Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 05:00
Behavioral task
behavioral1
Sample
df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exe
-
Size
80KB
-
MD5
e64dd6430ef406da889a8c246c7f6046
-
SHA1
44a6a5c00a67ec44df455cb5fb091d2c9e1abde1
-
SHA256
df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c
-
SHA512
00494ac3bc0f327391e5269c05087b407fa4f03201283053dc8e4d01a495fcaa701b81ad76135995fa062a95fc887dcc7bbd915b78ef8d2de5bc327b98f74bef
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6T7Qr:zhOmTsF93UYfwC6GIoutiTU2HVS63Qr
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/2328-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1208-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-126-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2384-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/944-143-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2076-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1516-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1784-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1404-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/564-527-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-610-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-740-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-1215-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1980-6796-0x0000000077420000-0x000000007753F000-memory.dmp family_blackmoon behavioral1/memory/1980-26349-0x0000000077320000-0x000000007741A000-memory.dmp family_blackmoon behavioral1/memory/1980-26348-0x0000000077420000-0x000000007753F000-memory.dmp family_blackmoon behavioral1/memory/1980-31519-0x0000000077420000-0x000000007753F000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2328-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bbtnbh.exe UPX behavioral1/memory/2276-10-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2328-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2276-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pdppv.exe UPX behavioral1/memory/2836-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2836-23-0x0000000000220000-0x0000000000247000-memory.dmp UPX C:\1xxrllr.exe UPX behavioral1/memory/2916-34-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hthtbt.exe UPX behavioral1/memory/2116-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5httbh.exe UPX behavioral1/memory/2648-52-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9pvdj.exe UPX behavioral1/memory/2668-54-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lflfxrr.exe UPX C:\llfxlxl.exe UPX C:\tththn.exe UPX behavioral1/memory/2444-77-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2468-79-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vpdpj.exe UPX behavioral1/memory/2488-87-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vjjdd.exe UPX behavioral1/memory/2376-94-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9rxffll.exe UPX behavioral1/memory/2376-102-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9thtnn.exe UPX behavioral1/memory/1208-112-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2436-110-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3hnbtn.exe UPX C:\pjpdd.exe UPX C:\jvdvv.exe UPX