Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7bc1aeb94b1d8de06240d0efbc1f8115e5a2a7eca12be740de879385d574c1ee.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
7bc1aeb94b1d8de06240d0efbc1f8115e5a2a7eca12be740de879385d574c1ee.exe
-
Size
454KB
-
MD5
bc3a3ff9eb2723ce1444598f6407afea
-
SHA1
beaa3d6574f6ba744483abef7a3cfc0234770e33
-
SHA256
7bc1aeb94b1d8de06240d0efbc1f8115e5a2a7eca12be740de879385d574c1ee
-
SHA512
e68ccfa1ee5d5a488af3aae73410c8b4367963a2c37e833fd1d343beb1d644fbfc97f831f08c7804e1c435252495c41f69c6c4d85b6652d97b9935e0f166b0b6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe7:q7Tc2NYHUrAwfMp3CD7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2188-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-36-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2588-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-146-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1700-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-155-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2968-173-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2264-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-215-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1924-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-447-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2096-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-574-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2380-593-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/632-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2664 ffxrxfl.exe 2836 7ddjp.exe 2688 tbnbnn.exe 2588 djvvd.exe 2608 1xlxrrf.exe 2584 hbnntb.exe 2604 fxrflrf.exe 576 1pjpd.exe 2932 lfxfflr.exe 1736 jvvdp.exe 1168 7lfrxfl.exe 600 hhntnb.exe 316 fxrlrfl.exe 1700 bbhthn.exe 2832 xlfrffr.exe 588 hhnhnt.exe 2968 vjdpd.exe 1104 xrfrrfr.exe 2264 dpvdj.exe 2236 xrxrxfr.exe 1944 nbnttt.exe 1924 xlxflff.exe 2528 bbtbhn.exe 916 xrrlllx.exe 764 5tbhtb.exe 2100 xlffllr.exe 1996 hhbthn.exe 2336 fxlxxxl.exe 888 hbthnn.exe 2456 1xrfllr.exe 2752 thbhnn.exe 1592 9dvvj.exe 2680 llxlxfx.exe 2748 vjvpv.exe 2716 7jdvv.exe 2116 rxllllr.exe 1744 thnntn.exe 632 vpvvj.exe 3028 jdppp.exe 1732 5fxlfff.exe 2848 hbbbnn.exe 2908 vjppj.exe 2916 pjddd.exe 620 xrfllfl.exe 2540 tnhnbb.exe 1632 dvjpj.exe 1496 1pppv.exe 2072 xrlxrxx.exe 2872 nbnhhh.exe 2876 9jpjp.exe 1484 pjddp.exe 264 llffxll.exe 2976 nhtbhn.exe 2168 jdpvd.exe 2248 9jvvj.exe 2096 9rxlrll.exe 2124 nhthtt.exe 2128 bnhhhb.exe 1984 vpdpd.exe 1608 xlxxxrx.exe 2520 hbnntb.exe 1324 5pvjd.exe 3000 vpdpv.exe 2524 ffxllrr.exe -
resource yara_rule behavioral1/memory/2188-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-36-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2588-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-489-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2520-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-635-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2664 2188 7bc1aeb94b1d8de06240d0efbc1f8115e5a2a7eca12be740de879385d574c1ee.exe 30 PID 2188 wrote to memory of 2664 2188 7bc1aeb94b1d8de06240d0efbc1f8115e5a2a7eca12be740de879385d574c1ee.exe 30 PID 2188 wrote to memory of 2664 2188 7bc1aeb94b1d8de06240d0efbc1f8115e5a2a7eca12be740de879385d574c1ee.exe 30 PID 2188 wrote to memory of 2664 2188 7bc1aeb94b1d8de06240d0efbc1f8115e5a2a7eca12be740de879385d574c1ee.exe 30 PID 2664 wrote to memory of 2836 2664 ffxrxfl.exe 31 PID 2664 wrote to memory of 2836 2664 ffxrxfl.exe 31 PID 2664 wrote to memory of 2836 2664 ffxrxfl.exe 