Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 20:06
Behavioral task
behavioral1
Sample
20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe
Resource
win7-20240419-en
windows7-x64
6 signatures
150 seconds
General
-
Target
20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe
-
Size
80KB
-
MD5
d596bd7cb7a3f4772559cbb9733cfe33
-
SHA1
993778e74bc4f172b48c9455852f06bfff8bc2bd
-
SHA256
20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45
-
SHA512
40dd43461c25405006539e6c6aea7adaacccd07eb6ee3b2851db029fc43f131e15edb1242c44f081a2461ef7d3159896c5db28e071f199c9bab7d749df32d6b4
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TQpKg:zhOmTsF93UYfwC6GIoutiTU2HVS6A
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
Processes:
resource yara_rule behavioral1/memory/2084-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1300-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/840-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-186-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1772-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1144-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2252-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1744-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-270-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2924-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/984-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-766-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1488-984-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2388-1013-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-1019-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-6583-0x00000000770E0000-0x00000000771FF000-memory.dmp family_blackmoon behavioral1/memory/2992-6584-0x0000000077200000-0x00000000772FA000-memory.dmp family_blackmoon behavioral1/memory/2992-24865-0x00000000770E0000-0x00000000771FF000-memory.dmp family_blackmoon behavioral1/memory/2992-28644-0x00000000770E0000-0x00000000771FF000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2040-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5vppd.exe UPX behavioral1/memory/2084-10-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2040-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\llxfrrf.exe UPX C:\tnbbtb.exe UPX behavioral1/memory/2196-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jjpdp.exe UPX C:\9fxfrrf.exe UPX behavioral1/memory/2720-39-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2716-40-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hhthnn.exe UPX behavioral1/memory/2716-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5bntbb.exe UPX behavioral1/memory/2776-56-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1300-57-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1300-65-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ppvvp.exe UPX C:\rlfrrrf.exe UPX behavioral1/memory/2772-73-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2532-74-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\btnnhn.exe UPX behavioral1/memory/2532-81-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9bnnnn.exe UPX behavioral1/memory/2496-90-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2104-91-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7jddp.exe