Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 20:23
Static task
static1
Behavioral task
behavioral1
Sample
20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe
Resource
win7-20241023-en
General
-
Target
20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe
-
Size
50KB
-
MD5
d66d1f39e03f980574c1cb69994925b7
-
SHA1
5622eadb2e97405ce00cbb01b934035b28b6adc2
-
SHA256
20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282
-
SHA512
b92a50c8e9dabc49afbe888706c1185f5c581cf8fb3ae6de72e0215e3bdedab46e11e5f37312d2c2a0b8210f4f088b65ecee29b61f524bb918b6da5530242970
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvl2:0cdpeeBSHHMHLf9RyIN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
Processes:
resource yara_rule behavioral1/memory/1268-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1204-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-95-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2924-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/604-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/604-80-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2508-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/960-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-253-0x00000000003D0000-0x00000000003F9000-memory.dmp family_blackmoon behavioral1/memory/2088-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-288-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/2596-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-316-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2884-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-350-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-345-0x00000000002B0000-0x00000000002D9000-memory.dmp family_blackmoon behavioral1/memory/2744-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-420-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3060-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-440-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-450-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/1480-497-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-535-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-580-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-600-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-599-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/788-607-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/332-614-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/332-633-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2744-640-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1012-801-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-826-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2612-851-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1996-936-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1992-945-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3044-952-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2156-956-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2156-960-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2276-993-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2788-1118-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
