Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-12-2024 22:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe
-
Size
53KB
-
MD5
864bf3fac5dde4189a2ec07d7f651cc5
-
SHA1
23d2923fc8be4ae09ccbc158112fbe5c57b6bafb
-
SHA256
7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b
-
SHA512
1b74a2052d9f37771b672ec064b383742abf0b110b17ab1bf023d4444ba1bedc23dc9777e532d6b81bb8886be412fcc90a7dafe73b355a8c6670151a82126bdc
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlm:0cdpeeBSHHMHLf9RyIB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 60 IoCs
resource yara_rule behavioral1/memory/2756-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-54-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2056-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-127-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2928-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-137-0x00000000002F0000-0x0000000000319000-memory.dmp family_blackmoon behavioral1/memory/1760-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-147-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/588-158-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2384-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1876-186-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1876-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/408-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-205-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2332-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/696-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/696-232-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/1604-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-334-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-391-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2620-398-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-410-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1352-420-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-440-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2332-478-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-505-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-524-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2012-549-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-556-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1608-563-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2884-649-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/700-680-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1980-689-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/3068-696-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/1444-760-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2424-794-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2828-814-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2368-873-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2640-923-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2372-959-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1040-993-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1040-1008-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/636-1019-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-1032-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1976-1058-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2816 xrrrrfr.exe 2684 thtttt.exe 2652 pppjj.exe 2720 vpvpv.exe 2560 9frlfff.exe 2056 9tbhnt.exe 1240 pppvv.exe 2252 vvpvp.exe 2648 lllllxx.exe 2936 hbnttt.exe 1036 hbnbbt.exe 2844 dddjd.exe 2928 9vjdj.exe 3068 frfxrxr.exe 1760 ffflxxr.exe 588 3nhhnn.exe 2384 jjvjj.exe 2120 llxlxfl.exe 1876 rlrflxl.exe 408 7hthhb.exe 2332 bbbhhn.exe 1300 jvjjp.exe 1044 ddvvd.exe 696 xrxxfxx.exe 2004 tntbhh.exe 772 btbbtt.exe 1004 dvdvv.exe 1572 5lflrrx.exe 1984 flrrrrr.exe 2508 hhnbhh.exe 3004 tthttt.exe 1604 jjppj.exe 2708 jjdvv.exe 2576 5flxxrr.exe 2584 lfllxrx.exe 2728 nbntbb.exe 2552 hhhhnn.exe 2368 jvvvj.exe 2108 5pddd.exe 644 rlrrrrf.exe 2412 3lrrxxx.exe 2084 thnthb.exe 2648 thbtnn.exe 2976 5djdj.exe 2792 3vpjp.exe 692 9xfxrrx.exe 2876 xrfrlll.exe 2620 tbhhnt.exe 2060 nnbbnh.exe 1352 nhbhhb.exe 1760 pjvvj.exe 588 pjvpd.exe 2220 rlxxfff.exe 2224 7xrrxrx.exe 2124 bttthb.exe 2400 tntnnn.exe 1088 3vddj.exe 1956 7djjj.exe 2332 lrxxxxr.exe 852 xlfrrrf.exe 968 nntbhb.exe 944 hbhhbt.exe 3008 hbhbth.exe 1732 ppdjj.