UPX C:\5xllrrx.exe UPX behavioral1/memory/2820-112-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3lxlxff.exe UPX C:\5nhbbb.exe UPX behavioral1/memory/2940-121-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\btnbtb.exe UPX behavioral1/memory/2428-129-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3pjdj.exe UPX behavioral1/memory/2420-139-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1972-137-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lflrxfr.exe UPX behavioral1/memory/1940-153-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9xrrxfx.exe UPX behavioral1/memory/1668-154-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1668-161-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tthntb.exe UPX C:\jvjjp.exe UPX C:\jdvjv.exe UPX behavioral1/memory/840-172-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\fxflrxx.exe UPX behavioral1/memory/2120-185-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1772-194-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hbtthn.exe UPX C:\vpvdp.exe UPX C:\dvvdj.exe UPX C:\xrlrlrf.exe UPX C:\9bhthh.exe UPX behavioral1/memory/1144-222-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2252-230-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3ntbhb.exe UPX C:\dvdjv.exe UPX behavioral1/memory/1744-238-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rfrxffr.exe UPX C:\fxffrrf.exe UPX behavioral1/memory/2924-276-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/984-282-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2168-308-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
5vppd.exellxfrrf.exetnbbtb.exejjpdp.exe9fxfrrf.exehhthnn.exe5bntbb.exeppvvp.exerlfrrrf.exebtnnhn.exe9bnnnn.exe7jddp.exe5xllrrx.exe3lxlxff.exe5nhbbb.exebtnbtb.exe3pjdj.exelflrxfr.exe9xrrxfx.exetthntb.exejvjjp.exejdvjv.exefxflrxx.exehbtthn.exevpvdp.exedvvdj.exexrlrlrf.exe9bhthh.exe3ntbhb.exedvdjv.exerfrxffr.exefxffrrf.exehbtbnn.exe5hhnnn.exedpdjp.exevvpdj.exe1fxrxff.exelfrrrxx.exe9hbtbh.exetnttbb.exe5pjpv.exevvjdp.exerfrfllx.exefrflxfr.exebnbthh.exebtnnbb.exebthtbb.exeppjjp.exellxrflx.exelfrrffl.exe1ththn.exehbntbb.exejdppp.exe9vjpj.exexrlxlxx.exethttnn.exe7tttbh.exetthbhh.exedpvdd.exefxlffll.exerlfxlxx.exehhtbnn.exetbnbhn.exe9jppp.exepid process 2084 5vppd.exe 2196 llxfrrf.exe 844 tnbbtb.exe 2720 jjpdp.exe 2716 9fxfrrf.exe 2776 hhthnn.exe 1300 5bntbb.exe 2772 ppvvp.exe 2532 rlfrrrf.exe 2496 btnnhn.exe 2104 9bnnnn.exe 1544 7jddp.exe 2820 5xllrrx.exe 2940 3lxlxff.exe 2428 5nhbbb.exe 1972 btnbtb.exe 2420 3pjdj.exe 1940 lflrxfr.exe 1668 9xrrxfx.exe 2192 tthntb.exe 840 jvjjp.exe 2120 jdvjv.exe 1772 fxflrxx.exe 2900 hbtthn.exe 2288 vpvdp.exe 1612 dvvdj.exe 1144 xrlrlrf.exe 2252 9bhthh.exe 1744 3ntbhb.exe 608 dvdjv.exe 2928 rfrxffr.exe 852 fxffrrf.exe 2024 hbtbnn.exe 1636 5hhnnn.exe 2924 dpdjp.exe 984 vvpdj.exe 884 1fxrxff.exe 2180 lfrrrxx.exe 2316 9hbtbh.exe 2884 tnttbb.exe 2084 5pjpv.exe 2168 vvjdp.exe 2032 rfrfllx.exe 844 frflxfr.exe 2656 bnbthh.exe 2672 btnnbb.exe 2536 bthtbb.exe 2644 ppjjp.exe 2708 llxrflx.exe 1300 lfrrffl.exe 2528 1ththn.exe 2572 hbntbb.exe 2960 jdppp.exe 2980 9vjpj.exe 1960 xrlxlxx.exe 2588 thttnn.exe 2852 7tttbh.exe 2820 tthbhh.exe 396 dpvdd.exe 1840 fxlffll.exe 1580 rlfxlxx.exe 1672 hhtbnn.exe 1964 tbnbhn.exe 2156 9jppp.exe -
Processes:
resource yara_rule behavioral1/memory/2040-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5vppd.exe upx behavioral1/memory/2084-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2040-6-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llxfrrf.exe upx C:\tnbbtb.exe upx behavioral1/memory/2196-24-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjpdp.exe upx C:\9fxfrrf.exe upx behavioral1/memory/2720-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2716-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhthnn.exe upx behavioral1/memory/2716-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5bntbb.exe upx behavioral1/memory/2776-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1300-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1300-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppvvp.exe upx C:\rlfrrrf.exe upx behavioral1/memory/2772-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-74-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btnnhn.exe upx behavioral1/memory/2532-81-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9bnnnn.exe upx behavioral1/memory/2496-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2104-91-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7jddp.exe upx C:\5xllrrx.exe upx behavioral1/memory/2820-112-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3lxlxff.exe upx C:\5nhbbb.exe upx behavioral1/memory/2940-121-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btnbtb.exe upx behavioral1/memory/2428-129-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3pjdj.exe upx behavioral1/memory/2420-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1972-137-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lflrxfr.exe upx behavioral1/memory/1940-153-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9xrrxfx.exe upx behavioral1/memory/1668-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1668-161-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tthntb.exe upx C:\jvjjp.exe upx C:\jdvjv.exe upx behavioral1/memory/840-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxflrxx.exe upx behavioral1/memory/2120-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1772-194-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbtthn.exe upx C:\vpvdp.exe upx C:\dvvdj.exe upx C:\xrlrlrf.exe upx C:\9bhthh.exe upx behavioral1/memory/1144-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2252-230-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3ntbhb.exe upx C:\dvdjv.exe upx behavioral1/memory/1744-238-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfrxffr.exe upx C:\fxffrrf.exe upx behavioral1/memory/2924-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/984-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2168-308-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe5vppd.exellxfrrf.exetnbbtb.exejjpdp.exe9fxfrrf.exehhthnn.exe5bntbb.exeppvvp.exerlfrrrf.exebtnnhn.exe9bnnnn.exe7jddp.exe5xllrrx.exe3lxlxff.exe5nhbbb.exedescription pid process target process PID 2040 wrote to memory of 2084 2040 20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe 5vppd.exe PID 2040 wrote to memory of 2084 2040 20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe 5vppd.exe PID 2040 wrote to memory of 2084 2040 