Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 20:14
Behavioral task
behavioral1
Sample
0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exe
-
Size
379KB
-
MD5
3b96ae3b26c6523554e3a782f7b131c0
-
SHA1
d10f320fc5f84e699d3b8f6b648278785acf5603
-
SHA256
0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e
-
SHA512
b4121c04538870034d22b6312ff006b5cf5f07cf629ffa3bfbf8875d5ca7fdc6c8369982da4902c8e62ec53e847be6a7ffa91a12cea0deb37e1c880047810101
-
SSDEEP
6144:Ocm4FmowdHoSsm4FIc1/cm4FmowdHoSsiNlcJcmHYC9/jvvfwL+TLPfSRcm4FVon:w4wFHoSl4h4wFHoS24yTgL+zfu4/FHov
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2036-8-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1736-17-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2324-37-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2664-54-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2624-64-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1908-81-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2556-90-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1404-100-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2608-109-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1660-119-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/608-137-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2372-183-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2216-193-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2068-202-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/600-213-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/576-218-0x00000000007E0000-0x0000000000852000-memory.dmp family_blackmoon behavioral1/memory/3028-231-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/996-242-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1360-262-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2448-254-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/896-274-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1544-284-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/896-282-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/3068-304-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2144-302-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2144-301-0x00000000002A0000-0x0000000000312000-memory.dmp family_blackmoon behavioral1/memory/1544-291-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/3064-313-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/3068-312-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/3064-320-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1576-327-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1752-336-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1764-335-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1752-343-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2788-344-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2788-351-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2068-195-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1696-175-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/752-164-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1580-360-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1920-147-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2740-368-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2748-379-