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2816 2756 7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe 30 PID 2756 wrote to memory of 2816 2756 7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe 30 PID 2756 wrote to memory of 2816 2756 7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe 30 PID 2756 wrote to memory of 2816 2756 7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe 30 PID 2816 wrote to memory of 2684 2816 xrrrrfr.exe 31 PID 2816 wrote to memory of 2684 2816 xrrrrfr.exe 31 PID 2816 wrote to memory of 2684 2816 xrrrrfr.exe 31 PID 2816 wrote to memory of 2684 2816 xrrrrfr.exe 31 PID 2684 wrote to memory of 2652 2684 thtttt.exe 32 PID 2684 wrote to memory of 2652 2684 thtttt.exe 32 PID 2684 wrote to memory of 2652 2684 thtttt.exe 32 PID 2684 wrote to memory of 2652 2684 thtttt.exe 32 PID 2652 wrote to memory of 2720 2652 pppjj.exe 33 PID 2652 wrote to memory of 2720 2652 pppjj.exe 33 PID 2652 wrote to memory of 2720 2652 pppjj.exe 33 PID 2652 wrote to memory of 2720 2652 pppjj.exe 33 PID 2720 wrote to memory of 2560 2720 vpvpv.exe 34 PID 2720 wrote to memory of 2560 2720 vpvpv.exe 34 PID 2720 wrote to memory of 2560 2720 vpvpv.exe 34 PID 2720 wrote to memory of 2560 2720 vpvpv.exe 34 PID 2560 wrote to memory of 2056 2560 9frlfff.exe 35 PID 2560 wrote to memory of 2056 2560 9frlfff.exe 35 PID 2560 wrote to memory of 2056 2560 9frlfff.exe 35 PID 2560 wrote to memory of 2056 2560 9frlfff.exe 35 PID 2056 wrote to memory of 1240 2056 9tbhnt.exe 36 PID 2056 wrote to memory of 1240 2056 9tbhnt.exe 36 PID 2056 wrote to memory of 1240 2056 9tbhnt.exe 36 PID 2056 wrote to memory of 1240 2056 9tbhnt.exe 36 PID 1240 wrote to memory of 2252 1240 pppvv.exe 37 PID 1240 wrote to memory of 2252 1240 pppvv.exe 37 PID 1240 wrote to memory of 2252 1240 pppvv.exe 37 PID 1240 wrote to memory of 2252 1240 pppvv.exe 37 PID 2252 wrote to memory of 2648 2252 vvpvp.exe 38 PID 2252 wrote to memory of 2648 2252 vvpvp.exe 38 PID 2252 wrote to memory of 2648 2252 vvpvp.exe 38 PID 2252 wrote to memory of 2648 2252 vvpvp.exe 38 PID 2648 wrote to memory of 2936 2648 lllllxx.exe 39 PID 2648 wrote to memory of 2936 2648 lllllxx.exe 39 PID 2648 wrote to memory of 2936 2648 lllllxx.exe 39 PID 2648 wrote to memory of 2936 2648 lllllxx.exe 39 PID 2936 wrote to memory of 1036 2936 hbnttt.exe 40 PID 2936 wrote to memory of 1036 2936 hbnttt.exe 40 PID 2936 wrote to memory of 1036 2936 hbnttt.exe 40 PID 2936 wrote to memory of 1036 2936 hbnttt.exe 40 PID 1036 wrote to memory of 2844 1036 hbnbbt.exe 41 PID 1036 wrote to memory of 2844 1036 hbnbbt.exe 41 PID 1036 wrote to memory of 2844 1036 hbnbbt.exe 41 PID 1036 wrote to memory of 2844 1036 hbnbbt.exe 41 PID 2844 wrote to memory of 2928 2844 dddjd.exe 42 PID 2844 wrote to memory of 2928 2844 dddjd.exe 42 PID 2844 wrote to memory of 2928 2844 dddjd.exe 42 PID 2844 wrote to memory of 2928 2844 dddjd.exe 42 PID 2928 wrote to memory of 3068 2928 9vjdj.exe 43 PID 2928 wrote to memory of 3068 2928 9vjdj.exe 43 PID 2928 wrote to memory of 3068 2928 9vjdj.exe 43 PID 2928 wrote to memory of 3068 2928 9vjdj.exe 43 PID 3068 wrote to memory of 1760 3068 frfxrxr.exe 44 PID 3068 wrote to memory of 1760 3068 frfxrxr.exe 44 PID 3068 