31 PID 2664 wrote to memory of 2836 2664 ffxrxfl.exe 31 PID 2836 wrote to memory of 2688 2836 7ddjp.exe 32 PID 2836 wrote to memory of 2688 2836 7ddjp.exe 32 PID 2836 wrote to memory of 2688 2836 7ddjp.exe 32 PID 2836 wrote to memory of 2688 2836 7ddjp.exe 32 PID 2688 wrote to memory of 2588 2688 tbnbnn.exe 33 PID 2688 wrote to memory of 2588 2688 tbnbnn.exe 33 PID 2688 wrote to memory of 2588 2688 tbnbnn.exe 33 PID 2688 wrote to memory of 2588 2688 tbnbnn.exe 33 PID 2588 wrote to memory of 2608 2588 djvvd.exe 34 PID 2588 wrote to memory of 2608 2588 djvvd.exe 34 PID 2588 wrote to memory of 2608 2588 djvvd.exe 34 PID 2588 wrote to memory of 2608 2588 djvvd.exe 34 PID 2608 wrote to memory of 2584 2608 1xlxrrf.exe 35 PID 2608 wrote to memory of 2584 2608 1xlxrrf.exe 35 PID 2608 wrote to memory of 2584 2608 1xlxrrf.exe 35 PID 2608 wrote to memory of 2584 2608 1xlxrrf.exe 35 PID 2584 wrote to memory of 2604 2584 hbnntb.exe 36 PID 2584 wrote to memory of 2604 2584 hbnntb.exe 36 PID 2584 wrote to memory of 2604 2584 hbnntb.exe 36 PID 2584 wrote to memory of 2604 2584 hbnntb.exe 36 PID 2604 wrote to memory of 576 2604 fxrflrf.exe 37 PID 2604 wrote to memory of 576 2604 fxrflrf.exe 37 PID 2604 wrote to memory of 576 2604 fxrflrf.exe 37 PID 2604 wrote to memory of 576 2604 fxrflrf.exe 37 PID 576 wrote to memory of 2932 576 1pjpd.exe 38 PID 576 wrote to memory of 2932 576 1pjpd.exe 38 PID 576 wrote to memory of 2932 576 1pjpd.exe 38 PID 576 wrote to memory of 2932 576 1pjpd.exe 38 PID 2932 wrote to memory of 1736 2932 lfxfflr.exe 39 PID 2932 wrote to memory of 1736 2932 lfxfflr.exe 39 PID 2932 wrote to memory of 1736 2932 lfxfflr.exe 39 PID 2932 wrote to memory of 1736 2932 lfxfflr.exe 39 PID 1736 wrote to memory of 1168 1736 jvvdp.exe 40 PID 1736 wrote to memory of 1168 1736 jvvdp.exe 40 PID 1736 wrote to memory of 1168 1736 jvvdp.exe 40 PID 1736 wrote to memory of 1168 1736 jvvdp.exe 40 PID 1168 wrote to memory of 600 1168 7lfrxfl.exe 41 PID 1168 wrote to memory of 600 1168 7lfrxfl.exe 41 PID 1168 wrote to memory of 600 1168 7lfrxfl.exe 41 PID 1168 wrote to memory of 600 1168 7lfrxfl.exe 41 PID 600 wrote to memory of 316 600 hhntnb.exe 42 PID 600 wrote to memory of 316 600 hhntnb.exe 42 PID 600 wrote to memory of 316 600 hhntnb.exe 42 PID 600 wrote to memory of 316 600 hhntnb.exe 42 PID 316 wrote to memory of 1700 316 fxrlrfl.exe 43 PID 316 wrote to memory of 1700 316 fxrlrfl.exe 43 PID 316 wrote to memory of 1700 316 fxrlrfl.exe 43 PID 316 wrote to memory of 1700 316 fxrlrfl.exe 43 PID 1700 wrote to memory of 2832 1700 bbhthn.exe 44 PID 1700 wrote to memory of 2832 1700 bbhthn.exe 44 PID 1700 wrote to memory of 2832 1700 bbhthn.exe 44 PID 1700 wrote to memory of 2832 1700 bbhthn.exe 44 PID 2832 wrote to memory of 588 2832 xlfrffr.exe 45 PID 2832 wrote to memory of 588 2832 xlfrffr.exe 45 PID 2832 wrote to memory of 588 2832 xlfrffr.exe 45 PID 2832 wrote to memory of 588 2832 xlfrffr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bc1aeb94b1d8de06240d0efbc1f8115e5a2a7eca12be740de879385d574c1ee.exe"C:\Users\Admin\AppData\Local\Temp\7bc1aeb94b1d8de06240d0efbc1f8115e5a2a7eca12be740de879385d574c1ee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\ffxrxfl.exec:\ffxrxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\7ddjp.exec:\7ddjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\tbnbnn.exec:\tbnbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\djvvd.exec:\djvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\1xlxrrf.exec:\1xlxrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\hbnntb.exec:\hbnntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\fxrflrf.exec:\fxrflrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\1pjpd.exec:\1pjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\lfxfflr.exec:\lfxfflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\jvvdp.exec:\jvvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\7lfrxfl.exec:\7lfrxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\hhntnb.exec:\hhntnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\fxrlrfl.exec:\fxrlrfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\bbhthn.exec:\bbhthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\xlfrffr.exec:\xlfrffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\hhnhnt.exec:\hhnhnt.exe17⤵
- Executes dropped EXE
PID:588 -
\??\c:\vjdpd.exec:\vjdpd.exe18⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xrfrrfr.exec:\xrfrrfr.exe19⤵
- Executes dropped EXE
PID:1104 -
\??\c:\dpvdj.exec:\dpvdj.exe20⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xrxrxfr.exec:\xrxrxfr.exe21⤵
- Executes dropped EXE
PID:2236 -
\??\c:\nbnttt.exec:\nbnttt.exe22⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xlxflff.exec:\xlxflff.exe23⤵
- Executes dropped EXE
PID:1924 -
\??\c:\bbtbhn.exec:\bbtbhn.exe24⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xrrlllx.exec:\xrrlllx.exe25⤵
- Executes dropped EXE
PID:916 -
\??\c:\5tbhtb.exec:\5tbhtb.exe26⤵
- Executes dropped EXE
PID:764 -
\??\c:\xlffllr.exec:\xlffllr.exe27⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hhbthn.exec:\hhbthn.exe28⤵
- Executes dropped EXE
PID:1996 -
\??\c:\fxlxxxl.exec:\fxlxxxl.exe29⤵
- Executes dropped EXE
PID:2336 -
\??\c:\hbthnn.exec:\hbthnn.exe30⤵
- Executes dropped EXE
PID:888 -
\??\c:\1xrfllr.exec:\1xrfllr.exe31⤵
- Executes dropped EXE
PID:2456 -
\??\c:\thbhnn.exec:\thbhnn.exe32⤵
- Executes dropped EXE
PID:2752 -
\??\c:\9dvvj.exec:\9dvvj.exe33⤵
- Executes dropped EXE
PID:1592 -
\??\c:\llxlxfx.exec:\llxlxfx.exe34⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vjvpv.exec:\vjvpv.exe35⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7jdvv.exec:\7jdvv.exe36⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rxllllr.exec:\rxllllr.exe37⤵
- Executes dropped EXE
PID:2116 -
\??\c:\thnntn.exec:\thnntn.exe38⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vpvvj.exec:\vpvvj.exe39⤵
- Executes dropped EXE
PID:632 -
\??\c:\jdppp.exec:\jdppp.exe40⤵
- Executes dropped EXE
PID:3028 -
\??\c:\5fxlfff.exec:\5fxlfff.exe41⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hbbbnn.exec:\hbbbnn.exe42⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vjppj.exec:\vjppj.exe43⤵
- Executes dropped EXE
PID:2908 -
\??\c:\pjddd.exec:\pjddd.exe44⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xrfllfl.exec:\xrfllfl.exe45⤵
- Executes dropped EXE
PID:620 -
\??\c:\tnhnbb.exec:\tnhnbb.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\dvjpj.exec:\dvjpj.exe47⤵
- Executes dropped EXE
PID:1632 -
\??\c:\1pppv.exec:\1pppv.exe48⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xrlxrxx.exec:\xrlxrxx.exe49⤵
- Executes dropped EXE
PID:2072 -
\??\c:\nbnhhh.exec:\nbnhhh.exe50⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9jpjp.exec:\9jpjp.exe51⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pjddp.exec:\pjddp.exe52⤵
- Executes dropped EXE
PID:1484 -
\??\c:\llffxll.exec:\llffxll.exe53⤵
- Executes dropped EXE
PID:264 -
\??\c:\nhtbhn.exec:\nhtbhn.exe54⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jdpvd.exec:\jdpvd.exe55⤵
