Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 19:04
Static task
static1
Behavioral task
behavioral1
Sample
e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exe
Resource
win7-20240903-en
General
-
Target
e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exe
-
Size
81KB
-
MD5
d2f821cac4d7cb591b05b998eeb065d8
-
SHA1
c5f55765f4cb8a55895509b7eb30b78879a8e40c
-
SHA256
e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c
-
SHA512
7b2217ed103eea8f69b45f7ef46887970b5209fde5306ff0b316bf00bf83ae6fef53362119c20b8fb7632cd0ff5f37f2d75a91f92703ee6e0cf2de7488584894
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qoHrnZHaY3DLELsn8:ymb3NkkiQ3mdBjFIj+qYjhaoLD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1236-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-292-0x00000000777E0000-0x00000000778DA000-memory.dmp family_blackmoon behavioral1/memory/2424-291-0x00000000776C0000-0x00000000777DF000-memory.dmp family_blackmoon behavioral1/memory/892-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/796-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
flfxrlr.exerrxxfrr.exettntht.exenhnhnt.exejjvjv.exelfrxlxf.exetthntb.exebbttnt.exejjvjv.exe9jjpd.exelxrfrxl.exe3tbnnt.exe1btnbb.exe1vddj.exe7pjpd.exerlrrrxl.exerlxlrrx.exe9bthtt.exebhbhnn.exe1tthnt.exejvjjp.exevvvvj.exepjjjj.exexxlfrxl.exe7xxfrrx.exebthnhh.exetthnth.exe5jdpv.exe9jdjv.exexrflxxr.exehhbtnn.exe3tnbhn.exe1ppdv.exe7pjdp.exe1dvvv.exe9fxflrf.exelfllrxf.exe1xfffrx.exehbnntn.exehbnhnn.exe5bnnnn.exedvjjv.exedvddj.exerfrlrxf.exexrflrrf.exexrxfffx.exehhhhhb.exe5thnhh.exeddvpv.exevpvdj.exexlxfrlf.exetnbhnt.exetnhhbb.exebthhnt.exe3ppdd.exevpddj.exexrflrrx.exexxlfrfl.exehhtbhh.exehbtbbb.exevdpjd.exexrffrxf.exe5bbbbn.exehbnntn.exepid Process 3068 flfxrlr.exe 2500 rrxxfrr.exe 1988 ttntht.exe 796 nhnhnt.exe 2388 jjvjv.exe 2808 lfrxlxf.exe 3004 tthntb.exe 2144 bbttnt.exe 2832 jjvjv.exe 2592 9jjpd.exe 2128 lxrfrxl.exe 2532 3tbnnt.exe 2940 1btnbb.exe 2880 1vddj.exe 864 7pjpd.exe 2916 rlrrrxl.exe 2036 rlxlrrx.exe 1752 9bthtt.exe 2952 bhbhnn.exe 2396 1tthnt.exe 2280 jvjjp.exe 1056 vvvvj.exe 1244 pjjjj.exe 828 xxlfrxl.exe 1612 7xxfrrx.exe 712 bthnhh.exe 1892 tthnth.exe 988 5jdpv.exe 892 9jdjv.exe 2424 xrflxxr.exe 2332 hhbtnn.exe 300 3tnbhn.exe 2160 1ppdv.exe 764 7pjdp.exe 2728 1dvvv.exe 2388 9fxflrf.exe 2148 lfllrxf.exe 2812 1xfffrx.exe 2788 hbnntn.exe 2612 hbnhnn.exe 2572 5bnnnn.exe 2860 dvjjv.exe 1528 dvddj.exe 2944 rfrlrxf.exe 1844 xrflrrf.exe 2828 xrxfffx.exe 2928 hhhhhb.exe 344 5thnhh.exe 2308 ddvpv.exe 1784 vpvdj.exe 1048 xlxfrlf.exe 2132 tnbhnt.exe 2232 tnhhbb.exe 2672 bthhnt.exe 1468 3ppdd.exe 2184 vpddj.exe 1056 xrflrrx.exe 600 xxlfrfl.exe 1084 hhtbhh.exe 2200 hbtbbb.exe 2976 vdpjd.exe 1740 xrffrxf.exe 496 5bbbbn.exe 1496 hbnntn.exe -
Processes:
resource yara_rule behavioral1/memory/1236-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1236-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-291-0x00000000776C0000-0x00000000777DF000-memory.dmp upx behavioral1/memory/892-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-24-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
frrrxfx.exexlxxxfx.exejvjpv.exehnbbnn.exetnhtth.exe5xfxfrx.exe5ffrxxf.exexlxxffl.exebthhtt.exejvppp.exevjdjj.exe3vpjd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exeflfxrlr.exerrxxfrr.exettntht.exenhnhnt.exejjvjv.exelfrxlxf.exetthntb.exebbttnt.exejjvjv.exe9jjpd.exelxrfrxl.exe3tbnnt.exe1btnbb.exe1vddj.exe7pjpd.exedescription pid Process procid_target PID 1236 wrote to memory of 3068 1236 e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exe 30 PID 1236 wrote to memory of 3068 1236 e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exe 30 PID 1236 wrote to memory of 3068 1236 e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exe 30 PID 1236 wrote to memory of 3068 1236 e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exe 30 PID 3068 wrote to memory of 2500 3068 flfxrlr.exe 31 PID 3068 wrote to memory of 2500 3068 flfxrlr.exe 31 PID 3068 wrote to memory of 2500 3068 flfxrlr.exe 31 PID 3068 wrote to memory of 2500 3068 flfxrlr.exe 31 PID 2500 wrote to memory of 1988 2500 rrxxfrr.exe 32 PID 2500 wrote to memory of 1988 2500 rrxxfrr.exe 32 PID 2500 wrote to memory of 1988 2500 rrxxfrr.exe 32 PID 2500 wrote to memory of 1988 2500 rrxxfrr.exe 32 PID 1988 wrote to memory of 796 1988 ttntht.exe 33 PID 1988 wrote to memory of 796 1988 ttntht.exe 33 PID 1988 wrote to memory of 796 1988 ttntht.exe 33 PID 1988 wrote to memory of 796 1988 ttntht.exe 33 PID 796 wrote to memory of 2388 796 nhnhnt.exe 34 PID 796 wrote to memory of 2388 796 nhnhnt.exe 34 PID 796 wrote to memory of 2388 796 nhnhnt.exe 34 PID 796 wrote to memory of 2388 796 nhnhnt.exe 34 PID 2388 wrote to memory of 2808 2388 jjvjv.exe 35 PID 2388 wrote to memory of 2808 2388 jjvjv.exe 35 PID 2388 wrote to memory of 2808 2388 jjvjv.exe 35 PID 2388 wrote to memory of 2808 2388 jjvjv.exe 35 PID 2808 wrote to memory of 3004 2808 lfrxlxf.exe 36 PID 2808 wrote to memory of 3004 2808 lfrxlxf.exe 36 PID 2808 wrote to memory of 3004 2808 lfrxlxf.exe 36 PID 2808 wrote to memory of 3004 2808 lfrxlxf.exe 36 PID 3004 wrote to memory of 2144 3004 tthntb.exe 37 PID 3004 wrote to memory of 2144 3004 tthntb.exe 37 PID 3004 wrote to memory of 2144 3004 tthntb.exe 37 PID 3004 wrote to memory of 2144 3004 tthntb.exe 37 PID 2144 wrote to memory of 2832 2144 bbttnt.exe 38 PID 2144 wrote to memory of 2832 2144 bbttnt.exe 38 PID 2144 wrote to memory of 2832 2144 bbttnt.exe 38 PID 2144 wrote to memory of 2832 2144 bbttnt.exe 38 PID 2832 wrote to memory of 2592 2832 jjvjv.exe 39 PID 2832 wrote to memory of 2592 2832 jjvjv.exe 39 PID 2832 wrote to memory of 2592 2832 jjvjv.exe 39 