wrote to memory of 1760 3068 frfxrxr.exe 44 PID 3068 wrote to memory of 1760 3068 frfxrxr.exe 44 PID 1760 wrote to memory of 588 1760 ffflxxr.exe 45 PID 1760 wrote to memory of 588 1760 ffflxxr.exe 45 PID 1760 wrote to memory of 588 1760 ffflxxr.exe 45 PID 1760 wrote to memory of 588 1760 ffflxxr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe"C:\Users\Admin\AppData\Local\Temp\7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\xrrrrfr.exec:\xrrrrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\thtttt.exec:\thtttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\pppjj.exec:\pppjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vpvpv.exec:\vpvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\9frlfff.exec:\9frlfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\9tbhnt.exec:\9tbhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\pppvv.exec:\pppvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\vvpvp.exec:\vvpvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\lllllxx.exec:\lllllxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hbnttt.exec:\hbnttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\hbnbbt.exec:\hbnbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\dddjd.exec:\dddjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\9vjdj.exec:\9vjdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\frfxrxr.exec:\frfxrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\ffflxxr.exec:\ffflxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\3nhhnn.exec:\3nhhnn.exe17⤵
- Executes dropped EXE
PID:588 -
\??\c:\jjvjj.exec:\jjvjj.exe18⤵
- Executes dropped EXE
PID:2384 -
\??\c:\llxlxfl.exec:\llxlxfl.exe19⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rlrflxl.exec:\rlrflxl.exe20⤵
- Executes dropped EXE
PID:1876 -
\??\c:\7hthhb.exec:\7hthhb.exe21⤵
- Executes dropped EXE
PID:408 -
\??\c:\bbbhhn.exec:\bbbhhn.exe22⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jvjjp.exec:\jvjjp.exe23⤵
- Executes dropped EXE
PID:1300 -
\??\c:\ddvvd.exec:\ddvvd.exe24⤵
- Executes dropped EXE
PID:1044 -
\??\c:\xrxxfxx.exec:\xrxxfxx.exe25⤵
- Executes dropped EXE
PID:696 -
\??\c:\tntbhh.exec:\tntbhh.exe26⤵
- Executes dropped EXE
PID:2004 -
\??\c:\btbbtt.exec:\btbbtt.exe27⤵
- Executes dropped EXE
PID:772 -
\??\c:\dvdvv.exec:\dvdvv.exe28⤵
- Executes dropped EXE
PID:1004 -
\??\c:\5lflrrx.exec:\5lflrrx.exe29⤵
- Executes dropped EXE
PID:1572 -
\??\c:\flrrrrr.exec:\flrrrrr.exe30⤵
- Executes dropped EXE
PID:1984 -
\??\c:\hhnbhh.exec:\hhnbhh.exe31⤵
- Executes dropped EXE
PID:2508 -
\??\c:\tthttt.exec:\tthttt.exe32⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jjppj.exec:\jjppj.exe33⤵
- Executes dropped EXE
PID:1604 -
\??\c:\jjdvv.exec:\jjdvv.exe34⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5flxxrr.exec:\5flxxrr.exe35⤵
- Executes dropped EXE
PID:2576 -
\??\c:\lfllxrx.exec:\lfllxrx.exe36⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nbntbb.exec:\nbntbb.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\hhhhnn.exec:\hhhhnn.exe38⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jvvvj.exec:\jvvvj.exe39⤵
- Executes dropped EXE
PID:2368 -
\??\c:\5pddd.exec:\5pddd.exe40⤵
- Executes dropped EXE
PID:2108 -
\??\c:\rlrrrrf.exec:\rlrrrrf.exe41⤵
- Executes dropped EXE
PID:644 -
\??\c:\3lrrxxx.exec:\3lrrxxx.exe42⤵
- Executes dropped EXE
PID:2412 -
\??\c:\thnthb.exec:\thnthb.exe43⤵
- Executes dropped EXE
PID:2084 -
\??\c:\thbtnn.exec:\thbtnn.exe44⤵
- Executes dropped EXE
PID:2648 -
\??\c:\5djdj.exec:\5djdj.exe45⤵
- Executes dropped EXE
PID:2976 -
\??\c:\3vpjp.exec:\3vpjp.exe46⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9xfxrrx.exec:\9xfxrrx.exe47⤵
- Executes dropped EXE
PID:692 -
\??\c:\xrfrlll.exec:\xrfrlll.exe48⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tbhhnt.exec:\tbhhnt.exe49⤵
