Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 23:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8065aee0b577c31a2708c878f346e4b36d4a29f6058939231897bd6d0127b57d.exe
Resource
win7-20240708-en
5 signatures
150 seconds
General
-
Target
8065aee0b577c31a2708c878f346e4b36d4a29f6058939231897bd6d0127b57d.exe
-
Size
49KB
-
MD5
04ec9dec8abb05562f4403892d31fe59
-
SHA1
6689bc782360cdc8bbb9749da86b99b1a38bcc43
-
SHA256
8065aee0b577c31a2708c878f346e4b36d4a29f6058939231897bd6d0127b57d
-
SHA512
280d1f4ff2b3ab3618c91f075f376dbb4e034092a2ba9df6ed07239bfe3023007fe7b20dddd70983723e2ef287287726cb2e65838bf0fcab6092d20b71c1cb6e
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvcI:0cdpeeBSHHMHLf9RyIe
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3564-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2092-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3784-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-355-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-359-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-404-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-427-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-438-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-451-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-467-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-481-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-522-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-532-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-543-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-556-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-591-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-598-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-602-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-621-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-651-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-796-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2344 nbtttn.exe 3032 nnttbh.exe 4216 7jddp.exe 3772 vdjdd.exe 3272 fxxrfxx.exe 4820 bttnnn.exe 1780 vpjdd.exe 1928 7rfxrlf.exe 4264 9frllfx.exe 1420 dddjj.exe 3276 9pjdv.exe 2120 flllllr.exe 4840 nhbbhh.exe 1568 bbtnhh.exe 224 jpjjj.exe 972 djppj.exe 4376 rrrlffl.exe 2092 bhnhtt.exe 3784 nnnthn.exe 4444 djjjv.exe 4156 5rxrlff.exe 2764 hbnbhh.exe 2460 pjvvv.exe 3232 jvddd.exe 4804 frxxxxx.exe 3532 bttttt.exe 5068 9jpjd.exe 4948 rfllrxr.exe 1340 bttbht.exe 1040 nbbnhn.exe 2684 vjjdd.exe 1784 1rrllxx.exe 4852 ttnbtn.exe 2508 1nhhnb.exe 4952 pvvvp.exe 1528 vjppp.exe 1000 xfllllr.exe 1576 hnttnt.exe 3572 tbhbtt.exe 4092 7dddv.exe 3748 pvppp.exe 1796 lrffllx.exe 4296 xrrfllr.exe 2052 9rfxflr.exe 760 hhnhbb.exe 4696 tbnnhn.exe 3676 3jjjj.exe 3496 fxffxxx.exe 1640 lflfxrl.exe 1596 nbhhbb.exe 2572 5jdvj.exe 4088 vdjdp.exe 4840 vdjjj.exe 3036 xrxxrll.exe 4860 hhhbnt.exe 4416 jjjdv.exe 972 vppdv.exe 728 flrxrrr.exe 3904 xfllllf.exe 4956 nbhttn.exe 220 9htnbb.exe 4156 ddpjd.exe 620 djpdp.exe 4604 xxfflfl.