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1224-377-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2772-386-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2748-385-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2516-395-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2772-393-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2516-401-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2580-408-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/3056-416-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2920-424-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2828-432-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2908-441-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2396-448-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1876-456-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1656-457-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1044-471-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/308-478-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2236-486-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2236-493-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2952-500-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1760-507-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1484-537-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tnnthn.exetnhnbb.exeffllffl.exe7jjjp.exe3nhnbh.exevpdjv.exe3nbhnh.exeddvvj.exehbthhh.exe5hhthh.exethbhnt.exexxlxflx.exe9jjvj.exehtbhnb.exe5pddj.exe7lfflrr.exenhbnth.exedvpdj.exerlxrfrl.exe5tnttb.exepjdjv.exe1lxflrf.exedvjpd.exebbbnth.exejjdjv.exedvjpd.exehhbhtb.exetnhntt.exebthbtb.exe5vjpd.exexxxxrxr.exeflflrxl.exe9nnbhn.exebbthnb.exejjjvj.exe9fxfrxl.exedjdpd.exe7vpdj.exehthhbb.exe9xxxlfl.exe3bnbnt.exe7jdjp.exexfxlxlx.exerlfrxxr.exe7ttbnn.exetnbhbh.exerxlxflr.exetbnnth.exerrlfrxl.exenhhhnb.exexrlxrxl.exepjvjp.exerrlrflr.exe7thntb.exedvpdd.exelfffxrl.exebbnbht.exe1lllrxl.exe9hhnbh.exeppjdp.exelfxlrfr.exeffrxlrf.exetthntb.exe1jjjd.exepid process 1736 tnnthn.exe 2112 tnhnbb.exe 2324 ffllffl.exe 2712 7jjjp.exe 2664 3nhnbh.exe 2624 vpdjv.exe 2528 3nbhnh.exe 1908 ddvvj.exe 2556 hbthhh.exe 1404 5hhthh.exe 2608 thbhnt.exe 1660 xxlxflx.exe 2240 9jjvj.exe 608 htbhnb.exe 1920 5pddj.exe 2808 7lfflrr.exe 752 nhbnth.exe 1696 dvpdj.exe 2372 rlxrfrl.exe 2216 5tnttb.exe 2068 pjdjv.exe 600 1lxflrf.exe 576 dvjpd.exe 3028 bbbnth.exe 996 jjdjv.exe 2448 dvjpd.exe 1360 hhbhtb.exe 1872 tnhntt.exe 896 bthbtb.exe 1544 5vjpd.exe 2144 xxxxrxr.exe 3068 flflrxl.exe 3064 9nnbhn.exe 1576 bbthnb.exe 1764 jjjvj.exe 1752 9fxfrxl.exe 2788 djdpd.exe 1580 7vpdj.exe 2740 hthhbb.exe 1224 9xxxlfl.exe 2748 3bnbnt.exe 2772 7jdjp.exe 2516 xfxlxlx.exe 2580 rlfrxxr.exe 3056 7ttbnn.exe 2920 tnbhbh.exe 2828 rxlxflr.exe 2908 tbnnth.exe 2396 rrlfrxl.exe 1876 nhhhnb.exe 1656 xrlxrxl.exe 1044 pjvjp.exe 308 rrlrflr.exe 1688 7thntb.exe 2236 dvpdd.exe 2952 lfffxrl.exe 1760 bbnbht.exe 1308 1lllrxl.exe 2280 9hhnbh.exe 1000 ppjdp.exe 1484 lfxlrfr.exe 2464 ffrxlrf.exe 2452 tthntb.exe 1548 1jjjd.exe -
Processes:
resource yara_rule behavioral1/memory/2036-0-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/1736-10-0x0000000000400000-0x0000000000472000-memory.dmp upx \??\c:\tnnthn.exe upx behavioral1/memory/2036-8-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\tnhnbb.exe upx behavioral1/memory/2112-19-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/1736-17-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2112-26-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\ffllffl.exe upx behavioral1/memory/2324-28-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\7jjjp.exe upx behavioral1/memory/2324-37-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\3nhnbh.exe upx C:\vpdjv.exe upx behavioral1/memory/2624-55-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2664-54-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\3nbhnh.exe upx behavioral1/memory/2624-64-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\ddvvj.exe upx C:\hbthhh.exe upx behavioral1/memory/1908-81-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2556-82-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\5hhthh.exe upx behavioral1/memory/2556-90-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2556-89-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/1404-95-0x0000000000480000-0x00000000004F2000-memory.dmp upx C:\thbhnt.exe upx behavioral1/memory/1404-100-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\xxlxflx.exe upx behavioral1/memory/2608-109-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/1660-111-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2240-121-0x0000000000400000-0x0000000000472000-memory.dmp upx \??\c:\9jjvj.exe upx behavioral1/memory/1660-119-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\htbhnb.exe upx behavioral1/memory/1920-139-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\5pddj.exe upx behavioral1/memory/608-137-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\dvpdj.exe upx \??\c:\rlxrfrl.exe upx behavioral1/memory/2216-185-0x0000000000400000-0x0000000000472000-memory.dmp upx \??\c:\5tnttb.exe upx behavioral1/memory/2372-183-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\pjdjv.exe upx behavioral1/memory/600-204-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\1lxflrf.exe upx behavioral1/memory/2068-202-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\dvjpd.exe upx behavioral1/memory/600-213-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/576-214-0x0000000000400000-0x0000000000472000-memory.dmp upx \??\c:\bbbnth.exe upx behavioral1/memory/576-218-0x00000000007E0000-0x0000000000852000-memory.dmp upx behavioral1/memory/996-233-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\jjdjv.exe upx behavioral1/memory/3028-231-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/996-242-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\dvjpd.exe upx \??\c:\hhbhtb.exe upx behavioral1/memory/1872-264-0x0000000000400000-0x0000000000472000-memory.dmp upx C:\tnhntt.exe upx behavioral1/memory/1360-262-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2448-254-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2448-252-0x0000000000220000-0x0000000000292000-memory.dmp upx behavioral1/memory/896-274-0x0000000000400000-0x0000000000472000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exetnnthn.exetnhnbb.exeffllffl.exe7jjjp.exe3nhnbh.exevpdjv.exe3nbhnh.exeddvvj.exehbthhh.exe5hhthh.exethbhnt.exexxlxflx.exe9jjvj.exehtbhnb.exe5pddj.exedescription pid process target process PID 2036 wrote to memory of 1736 2036 0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exe tnnthn.exe PID 