Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 00:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bcb05e58ae482629cc3a13acea1d6630N.exe
Resource
win7-20240729-en
6 signatures
120 seconds
General
-
Target
bcb05e58ae482629cc3a13acea1d6630N.exe
-
Size
105KB
-
MD5
bcb05e58ae482629cc3a13acea1d6630
-
SHA1
f484bd97a365a5e9c1ce1b724b28b7520387957c
-
SHA256
8552cb84a614aaaab22888bafefae06210f1d1c704964111749d16d2e0803e54
-
SHA512
abc7732e7bf3eb8a7ebc20f4cef9bd4766377b3924f4584e6122e7579b93472f2a73ed03e584e4f77f47828a740dbc2f159892d1e6b06399413c8cfa69a5f670
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afounQD6/T+gw3xtE:n3C9BRW0j/uQDy
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4852-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3424 7hnbbt.exe 972 5vjvj.exe 4924 djjjj.exe 4712 hthbnh.exe 2456 vvvpd.exe 3196 9xrfrrf.exe 2584 5hbthh.exe 3564 djddv.exe 1488 llrlxrr.exe 4504 9btnht.exe 2140 nhhbbb.exe 4124 3vpdp.exe 3492 xrxrllf.exe 3096 5tbbtb.exe 4472 jdvjv.exe 4560 1lxrflf.exe 3548 rxfrflx.exe 3080 ttbthn.exe 2120 dpvvj.exe 4984 9jppj.exe 4320 llflxxx.exe 4192 xxrllfx.exe 3812 bnttnn.exe 4780 jddjd.exe 1312 rrrxlxx.exe 1528 tttnnh.exe 3560 hbnhbb.exe 1404 vdjjp.exe 1360 xxfrlrl.exe 4784 bhnhtn.exe 3832 dpdvj.exe 1532 rxrflfx.exe 2808 fffxrrl.exe 4872 tnhbnh.exe 220 ppddj.exe 4344 jdpjd.exe 2580 lflxlrl.exe 4684 lfxfllf.exe 1668 hbhbbb.exe 5028 9hnntb.exe 4940 jdjdv.exe 1220 dpvpj.exe 2108 rxxxlxx.exe 4060 nnthtn.exe 3868 nthbtt.exe 1420 hhnhnn.exe 3380 7ppjd.exe 4812 dvpjp.exe 5092 9llxfxf.exe 1944 xffxrrr.exe 4392 btnnhb.exe 5024 dppdv.exe 2140 lrrlxxr.exe 2700 rrlrffr.exe 3720 tnnbtt.exe 4212 bbthbt.exe 4432 pjjdj.exe 1960 vppvj.exe 4236 rlflllf.exe 832 lxrrlfx.exe 3768 thbbth.exe 3028 thbnbt.exe 3672 vjdvj.exe 1116 pvpdv.exe -
resource yara_rule behavioral2/memory/4852-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1360-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4852 wrote to memory of 3424 4852 bcb05e58ae482629cc3a13acea1d6630N.exe 86 PID 4852 wrote to memory of 3424 4852 bcb05e58ae482629cc3a13acea1d6630N.exe 86 PID 4852 wrote to memory of 3424 4852 bcb05e58ae482629cc3a13acea1d6630N.exe 86 PID 3424 wrote to memory of 972 3424 7hnbbt.exe 87 PID 3424 wrote to memory of 972 3424 7hnbbt.exe 87 PID 3424 wrote to memory of 972 3424 7hnbbt.exe 87 PID 972 wrote to memory of 4924 972 5vjvj.exe 88 PID 972 wrote to memory of 4924 972 5vjvj.exe 88 PID 972 wrote to memory of 4924 972 5vjvj.exe 88 PID 4924 wrote to memory of 4712 4924 djjjj.exe 89 PID 4924 wrote to memory of 4712 4924 djjjj.exe 89 PID 4924 wrote to memory of 4712 4924 djjjj.exe 89 PID 4712 wrote to memory of 2456 4712 hthbnh.exe 90 PID 4712 wrote to memory of 2456 4712 hthbnh.exe 90 PID 4712 wrote to memory of 2456 4712 hthbnh.exe 90 PID 2456 wrote to memory of 3196 2456 vvvpd.exe 91 PID 2456 wrote to memory of 3196 2456 vvvpd.exe 91 PID 2456 wrote to memory of 3196 2456 vvvpd.exe 91 PID 3196 wrote to memory of 2584 3196 9xrfrrf.exe 92 PID 3196 wrote to memory of 2584 3196 9xrfrrf.exe 92 PID 3196 wrote to memory of 2584 3196 9xrfrrf.exe 92 PID 2584 wrote to memory of 3564 2584 5hbthh.exe 93 