Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 19:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
086260fd83d89a1bb1914ac053fb4557609fdfc9079912a91e917bd6e55cb783.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
086260fd83d89a1bb1914ac053fb4557609fdfc9079912a91e917bd6e55cb783.exe
-
Size
454KB
-
MD5
860567e1d47173adfb2ede47bd9ebd36
-
SHA1
8b82b66ec7724c6921b8308793705320508b16c4
-
SHA256
086260fd83d89a1bb1914ac053fb4557609fdfc9079912a91e917bd6e55cb783
-
SHA512
9aba77808cad8b9169a0b58583681609f035e125e48203e0cfdc679521917e76ffb1228a04fbce40f58eed6bc5b02fe9c6d3131c148738781680282075f5af84
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeP:q7Tc2NYHUrAwfMp3CDP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2196-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-210-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2072-215-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1536-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-420-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/804-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-530-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2424-579-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-624-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2224-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-714-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2916-755-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2916-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-760-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1960-781-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2640 hbhnbh.exe 2792 042888.exe 2760 0806880.exe 2712 2024862.exe 2668 a8622.exe 2528 1xllxxl.exe 2960 64280.exe 2972 60844.exe 2508 hthhnn.exe 1576 3bntht.exe 2900 bbttbb.exe 3036 64284.exe 1236 btbbtb.exe 1388 046288.exe 2044 thnbhn.exe 1084 jvppv.exe 1820 3dvvd.exe 2156 hhnbbh.exe 1552 224628.exe 2920 666866.exe 2976 60224.exe 752 dvpdj.exe 2072 886806.exe 684 1dvdp.exe 1536 k40404.exe 1996 604628.exe 2484 9jvdp.exe 1412 bnnthh.exe 2260 8428062.exe 988 5jvvd.exe 1756 1pdjj.exe 1620 4240040.exe 2136 hnhnbt.exe 2680 a0880.exe 2896 02444.exe 2792 206228.exe 2560 dpddv.exe 2744 g2828.exe 2996 lxrlxxl.exe 2564 vpjvd.exe 2544 486200.exe 948 04408.exe 2968 0428020.exe 2972 3rflxfl.exe 2100 xxflrxf.exe 376 04224.exe 2708 o440280.exe 2332 60020.exe 1088 1rlllrr.exe 2440 u246666.exe 1508 7dddd.exe 804 8644628.exe 2356 08000.exe 2068 pjdvv.exe 2116 6864888.exe 2208 20846.exe 1724 g8488.exe 1912 c268668.exe 2876 hbhnnn.exe 960 4868220.exe 644 2460046.exe 496 8244602.exe 1760 btbbbb.exe 2852 9lflffx.exe -
resource yara_rule behavioral1/memory/2640-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-304-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2896-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-755-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2916-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-867-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a4284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s2600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vppp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2640 2196 086260fd83d89a1bb1914ac053fb4557609fdfc9079912a91e917bd6e55cb783.exe 30 PID 2196 wrote to memory of 2640 2196 086260fd83d89a1bb1914ac053fb4557609fdfc9079912a91e917bd6e55cb783.exe 30 PID 2196 wrote to memory of 2640 2196 086260fd83d89a1bb1914ac053fb4557609fdfc9079912a91e917bd6e55cb783.exe 30 PID 2196 