behavioral1/memory/2384-133-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/944-135-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rrrxxxr.exe UPX C:\hnhbht.exe UPX C:\bthtbn.exe UPX C:\ddpvp.exe UPX behavioral1/memory/1080-167-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5xrxxxl.exe UPX behavioral1/memory/2152-175-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\fxrfrlr.exe UPX behavioral1/memory/2076-184-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\hbbbtb.exe UPX C:\jjdjj.exe UPX behavioral1/memory/2084-199-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lxfffff.exe UPX behavioral1/memory/1516-208-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xrfrxxl.exe UPX behavioral1/memory/2416-216-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2416-223-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nhnnnt.exe UPX C:\dppjp.exe UPX behavioral1/memory/2604-231-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1784-233-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\frllllr.exe UPX behavioral1/memory/1784-240-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1404-248-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hnbntb.exe UPX C:\nbnhhb.exe UPX behavioral1/memory/2228-263-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7ppvv.exe UPX behavioral1/memory/2012-265-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
bbtnbh.exepdppv.exe1xxrllr.exehthtbt.exe5httbh.exe9pvdj.exelflfxrr.exellfxlxl.exetththn.exevpdpj.exevjjdd.exe9rxffll.exe9thtnn.exe3hnbtn.exepjpdd.exejvdvv.exerrrxxxr.exehnhbht.exebthtbn.exeddpvp.exe5xrxxxl.exefxrfrlr.exehbbbtb.exevpdpj.exejjdjj.exelxfffff.exexrfrxxl.exenhnnnt.exedppjp.exefrllllr.exehnbntb.exenbnhhb.exe7ppvv.exefrxfffr.exexxlxrxf.exehbhbhh.exenhttbb.exejpdpd.exevjjjp.exe9rrfflr.exerlfflrx.exetnbbhn.exennthht.exe7pddj.exerrflrxf.exelllfrxl.exennbbht.exehhbnbb.exevpjjj.exe1djjv.exerxrxlxr.exellrxfrx.exenttbhn.exetnthtb.exepjjpv.exeffrllfl.exelrlfxfx.exennhhnt.exebbntnt.exejjjvd.exe5dvjp.exefxxflrl.exe3hbhbh.exebthnbh.exepid process 2276 bbtnbh.exe 2836 pdppv.exe 2916 1xxrllr.exe 2116 hthtbt.exe 2648 5httbh.exe 2668 9pvdj.exe 2696 lflfxrr.exe 2444 llfxlxl.exe 2468 tththn.exe 2488 vpdpj.exe 2376 vjjdd.exe 2436 9rxffll.exe 1208 9thtnn.exe 2004 3hnbtn.exe 2384 pjpdd.exe 944 jvdvv.exe 1456 rrrxxxr.exe 2712 hnhbht.exe 1296 bthtbn.exe 1080 ddpvp.exe 2152 5xrxxxl.exe 2076 fxrfrlr.exe 2360 hbbbtb.exe 2084 vpdpj.exe 536 jjdjj.exe 1516 lxfffff.exe 2416 xrfrxxl.exe 2604 nhnnnt.exe 1784 dppjp.exe 1404 frllllr.exe 604 hnbntb.exe 2228 nbnhhb.exe 2012 7ppvv.exe 2924 frxfffr.exe 1136 xxlxrxf.exe 2272 hbhbhh.exe 2992 nhttbb.exe 1740 jpdpd.exe 2276 vjjjp.exe 1696 9rrfflr.exe 2900 rlfflrx.exe 2836 tnbbhn.exe 1812 nnthht.exe 1688 7pddj.exe 2800 rrflrxf.exe 2648 lllfrxl.exe 2576 nnbbht.exe 2548 hhbnbb.exe 2524 vpjjj.exe 2672 1djjv.exe 2408 rxrxlxr.exe 2644 llrxfrx.exe 2452 nttbhn.exe 2488 tnthtb.exe 2868 pjjpv.exe 2512 ffrllfl.exe 1208 lrlfxfx.exe 1572 nnhhnt.exe 2760 bbntnt.exe 1684 jjjvd.exe 932 5dvjp.exe 1776 fxxflrl.exe 1508 3hbhbh.exe 2712 bthnbh.exe -
Processes:
resource yara_rule behavioral1/memory/2328-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbtnbh.exe upx behavioral1/memory/2276-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2328-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2276-17-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pdppv.exe upx behavioral1/memory/2836-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-23-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\1xxrllr.exe upx behavioral1/memory/2916-34-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hthtbt.exe upx behavioral1/memory/2116-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2116-43-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\5httbh.exe upx behavioral1/memory/2648-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9pvdj.exe upx behavioral1/memory/2668-54-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lflfxrr.exe upx C:\llfxlxl.exe upx C:\tththn.exe upx behavioral1/memory/2444-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2468-79-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpdpj.exe upx behavioral1/memory/2488-87-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjjdd.exe upx behavioral1/memory/2376-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9rxffll.exe upx behavioral1/memory/2376-102-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9thtnn.exe upx behavioral1/memory/1208-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2436-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3hnbtn.exe upx C:\pjpdd.exe upx C:\jvdvv.exe upx behavioral1/memory/2384-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/944-135-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrrxxxr.exe upx C:\hnhbht.exe upx C:\bthtbn.exe upx behavioral1/memory/2712-158-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\ddpvp.exe upx behavioral1/memory/1080-167-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5xrxxxl.exe upx behavioral1/memory/2152-175-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxrfrlr.exe upx behavioral1/memory/2076-184-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hbbbtb.exe upx C:\jjdjj.exe upx behavioral1/memory/2084-199-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxfffff.exe upx behavioral1/memory/1516-208-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrfrxxl.exe upx behavioral1/memory/2416-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2416-223-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhnnnt.exe upx C:\dppjp.exe upx behavioral1/memory/2604-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1784-233-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frllllr.exe upx behavioral1/memory/1784-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1404-248-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnbntb.exe upx C:\nbnhhb.exe upx behavioral1/memory/2228-263-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exebbtnbh.exepdppv.exe1xxrllr.exehthtbt.exe5httbh.exe9pvdj.exelflfxrr.exellfxlxl.exetththn.exevpdpj.exevjjdd.exe9rxffll.exe9thtnn.exe3hnbtn.exepjpdd.exedescription pid process target process PID 2328 wrote to memory of 2276 2328 df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exe bbtnbh.exe PID 2328 wrote to memory of 2276 2328 df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exe bbtnbh.exe PID 2328 wrote to memory of 2276 2328 df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exe bbtnbh.exe PID 2328 wrote to memory of 2276 2328 