6066262.exebtbtbh.exejvddv.exetnbbbh.exebttthn.exejdvjd.exexrxxlfr.exebthntt.exevpjpj.exe264022.exebbbbhh.exe7bhhhn.exe048800.exe220228.exe8628040.exepvddd.exebtnnhb.exexxrflrx.exebtnbtt.exebtnntb.exe2488664.exedpvdj.exeg8062.exexxfxfff.exedpjvp.exe264808.exedpvdj.exem4606.exetnbhtt.exexxllrrx.exe5vvvp.exebntnhh.exe6066666.exedvvpp.exeththth.exe7ntbtb.exerfxxfxf.exe02062.exe3ntttn.exe7frlrrr.exerflxlff.exe7nhtnb.exebntbbh.exe82462.exe8828400.exeq26206.exe82264.exehhbnth.exe60446.exe3xxxffl.exe224084.exe3ddpp.exetttnbb.exe7btbhb.exejdvjv.exe006846.exe864428.exejjpjj.exe822884.exei244628.exerxrflrf.exe48622.exe4468044.exenttbbn.exepid process 1204 6066262.exe 320 btbtbh.exe 1028 jvddv.exe 2152 tnbbbh.exe 2844 bttthn.exe 780 jdvjd.exe 2856 xrxxlfr.exe 604 bthntt.exe 2924 vpjpj.exe 2756 264022.exe 2508 bbbbhh.exe 2680 7bhhhn.exe 2588 048800.exe 2004 220228.exe 1696 8628040.exe 3060 pvddd.exe 1344 btnnhb.exe 1912 xxrflrx.exe 2192 btnbtt.exe 2292 btnntb.exe 2312 2488664.exe 1020 dpvdj.exe 1552 g8062.exe 960 xxfxfff.exe 1036 dpjvp.exe 1112 264808.exe 840 dpvdj.exe 2168 m4606.exe 1956 tnbhtt.exe 1660 xxllrrx.exe 2088 5vvvp.exe 2652 bntnhh.exe 2596 6066666.exe 1724 dvvpp.exe 2664 ththth.exe 2104 7ntbtb.exe 2884 rfxxfxf.exe 2568 02062.exe 2944 3ntttn.exe 332 7frlrrr.exe 2324 rflxlff.exe 2380 7nhtnb.exe 2928 bntbbh.exe 2924 82462.exe 2744 8828400.exe 920 q26206.exe 1856 82264.exe 3064 hhbnth.exe 2976 60446.exe 2992 3xxxffl.exe 3048 224084.exe 1440 3ddpp.exe 2980 tttnbb.exe 3060 7btbhb.exe 2188 jdvjv.exe 2096 006846.exe 2204 864428.exe 2276 jjpjj.exe 2448 822884.exe 1860 i244628.exe 2616 rxrflrf.exe 2332 48622.exe 2424 4468044.exe 1480 nttbbn.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
0420606.exea4622.exe8606266.exebtbbhh.exetthhnn.exe86220.exenhnhhh.exe48000.exe4420068.exehhnthn.exejdjjd.exe0084286.exe3frxrff.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0420606.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a4622.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8606266.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86220.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4420068.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0084286.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe6066262.exebtbtbh.exejvddv.exetnbbbh.exebttthn.exejdvjd.exexrxxlfr.exebthntt.exevpjpj.exe264022.exebbbbhh.exe7bhhhn.exe048800.exe220228.exe8628040.exedescription pid process target process PID 1268 wrote to memory of 1204 1268 20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe 6066262.exe PID 1268 wrote to memory of 1204 1268 20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe 6066262.exe PID 1268 wrote to memory of 1204 1268 20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe 6066262.exe PID 1268 wrote to memory of 1204 1268 20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe 6066262.exe PID 1204 wrote to memory of 320 1204 6066262.exe btbtbh.exe PID 1204 wrote to memory of 320 1204 6066262.exe btbtbh.exe PID 1204 wrote to memory of 320 1204 6066262.exe btbtbh.exe PID 1204 wrote to memory of 320 1204 6066262.exe btbtbh.exe PID 320 wrote to memory of 1028 320 btbtbh.exe jvddv.exe PID 320 wrote to memory of 1028 320 btbtbh.exe jvddv.exe PID 320 wrote to memory of 1028 320 btbtbh.exe jvddv.exe PID 320 wrote to memory of 1028 320 btbtbh.exe jvddv.exe PID 1028 wrote to memory of 2152 1028 jvddv.exe tnbbbh.exe PID 1028 wrote to memory of 2152 1028 jvddv.exe tnbbbh.exe PID 1028 wrote to memory of 2152 1028 jvddv.exe tnbbbh.exe PID 1028 wrote to memory