wrote to memory of 2640 2196 086260fd83d89a1bb1914ac053fb4557609fdfc9079912a91e917bd6e55cb783.exe 30 PID 2640 wrote to memory of 2792 2640 hbhnbh.exe 31 PID 2640 wrote to memory of 2792 2640 hbhnbh.exe 31 PID 2640 wrote to memory of 2792 2640 hbhnbh.exe 31 PID 2640 wrote to memory of 2792 2640 hbhnbh.exe 31 PID 2792 wrote to memory of 2760 2792 042888.exe 32 PID 2792 wrote to memory of 2760 2792 042888.exe 32 PID 2792 wrote to memory of 2760 2792 042888.exe 32 PID 2792 wrote to memory of 2760 2792 042888.exe 32 PID 2760 wrote to memory of 2712 2760 0806880.exe 33 PID 2760 wrote to memory of 2712 2760 0806880.exe 33 PID 2760 wrote to memory of 2712 2760 0806880.exe 33 PID 2760 wrote to memory of 2712 2760 0806880.exe 33 PID 2712 wrote to memory of 2668 2712 2024862.exe 34 PID 2712 wrote to memory of 2668 2712 2024862.exe 34 PID 2712 wrote to memory of 2668 2712 2024862.exe 34 PID 2712 wrote to memory of 2668 2712 2024862.exe 34 PID 2668 wrote to memory of 2528 2668 a8622.exe 35 PID 2668 wrote to memory of 2528 2668 a8622.exe 35 PID 2668 wrote to memory of 2528 2668 a8622.exe 35 PID 2668 wrote to memory of 2528 2668 a8622.exe 35 PID 2528 wrote to memory of 2960 2528 1xllxxl.exe 36 PID 2528 wrote to memory of 2960 2528 1xllxxl.exe 36 PID 2528 wrote to memory of 2960 2528 1xllxxl.exe 36 PID 2528 wrote to memory of 2960 2528 1xllxxl.exe 36 PID 2960 wrote to memory of 2972 2960 64280.exe 37 PID 2960 wrote to memory of 2972 2960 64280.exe 37 PID 2960 wrote to memory of 2972 2960 64280.exe 37 PID 2960 wrote to memory of 2972 2960 64280.exe 37 PID 2972 wrote to memory of 2508 2972 60844.exe 38 PID 2972 wrote to memory of 2508 2972 60844.exe 38 PID 2972 wrote to memory of 2508 2972 60844.exe 38 PID 2972 wrote to memory of 2508 2972 60844.exe 38 PID 2508 wrote to memory of 1576 2508 hthhnn.exe 39 PID 2508 wrote to memory of 1576 2508 hthhnn.exe 39 PID 2508 wrote to memory of 1576 2508 hthhnn.exe 39 PID 2508 wrote to memory of 1576 2508 hthhnn.exe 39 PID 1576 wrote to memory of 2900 1576 3bntht.exe 40 PID 1576 wrote to memory of 2900 1576 3bntht.exe 40 PID 1576 wrote to memory of 2900 1576 3bntht.exe 40 PID 1576 wrote to memory of 2900 1576 3bntht.exe 40 PID 2900 wrote to memory of 3036 2900 bbttbb.exe 41 PID 2900 wrote to memory of 3036 2900 bbttbb.exe 41 PID 2900 wrote to memory of 3036 2900 bbttbb.exe 41 PID 2900 wrote to memory of 3036 2900 bbttbb.exe 41 PID 3036 wrote to memory of 1236 3036 64284.exe 42 PID 3036 wrote to memory of 1236 3036 64284.exe 42 PID 3036 wrote to memory of 1236 3036 64284.exe 42 PID 3036 wrote to memory of 1236 3036 64284.exe 42 PID 1236 wrote to memory of 1388 1236 btbbtb.exe 43 PID 1236 wrote to memory of 1388 1236 btbbtb.exe 43 PID 1236 wrote to memory of 1388 1236 btbbtb.exe 43 PID 1236 wrote to memory of 1388 1236 btbbtb.exe 43 PID 1388 wrote to memory of 2044 1388 046288.exe 44 PID 1388 wrote to memory of 2044 1388 046288.exe 44 PID 1388 wrote to memory of 2044 1388 046288.exe 44 PID 1388 wrote to memory of 2044 1388 046288.exe 44 PID 2044 wrote to memory of 1084 2044 thnbhn.exe 45 PID 2044 wrote to memory of 1084 2044 thnbhn.exe 45 PID 2044 wrote to memory of 1084 2044 thnbhn.exe 45 PID 2044 wrote to memory of 1084 2044 thnbhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\086260fd83d89a1bb1914ac053fb4557609fdfc9079912a91e917bd6e55cb783.exe"C:\Users\Admin\AppData\Local\Temp\086260fd83d89a1bb1914ac053fb4557609fdfc9079912a91e917bd6e55cb783.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\hbhnbh.exec:\hbhnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\042888.exec:\042888.