df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exe bbtnbh.exe PID 2276 wrote to memory of 2836 2276 bbtnbh.exe pdppv.exe PID 2276 wrote to memory of 2836 2276 bbtnbh.exe pdppv.exe PID 2276 wrote to memory of 2836 2276 bbtnbh.exe pdppv.exe PID 2276 wrote to memory of 2836 2276 bbtnbh.exe pdppv.exe PID 2836 wrote to memory of 2916 2836 pdppv.exe 1xxrllr.exe PID 2836 wrote to memory of 2916 2836 pdppv.exe 1xxrllr.exe PID 2836 wrote to memory of 2916 2836 pdppv.exe 1xxrllr.exe PID 2836 wrote to memory of 2916 2836 pdppv.exe 1xxrllr.exe PID 2916 wrote to memory of 2116 2916 1xxrllr.exe hthtbt.exe PID 2916 wrote to memory of 2116 2916 1xxrllr.exe hthtbt.exe PID 2916 wrote to memory of 2116 2916 1xxrllr.exe hthtbt.exe PID 2916 wrote to memory of 2116 2916 1xxrllr.exe hthtbt.exe PID 2116 wrote to memory of 2648 2116 hthtbt.exe 5httbh.exe PID 2116 wrote to memory of 2648 2116 hthtbt.exe 5httbh.exe PID 2116 wrote to memory of 2648 2116 hthtbt.exe 5httbh.exe PID 2116 wrote to memory of 2648 2116 hthtbt.exe 5httbh.exe PID 2648 wrote to memory of 2668 2648 5httbh.exe 9pvdj.exe PID 2648 wrote to memory of 2668 2648 5httbh.exe 9pvdj.exe PID 2648 wrote to memory of 2668 2648 5httbh.exe 9pvdj.exe PID 2648 wrote to memory of 2668 2648 5httbh.exe 9pvdj.exe PID 2668 wrote to memory of 2696 2668 9pvdj.exe lflfxrr.exe PID 2668 wrote to memory of 2696 2668 9pvdj.exe lflfxrr.exe PID 2668 wrote to memory of 2696 2668 9pvdj.exe lflfxrr.exe PID 2668 wrote to memory of 2696 2668 9pvdj.exe lflfxrr.exe PID 2696 wrote to memory of 2444 2696 lflfxrr.exe llfxlxl.exe PID 2696 wrote to memory of 2444 2696 lflfxrr.exe llfxlxl.exe PID 2696 wrote to memory of 2444 2696 lflfxrr.exe llfxlxl.exe PID 2696 wrote to memory of 2444 2696 lflfxrr.exe llfxlxl.exe PID 2444 wrote to memory of 2468 2444 llfxlxl.exe tththn.exe PID 2444 wrote to memory of 2468 2444 llfxlxl.exe tththn.exe PID 2444 wrote to memory of 2468 2444 llfxlxl.exe tththn.exe PID 2444 wrote to memory of 2468 2444 llfxlxl.exe tththn.exe PID 2468 wrote to memory of 2488 2468 tththn.exe vpdpj.exe PID 2468 wrote to memory of 2488 2468 tththn.exe vpdpj.exe PID 2468 wrote to memory of 2488 2468 tththn.exe vpdpj.exe PID 2468 wrote to memory of 2488 2468 tththn.exe vpdpj.exe PID 2488 wrote to memory of 2376 2488 vpdpj.exe vjjdd.exe PID 2488 wrote to memory of 2376 2488 vpdpj.exe vjjdd.exe PID 2488 wrote to memory of 2376 2488 vpdpj.exe vjjdd.exe PID 2488 wrote to memory of 2376 2488 vpdpj.exe vjjdd.exe PID 2376 wrote to memory of 2436 2376 vjjdd.exe 9rxffll.exe PID 2376 wrote to memory of 2436 2376 vjjdd.exe 9rxffll.exe PID 2376 wrote to memory of 2436 2376 vjjdd.exe 9rxffll.exe PID 2376 wrote to memory of 2436 2376 vjjdd.exe 9rxffll.exe PID 2436 wrote to memory of 1208 2436 9rxffll.exe 9thtnn.exe PID 2436 wrote to memory of 1208 2436 9rxffll.exe 9thtnn.exe PID 2436 wrote to memory of 1208 2436 9rxffll.exe 9thtnn.exe PID 2436 wrote to memory of 1208 2436 9rxffll.exe 9thtnn.exe PID 1208 wrote to memory of 2004 1208 9thtnn.exe 3hnbtn.exe PID 1208 wrote to memory of 2004 1208 9thtnn.exe 3hnbtn.exe PID 1208 wrote to memory of 2004 1208 9thtnn.exe 3hnbtn.exe PID 1208 wrote to memory of 2004 1208 9thtnn.exe 3hnbtn.exe PID 2004 wrote to memory of 2384 2004 3hnbtn.exe pjpdd.exe PID 2004 wrote to memory of 2384 2004 3hnbtn.exe