PID 2832 wrote to memory of 2592 2832 jjvjv.exe 39 PID 2592 wrote to memory of 2128 2592 9jjpd.exe 40 PID 2592 wrote to memory of 2128 2592 9jjpd.exe 40 PID 2592 wrote to memory of 2128 2592 9jjpd.exe 40 PID 2592 wrote to memory of 2128 2592 9jjpd.exe 40 PID 2128 wrote to memory of 2532 2128 lxrfrxl.exe 41 PID 2128 wrote to memory of 2532 2128 lxrfrxl.exe 41 PID 2128 wrote to memory of 2532 2128 lxrfrxl.exe 41 PID 2128 wrote to memory of 2532 2128 lxrfrxl.exe 41 PID 2532 wrote to memory of 2940 2532 3tbnnt.exe 42 PID 2532 wrote to memory of 2940 2532 3tbnnt.exe 42 PID 2532 wrote to memory of 2940 2532 3tbnnt.exe 42 PID 2532 wrote to memory of 2940 2532 3tbnnt.exe 42 PID 2940 wrote to memory of 2880 2940 1btnbb.exe 43 PID 2940 wrote to memory of 2880 2940 1btnbb.exe 43 PID 2940 wrote to memory of 2880 2940 1btnbb.exe 43 PID 2940 wrote to memory of 2880 2940 1btnbb.exe 43 PID 2880 wrote to memory of 864 2880 1vddj.exe 44 PID 2880 wrote to memory of 864 2880 1vddj.exe 44 PID 2880 wrote to memory of 864 2880 1vddj.exe 44 PID 2880 wrote to memory of 864 2880 1vddj.exe 44 PID 864 wrote to memory of 2916 864 7pjpd.exe 45 PID 864 wrote to memory of 2916 864 7pjpd.exe 45 PID 864 wrote to memory of 2916 864 7pjpd.exe 45 PID 864 wrote to memory of 2916 864 7pjpd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exe"C:\Users\Admin\AppData\Local\Temp\e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\flfxrlr.exec:\flfxrlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\rrxxfrr.exec:\rrxxfrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\ttntht.exec:\ttntht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\nhnhnt.exec:\nhnhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\jjvjv.exec:\jjvjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\lfrxlxf.exec:\lfrxlxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\tthntb.exec:\tthntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\bbttnt.exec:\bbttnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\jjvjv.exec:\jjvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\9jjpd.exec:\9jjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\lxrfrxl.exec:\lxrfrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\3tbnnt.exec:\3tbnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\1btnbb.exec:\1btnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\1vddj.exec:\1vddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\7pjpd.exec:\7pjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\rlrrrxl.exec:\rlrrrxl.exe17⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rlxlrrx.exec:\rlxlrrx.exe18⤵
- Executes dropped EXE
PID:2036 -
\??\c:\9bthtt.exec:\9bthtt.exe19⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bhbhnn.exec:\bhbhnn.exe20⤵
- Executes dropped EXE
PID:2952 -