of 2152 1028 jvddv.exe tnbbbh.exe PID 2152 wrote to memory of 2844 2152 tnbbbh.exe bttthn.exe PID 2152 wrote to memory of 2844 2152 tnbbbh.exe bttthn.exe PID 2152 wrote to memory of 2844 2152 tnbbbh.exe bttthn.exe PID 2152 wrote to memory of 2844 2152 tnbbbh.exe bttthn.exe PID 2844 wrote to memory of 780 2844 bttthn.exe jdvjd.exe PID 2844 wrote to memory of 780 2844 bttthn.exe jdvjd.exe PID 2844 wrote to memory of 780 2844 bttthn.exe jdvjd.exe PID 2844 wrote to memory of 780 2844 bttthn.exe jdvjd.exe PID 780 wrote to memory of 2856 780 jdvjd.exe xrxxlfr.exe PID 780 wrote to memory of 2856 780 jdvjd.exe xrxxlfr.exe PID 780 wrote to memory of 2856 780 jdvjd.exe xrxxlfr.exe PID 780 wrote to memory of 2856 780 jdvjd.exe xrxxlfr.exe PID 2856 wrote to memory of 604 2856 xrxxlfr.exe bthntt.exe PID 2856 wrote to memory of 604 2856 xrxxlfr.exe bthntt.exe PID 2856 wrote to memory of 604 2856 xrxxlfr.exe bthntt.exe PID 2856 wrote to memory of 604 2856 xrxxlfr.exe bthntt.exe PID 604 wrote to memory of 2924 604 bthntt.exe vpjpj.exe PID 604 wrote to memory of 2924 604 bthntt.exe vpjpj.exe PID 604 wrote to memory of 2924 604 bthntt.exe vpjpj.exe PID 604 wrote to memory of 2924 604 bthntt.exe vpjpj.exe PID 2924 wrote to memory of 2756 2924 vpjpj.exe 264022.exe PID 2924 wrote to memory of 2756 2924 vpjpj.exe 264022.exe PID 2924 wrote to memory of 2756 2924 vpjpj.exe 264022.exe PID 2924 wrote to memory of 2756 2924 vpjpj.exe 264022.exe PID 2756 wrote to memory of 2508 2756 264022.exe bbbbhh.exe PID 2756 wrote to memory of 2508 2756 264022.exe bbbbhh.exe PID 2756 wrote to memory of 2508 2756 264022.exe bbbbhh.exe PID 2756 wrote to memory of 2508 2756 264022.exe bbbbhh.exe PID 2508 wrote to memory of 2680 2508 bbbbhh.exe 7bhhhn.exe PID 2508 wrote to memory of 2680 2508 bbbbhh.exe 7bhhhn.exe PID 2508 wrote to memory of 2680 2508 bbbbhh.exe 7bhhhn.exe PID 2508 wrote to memory of 2680 2508 bbbbhh.exe 7bhhhn.exe PID 2680 wrote to memory of 2588 2680 7bhhhn.exe 048800.exe PID 2680 wrote to memory of 2588 2680 7bhhhn.exe 048800.exe PID 2680 wrote to memory of 2588 2680 7bhhhn.exe 048800.exe PID 2680 wrote to memory of 2588 2680 7bhhhn.exe 048800.exe PID 2588 wrote to memory of 2004 2588 048800.exe 220228.exe PID 2588 wrote to memory of 2004 2588 048800.exe 220228.exe PID 2588 wrote to memory of 2004 2588 048800.exe 220228.exe PID 2588 wrote to memory of 2004 2588 048800.exe 220228.exe PID 2004 wrote to memory of 1696 2004 220228.exe 8628040.exe PID 2004 wrote to memory of 1696 2004 220228.exe 8628040.exe PID 2004 wrote to memory of 1696 2004 220228.exe 8628040.exe PID 2004 wrote to memory of 1696 2004 220228.exe 8628040.exe PID 1696 wrote to memory of 3060 1696 8628040.exe pvddd.exe PID 1696 wrote to memory of 3060 1696 8628040.exe pvddd.exe PID 1696 wrote to memory of 3060 1696 8628040.exe pvddd.exe PID 1696 wrote to memory of 3060 1696 8628040.exe pvddd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe"C:\Users\Admin\AppData\Local\Temp\20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\6066262.exec:\6066262.