2036 wrote to memory of 1736 2036 0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exe tnnthn.exe PID 2036 wrote to memory of 1736 2036 0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exe tnnthn.exe PID 2036 wrote to memory of 1736 2036 0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exe tnnthn.exe PID 1736 wrote to memory of 2112 1736 tnnthn.exe tnhnbb.exe PID 1736 wrote to memory of 2112 1736 tnnthn.exe tnhnbb.exe PID 1736 wrote to memory of 2112 1736 tnnthn.exe tnhnbb.exe PID 1736 wrote to memory of 2112 1736 tnnthn.exe tnhnbb.exe PID 2112 wrote to memory of 2324 2112 tnhnbb.exe ffllffl.exe PID 2112 wrote to memory of 2324 2112 tnhnbb.exe ffllffl.exe PID 2112 wrote to memory of 2324 2112 tnhnbb.exe ffllffl.exe PID 2112 wrote to memory of 2324 2112 tnhnbb.exe ffllffl.exe PID 2324 wrote to memory of 2712 2324 ffllffl.exe 7jjjp.exe PID 2324 wrote to memory of 2712 2324 ffllffl.exe 7jjjp.exe PID 2324 wrote to memory of 2712 2324 ffllffl.exe 7jjjp.exe PID 2324 wrote to memory of 2712 2324 ffllffl.exe 7jjjp.exe PID 2712 wrote to memory of 2664 2712 7jjjp.exe 3nhnbh.exe PID 2712 wrote to memory of 2664 2712 7jjjp.exe 3nhnbh.exe PID 2712 wrote to memory of 2664 2712 7jjjp.exe 3nhnbh.exe PID 2712 wrote to memory of 2664 2712 7jjjp.exe 3nhnbh.exe PID 2664 wrote to memory of 2624 2664 3nhnbh.exe vpdjv.exe PID 2664 wrote to memory of 2624 2664 3nhnbh.exe vpdjv.exe PID 2664 wrote to memory of 2624 2664 3nhnbh.exe vpdjv.exe PID 2664 wrote to memory of 2624 2664 3nhnbh.exe vpdjv.exe PID 2624 wrote to memory of 2528 2624 vpdjv.exe 3nbhnh.exe PID 2624 wrote to memory of 2528 2624 vpdjv.exe 3nbhnh.exe PID 2624 wrote to memory of 2528 2624 vpdjv.exe 3nbhnh.exe PID 2624 wrote to memory of 2528 2624 vpdjv.exe 3nbhnh.exe PID 2528 wrote to memory of 1908 2528 3nbhnh.exe ddvvj.exe PID 2528 wrote to memory of 1908 2528 3nbhnh.exe ddvvj.exe PID 2528 wrote to memory of 1908 2528 3nbhnh.exe ddvvj.exe PID 2528 wrote to memory of 1908 2528 3nbhnh.exe ddvvj.exe PID 1908 wrote to memory of 2556 1908 ddvvj.exe hbthhh.exe PID 1908 wrote to memory of 2556 1908 ddvvj.exe hbthhh.exe PID 1908 wrote to memory of 2556 1908 ddvvj.exe hbthhh.exe PID 1908 wrote to memory of 2556 1908 ddvvj.exe hbthhh.exe PID 2556 wrote to memory of 1404 2556 hbthhh.exe 5hhthh.exe PID 2556 wrote to memory of 1404 2556 hbthhh.exe 5hhthh.exe PID 2556 wrote to memory of 1404 2556 hbthhh.exe 5hhthh.exe PID 2556 wrote to memory of 1404 2556 hbthhh.exe 5hhthh.exe PID 1404 wrote to memory of 2608 1404 5hhthh.exe thbhnt.exe PID 1404 wrote to memory of 2608 1404 5hhthh.exe thbhnt.exe PID 1404 wrote to memory of 2608 1404 5hhthh.exe thbhnt.exe PID 1404 wrote to memory of 2608 1404 5hhthh.exe thbhnt.exe PID 2608 wrote to memory of 1660 2608 thbhnt.exe xxlxflx.exe PID 2608 wrote to memory of 1660 2608 thbhnt.exe xxlxflx.exe PID 2608 wrote to memory of 1660 2608 thbhnt.exe xxlxflx.exe PID 2608 wrote to memory of 1660 2608 thbhnt.exe xxlxflx.exe PID 1660 wrote to memory of 2240 1660 xxlxflx.exe 9jjvj.exe PID 1660 wrote to memory of 2240 1660 xxlxflx.exe 9jjvj.exe PID 1660 wrote to memory of 2240 1660 xxlxflx.exe 9jjvj.exe PID 1660 wrote to memory of 2240 1660 xxlxflx.exe 9jjvj.exe PID 2240 wrote to memory of 608 2240 9jjvj.exe htbhnb.exe PID 2240 wrote to memory of 608 2240 9jjvj.exe htbhnb.exe PID 2240 wrote