\??\c:\1tthnt.exec:\1tthnt.exe21⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jvjjp.exec:\jvjjp.exe22⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vvvvj.exec:\vvvvj.exe23⤵
- Executes dropped EXE
PID:1056 -
\??\c:\pjjjj.exec:\pjjjj.exe24⤵
- Executes dropped EXE
PID:1244 -
\??\c:\xxlfrxl.exec:\xxlfrxl.exe25⤵
- Executes dropped EXE
PID:828 -
\??\c:\7xxfrrx.exec:\7xxfrrx.exe26⤵
- Executes dropped EXE
PID:1612 -
\??\c:\bthnhh.exec:\bthnhh.exe27⤵
- Executes dropped EXE
PID:712 -
\??\c:\tthnth.exec:\tthnth.exe28⤵
- Executes dropped EXE
PID:1892 -
\??\c:\5jdpv.exec:\5jdpv.exe29⤵
- Executes dropped EXE
PID:988 -
\??\c:\9jdjv.exec:\9jdjv.exe30⤵
- Executes dropped EXE
PID:892 -
\??\c:\xrflxxr.exec:\xrflxxr.exe31⤵
- Executes dropped EXE
PID:2424 -
\??\c:\lxlrrrx.exec:\lxlrrrx.exe32⤵PID:1600
-
\??\c:\hhbtnn.exec:\hhbtnn.exe33⤵
- Executes dropped EXE
PID:2332 -
\??\c:\3tnbhn.exec:\3tnbhn.exe34⤵
- Executes dropped EXE
PID:300 -
\??\c:\1ppdv.exec:\1ppdv.exe35⤵
- Executes dropped EXE
PID:2160 -
\??\c:\7pjdp.exec:\7pjdp.exe36⤵
- Executes dropped EXE
PID:764 -
\??\c:\1dvvv.exec:\1dvvv.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\9fxflrf.exec:\9fxflrf.exe38⤵
- Executes dropped EXE
PID:2388 -
\??\c:\lfllrxf.exec:\lfllrxf.exe39⤵
- Executes dropped EXE
PID:2148 -
\??\c:\1xfffrx.exec:\1xfffrx.exe40⤵
- Executes dropped EXE
PID:2812 -
\??\c:\hbnntn.exec:\hbnntn.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hbnhnn.exec:\hbnhnn.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\5bnnnn.exec:\5bnnnn.exe43⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dvjjv.exec:\dvjjv.exe44⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dvddj.exec:\dvddj.exe45⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rfrlrxf.exec:\rfrlrxf.exe46⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xrflrrf.exec:\xrflrrf.exe47⤵
- Executes dropped EXE
PID:1844 -
\??\c:\xrxfffx.exec:\xrxfffx.exe48⤵
- Executes dropped EXE
PID:2828 -
\??\c:\hhhhhb.exec:\hhhhhb.exe49⤵
- Executes dropped EXE
PID:2928 -
\??\c:\5thnhh.exec:\5thnhh.exe50⤵
- Executes dropped EXE
PID:344 -
\??\c:\ddvpv.exec:\ddvpv.exe51⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vpvdj.exec:\vpvdj.exe52⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xlxfrlf.exec:\xlxfrlf.exe53⤵
- Executes dropped EXE
PID:1048 -
\??\c:\tnbhnt.exec:\tnbhnt.exe54⤵
- Executes dropped EXE
PID:2132 -
\??\c:\tnhhbb.exec:\tnhhbb.exe55⤵
- Executes dropped EXE
PID:2232 -
\??\c:\bthhnt.exec:\bthhnt.exe56⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3ppdd.exec:\3ppdd.exe57⤵
- Executes dropped EXE
PID:1468 -
\??\c:\vpddj.exec:\vpddj.exe58⤵
- Executes dropped EXE
PID:2184 -
\??\c:\xrflrrx.exec:\xrflrrx.exe59⤵
- Executes dropped EXE
PID:1056 -
\??\c:\xxlfrfl.exec:\xxlfrfl.exe60⤵
- Executes dropped EXE
PID:600 -
\??\c:\hhtbhh.exec:\hhtbhh.exe61⤵
- Executes dropped EXE
PID:1084 -
\??\c:\hbtbbb.exec:\hbtbbb.exe62⤵