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\btbtbh.exec:\btbtbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\jvddv.exec:\jvddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\tnbbbh.exec:\tnbbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\bttthn.exec:\bttthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\jdvjd.exec:\jdvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\xrxxlfr.exec:\xrxxlfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\bthntt.exec:\bthntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\vpjpj.exec:\vpjpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\264022.exec:\264022.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\bbbbhh.exec:\bbbbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\7bhhhn.exec:\7bhhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\048800.exec:\048800.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\220228.exec:\220228.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\8628040.exec:\8628040.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\pvddd.exec:\pvddd.exe17⤵
- Executes dropped EXE
PID:3060 -
\??\c:\btnnhb.exec:\btnnhb.exe18⤵
- Executes dropped EXE
PID:1344 -
\??\c:\xxrflrx.exec:\xxrflrx.exe19⤵
- Executes dropped EXE
PID:1912 -
\??\c:\btnbtt.exec:\btnbtt.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\btnntb.exec:\btnntb.exe21⤵
- Executes dropped EXE
PID:2292 -
\??\c:\2488664.exec:\2488664.exe22⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dpvdj.exec:\dpvdj.exe23⤵
- Executes dropped EXE
PID:1020 -
\??\c:\g8062.exec:\g8062.exe24⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xxfxfff.exec:\xxfxfff.exe25⤵
- Executes dropped EXE
PID:960 -
\??\c:\dpjvp.exec:\dpjvp.exe26⤵
- Executes dropped EXE
PID:1036 -
\??\c:\264808.exec:\264808.exe27⤵
- Executes dropped EXE
PID:1112 -
\??\c:\dpvdj.exec:\dpvdj.exe28⤵
- Executes dropped EXE
PID:840 -
\??\c:\m4606.exec:\m4606.exe29⤵
- Executes dropped EXE
PID:2168 -
\??\c:\tnbhtt.exec:\tnbhtt.exe30⤵
- Executes dropped EXE
PID:1956 -
\??\c:\xxllrrx.exec:\xxllrrx.exe31⤵
- Executes dropped EXE
PID:1660 -
\??\c:\5vvvp.exec:\5vvvp.exe32⤵
- Executes dropped EXE
PID:2088 -
\??\c:\bntnhh.exec:\bntnhh.exe33⤵
- Executes dropped EXE
PID:2652 -
\??\c:\6066666.exec:\6066666.exe34⤵
- Executes dropped EXE
PID:2596 -
\??\c:\dvvpp.exec:\dvvpp.exe35⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ththth.exec:\ththth.exe36⤵
- Executes dropped EXE
PID:2664 -
\??\c:\7ntbtb.exec:\7ntbtb.exe37⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rfxxfxf.exec:\rfxxfxf.exe38⤵
- Executes dropped EXE
PID:2884 -
\??\c:\02062.exec:\02062.exe39⤵
- Executes dropped EXE
PID:2568 -
\??\c:\3ntttn.exec:\3ntttn.exe40⤵
- Executes dropped EXE
PID:2944 -
\??\c:\7frlrrr.exec:\7frlrrr.exe41⤵
- Executes dropped EXE
PID:332 -
\??\c:\rflxlff.exec:\rflxlff.exe42⤵
- Executes dropped EXE
PID:2324 -
\??\c:\7nhtnb.exec:\7nhtnb.exe43⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bntbbh.exec:\bntbbh.exe44⤵
- Executes dropped EXE
PID:2928 -
\??\c:\82462.exec:\82462.exe45⤵
- Executes dropped EXE
PID:2924 -
\??\c:\8828400.exec:\8828400.exe46⤵
- Executes dropped EXE
PID:2744 -
\??\c:\q26206.exec:\q26206.exe47⤵
- Executes dropped EXE
PID:920 -
\??\c:\82264.exec:\82264.exe48⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hhbnth.exec:\hhbnth.exe49⤵
- Executes dropped EXE
PID:3064 -
\??\c:\60446.exec:\60446.exe50⤵
- Executes dropped EXE
PID:2976 -
\??\c:\3xxxffl.exec:\3xxxffl.exe51⤵
- Executes dropped EXE
PID:2992 -
\??\c:\224084.exec:\224084.exe52⤵
- Executes dropped EXE
PID:3048 -
\??\c:\3ddpp.exec:\3ddpp.exe53⤵
- Executes dropped EXE
PID:1440 -
\??\c:\tttnbb.exec:\tttnbb.exe54⤵
- Executes dropped EXE
