Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 03:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
acbd911dc571c1941f864db554f136f299d244c8063e17920a29116354b8b701N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
acbd911dc571c1941f864db554f136f299d244c8063e17920a29116354b8b701N.exe
-
Size
456KB
-
MD5
53a9ad231bec6142a4da58c197433f60
-
SHA1
f9d86c91c6f4c4ac49fd92484e77c4d015e23447
-
SHA256
acbd911dc571c1941f864db554f136f299d244c8063e17920a29116354b8b701
-
SHA512
357b0c380f675508a5ada860d6a29bdb999b6d3a640569807e750829facd74b2c9567686d0e5b44a09e8607ce3804b0b59e1c1e35a61bcc812e44f7243082b32
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2724-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-24-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2412-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-156-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2176-180-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2528-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-253-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2444-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-279-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2520-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-460-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1560-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-541-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2668-552-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2800-616-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2604-644-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2920-643-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2760-722-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2388-752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-759-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2724 2606880.exe 2964 pdvdj.exe 2848 djvvj.exe 2412 608062.exe 2720 0866624.exe 2600 42006.exe 3052 7nbtbh.exe 1924 2000644.exe 2096 g8602.exe 2904 fxrxxff.exe 2532 5hbnbh.exe 2456 6602404.exe 1340 vpdjv.exe 2912 0800228.exe 2680 5nhnnt.exe 268 04246.exe 620 nnhbht.exe 2188 6080628.exe 2176 2088040.exe 2204 9pdpj.exe 2528 00662.exe 3036 264022.exe 1804 486806.exe 1676 xrllxxf.exe 2016 0462668.exe 2340 jdpvd.exe 2024 rlrrxxf.exe 2040 k66206.exe 2444 5nbttt.exe 1632 nntntn.exe 2520 ffxlxxl.exe 2712 08684.exe 2688 448866.exe 1584 vpjpp.exe 2876 e08084.exe 2848 8202408.exe 2196 i208006.exe 2624 4262468.exe 2628 rlxlrxf.exe 2600 4866486.exe 1356 a8680.exe 2136 m8660.exe 1976 fxfxflx.exe 1412 fxrfrxr.exe 2980 2262468.exe 1792 lfxfrlf.exe 348 426800.exe 944 bbbbhn.exe 1480 6422002.exe 1592 4862008.exe 1132 422660.exe 2680 86008.exe 1040 48620.exe 2396 tbnhtb.exe 1984 jjdpj.exe 464 e24082.exe 1292 2644220.exe 2468 nhbtbh.exe 1560 00404.exe 1744 08846.exe 3064 o868406.exe 1536 nhhhnn.exe 2440 rxxxxrf.exe 1860 420400.exe -
resource yara_rule behavioral1/memory/2724-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-180-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2528-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-399-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1480-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-722-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2388-752-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86628.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60802.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 042040.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 486088.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a4846.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0424686.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2088040.