to memory of 608 2240 9jjvj.exe htbhnb.exe PID 2240 wrote to memory of 608 2240 9jjvj.exe htbhnb.exe PID 608 wrote to memory of 1920 608 htbhnb.exe 5pddj.exe PID 608 wrote to memory of 1920 608 htbhnb.exe 5pddj.exe PID 608 wrote to memory of 1920 608 htbhnb.exe 5pddj.exe PID 608 wrote to memory of 1920 608 htbhnb.exe 5pddj.exe PID 1920 wrote to memory of 2808 1920 5pddj.exe 7lfflrr.exe PID 1920 wrote to memory of 2808 1920 5pddj.exe 7lfflrr.exe PID 1920 wrote to memory of 2808 1920 5pddj.exe 7lfflrr.exe PID 1920 wrote to memory of 2808 1920 5pddj.exe 7lfflrr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exe"C:\Users\Admin\AppData\Local\Temp\0197ebef6c4c5354990e6726120d82a554488a3f75ad065e2affaf907c860e0e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\tnnthn.exec:\tnnthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\tnhnbb.exec:\tnhnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\ffllffl.exec:\ffllffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\7jjjp.exec:\7jjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\3nhnbh.exec:\3nhnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\vpdjv.exec:\vpdjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\3nbhnh.exec:\3nbhnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\ddvvj.exec:\ddvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\hbthhh.exec:\hbthhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\5hhthh.exec:\5hhthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\thbhnt.exec:\thbhnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\xxlxflx.exec:\xxlxflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\9jjvj.exec:\9jjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\htbhnb.exec:\htbhnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\5pddj.exec:\5pddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\7lfflrr.exec:\7lfflrr.exe17⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nhbnth.exec:\nhbnth.exe18⤵
- Executes dropped EXE
PID:752 -
\??\c:\dvpdj.exec:\dvpdj.exe19⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rlxrfrl.exec:\rlxrfrl.exe20⤵
- Executes dropped EXE
PID:2372 -
\??\c:\5tnttb.exec:\5tnttb.exe21⤵
- Executes dropped EXE
PID:2216 -
\??\c:\pjdjv.exec:\pjdjv.exe22⤵
- Executes dropped EXE
PID:2068 -
\??\c:\1lxflrf.exec:\1lxflrf.exe23⤵
- Executes dropped EXE
PID:600 -
\??\c:\dvjpd.exec:\dvjpd.exe24⤵
- Executes dropped EXE
PID:576 -
\??\c:\bbbnth.exec:\bbbnth.exe25⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jjdjv.exec:\jjdjv.exe26⤵
- Executes dropped EXE
PID:996 -
\??\c:\dvjpd.exec:\dvjpd.exe27⤵
- Executes dropped EXE
PID:2448 -
\??\c:\hhbhtb.exec:\hhbhtb.exe28⤵
- Executes dropped EXE
PID:1360 -
\??\c:\tnhntt.exec:\tnhntt.exe29⤵
- Executes dropped EXE
PID:1872 -
\??\c:\bthbtb.exec:\bthbtb.exe30⤵
- Executes dropped EXE
PID:896 -
\??\c:\5vjpd.exec:\5vjpd.exe31⤵
- Executes dropped EXE
PID:1544 -
\??\c:\xxxxrxr.exec:\xxxxrxr.exe32⤵
- Executes dropped EXE
PID:2144 -
\??\c:\flflrxl.exec:\flflrxl.exe33⤵
- Executes dropped EXE
PID:3068 -
\??\c:\9nnbhn.exec:\9nnbhn.exe34⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bbthnb.exec:\bbthnb.exe35⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jjjvj.exec:\jjjvj.exe36⤵
- Executes dropped EXE
PID:1764 -
\??\c:\9fxfrxl.exec:\9fxfrxl.exe37⤵
- Executes dropped EXE
PID:1752 -