pjpdd.exe PID 2004 wrote to memory of 2384 2004 3hnbtn.exe pjpdd.exe PID 2004 wrote to memory of 2384 2004 3hnbtn.exe pjpdd.exe PID 2384 wrote to memory of 944 2384 pjpdd.exe jvdvv.exe PID 2384 wrote to memory of 944 2384 pjpdd.exe jvdvv.exe PID 2384 wrote to memory of 944 2384 pjpdd.exe jvdvv.exe PID 2384 wrote to memory of 944 2384 pjpdd.exe jvdvv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exe"C:\Users\Admin\AppData\Local\Temp\df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\bbtnbh.exec:\bbtnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\pdppv.exec:\pdppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\1xxrllr.exec:\1xxrllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\hthtbt.exec:\hthtbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\5httbh.exec:\5httbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\9pvdj.exec:\9pvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\lflfxrr.exec:\lflfxrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\llfxlxl.exec:\llfxlxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\tththn.exec:\tththn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\vpdpj.exec:\vpdpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\vjjdd.exec:\vjjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\9rxffll.exec:\9rxffll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\9thtnn.exec:\9thtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\3hnbtn.exec:\3hnbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\pjpdd.exec:\pjpdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\jvdvv.exec:\jvdvv.exe17⤵
- Executes dropped EXE
PID:944 -
\??\c:\rrrxxxr.exec:\rrrxxxr.exe18⤵
- Executes dropped EXE
PID:1456 -
\??\c:\hnhbht.exec:\hnhbht.exe19⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bthtbn.exec:\bthtbn.exe20⤵
- Executes dropped EXE
PID:1296 -
\??\c:\ddpvp.exec:\ddpvp.exe21⤵
- Executes dropped EXE
PID:1080 -
\??\c:\5xrxxxl.exec:\5xrxxxl.exe22⤵
- Executes dropped EXE
PID:2152 -
\??\c:\fxrfrlr.exec:\fxrfrlr.exe23⤵
- Executes dropped EXE
PID:2076 -
\??\c:\hbbbtb.exec:\hbbbtb.exe24⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vpdpj.exec:\vpdpj.exe25⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jjdjj.exec:\jjdjj.exe26⤵
- Executes dropped EXE
PID:536 -
\??\c:\lxfffff.exec:\lxfffff.exe27⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xrfrxxl.exec:\xrfrxxl.exe28⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nhnnnt.exec:\nhnnnt.exe29⤵
- Executes dropped EXE
PID:2604 -
\??\c:\dppjp.exec:\dppjp.exe30⤵
- Executes dropped EXE
PID:1784 -
\??\c:\frllllr.exec:\frllllr.exe31⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hnbntb.exec:\hnbntb.exe32⤵
- Executes dropped EXE
PID:604 -
\??\c:\nbnhhb.exec:\nbnhhb.exe33⤵
- Executes dropped EXE
PID:2228 -
\??\c:\7ppvv.exec:\7ppvv.exe34⤵
- Executes dropped EXE
PID:2012 -
\??\c:\frxfffr.exec:\frxfffr.exe35⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xxlxrxf.exec:\xxlxrxf.exe36⤵
- Executes dropped EXE
PID:1136 -
\??\c:\hbhbhh.exec:\hbhbhh.exe37⤵
- Executes dropped EXE
PID:2272 -
\??\c:\nhttbb.exec:\nhttbb.exe38⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jpdpd.exec:\jpdpd.exe39⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vjjjp.exec:\vjjjp.exe40⤵
- Executes dropped EXE