- Executes dropped EXE
PID:2620 -
\??\c:\nnbbnh.exec:\nnbbnh.exe50⤵
- Executes dropped EXE
PID:2060 -
\??\c:\nhbhhb.exec:\nhbhhb.exe51⤵
- Executes dropped EXE
PID:1352 -
\??\c:\pjvvj.exec:\pjvvj.exe52⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pjvpd.exec:\pjvpd.exe53⤵
- Executes dropped EXE
PID:588 -
\??\c:\rlxxfff.exec:\rlxxfff.exe54⤵
- Executes dropped EXE
PID:2220 -
\??\c:\7xrrxrx.exec:\7xrrxrx.exe55⤵
- Executes dropped EXE
PID:2224 -
\??\c:\bttthb.exec:\bttthb.exe56⤵
- Executes dropped EXE
PID:2124 -
\??\c:\tntnnn.exec:\tntnnn.exe57⤵
- Executes dropped EXE
PID:2400 -
\??\c:\3vddj.exec:\3vddj.exe58⤵
- Executes dropped EXE
PID:1088 -
\??\c:\7djjj.exec:\7djjj.exe59⤵
- Executes dropped EXE
PID:1956 -
\??\c:\lrxxxxr.exec:\lrxxxxr.exe60⤵
- Executes dropped EXE
PID:2332 -
\??\c:\xlfrrrf.exec:\xlfrrrf.exe61⤵
- Executes dropped EXE
PID:852 -
\??\c:\nntbhb.exec:\nntbhb.exe62⤵
- Executes dropped EXE
PID:968 -
\??\c:\hbhhbt.exec:\hbhhbt.exe63⤵
- Executes dropped EXE
PID:944 -
\??\c:\hbhbth.exec:\hbhbth.exe64⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ppdjj.exec:\ppdjj.exe65⤵
- Executes dropped EXE
PID:1732 -
\??\c:\3vdjp.exec:\3vdjp.exe66⤵PID:1368
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe67⤵PID:1512
-
\??\c:\lfxxffl.exec:\lfxxffl.exe68⤵PID:1016
-
\??\c:\1httbb.exec:\1httbb.exe69⤵PID:1572
-
\??\c:\5bhnnn.exec:\5bhnnn.exe70⤵PID:2740
-
\??\c:\ppvpp.exec:\ppvpp.exe71⤵PID:2012
-
\??\c:\jjppv.exec:\jjppv.exe72⤵PID:2764
-
\??\c:\lxrxrlr.exec:\lxrxrlr.exe73⤵PID:1608
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe74⤵PID:2832
-
\??\c:\bbhhbh.exec:\bbhhbh.exe75⤵PID:2708
-
\??\c:\tthttt.exec:\tthttt.exe76⤵PID:2576
-
\??\c:\vpddd.exec:\vpddd.exe77⤵PID:1528
-
\??\c:\9vjpv.exec:\9vjpv.exe78⤵PID:2728
-
\??\c:\rlxxxrf.exec:\rlxxxrf.exe79⤵PID:2612
-
\??\c:\1xlrlll.exec:\1xlrlll.exe80⤵PID:2624
-
\??\c:\bttthh.exec:\bttthh.exe81⤵PID:2096
-
\??\c:\hbhttb.exec:\hbhttb.exe82⤵PID:2588
-
\??\c:\tnnhbb.exec:\tnnhbb.exe83⤵PID:1296
-
\??\c:\pjvdj.exec:\pjvdj.exe84⤵PID:2396
-
\??\c:\vpvvd.exec:\vpvvd.exe85⤵PID:1388
-
\??\c:\xxfrxxf.exec:\xxfrxxf.exe86⤵PID:2648
-
\??\c:\fffxffr.exec:\fffxffr.exe87⤵PID:2884
-
\??\c:\bttbhn.exec:\bttbhn.exe88⤵PID:2792
-
\??\c:\5nhnhb.exec:\5nhnhb.exe89⤵PID:2924
-
\??\c:\pddvv.exec:\pddvv.exe90⤵PID:3056
-
\??\c:\jjvvv.exec:\jjvvv.exe91⤵PID:3068
-
\??\c:\9lrrlll.exec:\9lrrlll.exe92⤵PID:700
-
\??\c:\llrfffr.exec:\llrfffr.exe93⤵PID:1980
-
\??\c:\xxfxrlr.exec:\xxfxrlr.exe94⤵PID:1408
-
\??\c:\ttbhnn.exec:\ttbhnn.exe95⤵PID:588
-
\??\c:\5hnbbt.exec:\5hnbbt.exe96⤵PID:2220
-
\??\c:\djdjd.exec:\djdjd.exe97⤵PID:2380
-
\??\c:\llxflrl.exec:\llxflrl.exe98⤵PID:2124
-
\??\c:\fxlrrrl.exec:\fxlrrrl.exe99⤵PID:444
-
\??\c:\nhbhbb.exec:\nhbhbb.exe100⤵PID:1088
-
\??\c:\bbttbb.exec:\bbttbb.exe101⤵PID:1444
-
\??\c:\jdpvp.exec:\jdpvp.exe102⤵PID:864
-
\??\c:\vjvdv.exec:\vjvdv.exe103⤵PID:916
-
\??\c:\lfxrxrf.exec:\lfxrxrf.exe104⤵PID:1064
-
\??\c:\fflrffr.exec:\fflrffr.exe105⤵PID:2268
-
\??\c:\3ttbbt.exec:\3ttbbt.exe106⤵PID:3008
-
\??\c:\9nhhbt.exec:\9nhhbt.exe107⤵PID:2476
-
\??\c:\3jvpp.exec:\3jvpp.exe108⤵PID:2988
-
\??\c:\3jvpp.exec:\3jvpp.exe109⤵PID:1004
-
\??\c:\jjvdj.exec:\jjvdj.exe110⤵PID:2424
-
\??\c:\rrflrrf.exec:\rrflrrf.exe111⤵PID:2468
-
\??\c:\ffrlxxf.exec:\ffrlxxf.exe112⤵PID:1776
-
\??\c:\3tbhnn.exec:\3tbhnn.exe113⤵PID:2828
-
\??\c:\pvjjj.exec:\pvjjj.exe114⤵PID:2816
-
\??\c:\7djpp.exec:\7djpp.exe115⤵PID:2824
-
\??\c:\fxfxffl.exec:\fxfxffl.exe116⤵PID:2684
-
\??\c:\ttntbh.exec:\ttntbh.exe117⤵PID:1236
-
\??\c:\5bnhbh.exec:\5bnhbh.exe118⤵PID:2652
-
\??\c:\vpvpv.exec:\vpvpv.exe119⤵PID:2600
-
\??\c:\pjjjj.exec:\pjjjj.exe120⤵PID:2564
-
\??\c:\rlxrffr.exec:\rlxrffr.exe121⤵PID:2628
-
\??\c:\5frxxxf.exec:\5frxxxf.exe122⤵PID:2368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-