\??\c:\djdpd.exec:\djdpd.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\7vpdj.exec:\7vpdj.exe39⤵
- Executes dropped EXE
PID:1580 -
\??\c:\hthhbb.exec:\hthhbb.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\9xxxlfl.exec:\9xxxlfl.exe41⤵
- Executes dropped EXE
PID:1224 -
\??\c:\3bnbnt.exec:\3bnbnt.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7jdjp.exec:\7jdjp.exe43⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xfxlxlx.exec:\xfxlxlx.exe44⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rlfrxxr.exec:\rlfrxxr.exe45⤵
- Executes dropped EXE
PID:2580 -
\??\c:\7ttbnn.exec:\7ttbnn.exe46⤵
- Executes dropped EXE
PID:3056 -
\??\c:\tnbhbh.exec:\tnbhbh.exe47⤵
- Executes dropped EXE
PID:2920 -
\??\c:\rxlxflr.exec:\rxlxflr.exe48⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tbnnth.exec:\tbnnth.exe49⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rrlfrxl.exec:\rrlfrxl.exe50⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nhhhnb.exec:\nhhhnb.exe51⤵
- Executes dropped EXE
PID:1876 -
\??\c:\xrlxrxl.exec:\xrlxrxl.exe52⤵
- Executes dropped EXE
PID:1656 -
\??\c:\pjvjp.exec:\pjvjp.exe53⤵
- Executes dropped EXE
PID:1044 -
\??\c:\rrlrflr.exec:\rrlrflr.exe54⤵
- Executes dropped EXE
PID:308 -
\??\c:\7thntb.exec:\7thntb.exe55⤵
- Executes dropped EXE
PID:1688 -
\??\c:\dvpdd.exec:\dvpdd.exe56⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lfffxrl.exec:\lfffxrl.exe57⤵
- Executes dropped EXE
PID:2952 -
\??\c:\bbnbht.exec:\bbnbht.exe58⤵
- Executes dropped EXE
PID:1760 -
\??\c:\1lllrxl.exec:\1lllrxl.exe59⤵
- Executes dropped EXE
PID:1308 -
\??\c:\9hhnbh.exec:\9hhnbh.exe60⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ppjdp.exec:\ppjdp.exe61⤵
- Executes dropped EXE
PID:1000 -
\??\c:\lfxlrfr.exec:\lfxlrfr.exe62⤵
- Executes dropped EXE
PID:1484 -
\??\c:\ffrxlrf.exec:\ffrxlrf.exe63⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tthntb.exec:\tthntb.exe64⤵
- Executes dropped EXE
PID:2452 -
\??\c:\1jjjd.exec:\1jjjd.exe65⤵
- Executes dropped EXE
PID:1548 -
\??\c:\fxrlllx.exec:\fxrlllx.exe66⤵PID:2268
-
\??\c:\1bbthn.exec:\1bbthn.exe67⤵PID:1360
-
\??\c:\nhbhbh.exec:\nhbhbh.exe68⤵PID:1864
-
\??\c:\jjdvj.exec:\jjdvj.exe69⤵PID:1032
-
\??\c:\ffflxxl.exec:\ffflxxl.exe70⤵PID:2436
-
\??\c:\llfrflx.exec:\llfrflx.exe71⤵PID:2320
-
\??\c:\1htntn.exec:\1htntn.exe72⤵PID:2456
-
\??\c:\9jjpj.exec:\9jjpj.exe73⤵PID:2128
-
\??\c:\dvpdd.exec:\dvpdd.exe74⤵PID:880
-
\??\c:\flxrfrl.exec:\flxrfrl.exe75⤵PID:552
-
\??\c:\7bhtbb.exec:\7bhtbb.exe76⤵PID:2928
-
\??\c:\nnnhhb.exec:\nnnhhb.exe77⤵PID:2616
-
\??\c:\jvddj.exec:\jvddj.exe78⤵PID:2100
-
\??\c:\fxlrlfx.exec:\fxlrlfx.exe79⤵PID:2336
-
\??\c:\nhbhbb.exec:\nhbhbb.exe80⤵PID:2728
-
\??\c:\3pvjv.exec:\3pvjv.exe81⤵PID:1580
-
\??\c:\3rrllrf.exec:\3rrllrf.exe82⤵PID:2712
-
\??\c:\fxxlxfx.exec:\fxxlxfx.exe83⤵PID:2080
-
\??\c:\5bntbh.exec:\5bntbh.exe84⤵PID:2764
-
\??\c:\dvpvj.exec:\dvpvj.exe85⤵PID:2672
-
\??\c:\xrrrffr.exec:\xrrrffr.exe86⤵PID:2500
-
\??\c:\tnnhth.exec:\tnnhth.exe87⤵PID:2520
-
\??\c:\nhthnb.exec:\nhthnb.exe88⤵PID:2584
-
\??\c:\5dpvj.exec:\5dpvj.exe89⤵PID:2044
-
\??\c:\xrffllr.exec:\xrffllr.exe90⤵PID:2844
-
\??\c:\tnhnbh.exec:\tnhnbh.exe91⤵PID:2832
-
\??\c:\nhtthn.exec:\nhtthn.exe92⤵PID:2608
-
\??\c:\ppjdp.exec:\ppjdp.exe93⤵PID:1660
-
\??\c:\rfxxffl.exec:\rfxxffl.exe94⤵PID:2240
-
\??\c:\lfxrflx.exec:\lfxrflx.exe95⤵PID:1796