20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe 5vppd.exe PID 2040 wrote to memory of 2084 2040 20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe 5vppd.exe PID 2084 wrote to memory of 2196 2084 5vppd.exe llxfrrf.exe PID 2084 wrote to memory of 2196 2084 5vppd.exe llxfrrf.exe PID 2084 wrote to memory of 2196 2084 5vppd.exe llxfrrf.exe PID 2084 wrote to memory of 2196 2084 5vppd.exe llxfrrf.exe PID 2196 wrote to memory of 844 2196 llxfrrf.exe tnbbtb.exe PID 2196 wrote to memory of 844 2196 llxfrrf.exe tnbbtb.exe PID 2196 wrote to memory of 844 2196 llxfrrf.exe tnbbtb.exe PID 2196 wrote to memory of 844 2196 llxfrrf.exe tnbbtb.exe PID 844 wrote to memory of 2720 844 tnbbtb.exe jjpdp.exe PID 844 wrote to memory of 2720 844 tnbbtb.exe jjpdp.exe PID 844 wrote to memory of 2720 844 tnbbtb.exe jjpdp.exe PID 844 wrote to memory of 2720 844 tnbbtb.exe jjpdp.exe PID 2720 wrote to memory of 2716 2720 jjpdp.exe 9fxfrrf.exe PID 2720 wrote to memory of 2716 2720 jjpdp.exe 9fxfrrf.exe PID 2720 wrote to memory of 2716 2720 jjpdp.exe 9fxfrrf.exe PID 2720 wrote to memory of 2716 2720 jjpdp.exe 9fxfrrf.exe PID 2716 wrote to memory of 2776 2716 9fxfrrf.exe hhthnn.exe PID 2716 wrote to memory of 2776 2716 9fxfrrf.exe hhthnn.exe PID 2716 wrote to memory of 2776 2716 9fxfrrf.exe hhthnn.exe PID 2716 wrote to memory of 2776 2716 9fxfrrf.exe hhthnn.exe PID 2776 wrote to memory of 1300 2776 hhthnn.exe 5bntbb.exe PID 2776 wrote to memory of 1300 2776 hhthnn.exe 5bntbb.exe PID 2776 wrote to memory of 1300 2776 hhthnn.exe 5bntbb.exe PID 2776 wrote to memory of 1300 2776 hhthnn.exe 5bntbb.exe PID 1300 wrote to memory of 2772 1300 5bntbb.exe ppvvp.exe PID 1300 wrote to memory of 2772 1300 5bntbb.exe ppvvp.exe PID 1300 wrote to memory of 2772 1300 5bntbb.exe ppvvp.exe PID 1300 wrote to memory of 2772 1300 5bntbb.exe ppvvp.exe PID 2772 wrote to memory of 2532 2772 ppvvp.exe rlfrrrf.exe PID 2772 wrote to memory of 2532 2772 ppvvp.exe rlfrrrf.exe PID 2772 wrote to memory of 2532 2772 ppvvp.exe rlfrrrf.exe PID 2772 wrote to memory of 2532 2772 ppvvp.exe rlfrrrf.exe PID 2532 wrote to memory of 2496 2532 rlfrrrf.exe btnnhn.exe PID 2532 wrote to memory of 2496 2532 rlfrrrf.exe btnnhn.exe PID 2532 wrote to memory of 2496 2532 rlfrrrf.exe btnnhn.exe PID 2532 wrote to memory of 2496 2532 rlfrrrf.exe btnnhn.exe PID 2496 wrote to memory of 2104 2496 btnnhn.exe 9bnnnn.exe PID 2496 wrote to memory of 2104 2496 btnnhn.exe 9bnnnn.exe PID 2496 wrote to memory of 2104 2496 btnnhn.exe 9bnnnn.exe PID 2496 wrote to memory of 2104 2496 btnnhn.exe 9bnnnn.exe PID 2104 wrote to memory of 1544 2104 9bnnnn.exe 7jddp.exe PID 2104 wrote to memory of 1544 2104 9bnnnn.exe 7jddp.exe PID 2104 wrote to memory of 1544 2104 9bnnnn.exe 7jddp.exe PID 2104 wrote to memory of 1544 2104 9bnnnn.exe 7jddp.exe PID 1544 wrote to memory of 2820 1544 7jddp.exe 5xllrrx.exe PID 1544 wrote to memory of 2820 1544 7jddp.exe 5xllrrx.exe PID 1544 wrote to memory of 2820 1544 7jddp.exe 5xllrrx.exe PID 1544 wrote to memory of 2820 1544 7jddp.exe 5xllrrx.exe PID 2820 wrote to memory of 2940 2820 5xllrrx.exe 3lxlxff.exe PID 2820 wrote to memory of 2940 2820 5xllrrx.exe 3lxlxff.exe PID 2820 wrote to memory of 2940 2820 5xllrrx.exe 3lxlxff.exe PID 2820 wrote to memory of 2940 2820 5xllrrx.exe 3lxlxff.exe PID 2940 wrote to memory