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28646.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 820684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 048084.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2724 2192 acbd911dc571c1941f864db554f136f299d244c8063e17920a29116354b8b701N.exe 30 PID 2192 wrote to memory of 2724 2192 acbd911dc571c1941f864db554f136f299d244c8063e17920a29116354b8b701N.exe 30 PID 2192 wrote to memory of 2724 2192 acbd911dc571c1941f864db554f136f299d244c8063e17920a29116354b8b701N.exe 30 PID 2192 wrote to memory of 2724 2192 acbd911dc571c1941f864db554f136f299d244c8063e17920a29116354b8b701N.exe 30 PID 2724 wrote to memory of 2964 2724 2606880.exe 31 PID 2724 wrote to memory of 2964 2724 2606880.exe 31 PID 2724 wrote to memory of 2964 2724 2606880.exe 31 PID 2724 wrote to memory of 2964 2724 2606880.exe 31 PID 2964 wrote to memory of 2848 2964 pdvdj.exe 32 PID 2964 wrote to memory of 2848 2964 pdvdj.exe 32 PID 2964 wrote to memory of 2848 2964 pdvdj.exe 32 PID 2964 wrote to memory of 2848 2964 pdvdj.exe 32 PID 2848 wrote to memory of 2412 2848 djvvj.exe 33 PID 2848 wrote to memory of 2412 2848 djvvj.exe 33 PID 2848 wrote to memory of 2412 2848 djvvj.exe 33 PID 2848 wrote to memory of 2412 2848 djvvj.exe 33 PID 2412 wrote to memory of 2720 2412 608062.exe 34 PID 2412 wrote to memory of 2720 2412 608062.exe 34 PID 2412 wrote to memory of 2720 2412 608062.exe 34 PID 2412 wrote to memory of 2720 2412 608062.exe 34 PID 2720 wrote to memory of 2600 2720 0866624.exe 35 PID 2720 wrote to memory of 2600 2720 0866624.exe 35 PID 2720 wrote to memory of 2600 2720 0866624.exe 35 PID 2720 wrote to memory of 2600 2720 0866624.exe 35 PID 2600 wrote to memory of 3052 2600 42006.exe 36 PID 2600 wrote to memory of 3052 2600 42006.exe 36 PID 2600 wrote to memory of 3052 2600 42006.exe 36 PID 2600 wrote to memory of 3052 2600 42006.exe 36 PID 3052 wrote to memory of 1924 3052 7nbtbh.exe 37 PID 3052 wrote to memory of 1924 3052 7nbtbh.exe 37 PID 3052 wrote to memory of 1924 3052 7nbtbh.exe 37 PID 3052 wrote to memory of 1924 3052 7nbtbh.exe 37 PID 1924 wrote to memory of 2096 1924 2000644.exe 38 PID 1924 wrote to memory of 2096 1924 2000644.exe 38 PID 1924 wrote to memory of 2096 1924 2000644.exe 38 PID 1924 wrote to memory of 2096 1924 2000644.exe 38 PID 2096 wrote to memory of 2904 2096 g8602.exe 39 PID 2096 wrote to memory of 2904 2096 g8602.exe 39 PID 2096 wrote to memory of 2904 2096 g8602.exe 39 PID 2096 wrote to memory of 2904 2096 g8602.exe 39 PID 2904 wrote to memory of 2532 2904 fxrxxff.exe 40 PID 2904 wrote to memory of 2532 2904 fxrxxff.exe 40 PID 2904 wrote to memory of 2532 2904 fxrxxff.exe 40 PID 2904 wrote to memory of 2532 2904 fxrxxff.exe 40 PID 2532 wrote to memory of 2456 2532 5hbnbh.exe 41 PID 2532 wrote to memory of 2456 2532 5hbnbh.exe 41 PID 2532 wrote to memory of 2456 2532 5hbnbh.exe 41 PID 2532 wrote to memory of 2456 2532 5hbnbh.exe 41 PID 2456 wrote to memory of 1340 2456 6602404.exe 42 PID 2456 wrote to memory of 1340 2456 6602404.exe 42 PID 2456 wrote to memory of 1340 2456 6602404.exe 42 PID 2456 wrote to memory of 1340 2456 6602404.exe 42 PID 1340 wrote to memory of 2912 1340 vpdjv.exe 43 PID 1340 wrote to memory of 2912 1340 vpdjv.exe 43 PID 1340 wrote to memory of 2912 1340 vpdjv.exe 43 PID 1340 wrote to memory of 2912 1340 vpdjv.exe 43 PID 2912 wrote to memory of 2680 2912 0800228.exe 44 PID 2912 wrote to memory of 2680 2912 0800228.exe 44 PID 2912 wrote to memory of 2680 2912 0800228.exe 44 PID 2912 wrote to memory of 2680 2912 0800228.exe 44 PID 2680 wrote to memory of 268 2680 5nhnnt.exe 45 PID 2680 wrote to memory of 268 2680 5nhnnt.exe 45 PID 2680 wrote to memory of 268 2680 5nhnnt.exe 45 PID 2680 wrote to memory of 268 2680 5nhnnt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\acbd911dc571c1941f864db554f136f299d244c8063e17920a29116354b8b701N.exe"C:\Users\Admin\AppData\Local\Temp\acbd911dc571c1941f864db554f136f299d244c8063e17920a29116354b8b701N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\2606880.exec:\2606880.