PID:2276 -
\??\c:\9rrfflr.exec:\9rrfflr.exe41⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rlfflrx.exec:\rlfflrx.exe42⤵
- Executes dropped EXE
PID:2900 -
\??\c:\tnbbhn.exec:\tnbbhn.exe43⤵
- Executes dropped EXE
PID:2836 -
\??\c:\nnthht.exec:\nnthht.exe44⤵
- Executes dropped EXE
PID:1812 -
\??\c:\7pddj.exec:\7pddj.exe45⤵
- Executes dropped EXE
PID:1688 -
\??\c:\rrflrxf.exec:\rrflrxf.exe46⤵
- Executes dropped EXE
PID:2800 -
\??\c:\lllfrxl.exec:\lllfrxl.exe47⤵
- Executes dropped EXE
PID:2648 -
\??\c:\nnbbht.exec:\nnbbht.exe48⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hhbnbb.exec:\hhbnbb.exe49⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vpjjj.exec:\vpjjj.exe50⤵
- Executes dropped EXE
PID:2524 -
\??\c:\1djjv.exec:\1djjv.exe51⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rxrxlxr.exec:\rxrxlxr.exe52⤵
- Executes dropped EXE
PID:2408 -
\??\c:\llrxfrx.exec:\llrxfrx.exe53⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nttbhn.exec:\nttbhn.exe54⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tnthtb.exec:\tnthtb.exe55⤵
- Executes dropped EXE
PID:2488 -
\??\c:\pjjpv.exec:\pjjpv.exe56⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ffrllfl.exec:\ffrllfl.exe57⤵
- Executes dropped EXE
PID:2512 -
\??\c:\lrlfxfx.exec:\lrlfxfx.exe58⤵
- Executes dropped EXE
PID:1208 -
\??\c:\nnhhnt.exec:\nnhhnt.exe59⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bbntnt.exec:\bbntnt.exe60⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jjjvd.exec:\jjjvd.exe61⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5dvjp.exec:\5dvjp.exe62⤵
- Executes dropped EXE
PID:932 -
\??\c:\fxxflrl.exec:\fxxflrl.exe63⤵
- Executes dropped EXE
PID:1776 -
\??\c:\3hbhbh.exec:\3hbhbh.exe64⤵
- Executes dropped EXE
PID:1508 -
\??\c:\bthnbh.exec:\bthnbh.exe65⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vvpjv.exec:\vvpjv.exe66⤵PID:848
-
\??\c:\vjpdj.exec:\vjpdj.exe67⤵PID:1444
-
\??\c:\lxlxflr.exec:\lxlxflr.exe68⤵PID:2124
-
\??\c:\lfxxxff.exec:\lfxxxff.exe69⤵PID:3052
-
\??\c:\5bnnth.exec:\5bnnth.exe70⤵PID:2068
-
\??\c:\hthbbt.exec:\hthbbt.exe71⤵PID:1984
-
\??\c:\pdvvp.exec:\pdvvp.exe72⤵PID:2052
-
\??\c:\jvjdv.exec:\jvjdv.exe73⤵PID:528
-
\??\c:\xfrrrxx.exec:\xfrrrxx.exe74⤵PID:696
-
\??\c:\frxlrrf.exec:\frxlrrf.exe75⤵PID:2300
-
\??\c:\hbhhnb.exec:\hbhhnb.exe76⤵PID:2264
-
\??\c:\7bnnnn.exec:\7bnnnn.exe77⤵PID:2104
-
\??\c:\1jvjp.exec:\1jvjp.exe78⤵PID:2604
-
\??\c:\pvddp.exec:\pvddp.exe79⤵PID:1240
-
\??\c:\fxrrxrr.exec:\fxrrxrr.exe80⤵PID:1880
-
\??\c:\rlxlfff.exec:\rlxlfff.exe81⤵PID:3036
-
\??\c:\tthhbt.exec:\tthhbt.exe82⤵PID:564
-
\??\c:\nbnbbn.exec:\nbnbbn.exe83⤵PID:2932
-
\??\c:\pdpjv.exec:\pdpjv.exe84⤵PID:2340
-
\??\c:\pjvdv.exec:\pjvdv.exe85⤵PID:2248
-
\??\c:\frxrrrl.exec:\frxrrrl.exe86⤵PID:3004
-
\??\c:\lrxrxff.exec:\lrxrxff.exe87⤵PID:1136
-
\??\c:\nbnnhb.exec:\nbnnhb.exe88⤵PID:2296
-
\??\c:\nhbbtt.exec:\nhbbtt.exe89⤵PID:1028
-
\??\c:\dpjjv.exec:\dpjjv.exe90⤵PID:1556
-
\??\c:\dvddd.exec:\dvddd.exe91⤵PID:2888
-
\??\c:\7xrxfrr.exec:\7xrxfrr.exe92⤵PID:1672
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe93⤵PID:2516
-
\??\c:\5htttn.exec:\5htttn.exe94⤵PID:2572
-
\??\c:\5thbbh.exec:\5thbbh.exe95⤵PID:2744
-
\??\c:\ntbtbt.exec:\ntbtbt.exe96⤵PID:2632
-
\??\c:\1pdvd.exec:\1pdvd.exe97⤵PID:2556
-