of 2428 2940 3lxlxff.exe 5nhbbb.exe PID 2940 wrote to memory of 2428 2940 3lxlxff.exe 5nhbbb.exe PID 2940 wrote to memory of 2428 2940 3lxlxff.exe 5nhbbb.exe PID 2940 wrote to memory of 2428 2940 3lxlxff.exe 5nhbbb.exe PID 2428 wrote to memory of 1972 2428 5nhbbb.exe btnbtb.exe PID 2428 wrote to memory of 1972 2428 5nhbbb.exe btnbtb.exe PID 2428 wrote to memory of 1972 2428 5nhbbb.exe btnbtb.exe PID 2428 wrote to memory of 1972 2428 5nhbbb.exe btnbtb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe"C:\Users\Admin\AppData\Local\Temp\20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\5vppd.exec:\5vppd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\llxfrrf.exec:\llxfrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\tnbbtb.exec:\tnbbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\jjpdp.exec:\jjpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\9fxfrrf.exec:\9fxfrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\hhthnn.exec:\hhthnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\5bntbb.exec:\5bntbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\ppvvp.exec:\ppvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rlfrrrf.exec:\rlfrrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\btnnhn.exec:\btnnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\9bnnnn.exec:\9bnnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\7jddp.exec:\7jddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\5xllrrx.exec:\5xllrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\3lxlxff.exec:\3lxlxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\5nhbbb.exec:\5nhbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\btnbtb.exec:\btnbtb.exe17⤵
- Executes dropped EXE
PID:1972 -
\??\c:\3pjdj.exec:\3pjdj.exe18⤵
- Executes dropped EXE
PID:2420 -
\??\c:\lflrxfr.exec:\lflrxfr.exe19⤵
- Executes dropped EXE
PID:1940 -
\??\c:\9xrrxfx.exec:\9xrrxfx.exe20⤵
- Executes dropped EXE
PID:1668 -
\??\c:\tthntb.exec:\tthntb.exe21⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jvjjp.exec:\jvjjp.exe22⤵
- Executes dropped EXE
PID:840 -
\??\c:\jdvjv.exec:\jdvjv.exe23⤵
- Executes dropped EXE
PID:2120 -
\??\c:\fxflrxx.exec:\fxflrxx.exe24⤵
- Executes dropped EXE
PID:1772 -
\??\c:\hbtthn.exec:\hbtthn.exe25⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vpvdp.exec:\vpvdp.exe26⤵
- Executes dropped EXE
PID:2288 -
\??\c:\dvvdj.exec:\dvvdj.exe27⤵
- Executes dropped EXE
PID:1612 -
\??\c:\xrlrlrf.exec:\xrlrlrf.exe28⤵
- Executes dropped EXE
PID:1144 -
\??\c:\9bhthh.exec:\9bhthh.exe29⤵
- Executes dropped EXE
PID:2252 -
\??\c:\3ntbhb.exec:\3ntbhb.exe30⤵
- Executes dropped EXE
PID:1744 -
\??\c:\dvdjv.exec:\dvdjv.exe31⤵
- Executes dropped EXE
PID:608 -
\??\c:\rfrxffr.exec:\rfrxffr.exe32⤵
- Executes dropped EXE
PID:2928 -
\??\c:\fxffrrf.exec:\fxffrrf.exe33⤵
- Executes dropped EXE
PID:852 -
\??\c:\hbtbnn.exec:\hbtbnn.exe34⤵
- Executes dropped EXE
PID:2024 -
\??\c:\5hhnnn.exec:\5hhnnn.exe35⤵
- Executes dropped EXE
PID:1636 -
\??\c:\dpdjp.exec:\dpdjp.exe36⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vvpdj.exec:\vvpdj.exe37⤵
- Executes dropped EXE
PID:984 -
\??\c:\1fxrxff.exec:\1fxrxff.exe38⤵
- Executes dropped EXE
PID:884 -
\??\c:\lfrrrxx.exec:\lfrrrxx.exe39⤵
- Executes dropped EXE
PID:2180 -
\??\c:\9hbtbh.exec:\9hbtbh.exe40⤵