PID 2584 wrote to memory of 3564 2584 5hbthh.exe 93 PID 2584 wrote to memory of 3564 2584 5hbthh.exe 93 PID 3564 wrote to memory of 1488 3564 djddv.exe 94 PID 3564 wrote to memory of 1488 3564 djddv.exe 94 PID 3564 wrote to memory of 1488 3564 djddv.exe 94 PID 1488 wrote to memory of 4504 1488 llrlxrr.exe 95 PID 1488 wrote to memory of 4504 1488 llrlxrr.exe 95 PID 1488 wrote to memory of 4504 1488 llrlxrr.exe 95 PID 4504 wrote to memory of 2140 4504 9btnht.exe 96 PID 4504 wrote to memory of 2140 4504 9btnht.exe 96 PID 4504 wrote to memory of 2140 4504 9btnht.exe 96 PID 2140 wrote to memory of 4124 2140 nhhbbb.exe 97 PID 2140 wrote to memory of 4124 2140 nhhbbb.exe 97 PID 2140 wrote to memory of 4124 2140 nhhbbb.exe 97 PID 4124 wrote to memory of 3492 4124 3vpdp.exe 98 PID 4124 wrote to memory of 3492 4124 3vpdp.exe 98 PID 4124 wrote to memory of 3492 4124 3vpdp.exe 98 PID 3492 wrote to memory of 3096 3492 xrxrllf.exe 99 PID 3492 wrote to memory of 3096 3492 xrxrllf.exe 99 PID 3492 wrote to memory of 3096 3492 xrxrllf.exe 99 PID 3096 wrote to memory of 4472 3096 5tbbtb.exe 100 PID 3096 wrote to memory of 4472 3096 5tbbtb.exe 100 PID 3096 wrote to memory of 4472 3096 5tbbtb.exe 100 PID 4472 wrote to memory of 4560 4472 jdvjv.exe 101 PID 4472 wrote to memory of 4560 4472 jdvjv.exe 101 PID 4472 wrote to memory of 4560 4472 jdvjv.exe 101 PID 4560 wrote to memory of 3548 4560 1lxrflf.exe 102 PID 4560 wrote to memory of 3548 4560 1lxrflf.exe 102 PID 4560 wrote to memory of 3548 4560 1lxrflf.exe 102 PID 3548 wrote to memory of 3080 3548 rxfrflx.exe 104 PID 3548 wrote to memory of 3080 3548 rxfrflx.exe 104 PID 3548 wrote to memory of 3080 3548 rxfrflx.exe 104 PID 3080 wrote to memory of 2120 3080 ttbthn.exe 105 PID 3080 wrote to memory of 2120 3080 ttbthn.exe 105 PID 3080 wrote to memory of 2120 3080 ttbthn.exe 105 PID 2120 wrote to memory of 4984 2120 dpvvj.exe 106 PID 2120 wrote to memory of 4984 2120 dpvvj.exe 106 PID 2120 wrote to memory of 4984 2120 dpvvj.exe 106 PID 4984 wrote to memory of 4320 4984 9jppj.exe 107 PID 4984 wrote to memory of 4320 4984 9jppj.exe 107 PID 4984 wrote to memory of 4320 4984 9jppj.exe 107 PID 4320 wrote to memory of 4192 4320 llflxxx.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcb05e58ae482629cc3a13acea1d6630N.exe"C:\Users\Admin\AppData\Local\Temp\bcb05e58ae482629cc3a13acea1d6630N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\7hnbbt.exec:\7hnbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\5vjvj.exec:\5vjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\djjjj.exec:\djjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\hthbnh.exec:\hthbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\vvvpd.exec:\vvvpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\9xrfrrf.exec:\9xrfrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\5hbthh.exec:\5hbthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\djddv.exec:\djddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\llrlxrr.exec:\llrlxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\9btnht.exec:\9btnht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\nhhbbb.exec:\nhhbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\3vpdp.exec:\3vpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\xrxrllf.exec:\xrxrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\5tbbtb.exec:\5tbbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\jdvjv.exec:\jdvjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\1lxrflf.exec:\1lxrflf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\rxfrflx.exec:\rxfrflx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\ttbthn.exec:\ttbthn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\dpvvj.exec:\dpvvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\9jppj.exec:\9jppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\llflxxx.exec:\llflxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\xxrllfx.exec:\xxrllfx.exe23⤵
- Executes dropped EXE
PID:4192 -
\??\c:\bnttnn.exec:\bnttnn.exe24⤵
- Executes dropped EXE
PID:3812 -
\??\c:\jddjd.exec:\jddjd.exe25⤵
- Executes dropped EXE
PID:4780 -
\??\c:\rrrxlxx.exec:\rrrxlxx.exe26⤵
- Executes dropped EXE
PID:1312 -
\??\c:\tttnnh.exec:\tttnnh.exe27⤵
- Executes dropped EXE
PID:1528 -
\??\c:\hbnhbb.exec:\hbnhbb.exe28⤵
- Executes dropped EXE
PID:3560 -
\??\c:\vdjjp.exec:\vdjjp.exe29⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xxfrlrl.exec:\xxfrlrl.exe30⤵
- Executes dropped EXE
PID:1360 -
\??\c:\bhnhtn.exec:\bhnhtn.exe31⤵
- Executes dropped EXE
PID:4784 -
\??\c:\dpdvj.exec:\dpdvj.exe32⤵
- Executes dropped EXE
PID:3832 -
\??\c:\rxrflfx.exec:\rxrflfx.exe33⤵
- Executes dropped EXE
PID:1532 -
\??\c:\fffxrrl.exec:\fffxrrl.exe34⤵
- Executes dropped EXE
PID:2808 -
\??\c:\tnhbnh.exec:\tnhbnh.exe35⤵
- Executes dropped EXE
PID:4872 -
\??\c:\ppddj.exec:\ppddj.exe36⤵
- Executes dropped EXE
PID:220 -
\??\c:\jdpjd.exec:\jdpjd.exe37⤵
- Executes dropped EXE
PID:4344 -
\??\c:\lflxlrl.exec:\lflxlrl.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lfxfllf.exec:\lfxfllf.exe39⤵
- Executes dropped EXE
PID:4684 -
\??\c:\hbhbbb.exec:\hbhbbb.exe40⤵
- Executes dropped EXE
PID:1668 -
\??\c:\9hnntb.exec:\9hnntb.exe41⤵
- Executes dropped EXE
PID:5028 -
\??\c:\jdjdv.exec:\jdjdv.exe42⤵
- Executes dropped EXE
PID:4940 -
\??\c:\dpvpj.exec:\dpvpj.exe43⤵
- Executes dropped EXE
PID:1220 -
\??\c:\rxxxlxx.exec:\rxxxlxx.exe44⤵
- Executes dropped EXE
PID:2108 -
\??\c:\nnthtn.exec:\nnthtn.exe45⤵
- Executes dropped EXE
PID:4060 -
\??\c:\nthbtt.exec:\nthbtt.exe46⤵
- Executes dropped EXE
PID:3868 -
\??\c:\hhnhnn.exec:\hhnhnn.exe47⤵
- Executes dropped EXE
PID:1420 -
\??\c:\7ppjd.exec:\7ppjd.exe48⤵
- Executes dropped EXE
PID:3380 -
\??\c:\dvpjp.exec:\dvpjp.exe49⤵
- Executes dropped EXE
PID:4812 -
\??\c:\9llxfxf.exec:\9llxfxf.exe50⤵
- Executes dropped EXE
PID:5092 -
\??\c:\xffxrrr.exec:\xffxrrr.exe51⤵
- Executes dropped EXE
PID:1944 -
\??\c:\btnnhb.exec:\btnnhb.exe52⤵
- Executes dropped EXE
PID:4392 -
\??\c:\dppdv.exec:\dppdv.exe53⤵
- Executes dropped EXE
PID:5024 -
\??\c:\lrrlxxr.exec:\lrrlxxr.exe54⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rrlrffr.exec:\rrlrffr.exe55⤵
- Executes dropped EXE
PID:2700 -
\??\c:\tnnbtt.exec:\tnnbtt.exe56⤵
- Executes dropped EXE
PID:3720 -
\??\c:\bbthbt.exec:\bbthbt.exe57⤵