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\pdvdj.exec:\pdvdj.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\djvvj.exec:\djvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\608062.exec:\608062.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\0866624.exec:\0866624.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\42006.exec:\42006.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\7nbtbh.exec:\7nbtbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\2000644.exec:\2000644.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\g8602.exec:\g8602.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\fxrxxff.exec:\fxrxxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\5hbnbh.exec:\5hbnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\6602404.exec:\6602404.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\vpdjv.exec:\vpdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\0800228.exec:\0800228.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\5nhnnt.exec:\5nhnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\04246.exec:\04246.exe17⤵
- Executes dropped EXE
PID:268 -
\??\c:\nnhbht.exec:\nnhbht.exe18⤵
- Executes dropped EXE
PID:620 -
\??\c:\6080628.exec:\6080628.exe19⤵
- Executes dropped EXE
PID:2188 -
\??\c:\2088040.exec:\2088040.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2176 -
\??\c:\9pdpj.exec:\9pdpj.exe21⤵
- Executes dropped EXE
PID:2204 -
\??\c:\00662.exec:\00662.exe22⤵
- Executes dropped EXE
PID:2528 -
\??\c:\264022.exec:\264022.exe23⤵
- Executes dropped EXE
PID:3036 -
\??\c:\486806.exec:\486806.exe24⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xrllxxf.exec:\xrllxxf.exe25⤵
- Executes dropped EXE
PID:1676 -
\??\c:\0462668.exec:\0462668.exe26⤵
- Executes dropped EXE
PID:2016 -
\??\c:\jdpvd.exec:\jdpvd.exe27⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe28⤵
- Executes dropped EXE
PID:2024 -
\??\c:\k66206.exec:\k66206.exe29⤵
- Executes dropped EXE
PID:2040 -
\??\c:\5nbttt.exec:\5nbttt.exe30⤵
- Executes dropped EXE
PID:2444 -
\??\c:\nntntn.exec:\nntntn.exe31⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ffxlxxl.exec:\ffxlxxl.exe32⤵
- Executes dropped EXE
PID:2520 -
\??\c:\08684.exec:\08684.exe33⤵
- Executes dropped EXE
PID:2712 -
\??\c:\448866.exec:\448866.exe34⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vpjpp.exec:\vpjpp.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\e08084.exec:\e08084.exe36⤵
- Executes dropped EXE
PID:2876 -
\??\c:\8202408.exec:\8202408.exe37⤵
- Executes dropped EXE
PID:2848 -
\??\c:\i208006.exec:\i208006.exe38⤵
- Executes dropped EXE
PID:2196 -
\??\c:\4262468.exec:\4262468.exe39⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rlxlrxf.exec:\rlxlrxf.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\4866486.exec:\4866486.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\a8680.exec:\a8680.exe42⤵
- Executes dropped EXE
PID:1356 -
\??\c:\m8660.exec:\m8660.exe43⤵
- Executes dropped EXE
PID:2136 -
\??\c:\fxfxflx.exec:\fxfxflx.exe44⤵
- Executes dropped EXE
PID:1976 -
\??\c:\fxrfrxr.exec:\fxrfrxr.exe45⤵
- Executes dropped EXE
PID:1412 -
\??\c:\2262468.exec:\2262468.exe46⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lfxfrlf.exec:\lfxfrlf.exe47⤵
- Executes dropped EXE
PID:1792 -
\??\c:\426800.exec:\426800.exe48⤵
- Executes dropped EXE
PID:348 -
\??\c:\bbbbhn.exec:\bbbbhn.exe49⤵