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3564 wrote to memory of 2344 3564 8065aee0b577c31a2708c878f346e4b36d4a29f6058939231897bd6d0127b57d.exe 84 PID 3564 wrote to memory of 2344 3564 8065aee0b577c31a2708c878f346e4b36d4a29f6058939231897bd6d0127b57d.exe 84 PID 3564 wrote to memory of 2344 3564 8065aee0b577c31a2708c878f346e4b36d4a29f6058939231897bd6d0127b57d.exe 84 PID 2344 wrote to memory of 3032 2344 nbtttn.exe 85 PID 2344 wrote to memory of 3032 2344 nbtttn.exe 85 PID 2344 wrote to memory of 3032 2344 nbtttn.exe 85 PID 3032 wrote to memory of 4216 3032 nnttbh.exe 86 PID 3032 wrote to memory of 4216 3032 nnttbh.exe 86 PID 3032 wrote to memory of 4216 3032 nnttbh.exe 86 PID 4216 wrote to memory of 3772 4216 7jddp.exe 87 PID 4216 wrote to memory of 3772 4216 7jddp.exe 87 PID 4216 wrote to memory of 3772 4216 7jddp.exe 87 PID 3772 wrote to memory of 3272 3772 vdjdd.exe 88 PID 3772 wrote to memory of 3272 3772 vdjdd.exe 88 PID 3772 wrote to memory of 3272 3772 vdjdd.exe 88 PID 3272 wrote to memory of 4820 3272 fxxrfxx.exe 89 PID 3272 wrote to memory of 4820 3272 fxxrfxx.exe 89 PID 3272 wrote to memory of 4820 3272 fxxrfxx.exe 89 PID 4820 wrote to memory of 1780 4820 bttnnn.exe 90 PID 4820 wrote to memory of 1780 4820 bttnnn.exe 90 PID 4820 wrote to memory of 1780 4820 bttnnn.exe 90 PID 1780 wrote to memory of 1928 1780 vpjdd.exe 91 PID 1780 wrote to memory of 1928 1780 vpjdd.exe 91 PID 1780 wrote to memory of 1928 1780 vpjdd.exe 91 PID 1928 wrote to memory of 4264 1928 7rfxrlf.exe 92 PID 1928 wrote to memory of 4264 1928 7rfxrlf.exe 92 PID 1928 wrote to memory of 4264 1928 7rfxrlf.exe 92 PID 4264 wrote to memory of 1420 4264 9frllfx.exe 93 PID 4264 wrote to memory of 1420 4264 9frllfx.exe 93 PID 4264 wrote to memory of 1420 4264 9frllfx.exe 93 PID 1420 wrote to memory of 3276 1420 dddjj.exe 94 PID 1420 wrote to memory of 3276 1420 dddjj.exe 94 PID 1420 wrote to memory of 3276 1420 dddjj.exe 94 PID 3276 wrote to memory of 2120 3276 9pjdv.exe 95 PID 3276 wrote to memory of 2120 3276 9pjdv.exe 95 PID 3276 wrote to memory of 2120 3276 9pjdv.exe 95 PID 2120 wrote to memory of 4840 2120 flllllr.exe 96 PID 2120 wrote to memory of 4840 2120 flllllr.exe 96 PID 2120 wrote to memory of 4840 2120 flllllr.exe 96 PID 4840 wrote to memory of 1568 4840 nhbbhh.exe 97 PID 4840 wrote to memory of 1568 4840 nhbbhh.exe 97 PID 4840 wrote to memory of 1568 4840 nhbbhh.exe 97 PID 1568 wrote to memory of 224 1568 bbtnhh.exe 98 PID 1568 wrote to memory of 224 1568 bbtnhh.exe 98 PID 1568 wrote to memory of 224 1568 bbtnhh.exe 98 PID 224 wrote to memory