PID:2980 -
\??\c:\7btbhb.exec:\7btbhb.exe55⤵
- Executes dropped EXE
PID:3060 -
\??\c:\jdvjv.exec:\jdvjv.exe56⤵
- Executes dropped EXE
PID:2188 -
\??\c:\006846.exec:\006846.exe57⤵
- Executes dropped EXE
PID:2096 -
\??\c:\864428.exec:\864428.exe58⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jjpjj.exec:\jjpjj.exe59⤵
- Executes dropped EXE
PID:2276 -
\??\c:\822884.exec:\822884.exe60⤵
- Executes dropped EXE
PID:2448 -
\??\c:\i244628.exec:\i244628.exe61⤵
- Executes dropped EXE
PID:1860 -
\??\c:\rxrflrf.exec:\rxrflrf.exe62⤵
- Executes dropped EXE
PID:2616 -
\??\c:\48622.exec:\48622.exe63⤵
- Executes dropped EXE
PID:2332 -
\??\c:\4468044.exec:\4468044.exe64⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nttbbn.exec:\nttbbn.exe65⤵
- Executes dropped EXE
PID:1480 -
\??\c:\26468.exec:\26468.exe66⤵PID:888
-
\??\c:\6404040.exec:\6404040.exe67⤵PID:2040
-
\??\c:\lrxrxxf.exec:\lrxrxxf.exe68⤵PID:2620
-
\??\c:\0088002.exec:\0088002.exe69⤵PID:2316
-
\??\c:\llrrxfr.exec:\llrrxfr.exe70⤵PID:2064
-
\??\c:\djvjj.exec:\djvjj.exe71⤵PID:892
-
\??\c:\q64688.exec:\q64688.exe72⤵PID:884
-
\??\c:\04008.exec:\04008.exe73⤵PID:1268
-
\??\c:\0444062.exec:\0444062.exe74⤵PID:2176
-
\??\c:\ntbnbt.exec:\ntbnbt.exe75⤵PID:2404
-
\??\c:\rlflrxf.exec:\rlflrxf.exe76⤵PID:1608
-
\??\c:\0244200.exec:\0244200.exe77⤵PID:2012
-
\??\c:\4464668.exec:\4464668.exe78⤵PID:1916
-
\??\c:\880606.exec:\880606.exe79⤵PID:2440
-
\??\c:\lxfxllr.exec:\lxfxllr.exe80⤵PID:2968
-
\??\c:\pjdvd.exec:\pjdvd.exe81⤵PID:2820
-
\??\c:\848860.exec:\848860.exe82⤵PID:788
-
\??\c:\9frrfxl.exec:\9frrfxl.exe83⤵PID:332
-
\??\c:\5vjvd.exec:\5vjvd.exe84⤵PID:2716
-
\??\c:\002284.exec:\002284.exe85⤵PID:2380
-
\??\c:\ddvpj.exec:\ddvpj.exe86⤵PID:2868
-
\??\c:\3bnnnn.exec:\3bnnnn.exe87⤵PID:1588
-
\??\c:\vvjjj.exec:\vvjjj.exe88⤵PID:2744
-
\??\c:\9xxxrrf.exec:\9xxxrrf.exe89⤵PID:1920
-
\??\c:\llflrfx.exec:\llflrfx.exe90⤵PID:1856
-
\??\c:\rxfxllx.exec:\rxfxllx.exe91⤵PID:2984
-
\??\c:\064488.exec:\064488.exe92⤵PID:3068
-
\??\c:\jjvdj.exec:\jjvdj.exe93⤵PID:1752
-
\??\c:\dvjjj.exec:\dvjjj.exe94⤵PID:1696
-
\??\c:\4462060.exec:\4462060.exe95⤵PID:1440
-
\??\c:\bhhtht.exec:\bhhtht.exe96⤵PID:3028
-
\??\c:\9llrfff.exec:\9llrfff.exe97⤵PID:1448
-
\??\c:\42840.exec:\42840.exe98⤵PID:2188
-
\??\c:\ppvjv.exec:\ppvjv.exe99⤵PID:3012
-
\??\c:\hhtttt.exec:\hhtttt.exe100⤵PID:2284
-
\??\c:\vvvvd.exec:\vvvvd.exe101⤵PID:2292
-
\??\c:\9hhnnt.exec:\9hhnnt.exe102⤵PID:2240
-
\??\c:\4800222.exec:\4800222.exe103⤵PID:1700
-
\??\c:\264666.exec:\264666.exe104⤵PID:2344
-
\??\c:\626288.exec:\626288.exe105⤵PID:1384
-
\??\c:\c262402.exec:\c262402.exe106⤵PID:380
-
\??\c:\nhnnbb.exec:\nhnnbb.exe107⤵PID:1068
-
\??\c:\7pdjj.exec:\7pdjj.exe108⤵PID:1036
-
\??\c:\tthbhn.exec:\tthbhn.exe109⤵PID:840
-
\??\c:\o044006.exec:\o044006.exe110⤵PID:304
-
\??\c:\88848.exec:\88848.exe111⤵PID:1844
-
\??\c:\0648444.exec:\0648444.exe112⤵PID:1612
-
\??\c:\88202.exec:\88202.exe113⤵PID:1012
-
\??\c:\rlxflll.exec:\rlxflll.exe114⤵PID:1660
-
\??\c:\1xrlrll.exec:\1xrlrll.exe115⤵PID:2056
-
\??\c:\tnnntb.exec:\tnnntb.exe116⤵PID:1204
-
\??\c:\9tnbbh.exec:\9tnbbh.exe117⤵PID:1652
-
\??\c:\7rllllr.exec:\7rllllr.exe118⤵PID:2172
-
\??\c:\1bnttt.exec:\1bnttt.exe119⤵PID:1984
-
\??\c:\lfflxlr.exec:\lfflxlr.exe120⤵PID:2396
-
\??\c:\22628.exec:\22628.exe121⤵PID:2612
-
\??\c:\4822828.exec:\4822828.exe122⤵PID:2968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-