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\0806880.exec:\0806880.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\2024862.exec:\2024862.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\a8622.exec:\a8622.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\1xllxxl.exec:\1xllxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\64280.exec:\64280.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\60844.exec:\60844.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\hthhnn.exec:\hthhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\3bntht.exec:\3bntht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\bbttbb.exec:\bbttbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\64284.exec:\64284.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\btbbtb.exec:\btbbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\046288.exec:\046288.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\thnbhn.exec:\thnbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\jvppv.exec:\jvppv.exe17⤵
- Executes dropped EXE
PID:1084 -
\??\c:\3dvvd.exec:\3dvvd.exe18⤵
- Executes dropped EXE
PID:1820 -
\??\c:\hhnbbh.exec:\hhnbbh.exe19⤵
- Executes dropped EXE
PID:2156 -
\??\c:\224628.exec:\224628.exe20⤵
- Executes dropped EXE
PID:1552 -
\??\c:\666866.exec:\666866.exe21⤵
- Executes dropped EXE
PID:2920 -
\??\c:\60224.exec:\60224.exe22⤵
- Executes dropped EXE
PID:2976 -
\??\c:\dvpdj.exec:\dvpdj.exe23⤵
- Executes dropped EXE
PID:752 -
\??\c:\886806.exec:\886806.exe24⤵
- Executes dropped EXE
PID:2072 -
\??\c:\1dvdp.exec:\1dvdp.exe25⤵
- Executes dropped EXE
PID:684 -
\??\c:\k40404.exec:\k40404.exe26⤵
- Executes dropped EXE
PID:1536 -
\??\c:\604628.exec:\604628.exe27⤵
- Executes dropped EXE
PID:1996 -
\??\c:\9jvdp.exec:\9jvdp.exe28⤵
- Executes dropped EXE
PID:2484 -
\??\c:\bnnthh.exec:\bnnthh.exe29⤵
- Executes dropped EXE
PID:1412 -
\??\c:\8428062.exec:\8428062.exe30⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5jvvd.exec:\5jvvd.exe31⤵
- Executes dropped EXE
PID:988 -
\??\c:\1pdjj.exec:\1pdjj.exe32⤵
- Executes dropped EXE
PID:1756 -
\??\c:\4240040.exec:\4240040.exe33⤵
- Executes dropped EXE
PID:1620 -
\??\c:\hnhnbt.exec:\hnhnbt.exe34⤵
- Executes dropped EXE
PID:2136 -
\??\c:\a0880.exec:\a0880.exe35⤵
- Executes dropped EXE
PID:2680 -
\??\c:\02444.exec:\02444.exe36⤵
- Executes dropped EXE
PID:2896 -
\??\c:\206228.exec:\206228.exe37⤵
- Executes dropped EXE
PID:2792 -
\??\c:\dpddv.exec:\dpddv.exe38⤵
- Executes dropped EXE
PID:2560 -
\??\c:\g2828.exec:\g2828.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lxrlxxl.exec:\lxrlxxl.exe40⤵
- Executes dropped EXE
PID:2996 -
\??\c:\vpjvd.exec:\vpjvd.exe41⤵
- Executes dropped EXE
PID:2564 -
\??\c:\486200.exec:\486200.exe42⤵
- Executes dropped EXE
PID:2544 -
\??\c:\04408.exec:\04408.exe43⤵
- Executes dropped EXE
PID:948 -
\??\c:\0428020.exec:\0428020.exe44⤵
- Executes dropped EXE
PID:2968 -
\??\c:\3rflxfl.exec:\3rflxfl.exe45⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xxflrxf.exec:\xxflrxf.exe46⤵
- Executes dropped EXE
PID:2100 -
\??\c:\04224.exec:\04224.exe47⤵
- Executes dropped EXE
PID:376 -
\??\c:\o440280.exec:\o440280.exe48⤵
- Executes dropped EXE
PID:2708 -
\??\c:\60020.exec:\60020.exe49⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1rlllrr.exec:\1rlllrr.exe50⤵
- Executes dropped EXE
PID:1088 -
\??\c:\u246666.exec:\u246666.exe51⤵
- Executes dropped EXE
PID:2440 -
\??\c:\7dddd.exec:\7dddd.exe52⤵
- Executes dropped EXE