of 972 224 jpjjj.exe 99 PID 224 wrote to memory of 972 224 jpjjj.exe 99 PID 224 wrote to memory of 972 224 jpjjj.exe 99 PID 972 wrote to memory of 4376 972 djppj.exe 100 PID 972 wrote to memory of 4376 972 djppj.exe 100 PID 972 wrote to memory of 4376 972 djppj.exe 100 PID 4376 wrote to memory of 2092 4376 rrrlffl.exe 101 PID 4376 wrote to memory of 2092 4376 rrrlffl.exe 101 PID 4376 wrote to memory of 2092 4376 rrrlffl.exe 101 PID 2092 wrote to memory of 3784 2092 bhnhtt.exe 102 PID 2092 wrote to memory of 3784 2092 bhnhtt.exe 102 PID 2092 wrote to memory of 3784 2092 bhnhtt.exe 102 PID 3784 wrote to memory of 4444 3784 nnnthn.exe 103 PID 3784 wrote to memory of 4444 3784 nnnthn.exe 103 PID 3784 wrote to memory of 4444 3784 nnnthn.exe 103 PID 4444 wrote to memory of 4156 4444 djjjv.exe 105 PID 4444 wrote to memory of 4156 4444 djjjv.exe 105 PID 4444 wrote to memory of 4156 4444 djjjv.exe 105 PID 4156 wrote to memory of 2764 4156 5rxrlff.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\8065aee0b577c31a2708c878f346e4b36d4a29f6058939231897bd6d0127b57d.exe"C:\Users\Admin\AppData\Local\Temp\8065aee0b577c31a2708c878f346e4b36d4a29f6058939231897bd6d0127b57d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\nbtttn.exec:\nbtttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\nnttbh.exec:\nnttbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\7jddp.exec:\7jddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\vdjdd.exec:\vdjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\fxxrfxx.exec:\fxxrfxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\bttnnn.exec:\bttnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\vpjdd.exec:\vpjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\7rfxrlf.exec:\7rfxrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\9frllfx.exec:\9frllfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\dddjj.exec:\dddjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\9pjdv.exec:\9pjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\flllllr.exec:\flllllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\nhbbhh.exec:\nhbbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\bbtnhh.exec:\bbtnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\jpjjj.exec:\jpjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\djppj.exec:\djppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\rrrlffl.exec:\rrrlffl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\bhnhtt.exec:\bhnhtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\nnnthn.exec:\nnnthn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\djjjv.exec:\djjjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\5rxrlff.exec:\5rxrlff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\hbnbhh.exec:\hbnbhh.exe23⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pjvvv.exec:\pjvvv.exe24⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jvddd.exec:\jvddd.exe25⤵