- Executes dropped EXE
PID:4212 -
\??\c:\pjjdj.exec:\pjjdj.exe58⤵
- Executes dropped EXE
PID:4432 -
\??\c:\vppvj.exec:\vppvj.exe59⤵
- Executes dropped EXE
PID:1960 -
\??\c:\rlflllf.exec:\rlflllf.exe60⤵
- Executes dropped EXE
PID:4236 -
\??\c:\lxrrlfx.exec:\lxrrlfx.exe61⤵
- Executes dropped EXE
PID:832 -
\??\c:\thbbth.exec:\thbbth.exe62⤵
- Executes dropped EXE
PID:3768 -
\??\c:\thbnbt.exec:\thbnbt.exe63⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vjdvj.exec:\vjdvj.exe64⤵
- Executes dropped EXE
PID:3672 -
\??\c:\pvpdv.exec:\pvpdv.exe65⤵
- Executes dropped EXE
PID:1116 -
\??\c:\lllxlfr.exec:\lllxlfr.exe66⤵PID:1536
-
\??\c:\lxxxllx.exec:\lxxxllx.exe67⤵PID:1108
-
\??\c:\httnnh.exec:\httnnh.exe68⤵PID:3812
-
\??\c:\dpjjj.exec:\dpjjj.exe69⤵PID:1540
-
\??\c:\djppv.exec:\djppv.exe70⤵PID:3600
-
\??\c:\5rlxrfr.exec:\5rlxrfr.exe71⤵PID:1528
-
\??\c:\lllxlfx.exec:\lllxlfx.exe72⤵PID:3532
-
\??\c:\9bbnbt.exec:\9bbnbt.exe73⤵PID:744
-
\??\c:\3hbnbt.exec:\3hbnbt.exe74⤵PID:532
-
\??\c:\ppjdp.exec:\ppjdp.exe75⤵PID:2028
-
\??\c:\vvpdp.exec:\vvpdp.exe76⤵PID:1360
-
\??\c:\llfffrr.exec:\llfffrr.exe77⤵PID:3804
-
\??\c:\rfxrfxf.exec:\rfxrfxf.exe78⤵PID:3404
-
\??\c:\7bbtht.exec:\7bbtht.exe79⤵PID:3832
-
\??\c:\hthbtn.exec:\hthbtn.exe80⤵PID:4752
-
\??\c:\djjdv.exec:\djjdv.exe81⤵PID:380
-
\??\c:\fxxlfxl.exec:\fxxlfxl.exe82⤵PID:2060
-
\??\c:\rxffxrl.exec:\rxffxrl.exe83⤵PID:4396
-
\??\c:\bbbtnn.exec:\bbbtnn.exe84⤵PID:4624
-
\??\c:\thhbhh.exec:\thhbhh.exe85⤵PID:1168
-
\??\c:\jvjvj.exec:\jvjvj.exe86⤵PID:4164
-
\??\c:\5jdpj.exec:\5jdpj.exe87⤵PID:3172
-
\??\c:\fflfxxx.exec:\fflfxxx.exe88⤵PID:1036
-
\??\c:\xfxrfxr.exec:\xfxrfxr.exe89⤵PID:4712
-
\??\c:\htbthb.exec:\htbthb.exe90⤵PID:2312
-
\??\c:\htnhtn.exec:\htnhtn.exe91⤵PID:1364
-
\??\c:\jppdp.exec:\jppdp.exe92⤵PID:4376
-
\??\c:\7pjdv.exec:\7pjdv.exe93⤵PID:2584
-
\??\c:\xlrrfxr.exec:\xlrrfxr.exe94⤵PID:2420
-
\??\c:\1ntnbb.exec:\1ntnbb.exe95⤵PID:4360
-
\??\c:\bnbhnb.exec:\bnbhnb.exe96⤵PID:2348
-
\??\c:\pjvjd.exec:\pjvjd.exe97⤵PID:4964
-
\??\c:\7frfrlx.exec:\7frfrlx.exe98⤵PID:4504
-
\??\c:\3xxrxrl.exec:\3xxrxrl.exe99⤵PID:4244
-
\??\c:\bnhtnn.exec:\bnhtnn.exe100⤵PID:992
-
\??\c:\1nhthb.exec:\1nhthb.exe101⤵PID:4124
-
\??\c:\djvpj.exec:\djvpj.exe102⤵PID:3128
-
\??\c:\vvpjp.exec:\vvpjp.exe103⤵PID:4868
-
\??\c:\5flfllx.exec:\5flfllx.exe104⤵PID:4472
-
\??\c:\5fxlfrf.exec:\5fxlfrf.exe105⤵PID:3968
-
\??\c:\3hhbnn.exec:\3hhbnn.exe106⤵PID:4000
-
\??\c:\jjvpd.exec:\jjvpd.exe107⤵PID:4444
-
\??\c:\pppdv.exec:\pppdv.exe108⤵PID:3088
-
\??\c:\djdvj.exec:\djdvj.exe109⤵PID:4976
-
\??\c:\lxrfxxl.exec:\lxrfxxl.exe110⤵PID:2744
-
\??\c:\5bthbn.exec:\5bthbn.exe111⤵PID:1508
-
\??\c:\tbbnbb.exec:\tbbnbb.exe112⤵PID:3412
-
\??\c:\1vvjd.exec:\1vvjd.exe113⤵PID:2212
-
\??\c:\5jdvd.exec:\5jdvd.exe114⤵PID:1760
-
\??\c:\jvvpp.exec:\jvvpp.exe115⤵PID:3092
-
\??\c:\5ffrrlx.exec:\5ffrrlx.exe116⤵PID:3912
-
\??\c:\7fxrlxr.exec:\7fxrlxr.exe117⤵PID:4900
-
\??\c:\bttnbt.exec:\bttnbt.exe118⤵PID:2128
-
\??\c:\hbthtn.exec:\hbthtn.exe119⤵PID:1528
-
\??\c:\vppjp.exec:\vppjp.exe120⤵PID:960
-
\??\c:\dpjvj.exec:\dpjvj.exe121⤵PID:2668
-
\??\c:\rfxlfxx.exec:\rfxlfxx.exe122⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-