- Executes dropped EXE
PID:2168 -
\??\c:\9jvvj.exec:\9jvvj.exe56⤵
- Executes dropped EXE
PID:2248 -
\??\c:\9rxlrll.exec:\9rxlrll.exe57⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nhthtt.exec:\nhthtt.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2124 -
\??\c:\bnhhhb.exec:\bnhhhb.exe59⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vpdpd.exec:\vpdpd.exe60⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xlxxxrx.exec:\xlxxxrx.exe61⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hbnntb.exec:\hbnntb.exe62⤵
- Executes dropped EXE
PID:2520 -
\??\c:\5pvjd.exec:\5pvjd.exe63⤵
- Executes dropped EXE
PID:1324 -
\??\c:\vpdpv.exec:\vpdpv.exe64⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ffxllrr.exec:\ffxllrr.exe65⤵
- Executes dropped EXE
PID:2524 -
\??\c:\btbhnn.exec:\btbhnn.exe66⤵PID:1624
-
\??\c:\jvjvp.exec:\jvjvp.exe67⤵PID:1000
-
\??\c:\vjdvv.exec:\vjdvv.exe68⤵PID:1996
-
\??\c:\5xxrxxr.exec:\5xxrxxr.exe69⤵PID:2320
-
\??\c:\fxrxlfl.exec:\fxrxlfl.exe70⤵PID:3052
-
\??\c:\5tthhh.exec:\5tthhh.exe71⤵PID:2380
-
\??\c:\9ddpd.exec:\9ddpd.exe72⤵PID:2452
-
\??\c:\fxrlrlr.exec:\fxrlrlr.exe73⤵PID:2760
-
\??\c:\xflrllr.exec:\xflrllr.exe74⤵PID:2708
-
\??\c:\btnnnn.exec:\btnnnn.exe75⤵PID:2772
-
\??\c:\dvpvj.exec:\dvpvj.exe76⤵PID:2560
-
\??\c:\lfxfrxx.exec:\lfxfrxx.exe77⤵PID:2716
-
\??\c:\lflrffx.exec:\lflrffx.exe78⤵PID:2116
-
\??\c:\5hhbhn.exec:\5hhbhn.exe79⤵PID:1912
-
\??\c:\3pdvd.exec:\3pdvd.exe80⤵
- System Location Discovery: System Language Discovery
PID:632 -
\??\c:\xrfxfff.exec:\xrfxfff.exe81⤵PID:1672
-
\??\c:\7rlrrrx.exec:\7rlrrrx.exe82⤵
- System Location Discovery: System Language Discovery
PID:1732 -
\??\c:\hbhhhn.exec:\hbhhhn.exe83⤵PID:2924
-
\??\c:\5hbnbh.exec:\5hbnbh.exe84⤵PID:2900
-
\??\c:\ddjjv.exec:\ddjjv.exe85⤵PID:2256
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe86⤵PID:1408
-
\??\c:\1bbttb.exec:\1bbttb.exe87⤵PID:2444
-
\??\c:\hbnnnn.exec:\hbnnnn.exe88⤵PID:988
-
\??\c:\jvppd.exec:\jvppd.exe89⤵PID:1640
-
\??\c:\7vvdv.exec:\7vvdv.exe90⤵PID:2652
-
\??\c:\fxllxfl.exec:\fxllxfl.exe91⤵PID:872
-
\??\c:\3nbbhh.exec:\3nbbhh.exe92⤵PID:536
-
\??\c:\nhnhhh.exec:\nhnhhh.exe93⤵PID:820
-
\??\c:\pvdvv.exec:\pvdvv.exe94⤵PID:332
-
\??\c:\xlrlfxl.exec:\xlrlfxl.exe95⤵PID:2532
-
\??\c:\fxllllr.exec:\fxllllr.exe96⤵PID:2736
-
\??\c:\3nhbnt.exec:\3nhbnt.exe97⤵PID:2416
-
\??\c:\dpdvd.exec:\dpdvd.exe98⤵PID:2080
-
\??\c:\vjpjp.exec:\vjpjp.exe99⤵PID:2236
-
\??\c:\xllxfff.exec:\xllxfff.exe100⤵PID:1056
-
\??\c:\bhnbbt.exec:\bhnbbt.exe101⤵PID:1972
-
\??\c:\3hhtbt.exec:\3hhtbt.exe102⤵PID:1872
-
\??\c:\7ddjj.exec:\7ddjj.exe103⤵PID:908
-
\??\c:\rlxxfxx.exec:\rlxxfxx.exe104⤵PID:2508
-
\??\c:\rfrrffl.exec:\rfrrffl.exe105⤵PID:640
-
\??\c:\nhbnnn.exec:\nhbnnn.exe106⤵PID:2324
-
\??\c:\vjvdv.exec:\vjvdv.exe107⤵PID:2204
-
\??\c:\vjjjd.exec:\vjjjd.exe108⤵PID:1792
-
\??\c:\ffrxfxf.exec:\ffrxfxf.exe109⤵PID:2104
-
\??\c:\7bnntt.exec:\7bnntt.exe110⤵PID:2472
-
\??\c:\1thbtt.exec:\1thbtt.exe111⤵PID:2336
-
\??\c:\7jppp.exec:\7jppp.exe112⤵PID:2316
-
\??\c:\frllrlr.exec:\frllrlr.exe113⤵PID:2700
-
\??\c:\rflfrlf.exec:\rflfrlf.exe114⤵PID:2684
-
\??\c:\hhntnt.exec:\hhntnt.exe115⤵PID:2956
-
\??\c:\7vjdj.exec:\7vjdj.exe116⤵PID:2860
-
\??\c:\dvjjj.exec:\dvjjj.exe117⤵PID:1572
-
\??\c:\5xfxxrr.exec:\5xfxxrr.exe118⤵PID:2948
-
\??\c:\9flffff.exec:\9flffff.exe119⤵PID:2728
-
\??\c:\thbhnn.exec:\thbhnn.exe120⤵PID:2724
-
\??\c:\9jppv.exec:\9jppv.exe121⤵PID:2844
-
\??\c:\3jvdv.exec:\3jvdv.exe122⤵PID:2240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-