- Executes dropped EXE
PID:944 -
\??\c:\6422002.exec:\6422002.exe50⤵
- Executes dropped EXE
PID:1480 -
\??\c:\4862008.exec:\4862008.exe51⤵
- Executes dropped EXE
PID:1592 -
\??\c:\422660.exec:\422660.exe52⤵
- Executes dropped EXE
PID:1132 -
\??\c:\86008.exec:\86008.exe53⤵
- Executes dropped EXE
PID:2680 -
\??\c:\48620.exec:\48620.exe54⤵
- Executes dropped EXE
PID:1040 -
\??\c:\tbnhtb.exec:\tbnhtb.exe55⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jjdpj.exec:\jjdpj.exe56⤵
- Executes dropped EXE
PID:1984 -
\??\c:\e24082.exec:\e24082.exe57⤵
- Executes dropped EXE
PID:464 -
\??\c:\2644220.exec:\2644220.exe58⤵
- Executes dropped EXE
PID:1292 -
\??\c:\nhbtbh.exec:\nhbtbh.exe59⤵
- Executes dropped EXE
PID:2468 -
\??\c:\00404.exec:\00404.exe60⤵
- Executes dropped EXE
PID:1560 -
\??\c:\08846.exec:\08846.exe61⤵
- Executes dropped EXE
PID:1744 -
\??\c:\o868406.exec:\o868406.exe62⤵
- Executes dropped EXE
PID:3064 -
\??\c:\nhhhnn.exec:\nhhhnn.exe63⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rxxxxrf.exec:\rxxxxrf.exe64⤵
- Executes dropped EXE
PID:2440 -
\??\c:\420400.exec:\420400.exe65⤵
- Executes dropped EXE
PID:1860 -
\??\c:\3ppdp.exec:\3ppdp.exe66⤵PID:2668
-
\??\c:\nhbbnb.exec:\nhbbnb.exe67⤵PID:2300
-
\??\c:\xrxrxxl.exec:\xrxrxxl.exe68⤵PID:1200
-
\??\c:\i202068.exec:\i202068.exe69⤵PID:2420
-
\??\c:\604688.exec:\604688.exe70⤵PID:2664
-
\??\c:\200640.exec:\200640.exe71⤵PID:1636
-
\??\c:\046866.exec:\046866.exe72⤵PID:1768
-
\??\c:\o868628.exec:\o868628.exe73⤵PID:3000
-
\??\c:\642868.exec:\642868.exe74⤵PID:2208
-
\??\c:\k48428.exec:\k48428.exe75⤵PID:2792
-
\??\c:\08608.exec:\08608.exe76⤵PID:2800
-
\??\c:\tnhntb.exec:\tnhntb.exe77⤵PID:2964
-
\??\c:\0828028.exec:\0828028.exe78⤵PID:1588
-
\??\c:\868466.exec:\868466.exe79⤵PID:2824
-
\??\c:\xrllxfx.exec:\xrllxfx.exe80⤵PID:2920
-
\??\c:\64280.exec:\64280.exe81⤵PID:2696
-
\??\c:\lflxxrf.exec:\lflxxrf.exe82⤵PID:2616
-
\??\c:\080088.exec:\080088.exe83⤵PID:2604
-
\??\c:\9tnntb.exec:\9tnntb.exe84⤵PID:2216
-
\??\c:\8864246.exec:\8864246.exe85⤵PID:2260
-
\??\c:\1xfrrxf.exec:\1xfrrxf.exe86⤵PID:2000
-
\??\c:\864622.exec:\864622.exe87⤵PID:1976
-
\??\c:\9rfxffx.exec:\9rfxffx.exe88⤵PID:2144
-
\??\c:\vjvvd.exec:\vjvvd.exe89⤵PID:2980
-
\??\c:\26824.exec:\26824.exe90⤵PID:1792
-
\??\c:\m8808.exec:\m8808.exe91⤵PID:1864
-
\??\c:\rlflrxf.exec:\rlflrxf.exe92⤵PID:2032
-
\??\c:\e80460.exec:\e80460.exe93⤵PID:760
-
\??\c:\jdddp.exec:\jdddp.exe94⤵PID:1920
-
\??\c:\ppvjv.exec:\ppvjv.exe95⤵PID:2760
-
\??\c:\42068.exec:\42068.exe96⤵PID:268
-
\??\c:\dvpvd.exec:\dvpvd.exe97⤵PID:1980
-
\??\c:\nnhhhh.exec:\nnhhhh.exe98⤵PID:2396
-
\??\c:\frflrrf.exec:\frflrrf.exe99⤵PID:2388
-
\??\c:\5jddj.exec:\5jddj.exe100⤵PID:2988
-
\??\c:\0480280.exec:\0480280.exe101⤵PID:1704
-
\??\c:\m0424.exec:\m0424.exe102⤵PID:1788
-
\??\c:\0480668.exec:\0480668.exe103⤵PID:2960
-
\??\c:\ppjdp.exec:\ppjdp.exe104⤵PID:1744
-
\??\c:\ddpvp.exec:\ddpvp.exe105⤵PID:1544
-
\??\c:\u644068.exec:\u644068.exe106⤵PID:2008
-
\??\c:\vjvdv.exec:\vjvdv.exe107⤵PID:1564
-
\??\c:\vvjpv.exec:\vvjpv.exe108⤵PID:2304
-
\??\c:\lxrllxx.exec:\lxrllxx.exe109⤵PID:2272
-
\??\c:\86488.exec:\86488.exe110⤵PID:2500
-
\??\c:\vvpjp.exec:\vvpjp.exe111⤵PID:2416
-
\??\c:\vpdvv.exec:\vpdvv.exe112⤵PID:2956
-
\??\c:\lfrxlrx.exec:\lfrxlrx.exe113⤵PID:2200
-
\??\c:\60802.exec:\60802.exe114⤵PID:1076
-
\??\c:\fxrrflf.exec:\fxrrflf.exe115⤵PID:2732
-
\??\c:\60668.exec:\60668.exe116⤵PID:2724
-
\??\c:\pjvdj.exec:\pjvdj.exe117⤵PID:2788
-
\??\c:\k42600.exec:\k42600.exe118⤵PID:2112
-
\??\c:\2684668.exec:\2684668.exe119⤵PID:1556
-
\??\c:\7jjjv.exec:\7jjjv.exe120⤵PID:2592
-
\??\c:\0844268.exec:\0844268.exe121⤵PID:2772
-
\??\c:\hbhhbh.exec:\hbhhbh.exe122⤵PID:2620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-