\??\c:\vjvdv.exec:\vjvdv.exe98⤵PID:2540
-
\??\c:\pdjjv.exec:\pdjjv.exe99⤵PID:2640
-
\??\c:\rlrllll.exec:\rlrllll.exe100⤵PID:2584
-
\??\c:\fxfflrr.exec:\fxfflrr.exe101⤵PID:2444
-
\??\c:\hbnhhb.exec:\hbnhhb.exe102⤵PID:2480
-
\??\c:\thttnn.exec:\thttnn.exe103⤵PID:2864
-
\??\c:\nbttnn.exec:\nbttnn.exe104⤵PID:2496
-
\??\c:\7pjjj.exec:\7pjjj.exe105⤵PID:1948
-
\??\c:\dpppj.exec:\dpppj.exe106⤵PID:2108
-
\??\c:\xllffxx.exec:\xllffxx.exe107⤵PID:1748
-
\??\c:\lxxxlfl.exec:\lxxxlfl.exe108⤵PID:1720
-
\??\c:\1lfxxrr.exec:\1lfxxrr.exe109⤵PID:948
-
\??\c:\bnbbhh.exec:\bnbbhh.exe110⤵PID:1620
-
\??\c:\1htnnn.exec:\1htnnn.exe111⤵PID:2676
-
\??\c:\7dvdj.exec:\7dvdj.exe112⤵PID:884
-
\??\c:\vpvvd.exec:\vpvvd.exe113⤵PID:1512
-
\??\c:\vdpjj.exec:\vdpjj.exe114⤵PID:2708
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe115⤵PID:2740
-
\??\c:\lxlrlfl.exec:\lxlrlfl.exe116⤵PID:1244
-
\??\c:\frrlllr.exec:\frrlllr.exe117⤵PID:1744
-
\??\c:\thnhhh.exec:\thnhhh.exe118⤵PID:3064
-
\??\c:\1bbttt.exec:\1bbttt.exe119⤵PID:1172
-
\??\c:\9htnhb.exec:\9htnhb.exe120⤵PID:1716
-
\??\c:\3jdjj.exec:\3jdjj.exe121⤵PID:2088
-
\??\c:\pvjdv.exec:\pvjdv.exe122⤵PID:1928
-
\??\c:\lllxrfr.exec:\lllxrfr.exe123⤵PID:768
-
\??\c:\lrllfff.exec:\lrllfff.exe124⤵PID:1216
-
\??\c:\hhhthh.exec:\hhhthh.exe125⤵PID:1516
-
\??\c:\nhnnnt.exec:\nhnnnt.exe126⤵PID:332
-
\??\c:\dvvpv.exec:\dvvpv.exe127⤵PID:2996
-
\??\c:\vjvpv.exec:\vjvpv.exe128⤵PID:1956
-
\??\c:\lxflflr.exec:\lxflflr.exe129⤵PID:1460
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe130⤵PID:496
-
\??\c:\nbbhnt.exec:\nbbhnt.exe131⤵PID:1420
-
\??\c:\nhtntt.exec:\nhtntt.exe132⤵PID:1124
-
\??\c:\7vddd.exec:\7vddd.exe133⤵PID:3036
-
\??\c:\vjvvp.exec:\vjvvp.exe134⤵PID:564
-
\??\c:\dpvvd.exec:\dpvvd.exe135⤵PID:2280
-
\??\c:\lffrrrx.exec:\lffrrrx.exe136⤵PID:2340
-
\??\c:\9fxllrx.exec:\9fxllrx.exe137⤵PID:2032
-
\??\c:\5tntth.exec:\5tntth.exe138⤵PID:3004
-
\??\c:\hbhbnn.exec:\hbhbnn.exe139⤵PID:1980
-
\??\c:\dddpj.exec:\dddpj.exe140⤵PID:1676
-
\??\c:\pjpvd.exec:\pjpvd.exe141⤵PID:1584
-
\??\c:\llxlxrr.exec:\llxlxrr.exe142⤵PID:2276
-
\??\c:\nhhhtn.exec:\nhhhtn.exe143⤵PID:2904
-
\??\c:\nbnnhn.exec:\nbnnhn.exe144⤵PID:1680
-
\??\c:\1pdpd.exec:\1pdpd.exe145⤵PID:2268
-
\??\c:\fxfllfl.exec:\fxfllfl.exe146⤵PID:1812
-
\??\c:\1xlxrlr.exec:\1xlxrlr.exe147⤵PID:2628
-
\??\c:\hthhnb.exec:\hthhnb.exe148⤵PID:2620
-
\??\c:\7thhhb.exec:\7thhhb.exe149⤵PID:1688
-
\??\c:\dpjpj.exec:\dpjpj.exe150⤵PID:2576
-
\??\c:\1vdjd.exec:\1vdjd.exe151⤵PID:2548
-
\??\c:\3lllrrx.exec:\3lllrrx.exe152⤵PID:2388
-
\??\c:\1xfxrrx.exec:\1xfxrrx.exe153⤵PID:2592
-
\??\c:\bttbbt.exec:\bttbbt.exe154⤵PID:2560
-
\??\c:\hthnhh.exec:\hthnhh.exe155⤵PID:2480
-
\??\c:\dpvpv.exec:\dpvpv.exe156⤵PID:2936
-
\??\c:\jvjdj.exec:\jvjdj.exe157⤵PID:1856
-
\??\c:\5lrllll.exec:\5lrllll.exe158⤵PID:320
-
\??\c:\frrrrxx.exec:\frrrrxx.exe159⤵PID:1824
-
\??\c:\hbbhbb.exec:\hbbhbb.exe160⤵PID:1748
-
\??\c:\3hnhnh.exec:\3hnhnh.exe161⤵PID:1608
-
\??\c:\5vvpp.exec:\5vvpp.exe162⤵PID:2308
-
\??\c:\dvjpj.exec:\dvjpj.exe163⤵PID:2484
-
\??\c:\lrflfxx.exec:\lrflfxx.exe164⤵PID:2676
-
\??\c:\7lrxrll.exec:\7lrxrll.exe165⤵PID:932
-
\??\c:\tnhnhb.exec:\tnhnhb.exe166⤵PID:1512
-
\??\c:\thhbhb.exec:\thhbhb.exe167⤵PID:1392
-
\??\c:\9hhhth.exec:\9hhhth.exe168⤵PID:2740
-
\??\c:\jdvvp.exec:\jdvvp.exe169⤵PID:1296
-
\??\c:\9dpdj.exec:\9dpdj.exe170⤵PID:1444