- Executes dropped EXE
PID:2316 -
\??\c:\tnttbb.exec:\tnttbb.exe41⤵
- Executes dropped EXE
PID:2884 -
\??\c:\5pjpv.exec:\5pjpv.exe42⤵
- Executes dropped EXE
PID:2084 -
\??\c:\vvjdp.exec:\vvjdp.exe43⤵
- Executes dropped EXE
PID:2168 -
\??\c:\rfrfllx.exec:\rfrfllx.exe44⤵
- Executes dropped EXE
PID:2032 -
\??\c:\frflxfr.exec:\frflxfr.exe45⤵
- Executes dropped EXE
PID:844 -
\??\c:\bnbthh.exec:\bnbthh.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\btnnbb.exec:\btnnbb.exe47⤵
- Executes dropped EXE
PID:2672 -
\??\c:\bthtbb.exec:\bthtbb.exe48⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ppjjp.exec:\ppjjp.exe49⤵
- Executes dropped EXE
PID:2644 -
\??\c:\llxrflx.exec:\llxrflx.exe50⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lfrrffl.exec:\lfrrffl.exe51⤵
- Executes dropped EXE
PID:1300 -
\??\c:\1ththn.exec:\1ththn.exe52⤵
- Executes dropped EXE
PID:2528 -
\??\c:\hbntbb.exec:\hbntbb.exe53⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jdppp.exec:\jdppp.exe54⤵
- Executes dropped EXE
PID:2960 -
\??\c:\9vjpj.exec:\9vjpj.exe55⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xrlxlxx.exec:\xrlxlxx.exe56⤵
- Executes dropped EXE
PID:1960 -
\??\c:\thttnn.exec:\thttnn.exe57⤵
- Executes dropped EXE
PID:2588 -
\??\c:\7tttbh.exec:\7tttbh.exe58⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tthbhh.exec:\tthbhh.exe59⤵
- Executes dropped EXE
PID:2820 -
\??\c:\dpvdd.exec:\dpvdd.exe60⤵
- Executes dropped EXE
PID:396 -
\??\c:\fxlffll.exec:\fxlffll.exe61⤵
- Executes dropped EXE
PID:1840 -
\??\c:\rlfxlxx.exec:\rlfxlxx.exe62⤵
- Executes dropped EXE
PID:1580 -
\??\c:\hhtbnn.exec:\hhtbnn.exe63⤵
- Executes dropped EXE
PID:1672 -
\??\c:\tbnbhn.exec:\tbnbhn.exe64⤵
- Executes dropped EXE
PID:1964 -
\??\c:\9jppp.exec:\9jppp.exe65⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vvpvv.exec:\vvpvv.exe66⤵PID:1940
-
\??\c:\rxffrll.exec:\rxffrll.exe67⤵PID:2624
-
\??\c:\7nhhtb.exec:\7nhhtb.exe68⤵PID:1192
-
\??\c:\9bnthh.exec:\9bnthh.exe69⤵PID:2276
-
\??\c:\7nhhtt.exec:\7nhhtt.exe70⤵PID:2232
-
\??\c:\5vpdj.exec:\5vpdj.exe71⤵PID:2244
-
\??\c:\7pjpv.exec:\7pjpv.exe72⤵PID:1768
-
\??\c:\3rrxflr.exec:\3rrxflr.exe73⤵PID:2012
-
\??\c:\rlrxffl.exec:\rlrxffl.exe74⤵PID:2116
-
\??\c:\bthntt.exec:\bthntt.exe75⤵PID:592
-
\??\c:\5hbbhb.exec:\5hbbhb.exe76⤵PID:1732
-
\??\c:\7pdvj.exec:\7pdvj.exe77⤵PID:1800
-
\??\c:\vpjjp.exec:\vpjjp.exe78⤵PID:1076
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe79⤵PID:1372
-
\??\c:\fxflfff.exec:\fxflfff.exe80⤵PID:1536
-
\??\c:\hbhhnh.exec:\hbhhnh.exe81⤵PID:1604
-
\??\c:\hbnthb.exec:\hbnthb.exe82⤵PID:1816
-
\??\c:\jdjjv.exec:\jdjjv.exe83⤵PID:2932
-
\??\c:\pjvvd.exec:\pjvvd.exe84⤵PID:1044
-
\??\c:\pjpjp.exec:\pjpjp.exe85⤵PID:2920
-
\??\c:\rfrlxxl.exec:\rfrlxxl.exe86⤵PID:2024
-
\??\c:\rrflxfr.exec:\rrflxfr.exe87⤵PID:2092
-
\??\c:\tnhhnn.exec:\tnhhnn.exe88⤵PID:2160
-
\??\c:\3ttbnn.exec:\3ttbnn.exe89⤵PID:1784
-
\??\c:\pjdpv.exec:\pjdpv.exe90⤵PID:3000
-
\??\c:\pjdpd.exec:\pjdpd.exe91⤵PID:2864
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe92⤵PID:2176
-
\??\c:\7rfrfff.exec:\7rfrfff.exe93⤵PID:2740
-
\??\c:\rllfffl.exec:\rllfffl.exe94⤵PID:3020
-
\??\c:\nhhhnt.exec:\nhhhnt.exe95⤵PID:2620
-
\??\c:\hbntbh.exec:\hbntbh.exe96⤵PID:3036
-
\??\c:\3btthh.exec:\3btthh.exe97⤵PID:2032
-
\??\c:\dvjvv.exec:\dvjvv.exe98⤵PID:2728