- Executes dropped EXE
PID:3232 -
\??\c:\frxxxxx.exec:\frxxxxx.exe26⤵
- Executes dropped EXE
PID:4804 -
\??\c:\bttttt.exec:\bttttt.exe27⤵
- Executes dropped EXE
PID:3532 -
\??\c:\9jpjd.exec:\9jpjd.exe28⤵
- Executes dropped EXE
PID:5068 -
\??\c:\rfllrxr.exec:\rfllrxr.exe29⤵
- Executes dropped EXE
PID:4948 -
\??\c:\bttbht.exec:\bttbht.exe30⤵
- Executes dropped EXE
PID:1340 -
\??\c:\nbbnhn.exec:\nbbnhn.exe31⤵
- Executes dropped EXE
PID:1040 -
\??\c:\vjjdd.exec:\vjjdd.exe32⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1rrllxx.exec:\1rrllxx.exe33⤵
- Executes dropped EXE
PID:1784 -
\??\c:\ttnbtn.exec:\ttnbtn.exe34⤵
- Executes dropped EXE
PID:4852 -
\??\c:\1nhhnb.exec:\1nhhnb.exe35⤵
- Executes dropped EXE
PID:2508 -
\??\c:\pvvvp.exec:\pvvvp.exe36⤵
- Executes dropped EXE
PID:4952 -
\??\c:\vjppp.exec:\vjppp.exe37⤵
- Executes dropped EXE
PID:1528 -
\??\c:\xfllllr.exec:\xfllllr.exe38⤵
- Executes dropped EXE
PID:1000 -
\??\c:\hnttnt.exec:\hnttnt.exe39⤵
- Executes dropped EXE
PID:1576 -
\??\c:\tbhbtt.exec:\tbhbtt.exe40⤵
- Executes dropped EXE
PID:3572 -
\??\c:\7dddv.exec:\7dddv.exe41⤵
- Executes dropped EXE
PID:4092 -
\??\c:\pvppp.exec:\pvppp.exe42⤵
- Executes dropped EXE
PID:3748 -
\??\c:\lrffllx.exec:\lrffllx.exe43⤵
- Executes dropped EXE
PID:1796 -
\??\c:\xrrfllr.exec:\xrrfllr.exe44⤵
- Executes dropped EXE
PID:4296 -
\??\c:\9rfxflr.exec:\9rfxflr.exe45⤵
- Executes dropped EXE
PID:2052 -
\??\c:\hhnhbb.exec:\hhnhbb.exe46⤵
- Executes dropped EXE
PID:760 -
\??\c:\tbnnhn.exec:\tbnnhn.exe47⤵
- Executes dropped EXE
PID:4696 -
\??\c:\3jjjj.exec:\3jjjj.exe48⤵
- Executes dropped EXE
PID:3676 -
\??\c:\fxffxxx.exec:\fxffxxx.exe49⤵
- Executes dropped EXE
PID:3496 -
\??\c:\lflfxrl.exec:\lflfxrl.exe50⤵
- Executes dropped EXE
PID:1640 -
\??\c:\nbhhbb.exec:\nbhhbb.exe51⤵
- Executes dropped EXE
PID:1596 -
\??\c:\5jdvj.exec:\5jdvj.exe52⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vdjdp.exec:\vdjdp.exe53⤵
- Executes dropped EXE
PID:4088 -
\??\c:\vdjjj.exec:\vdjjj.exe54⤵
- Executes dropped EXE
PID:4840 -
\??\c:\xrxxrll.exec:\xrxxrll.exe55⤵
- Executes dropped EXE
PID:3036 -
\??\c:\hhhbnt.exec:\hhhbnt.exe56⤵
- Executes dropped EXE
PID:4860 -
\??\c:\jjjdv.exec:\jjjdv.exe57⤵
- Executes dropped EXE
PID:4416 -
\??\c:\vppdv.exec:\vppdv.exe58⤵
- Executes dropped EXE
PID:972 -
\??\c:\flrxrrr.exec:\flrxrrr.exe59⤵
- Executes dropped EXE
PID:728 -
\??\c:\xfllllf.exec:\xfllllf.exe60⤵
- Executes dropped EXE
PID:3904 -
\??\c:\nbhttn.exec:\nbhttn.exe61⤵
- Executes dropped EXE
PID:4956 -
\??\c:\9htnbb.exec:\9htnbb.exe62⤵
- Executes dropped EXE
PID:220 -
\??\c:\ddpjd.exec:\ddpjd.exe63⤵
- Executes dropped EXE
PID:4156 -