-
\??\c:\rlxxflf.exec:\rlxxflf.exe171⤵PID:3064
-
\??\c:\frflllf.exec:\frflllf.exe172⤵PID:2092
-
\??\c:\rxflflr.exec:\rxflflr.exe173⤵PID:2072
-
\??\c:\bhtttn.exec:\bhtttn.exe174⤵PID:1932
-
\??\c:\7ntnhh.exec:\7ntnhh.exe175⤵PID:2208
-
\??\c:\pvjdv.exec:\pvjdv.exe176⤵PID:528
-
\??\c:\pdvvp.exec:\pdvvp.exe177⤵PID:828
-
\??\c:\lfxfxff.exec:\lfxfxff.exe178⤵PID:2920
-
\??\c:\xlxfxlx.exec:\xlxfxlx.exe179⤵PID:2356
-
\??\c:\nhnttb.exec:\nhnttb.exe180⤵PID:1800
-
\??\c:\nhnntt.exec:\nhnntt.exe181⤵PID:1784
-
\??\c:\jdpvj.exec:\jdpvj.exe182⤵PID:936
-
\??\c:\vjppp.exec:\vjppp.exe183⤵PID:972
-
\??\c:\xlxxrrx.exec:\xlxxrrx.exe184⤵PID:1420
-
\??\c:\lfrxxxl.exec:\lfrxxxl.exe185⤵PID:1124
-
\??\c:\9tbtbn.exec:\9tbtbn.exe186⤵PID:2772
-
\??\c:\nbhbtt.exec:\nbhbtt.exe187⤵PID:3000
-
\??\c:\hthnnt.exec:\hthnnt.exe188⤵PID:2280
-
\??\c:\pdpjd.exec:\pdpjd.exe189⤵PID:2340
-
\??\c:\jvdvv.exec:\jvdvv.exe190⤵PID:1876
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe191⤵PID:2808
-
\??\c:\lfllxfr.exec:\lfllxfr.exe192⤵PID:2296
-
\??\c:\bthtbt.exec:\bthtbt.exe193⤵PID:2852
-
\??\c:\tnnbnb.exec:\tnnbnb.exe194⤵PID:1580
-
\??\c:\jvpvv.exec:\jvpvv.exe195⤵PID:1588
-
\??\c:\3vdvp.exec:\3vdvp.exe196⤵PID:2320
-
\??\c:\7xlxxff.exec:\7xlxxff.exe197⤵PID:2176
-
\??\c:\lrlrllr.exec:\lrlrllr.exe198⤵PID:2268
-
\??\c:\hnbbtn.exec:\hnbbtn.exe199⤵PID:2652
-
\??\c:\9bnbhb.exec:\9bnbhb.exe200⤵PID:2580
-
\??\c:\nthttb.exec:\nthttb.exe201⤵PID:2788
-
\??\c:\vdddd.exec:\vdddd.exe202⤵PID:2696
-
\??\c:\vpjjj.exec:\vpjjj.exe203⤵PID:1600
-
\??\c:\3rlrlll.exec:\3rlrlll.exe204⤵PID:2460
-
\??\c:\flrfffl.exec:\flrfffl.exe205⤵PID:2536
-
\??\c:\1fxrffl.exec:\1fxrffl.exe206⤵PID:1660
-
\??\c:\ntnhhh.exec:\ntnhhh.exe207⤵PID:2472
-
\??\c:\httnnh.exec:\httnnh.exe208⤵PID:2872
-
\??\c:\1djpj.exec:\1djpj.exe209⤵PID:1640
-
\??\c:\dppjp.exec:\dppjp.exe210⤵PID:2868
-
\??\c:\9lfxxxx.exec:\9lfxxxx.exe211⤵PID:2512
-
\??\c:\frfrrrr.exec:\frfrrrr.exe212⤵PID:1496
-
\??\c:\ntnthb.exec:\ntnthb.exe213⤵PID:1548
-
\??\c:\nhtbhh.exec:\nhtbhh.exe214⤵PID:1572
-
\??\c:\3tbnnn.exec:\3tbnnn.exe215⤵PID:1616
-
\??\c:\vjvpd.exec:\vjvpd.exe216⤵PID:944
-
\??\c:\9rlrxrx.exec:\9rlrxrx.exe217⤵PID:2756
-
\??\c:\nhnhnh.exec:\nhnhnh.exe218⤵PID:1348
-
\??\c:\tnhhhh.exec:\tnhhhh.exe219⤵PID:1752
-
\??\c:\vdjjj.exec:\vdjjj.exe220⤵PID:1448
-
\??\c:\7dvdv.exec:\7dvdv.exe221⤵PID:1744
-
\??\c:\llffxxx.exec:\llffxxx.exe222⤵PID:1084
-
\??\c:\rlfrrrx.exec:\rlfrrrx.exe223⤵PID:2024
-
\??\c:\3rffxxf.exec:\3rffxxf.exe224⤵PID:1716
-
\??\c:\bhtthn.exec:\bhtthn.exe225⤵PID:1984
-
\??\c:\tbhhhh.exec:\tbhhhh.exe226⤵PID:2052
-
\??\c:\vpjpv.exec:\vpjpv.exe227⤵PID:2208
-
\??\c:\pjppp.exec:\pjppp.exe228⤵PID:1152
-
\??\c:\5fxxxxx.exec:\5fxxxxx.exe229⤵PID:1476
-
\??\c:\ffllflx.exec:\ffllflx.exe230⤵PID:2920
-
\??\c:\lxfflrx.exec:\lxfflrx.exe231⤵PID:2816
-
\??\c:\btbbbb.exec:\btbbbb.exe232⤵PID:756
-
\??\c:\nhtntn.exec:\nhtntn.exe233⤵PID:3056
-
\??\c:\vjddj.exec:\vjddj.exe234⤵PID:936
-
\??\c:\5jjdv.exec:\5jjdv.exe235⤵PID:1132
-
\??\c:\frrfrxf.exec:\frrfrxf.exe236⤵PID:1116
-
\??\c:\ffxfxxl.exec:\ffxfxxl.exe237⤵PID:1124
-
\??\c:\bthnbn.exec:\bthnbn.exe238⤵PID:564
-
\??\c:\bthnbt.exec:\bthnbt.exe239⤵PID:3000
-
\??\c:\hbhbhb.exec:\hbhbhb.exe240⤵PID:2256
-
\??\c:\dvjvj.exec:\dvjvj.exe241⤵PID:2340
-
\??\c:\jjdpj.exec:\jjdpj.exe242⤵PID:1136