵PID:2352
-
\??\c:\ddvvj.exec:\ddvvj.exe150⤵PID:2672
-
\??\c:\5vpvd.exec:\5vpvd.exe151⤵PID:2648
-
\??\c:\dpdpj.exec:\dpdpj.exe152⤵PID:2976
-
\??\c:\1xxxlrf.exec:\1xxxlrf.exe153⤵PID:2452
-
\??\c:\7rxrrrx.exec:\7rxrrrx.exe154⤵PID:2588
-
\??\c:\bbthbn.exec:\bbthbn.exe155⤵PID:2800
-
\??\c:\thnnbb.exec:\thnnbb.exe156⤵PID:2804
-
\??\c:\7dvpj.exec:\7dvpj.exe157⤵PID:2792
-
\??\c:\dpjvd.exec:\dpjvd.exe158⤵PID:2784
-
\??\c:\rlflrxf.exec:\rlflrxf.exe159⤵PID:2008
-
\??\c:\1frfrxf.exec:\1frfrxf.exe160⤵PID:1068
-
\??\c:\5tbbhh.exec:\5tbbhh.exe161⤵PID:2208
-
\??\c:\1nbntt.exec:\1nbntt.exe162⤵PID:1804
-
\??\c:\vvpvd.exec:\vvpvd.exe163⤵PID:304
-
\??\c:\1vdpp.exec:\1vdpp.exe164⤵PID:812
-
\??\c:\lfxlllx.exec:\lfxlllx.exe165⤵PID:1668
-
\??\c:\rllfxff.exec:\rllfxff.exe166⤵PID:1588
-
\??\c:\3nthnh.exec:\3nthnh.exe167⤵PID:1736
-
\??\c:\vpdjp.exec:\vpdjp.exe168⤵PID:1264
-
\??\c:\7jjvd.exec:\7jjvd.exe169⤵PID:272
-
\??\c:\1ffflrf.exec:\1ffflrf.exe170⤵PID:2056
-
\??\c:\rllrxfr.exec:\rllrxfr.exe171⤵PID:2716
-
\??\c:\ntbnht.exec:\ntbnht.exe172⤵PID:2240
-
\??\c:\3jddj.exec:\3jddj.exe173⤵PID:536
-
\??\c:\vvddd.exec:\vvddd.exe174⤵PID:2432
-
\??\c:\lffflrx.exec:\lffflrx.exe175⤵PID:448
-
\??\c:\fffrxff.exec:\fffrxff.exe176⤵PID:2504
-
\??\c:\fxrlfff.exec:\fxrlfff.exe177⤵PID:2480
-
\??\c:\bbnhth.exec:\bbnhth.exe178⤵PID:1408
-
\??\c:\hbnthn.exec:\hbnthn.exe179⤵PID:1628
-
\??\c:\dvjpv.exec:\dvjpv.exe180⤵PID:1896
-
\??\c:\ffrxxxx.exec:\ffrxxxx.exe181⤵PID:1880
-
\??\c:\fxfrllf.exec:\fxfrllf.exe182⤵PID:1148
-
\??\c:\fxrfffl.exec:\fxrfffl.exe183⤵PID:1520
-
\??\c:\nhtbhn.exec:\nhtbhn.exe184⤵PID:2152
-
\??\c:\bthhnn.exec:\bthhnn.exe185⤵PID:2076
-
\??\c:\jdjpv.exec:\jdjpv.exe186⤵PID:2108
-
\??\c:\pjjvj.exec:\pjjvj.exe187⤵PID:2252
-
\??\c:\5ffrrxf.exec:\5ffrrxf.exe188⤵PID:2616
-
\??\c:\rflxlrx.exec:\rflxlrx.exe189⤵PID:2084
-
\??\c:\bnbntt.exec:\bnbntt.exe190⤵PID:1312
-
\??\c:\9tnnhb.exec:\9tnnhb.exe191⤵PID:1584
-
\??\c:\7rrflff.exec:\7rrflff.exe192⤵PID:2096
-
\??\c:\5nhntt.exec:\5nhntt.exe193⤵PID:2904
-
\??\c:\jdvjj.exec:\jdvjj.exe194⤵PID:2684
-
\??\c:\jjppp.exec:\jjppp.exe195⤵PID:2752
-
\??\c:\lxllxxf.exec:\lxllxxf.exe196⤵PID:2664