-
\??\c:\3bnntb.exec:\3bnntb.exe96⤵PID:1868
-
\??\c:\dvpdj.exec:\dvpdj.exe97⤵PID:3000
-
\??\c:\lfrrffx.exec:\lfrrffx.exe98⤵PID:2808
-
\??\c:\1fxfrrf.exec:\1fxfrrf.exe99⤵PID:1120
-
\??\c:\tnbhbh.exec:\tnbhbh.exe100⤵PID:1448
-
\??\c:\3ddpj.exec:\3ddpj.exe101⤵PID:1688
-
\??\c:\vdpvd.exec:\vdpvd.exe102⤵PID:1728
-
\??\c:\lxffllx.exec:\lxffllx.exe103⤵PID:468
-
\??\c:\bthtbb.exec:\bthtbb.exe104⤵PID:884
-
\??\c:\dvppd.exec:\dvppd.exe105⤵PID:2488
-
\??\c:\jjdpd.exec:\jjdpd.exe106⤵PID:1108
-
\??\c:\frlrffx.exec:\frlrffx.exe107⤵PID:1780
-
\??\c:\tntbnn.exec:\tntbnn.exe108⤵PID:1000
-
\??\c:\9tnttb.exec:\9tnttb.exe109⤵PID:1084
-
\??\c:\jddpv.exec:\jddpv.exe110⤵PID:1860
-
\??\c:\9vpdp.exec:\9vpdp.exe111⤵PID:1792
-
\??\c:\fxrxllr.exec:\fxrxllr.exe112⤵PID:2180
-
\??\c:\9btbnn.exec:\9btbnn.exe113⤵PID:1548
-
\??\c:\hthhtt.exec:\hthhtt.exe114⤵PID:2220
-
\??\c:\jpvdj.exec:\jpvdj.exe115⤵PID:648
-
\??\c:\xxxfxxr.exec:\xxxfxxr.exe116⤵PID:1928
-
\??\c:\nnbhbh.exec:\nnbhbh.exe117⤵PID:1032
-
\??\c:\bhbnbb.exec:\bhbnbb.exe118⤵PID:780
-
\??\c:\pdjpp.exec:\pdjpp.exe119⤵PID:2288
-
\??\c:\llfxllx.exec:\llfxllx.exe120⤵PID:1512
-
\??\c:\9lfrlfl.exec:\9lfrlfl.exe121⤵PID:2164
-
\??\c:\tbtthh.exec:\tbtthh.exe122⤵PID:2992
-
\??\c:\jppvv.exec:\jppvv.exe123⤵PID:1744
-
\??\c:\ddvjj.exec:\ddvjj.exe124⤵PID:2376
-
\??\c:\ffxrflx.exec:\ffxrflx.exe125⤵PID:2248
-
\??\c:\btthtb.exec:\btthtb.exe126⤵PID:2928
-
\??\c:\pjvpv.exec:\pjvpv.exe127⤵PID:1808
-
\??\c:\pdppv.exec:\pdppv.exe128⤵PID:1712
-
\??\c:\xxxfrrl.exec:\xxxfrrl.exe129⤵PID:2956
-
\??\c:\nhbhbn.exec:\nhbhbn.exe130⤵PID:2732
-
\??\c:\dvjvd.exec:\dvjvd.exe131⤵PID:2940
-
\??\c:\pdjdv.exec:\pdjdv.exe132⤵PID:2664
-
\??\c:\lflxxxx.exec:\lflxxxx.exe133⤵PID:2416
-
\??\c:\tnhntb.exec:\tnhntb.exe134⤵PID:2624
-
\??\c:\ddvjv.exec:\ddvjv.exe135⤵PID:2668
-
\??\c:\9lllrrl.exec:\9lllrrl.exe136⤵PID:2536
-
\??\c:\5xrxffl.exec:\5xrxffl.exe137⤵PID:2500
-
\??\c:\bhttbt.exec:\bhttbt.exe138⤵PID:2096
-
\??\c:\vvpdd.exec:\vvpdd.exe139⤵PID:3056
-
\??\c:\vvpdj.exec:\vvpdj.exe140⤵PID:1404
-
\??\c:\rrrxlrl.exec:\rrrxlrl.exe141⤵PID:2868
-
\??\c:\nbnhnb.exec:\nbnhnb.exe142⤵PID:2576
-
\??\c:\3pjvd.exec:\3pjvd.exe143⤵PID:1068
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe144⤵PID:1064
-
\??\c:\xfxxlrf.exec:\xfxxlrf.exe145⤵PID:2168
-
\??\c:\ttnthn.exec:\ttnthn.exe146⤵PID:1340
-
\??\c:\jdvdj.exec:\jdvdj.exe147⤵PID:1656
-
\??\c:\vppvj.exec:\vppvj.exe148⤵PID:1044
-
\??\c:\fllxlrl.exec:\fllxlrl.exe149⤵PID:544
-
\??\c:\hhbbhh.exec:\hhbbhh.exe150⤵PID:2156
-
\??\c:\5bhnbn.exec:\5bhnbn.exe151⤵PID:1636
-
\??\c:\dvvjv.exec:\dvvjv.exe152⤵PID:2216
-
\??\c:\ddvvd.exec:\ddvvd.exe153⤵PID:1728
-
\??\c:\rlfxllr.exec:\rlfxllr.exe154⤵PID:1992
-
\??\c:\btnbnn.exec:\btnbnn.exe155⤵PID:944
-
\??\c:\3jpdj.exec:\3jpdj.exe156⤵PID:1644
-
\??\c:\dpjvv.exec:\dpjvv.exe157⤵PID:628
-
\??\c:\rlflxxr.exec:\rlflxxr.exe158⤵PID:1132
-
\??\c:\tbhbbh.exec:\tbhbbh.exe159⤵PID:2484
-
\??\c:\5bnthh.exec:\5bnthh.exe160⤵PID:1964
-
\??\c:\5dpvd.exec:\5dpvd.exe161⤵PID:768
-
\??\c:\xlxllll.exec:\xlxllll.exe162⤵PID:1976
-
\??\c:\xxrllxx.exec:\xxrllxx.exe163⤵PID:1276
-
\??\c:\tnbbtb.exec:\tnbbtb.exe164⤵PID:1152
-
\??\c:\pvpvp.exec:\pvpvp.exe165⤵PID:1648
-
\??\c:\1ffffll.exec:\1ffffll.exe166⤵PID:2472
-
\??\c:\lllrxfr.exec:\lllrxfr.exe167⤵PID:1932
-
\??\c:\bbtthn.exec:\bbtthn.exe168⤵PID:1032
-