PID:1508 -
\??\c:\8644628.exec:\8644628.exe53⤵
- Executes dropped EXE
PID:804 -
\??\c:\08000.exec:\08000.exe54⤵
- Executes dropped EXE
PID:2356 -
\??\c:\pjdvv.exec:\pjdvv.exe55⤵
- Executes dropped EXE
PID:2068 -
\??\c:\6864888.exec:\6864888.exe56⤵
- Executes dropped EXE
PID:2116 -
\??\c:\20846.exec:\20846.exe57⤵
- Executes dropped EXE
PID:2208 -
\??\c:\g8488.exec:\g8488.exe58⤵
- Executes dropped EXE
PID:1724 -
\??\c:\c268668.exec:\c268668.exe59⤵
- Executes dropped EXE
PID:1912 -
\??\c:\hbhnnn.exec:\hbhnnn.exe60⤵
- Executes dropped EXE
PID:2876 -
\??\c:\4868220.exec:\4868220.exe61⤵
- Executes dropped EXE
PID:960 -
\??\c:\2460046.exec:\2460046.exe62⤵
- Executes dropped EXE
PID:644 -
\??\c:\8244602.exec:\8244602.exe63⤵
- Executes dropped EXE
PID:496 -
\??\c:\btbbbb.exec:\btbbbb.exe64⤵
- Executes dropped EXE
PID:1760 -
\??\c:\9lflffx.exec:\9lflffx.exe65⤵
- Executes dropped EXE
PID:2852 -
\??\c:\8206840.exec:\8206840.exe66⤵PID:1660
-
\??\c:\2642840.exec:\2642840.exe67⤵PID:2032
-
\??\c:\2666266.exec:\2666266.exe68⤵PID:1728
-
\??\c:\8646846.exec:\8646846.exe69⤵PID:2016
-
\??\c:\5vpjj.exec:\5vpjj.exe70⤵PID:528
-
\??\c:\7bbbhb.exec:\7bbbhb.exe71⤵PID:1072
-
\??\c:\7lrlflr.exec:\7lrlflr.exe72⤵PID:1916
-
\??\c:\o688044.exec:\o688044.exe73⤵PID:1908
-
\??\c:\c848826.exec:\c848826.exe74⤵PID:1764
-
\??\c:\lflrxrf.exec:\lflrxrf.exe75⤵PID:2424
-
\??\c:\pdppp.exec:\pdppp.exe76⤵PID:1672
-
\??\c:\lrflrrx.exec:\lrflrrx.exe77⤵PID:1592
-
\??\c:\64444.exec:\64444.exe78⤵PID:2640
-
\??\c:\htbttn.exec:\htbttn.exe79⤵PID:2884
-
\??\c:\6088462.exec:\6088462.exe80⤵PID:2760
-
\??\c:\nbnhtn.exec:\nbnhtn.exe81⤵PID:2620
-
\??\c:\i484662.exec:\i484662.exe82⤵PID:2712
-
\??\c:\jdvjv.exec:\jdvjv.exe83⤵PID:2588
-
\??\c:\i426246.exec:\i426246.exe84⤵PID:2668
-
\??\c:\6620846.exec:\6620846.exe85⤵PID:2224
-
\??\c:\204684.exec:\204684.exe86⤵PID:2548
-
\??\c:\lffflrl.exec:\lffflrl.exe87⤵PID:1684
-
\??\c:\8640628.exec:\8640628.exe88⤵PID:820
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe89⤵PID:1456
-
\??\c:\048084.exec:\048084.exe90⤵PID:2096
-
\??\c:\042462.exec:\042462.exe91⤵PID:2900
-
\??\c:\jvppv.exec:\jvppv.exe92⤵PID:1332
-
\??\c:\42864.exec:\42864.exe93⤵PID:1236
-
\??\c:\xxxxlrx.exec:\xxxxlrx.exe94⤵PID:2440
-
\??\c:\642422.exec:\642422.exe95⤵PID:1200
-
\??\c:\vpddp.exec:\vpddp.exe96⤵PID:804
-
\??\c:\fxfflrx.exec:\fxfflrx.exe97⤵PID:1252
-
\??\c:\bnhthh.exec:\bnhthh.exe98⤵PID:2188
-
\??\c:\vvpdp.exec:\vvpdp.exe99⤵PID:2460
-
\??\c:\08280.exec:\08280.exe100⤵PID:2916
-
\??\c:\7vvpj.exec:\7vvpj.exe101⤵PID:1552
-
\??\c:\66420.exec:\66420.exe102⤵PID:2344
-
\??\c:\9bbhtb.exec:\9bbhtb.exe103⤵PID:2948
-
\??\c:\a0402.exec:\a0402.exe104⤵PID:1960
-
\??\c:\22444.exec:\22444.exe105⤵PID:900
-
\??\c:\hhhnbh.exec:\hhhnbh.exe106⤵PID:760
-
\??\c:\9bhbtn.exec:\9bhbtn.exe107⤵PID:1356
-
\??\c:\260660.exec:\260660.exe108⤵PID:1544
-
\??\c:\xlrlfff.exec:\xlrlfff.exe109⤵PID:2024
-
\??\c:\60808.exec:\60808.exe110⤵PID:780
-
\??\c:\frlxxfr.exec:\frlxxfr.exe111⤵PID:2572
-
\??\c:\6084284.exec:\6084284.exe112⤵PID:2016
-
\??\c:\q44022.exec:\q44022.exe113⤵PID:1932
-
\??\c:\lllllrx.exec:\lllllrx.exe114⤵PID:2148
-
\??\c:\6806262.exec:\6806262.exe115⤵PID:1612
-
\??\c:\m2640.exec:\m2640.exe116⤵PID:1860
-
\??\c:\s6440.exec:\s6440.exe117⤵PID:1756
-
\??\c:\vpdjj.exec:\vpdjj.exe118⤵PID:2220
-
\??\c:\rlrxffx.exec:\rlrxffx.exe119⤵PID:2672
-
\??\c:\7pdvv.exec:\7pdvv.exe120⤵PID:2784
-
\??\c:\4244440.exec:\4244440.exe121⤵PID:2764
-
\??\c:\42068.exec:\42068.exe122⤵PID:2740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-