-
\??\c:\bttttt.exec:\bttttt.exe197⤵PID:2768
-
\??\c:\tnbhhn.exec:\tnbhhn.exe198⤵PID:2772
-
\??\c:\3jvjd.exec:\3jvjd.exe199⤵PID:3028
-
\??\c:\vjvjv.exec:\vjvjv.exe200⤵PID:2564
-
\??\c:\1lflrxf.exec:\1lflrxf.exe201⤵PID:2592
-
\??\c:\9fxlrrx.exec:\9fxlrrx.exe202⤵PID:2392
-
\??\c:\hbhnbt.exec:\hbhnbt.exe203⤵PID:2980
-
\??\c:\thnthn.exec:\thnthn.exe204⤵PID:3032
-
\??\c:\5jvvj.exec:\5jvvj.exe205⤵PID:1060
-
\??\c:\vppdj.exec:\vppdj.exe206⤵PID:2636
-
\??\c:\9xlfllx.exec:\9xlfllx.exe207⤵PID:764
-
\??\c:\fxxfxxf.exec:\fxxfxxf.exe208⤵PID:2852
-
\??\c:\1nbhnt.exec:\1nbhnt.exe209⤵PID:1800
-
\??\c:\nthbnt.exec:\nthbnt.exe210⤵PID:2028
-
\??\c:\htthbb.exec:\htthbb.exe211⤵PID:1812
-
\??\c:\pdpdv.exec:\pdpdv.exe212⤵PID:2424
-
\??\c:\9pvdj.exec:\9pvdj.exe213⤵PID:1804
-
\??\c:\lxrxlrx.exec:\lxrxlrx.exe214⤵PID:1820
-
\??\c:\rlxlxfl.exec:\rlxlxfl.exe215⤵PID:2204
-
\??\c:\hthnbb.exec:\hthnbb.exe216⤵PID:2216
-
\??\c:\hhbhnn.exec:\hhbhnn.exe217⤵PID:1604
-
\??\c:\pjvvj.exec:\pjvvj.exe218⤵PID:1776
-
\??\c:\pdvpd.exec:\pdvpd.exe219⤵PID:2136
-
\??\c:\1lxxxxf.exec:\1lxxxxf.exe220⤵PID:1192
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe221⤵PID:2520
-
\??\c:\bnttbt.exec:\bnttbt.exe222⤵PID:3060
-
\??\c:\htbbbt.exec:\htbbbt.exe223⤵PID:264
-
\??\c:\pjppv.exec:\pjppv.exe224⤵PID:332
-
\??\c:\1dvvj.exec:\1dvvj.exe225⤵PID:1136
-
\??\c:\rlrffrf.exec:\rlrffrf.exe226⤵PID:2412
-
\??\c:\7xxflfl.exec:\7xxflfl.exe227⤵PID:1372
-
\??\c:\1bbbnt.exec:\1bbbnt.exe228⤵PID:688
-
\??\c:\nnhhbt.exec:\nnhhbt.exe229⤵PID:628
-
\??\c:\nbhbhn.exec:\nbhbhn.exe230⤵PID:940
-
\??\c:\pjvjv.exec:\pjvjv.exe231⤵PID:2120
-
\??\c:\pdvjp.exec:\pdvjp.exe232⤵PID:1888
-
\??\c:\rlxxflx.exec:\rlxxflx.exe233⤵PID:888
-
\??\c:\rfxfxxf.exec:\rfxfxxf.exe234⤵PID:3020
-
\??\c:\tnntbb.exec:\tnntbb.exe235⤵PID:1992
-
\??\c:\htntbb.exec:\htntbb.exe236⤵PID:816
-
\??\c:\vvpvj.exec:\vvpvj.exe237⤵PID:1100
-
\??\c:\ddvdj.exec:\ddvdj.exe238⤵PID:1516
-
\??\c:\rlxrflx.exec:\rlxrflx.exe239⤵PID:2960
-
\??\c:\frxxrlr.exec:\frxxrlr.exe240⤵PID:2964
-
\??\c:\bththh.exec:\bththh.exe241⤵PID:1612
-
\??\c:\thnthh.exec:\thnthh.exe242⤵PID:2184