-
\??\c:\3jpvv.exec:\3jpvv.exe99⤵PID:2660
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe100⤵PID:2088
-
\??\c:\rfllxxl.exec:\rfllxxl.exe101⤵PID:2248
-
\??\c:\hhbhbb.exec:\hhbhbb.exe102⤵PID:2556
-
\??\c:\nbnthh.exec:\nbnthh.exe103⤵PID:2640
-
\??\c:\vpvdj.exec:\vpvdj.exe104⤵PID:1300
-
\??\c:\dpdjj.exec:\dpdjj.exe105⤵PID:2604
-
\??\c:\xrlrxff.exec:\xrlrxff.exe106⤵PID:2964
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe107⤵PID:2496
-
\??\c:\bthntt.exec:\bthntt.exe108⤵PID:2980
-
\??\c:\tnbhnt.exec:\tnbhnt.exe109⤵PID:1952
-
\??\c:\5btbhh.exec:\5btbhh.exe110⤵PID:2588
-
\??\c:\dvddp.exec:\dvddp.exe111⤵PID:2568
-
\??\c:\jjvdp.exec:\jjvdp.exe112⤵PID:2020
-
\??\c:\frffrxf.exec:\frffrxf.exe113⤵PID:1948
-
\??\c:\rfxxrlr.exec:\rfxxrlr.exe114⤵PID:1624
-
\??\c:\tthnbb.exec:\tthnbb.exe115⤵PID:1972
-
\??\c:\hbtbnt.exec:\hbtbnt.exe116⤵PID:1864
-
\??\c:\pjddd.exec:\pjddd.exe117⤵PID:1356
-
\??\c:\3vjpj.exec:\3vjpj.exe118⤵PID:1616
-
\??\c:\1jdvd.exec:\1jdvd.exe119⤵PID:2216
-
\??\c:\rfllrrl.exec:\rfllrrl.exe120⤵PID:2356
-
\??\c:\frfflff.exec:\frfflff.exe121⤵PID:2192
-
\??\c:\tntbhh.exec:\tntbhh.exe122⤵PID:1224
-
\??\c:\jddjj.exec:\jddjj.exe123⤵PID:2260
-
\??\c:\5dvvj.exec:\5dvvj.exe124⤵PID:2512
-
\??\c:\lflrfrf.exec:\lflrfrf.exe125⤵PID:2292
-
\??\c:\xrlrlrx.exec:\xrlrlrx.exe126⤵PID:2508
-
\??\c:\tnhnhn.exec:\tnhnhn.exe127⤵PID:760
-
\??\c:\5nnntn.exec:\5nnntn.exe128⤵PID:1084
-
\??\c:\hhbhnn.exec:\hhbhnn.exe129⤵PID:1116
-
\??\c:\7jvdd.exec:\7jvdd.exe130⤵PID:1644
-
\??\c:\jjddp.exec:\jjddp.exe131⤵PID:1368
-
\??\c:\xrfxfxx.exec:\xrfxfxx.exe132⤵PID:764
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe133⤵PID:1744
-
\??\c:\3ntbbh.exec:\3ntbbh.exe134⤵PID:340
-
\??\c:\bbbnhb.exec:\bbbnhb.exe135⤵PID:2240
-
\??\c:\dvddj.exec:\dvddj.exe136⤵PID:588
-
\??\c:\ppjjv.exec:\ppjjv.exe137⤵PID:2928
-
\??\c:\5xrllxf.exec:\5xrllxf.exe138⤵PID:568
-
\??\c:\fffrflf.exec:\fffrflf.exe139⤵PID:1716
-
\??\c:\5htbbt.exec:\5htbbt.exe140⤵PID:2924
-
\??\c:\bhbbbb.exec:\bhbbbb.exe141⤵PID:1492
-
\??\c:\9jppv.exec:\9jppv.exe142⤵PID:2468
-
\??\c:\5pjpv.exec:\5pjpv.exe143⤵PID:2212
-
\??\c:\pjdjp.exec:\pjdjp.exe144⤵PID:2064
-
\??\c:\1lxflrf.exec:\1lxflrf.exe145⤵PID:2040
-
\??\c:\3xllrrf.exec:\3xllrrf.exe146⤵PID:2464
-
\??\c:\ttbbnn.exec:\ttbbnn.exe147⤵PID:1592
-
\??\c:\hbnntb.exec:\hbnntb.exe148⤵PID:2668
-
\??\c:\jdpjp.exec:\jdpjp.exe149⤵PID:2756
-
\??\c:\9ddvd.exec:\9ddvd.exe150⤵PID:2684
-
\??\c:\lfxfrfl.exec:\lfxfrfl.exe151⤵PID:2876
-
\??\c:\rlxfrlr.exec:\rlxfrlr.exe152⤵PID:2872
-
\??\c:\lxlrxfl.exec:\lxlrxfl.exe153⤵PID:2564
-
\??\c:\1btnbb.exec:\1btnbb.exe154⤵PID:1600
-
\??\c:\htbhtb.exec:\htbhtb.exe155⤵PID:2576
-
\??\c:\pppdj.exec:\pppdj.exe156⤵PID:2544
-
\??\c:\1dppv.exec:\1dppv.exe157⤵PID:2524
-
\??\c:\9lfrrrx.exec:\9lfrrrx.exe158⤵PID:2580
-
\??\c:\rfrxllr.exec:\rfrxllr.exe159⤵PID:2392
-
\??\c:\nhnnbb.exec:\nhnnbb.exe160⤵PID:548
-
\??\c:\thbhbb.exec:\thbhbb.exe161⤵PID:2980
-
\??\c:\vjvvj.exec:\vjvvj.exe162⤵PID:2812
-
\??\c:\5jddj.exec:\5jddj.exe163⤵PID:2824
-
\??\c:\lxfflfr.exec:\lxfflfr.exe164⤵PID:2568
-
\??\c:\lfxfflr.exec:\lfxfflr.exe165⤵PID:1968
-
\??\c:\ffxfrrx.exec:\ffxfrrx.exe166⤵PID:1948
-
\??\c:\tnttnt.exec:\tnttnt.exe167⤵PID:1676
-
\??\c:\bthttn.exec:\bthttn.exe168⤵PID:836
-
\??\c:\vpjpj.exec:\vpjpj.exe169⤵PID:1996
-
\??\c:\pjddd.exec:\pjddd.exe170⤵PID:1844