- Executes dropped EXE
PID:2200 -
\??\c:\vdpjd.exec:\vdpjd.exe63⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xrffrxf.exec:\xrffrxf.exe64⤵
- Executes dropped EXE
PID:1740 -
\??\c:\5bbbbn.exec:\5bbbbn.exe65⤵
- Executes dropped EXE
PID:496 -
\??\c:\hbnntn.exec:\hbnntn.exe66⤵
- Executes dropped EXE
PID:1496 -
\??\c:\dvdjj.exec:\dvdjj.exe67⤵PID:3016
-
\??\c:\ddvdp.exec:\ddvdp.exe68⤵PID:1632
-
\??\c:\3lxxflr.exec:\3lxxflr.exe69⤵PID:1764
-
\??\c:\rfxxffl.exec:\rfxxffl.exe70⤵PID:3068
-
\??\c:\nnbnbh.exec:\nnbnbh.exe71⤵PID:2312
-
\??\c:\pjjdj.exec:\pjjdj.exe72⤵PID:536
-
\??\c:\1djpv.exec:\1djpv.exe73⤵PID:376
-
\??\c:\fllrxlx.exec:\fllrxlx.exe74⤵PID:2240
-
\??\c:\rrfflrr.exec:\rrfflrr.exe75⤵PID:2360
-
\??\c:\tnhbbh.exec:\tnhbbh.exe76⤵PID:2768
-
\??\c:\pdvvj.exec:\pdvvj.exe77⤵PID:348
-
\??\c:\9xrlrrr.exec:\9xrlrrr.exe78⤵PID:2856
-
\??\c:\1hbbhb.exec:\1hbbhb.exe79⤵PID:320
-
\??\c:\ddvjv.exec:\ddvjv.exe80⤵PID:2692
-
\??\c:\3jpdj.exec:\3jpdj.exe81⤵PID:2616
-
\??\c:\fflrxfr.exec:\fflrxfr.exe82⤵PID:2832
-
\??\c:\xrflxxl.exec:\xrflxxl.exe83⤵PID:2860
-
\??\c:\btnntt.exec:\btnntt.exe84⤵PID:2824
-
\??\c:\tnhnhh.exec:\tnhnhh.exe85⤵PID:2984
-
\??\c:\dvddp.exec:\dvddp.exe86⤵PID:840
-
\??\c:\5xllxfl.exec:\5xllxfl.exe87⤵PID:2888
-
\??\c:\5flxrrx.exec:\5flxrrx.exe88⤵PID:1948
-
\??\c:\9hbhnn.exec:\9hbhnn.exe89⤵PID:2652
-
\??\c:\bbbbht.exec:\bbbbht.exe90⤵PID:1924
-
\??\c:\pjvpv.exec:\pjvpv.exe91⤵PID:1144
-
\??\c:\xxfflxl.exec:\xxfflxl.exe92⤵PID:2192
-
\??\c:\xrllxfl.exec:\xrllxfl.exe93⤵PID:2252
-
\??\c:\tnbbhb.exec:\tnbbhb.exe94⤵PID:2820
-
\??\c:\jvpvd.exec:\jvpvd.exe95⤵PID:2696
-
\??\c:\lxllrxf.exec:\lxllrxf.exe96⤵PID:448
-
\??\c:\rrlflxl.exec:\rrlflxl.exe97⤵PID:2196
-
\??\c:\1btbth.exec:\1btbth.exe98⤵PID:2480
-
\??\c:\3nntbb.exec:\3nntbb.exe99⤵PID:1288
-
\??\c:\jjvdj.exec:\jjvdj.exe100⤵PID:2872
-
\??\c:\7pdpp.exec:\7pdpp.exe101⤵PID:1388
-
\??\c:\rrrfrfx.exec:\rrrfrfx.exe102⤵PID:2440
-
\??\c:\5tttnn.exec:\5tttnn.exe103⤵PID:1072
-
\??\c:\pjvpv.exec:\pjvpv.exe104⤵PID:2228
-
\??\c:\vjvvd.exec:\vjvvd.exe105⤵PID:1260
-
\??\c:\dpjdp.exec:\dpjdp.exe106⤵PID:1028
-
\??\c:\xrflrxl.exec:\xrflrxl.exe107⤵PID:1632
-
\??\c:\9hnhnn.exec:\9hnhnn.exe108⤵PID:2012
-
\??\c:\pvppv.exec:\pvppv.exe109⤵PID:1280
-
\??\c:\vjddp.exec:\vjddp.exe110⤵PID:1980
-
\??\c:\5xrxxfl.exec:\5xrxxfl.exe111⤵PID:760
-
\??\c:\ffflxfr.exec:\ffflxfr.exe112⤵PID:316
-
\??\c:\1tnnnt.exec:\1tnnnt.exe113⤵PID:2996
-
\??\c:\nhbbhn.exec:\nhbbhn.exe114⤵PID:824
-
\??\c:\nhtbbt.exec:\nhtbbt.exe115⤵PID:1944
-
\??\c:\pjjpd.exec:\pjjpd.exe116⤵PID:1904
-
\??\c:\7jjjp.exec:\7jjjp.exe117⤵PID:2596
-
\??\c:\lxfrlrr.exec:\lxfrlrr.exe118⤵PID:3004
-
\??\c:\tnhbnn.exec:\tnhbnn.exe119⤵PID:2776
-
\??\c:\bhtnbn.exec:\bhtnbn.exe120⤵PID:2592
-
\??\c:\dvdvv.exec:\dvdvv.exe121⤵PID:2644
-
\??\c:\jpvpd.exec:\jpvpd.exe122⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-