\??\c:\djpdp.exec:\djpdp.exe64⤵
- Executes dropped EXE
PID:620 -
\??\c:\xxfflfl.exec:\xxfflfl.exe65⤵
- Executes dropped EXE
PID:4604 -
\??\c:\5xxflrr.exec:\5xxflrr.exe66⤵PID:2460
-
\??\c:\3htnnn.exec:\3htnnn.exe67⤵PID:1048
-
\??\c:\nbnhtt.exec:\nbnhtt.exe68⤵PID:2536
-
\??\c:\jvdvp.exec:\jvdvp.exe69⤵PID:940
-
\??\c:\rfxrffx.exec:\rfxrffx.exe70⤵PID:464
-
\??\c:\3lffxxr.exec:\3lffxxr.exe71⤵PID:5068
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe72⤵PID:3212
-
\??\c:\nnbtbb.exec:\nnbtbb.exe73⤵PID:4212
-
\??\c:\1ppdv.exec:\1ppdv.exe74⤵PID:4148
-
\??\c:\ppdvp.exec:\ppdvp.exe75⤵PID:2040
-
\??\c:\rxxfflr.exec:\rxxfflr.exe76⤵PID:5108
-
\??\c:\bbnhhh.exec:\bbnhhh.exe77⤵PID:4404
-
\??\c:\tnbthh.exec:\tnbthh.exe78⤵PID:4856
-
\??\c:\9dddv.exec:\9dddv.exe79⤵PID:1136
-
\??\c:\rxxfrrl.exec:\rxxfrrl.exe80⤵PID:216
-
\??\c:\5rfllff.exec:\5rfllff.exe81⤵PID:4364
-
\??\c:\httnhh.exec:\httnhh.exe82⤵PID:1528
-
\??\c:\vpdvj.exec:\vpdvj.exe83⤵PID:2344
-
\??\c:\vdpjd.exec:\vdpjd.exe84⤵PID:3032
-
\??\c:\lflfrrx.exec:\lflfrrx.exe85⤵PID:3544
-
\??\c:\bhnbtt.exec:\bhnbtt.exe86⤵PID:3180
-
\??\c:\ppvvj.exec:\ppvvj.exe87⤵PID:2940
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe88⤵PID:4296
-
\??\c:\7nnnhb.exec:\7nnnhb.exe89⤵PID:2052
-
\??\c:\bhttnt.exec:\bhttnt.exe90⤵PID:760
-
\??\c:\dpjvv.exec:\dpjvv.exe91⤵PID:2260
-
\??\c:\lrfxrll.exec:\lrfxrll.exe92⤵PID:3120
-
\??\c:\9bhhnh.exec:\9bhhnh.exe93⤵PID:4264
-
\??\c:\hbnnnn.exec:\hbnnnn.exe94⤵PID:1428
-
\??\c:\djpvp.exec:\djpvp.exe95⤵PID:4300
-
\??\c:\llxxrxr.exec:\llxxrxr.exe96⤵PID:2232
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe97⤵PID:1472
-
\??\c:\bnnhbt.exec:\bnnhbt.exe98⤵PID:1660
-
\??\c:\nttnbb.exec:\nttnbb.exe99⤵PID:1052
-
\??\c:\jpvjj.exec:\jpvjj.exe100⤵PID:1360
-
\??\c:\1dpdv.exec:\1dpdv.exe101⤵PID:1696
-
\??\c:\1lfxfxl.exec:\1lfxfxl.exe102⤵PID:4392
-
\??\c:\3llrffx.exec:\3llrffx.exe103⤵PID:1832
-
\??\c:\hnnnnh.exec:\hnnnnh.exe104⤵PID:972
-
\??\c:\pdjvp.exec:\pdjvp.exe105⤵PID:728
-
\??\c:\jdjdd.exec:\jdjdd.exe106⤵PID:5032
-
\??\c:\1ffxrrl.exec:\1ffxrrl.exe107⤵PID:4556
-
\??\c:\5hnbnn.exec:\5hnbnn.exe108⤵PID:3976
-
\??\c:\thhhht.exec:\thhhht.exe109⤵PID:1368
-
\??\c:\9djvp.exec:\9djvp.exe110⤵PID:4596
-
\??\c:\rrllxfx.exec:\rrllxfx.exe111⤵PID:3584
-
\??\c:\lrxrfxl.exec:\lrxrfxl.exe112⤵PID:2516
-
\??\c:\tnnnbh.exec:\tnnnbh.exe113⤵PID:1720
-
\??\c:\bhnhbb.exec:\bhnhbb.exe114⤵PID:1048
-
\??\c:\vpjvd.exec:\vpjvd.exe115⤵PID:2536
-
\??\c:\llxfxlr.exec:\llxfxlr.exe116⤵PID:940
-
\??\c:\5llfrlx.exec:\5llfrlx.exe117⤵PID:464
-
\??\c:\nbbntn.exec:\nbbntn.exe118⤵PID:2976
-
\??\c:\dvpvj.exec:\dvpvj.exe119⤵PID:4592
-
\??\c:\9pjvj.exec:\9pjvj.exe120⤵PID:1864
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe121⤵PID:3200
-
\??\c:\bhtnhh.exec:\bhtnhh.exe122⤵PID:2040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-