-
\??\c:\3jvdj.exec:\3jvdj.exe171⤵PID:1608
-
\??\c:\xrllflr.exec:\xrllflr.exe172⤵PID:1488
-
\??\c:\xlxrxlr.exec:\xlxrxlr.exe173⤵PID:1516
-
\??\c:\thtbhb.exec:\thtbhb.exe174⤵PID:1512
-
\??\c:\9bhtbh.exec:\9bhtbh.exe175⤵PID:1224
-
\??\c:\vpvjp.exec:\vpvjp.exe176⤵PID:2232
-
\??\c:\dvpdj.exec:\dvpdj.exe177⤵PID:2512
-
\??\c:\dvpvd.exec:\dvpvd.exe178⤵PID:2388
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe179⤵PID:2012
-
\??\c:\3xffllr.exec:\3xffllr.exe180⤵PID:484
-
\??\c:\btnthn.exec:\btnthn.exe181⤵PID:2896
-
\??\c:\1bhtbh.exec:\1bhtbh.exe182⤵PID:1116
-
\??\c:\jdjjv.exec:\jdjjv.exe183⤵PID:1644
-
\??\c:\dpddp.exec:\dpddp.exe184⤵PID:1368
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe185⤵PID:1028
-
\??\c:\5lxlrrf.exec:\5lxlrrf.exe186⤵PID:608
-
\??\c:\xxrfffl.exec:\xxrfffl.exe187⤵PID:900
-
\??\c:\tnhthh.exec:\tnhthh.exe188⤵PID:768
-
\??\c:\9thbhb.exec:\9thbhb.exe189⤵PID:2072
-
\??\c:\1pjvd.exec:\1pjvd.exe190⤵PID:3016
-
\??\c:\jdppd.exec:\jdppd.exe191⤵PID:2936
-
\??\c:\lfxllrf.exec:\lfxllrf.exe192⤵PID:888
-
\??\c:\5frrfll.exec:\5frrfll.exe193⤵PID:2160
-
\??\c:\hhtbhh.exec:\hhtbhh.exe194⤵PID:3012
-
\??\c:\hbthhn.exec:\hbthhn.exe195⤵PID:3008
-
\??\c:\bthhnh.exec:\bthhnh.exe196⤵PID:2228
-
\??\c:\9pjjj.exec:\9pjjj.exe197⤵PID:2800
-
\??\c:\rlxxrxf.exec:\rlxxrxf.exe198⤵PID:2040
-
\??\c:\rxlfxrx.exec:\rxlfxrx.exe199⤵PID:2464
-
\??\c:\1bbhnn.exec:\1bbhnn.exe200⤵PID:1592
-
\??\c:\nhnthh.exec:\nhnthh.exe201⤵PID:2768
-
\??\c:\hhbnhh.exec:\hhbnhh.exe202⤵PID:2756
-
\??\c:\djdjp.exec:\djdjp.exe203⤵PID:2728
-
\??\c:\pjvvp.exec:\pjvvp.exe204⤵PID:2536
-
\??\c:\rlxflrf.exec:\rlxflrf.exe205⤵PID:2796
-
\??\c:\5llxllr.exec:\5llxllr.exe206⤵PID:2248
-
\??\c:\nhnthh.exec:\nhnthh.exe207⤵PID:2664
-
\??\c:\hbhhtn.exec:\hbhhtn.exe208⤵PID:2576
-
\??\c:\dvpjv.exec:\dvpjv.exe209⤵PID:2532
-
\??\c:\9vvvj.exec:\9vvvj.exe210⤵PID:2772
-
\??\c:\7dvjv.exec:\7dvjv.exe211⤵PID:2580
-
\??\c:\rffrxlr.exec:\rffrxlr.exe212⤵PID:2984
-
\??\c:\7lflrxl.exec:\7lflrxl.exe213⤵PID:2496
-
\??\c:\1thnhh.exec:\1thnhh.exe214⤵PID:2784
-
\??\c:\nnnthh.exec:\nnnthh.exe215⤵PID:2956
-
\??\c:\3pdvv.exec:\3pdvv.exe216⤵PID:2628
-
\??\c:\tnhnnt.exec:\tnhnnt.exe217⤵PID:1728
-
\??\c:\bbtntt.exec:\bbtntt.exe218⤵PID:1944
-
\??\c:\dvjpv.exec:\dvjpv.exe219⤵PID:1840
-
\??\c:\vpjjv.exec:\vpjjv.exe220⤵PID:1580
-
\??\c:\xrrxxfl.exec:\xrrxxfl.exe221⤵PID:2420
-
\??\c:\lxrxlfr.exec:\lxrxlfr.exe222⤵PID:1628
-
\??\c:\bbntbn.exec:\bbntbn.exe223⤵PID:1868
-
\??\c:\thbhhh.exec:\thbhhh.exe224⤵PID:1940
-
\??\c:\9btbnn.exec:\9btbnn.exe225⤵PID:2216
-
\??\c:\dvpjj.exec:\dvpjj.exe226⤵PID:2356
-
\??\c:\vddpj.exec:\vddpj.exe227⤵PID:2192
-
\??\c:\7xxxfrx.exec:\7xxxfrx.exe228⤵PID:2832
-
\??\c:\rllxlrr.exec:\rllxlrr.exe229⤵PID:2100
-
\??\c:\bnbbhn.exec:\bnbbhn.exe230⤵PID:320
-
\??\c:\bthtnn.exec:\bthtnn.exe231⤵PID:1768
-
\??\c:\7dpdj.exec:\7dpdj.exe232⤵PID:2912
-
\??\c:\dvjjv.exec:\dvjjv.exe233⤵PID:468
-
\??\c:\9fflrxf.exec:\9fflrxf.exe234⤵PID:2056
-
\??\c:\xlrrflr.exec:\xlrrflr.exe235⤵PID:824
-
\??\c:\nhttht.exec:\nhttht.exe236⤵PID:2252
-
\??\c:\nhthnt.exec:\nhthnt.exe237⤵PID:1560
-
\??\c:\nhthtb.exec:\nhthtb.exe238⤵PID:1036
-
\??\c:\vpddd.exec:\vpddd.exe239⤵PID:1028
-
\??\c:\vdppd.exec:\vdppd.exe240⤵PID:696
-
\??\c:\lxrxrrr.exec:\lxrxrrr.exe241⤵PID:1212
-
\??\c:\lfrxrlr.exec:\lfrxrlr.exe242⤵PID:1848