\??\c:\1pjpd.exec:\1pjpd.exe169⤵PID:780
-
\??\c:\ddvvj.exec:\ddvvj.exe170⤵PID:1352
-
\??\c:\rfxrrxx.exec:\rfxrrxx.exe171⤵PID:2072
-
\??\c:\btntbh.exec:\btntbh.exe172⤵PID:872
-
\??\c:\9dpvd.exec:\9dpvd.exe173⤵PID:2108
-
\??\c:\xxrxfrf.exec:\xxrxfrf.exe174⤵PID:1744
-
\??\c:\9xxfxff.exec:\9xxfxff.exe175⤵PID:1608
-
\??\c:\5nntbh.exec:\5nntbh.exe176⤵PID:1604
-
\??\c:\5tntbh.exec:\5tntbh.exe177⤵PID:2016
-
\??\c:\1dvdj.exec:\1dvdj.exe178⤵PID:2656
-
\??\c:\1xxxlrx.exec:\1xxxlrx.exe179⤵PID:2728
-
\??\c:\3xrrffl.exec:\3xrrffl.exe180⤵PID:1580
-
\??\c:\nbbbhh.exec:\nbbbhh.exe181⤵PID:2652
-
\??\c:\3pvjd.exec:\3pvjd.exe182⤵PID:1664
-
\??\c:\dpppv.exec:\dpppv.exe183⤵PID:3012
-
\??\c:\rffxlfl.exec:\rffxlfl.exe184⤵PID:2528
-
\??\c:\hbthth.exec:\hbthth.exe185⤵PID:2508
-
\??\c:\jddpd.exec:\jddpd.exe186⤵PID:2668
-
\??\c:\pdvdd.exec:\pdvdd.exe187⤵PID:1908
-
\??\c:\9rllfrf.exec:\9rllfrf.exe188⤵PID:2208
-
\??\c:\tnbbht.exec:\tnbbht.exe189⤵PID:3036
-
\??\c:\bbbhtb.exec:\bbbhtb.exe190⤵PID:2876
-
\??\c:\3jvjp.exec:\3jvjp.exe191⤵PID:304
-
\??\c:\7jjpj.exec:\7jjpj.exe192⤵PID:2868
-
\??\c:\fffrrxl.exec:\fffrrxl.exe193⤵PID:2244
-
\??\c:\tnnntt.exec:\tnnntt.exe194⤵PID:1068
-
\??\c:\hbnbhn.exec:\hbnbhn.exe195⤵PID:1876
-
\??\c:\pppdj.exec:\pppdj.exe196⤵PID:1868
-
\??\c:\xxrrffl.exec:\xxrrffl.exe197⤵PID:816
-
\??\c:\xfxfxfl.exec:\xfxfxfl.exe198⤵PID:1756
-
\??\c:\thtbnt.exec:\thtbnt.exe199⤵PID:1652
-
\??\c:\3vdpv.exec:\3vdpv.exe200⤵PID:2076
-
\??\c:\jppdp.exec:\jppdp.exe201⤵PID:1492
-
\??\c:\xxrfxfx.exec:\xxrfxfx.exe202⤵PID:316
-
\??\c:\bbhtnt.exec:\bbhtnt.exe203⤵PID:2216
-
\??\c:\ppjjv.exec:\ppjjv.exe204⤵PID:832
-
\??\c:\fxxrrfr.exec:\fxxrrfr.exe205⤵PID:1732
-
\??\c:\3xxfrfx.exec:\3xxfrfx.exe206⤵PID:2212
-
\??\c:\5hhntt.exec:\5hhntt.exe207⤵PID:3028
-
\??\c:\jdvdd.exec:\jdvdd.exe208⤵PID:1000
-
\??\c:\jdvjv.exec:\jdvjv.exe209⤵PID:1988
-
\??\c:\rlfrxxl.exec:\rlfrxxl.exe210⤵PID:840
-
\??\c:\btntbh.exec:\btntbh.exe211⤵PID:1800
-
\??\c:\3ttnhb.exec:\3ttnhb.exe212⤵PID:112
-
\??\c:\7jddj.exec:\7jddj.exe213⤵PID:1680
-
\??\c:\vpdjd.exec:\vpdjd.exe214⤵PID:1872
-
\??\c:\lflrffr.exec:\lflrffr.exe215⤵PID:2980
-
\??\c:\btnttt.exec:\btnttt.exe216⤵PID:1620
-
\??\c:\1bhnbh.exec:\1bhnbh.exe217⤵PID:2436
-
\??\c:\5pjjv.exec:\5pjjv.exe218⤵PID:376
-
\??\c:\5xrxlrf.exec:\5xrxlrf.exe219⤵PID:1944
-
\??\c:\lfxfrxf.exec:\lfxfrxf.exe220⤵PID:1504
-
\??\c:\5nhtbh.exec:\5nhtbh.exe221⤵PID:2332
-
\??\c:\5dpjp.exec:\5dpjp.exe222⤵PID:2992
-
\??\c:\rlfrfxf.exec:\rlfrfxf.exe223⤵PID:2152
-
\??\c:\lxfxlxl.exec:\lxfxlxl.exe224⤵PID:2376
-
\??\c:\hbbtbn.exec:\hbbtbn.exe225⤵PID:2248
-
\??\c:\hbbhnn.exec:\hbbhnn.exe226⤵PID:2028
-
\??\c:\vvpdp.exec:\vvpdp.exe227⤵PID:1808
-
\??\c:\rrrllff.exec:\rrrllff.exe228⤵PID:2788
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe229⤵PID:2956
-
\??\c:\3htbhh.exec:\3htbhh.exe230⤵PID:2744
-
\??\c:\ddvjj.exec:\ddvjj.exe231⤵PID:2940
-
\??\c:\vvpjd.exec:\vvpjd.exe232⤵PID:824
-
\??\c:\xxlfxlx.exec:\xxlfxlx.exe233⤵PID:2008
-
\??\c:\rlflrxl.exec:\rlflrxl.exe234⤵PID:2764
-
\??\c:\btnnbh.exec:\btnnbh.exe235⤵PID:2528
-
\??\c:\jdpvj.exec:\jdpvj.exe236⤵PID:2568
-
\??\c:\ppjvj.exec:\ppjvj.exe237⤵PID:2500
-
\??\c:\ffffrxl.exec:\ffffrxl.exe238⤵PID:3040
-
\??\c:\3fffrxl.exec:\3fffrxl.exe239⤵PID:3056
-
\??\c:\btbtnh.exec:\btbtnh.exe240⤵PID:1668
-
\??\c:\dvpvv.exec:\dvpvv.exe241⤵PID:1532
-
\??\c:\vvpvd.exec:\vvpvd.exe242⤵PID:1676