Analysis
-
max time kernel
120s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-08-2024 23:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9da72266fb5cd27bf8fccdaec67a2a0N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
e9da72266fb5cd27bf8fccdaec67a2a0N.exe
-
Size
71KB
-
MD5
e9da72266fb5cd27bf8fccdaec67a2a0
-
SHA1
5599b7a2515cb9457bb2d4ac8291f684facd2c8a
-
SHA256
649fb42203103b3ebd2568941454a9fcda319f88453a2aa158774776b044039f
-
SHA512
16c1d4cc23c7575bec8edc899df882d90ddfdb820792a5224f00e7c5a94b0166f89cc851d144887ee3a7e792b9317fa79da020b517aeb81b31686d989bdcc897
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjo:ymb3NkkiQ3mdBjFI4V4
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/3792-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/620-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4900 jdvpd.exe 3308 lxrlrrf.exe 1196 htbtbb.exe 4252 vvppp.exe 2784 9rrrrrr.exe 2836 tnbbtn.exe 4896 pdjdd.exe 4044 7bbbbb.exe 4052 5vdvv.exe 640 xlrrrff.exe 404 frfxrrl.exe 1348 ppvvp.exe 3936 rlrfxxx.exe 2008 xlxffff.exe 3748 ddddp.exe 3008 jvvpj.exe 1720 lxxxlrl.exe 1028 rrxlffx.exe 4760 httnhn.exe 2824 dvdvj.exe 4064 rlrlfff.exe 620 fxlfllr.exe 2564 5tbtth.exe 4636 7djdp.exe 1736 rfxrlfx.exe 4868 ttbbtn.exe 1408 bnbtnt.exe 4312 1jdvp.exe 4908 pdpdv.exe 4964 lrrlxxr.exe 5080 rlxxllf.exe 1048 5hnnhh.exe 2700 9vjjd.exe 4712 pddpp.exe 4284 frlfxxx.exe 2488 frrxrrl.exe 3724 thtnbt.exe 3480 7nnnhn.exe 4984 jjvpj.exe 2492 dvdvj.exe 2516 lffxllf.exe 4252 bhbbtt.exe 2460 hnnnhh.exe 2256 djjjv.exe 1120 1djvp.exe 4160 5lflfxr.exe 3296 rffrlll.exe 3208 xffrlfx.exe 5104 tnnhhb.exe 2444 pvdvj.exe 1172 9vpjd.exe 1984 rflrxrf.exe 3288 llxrlxr.exe 1516 nhttnt.exe 1348 bnbtnh.exe 1096 ddvpj.exe 4316 pjvpj.exe 2000 7ffrlrf.exe 536 rxllffx.exe 3008 bnhbnh.exe 3948 5tnhhh.exe 2616 jdvpj.exe 5028 jpvjd.exe 4352 rrllxff.exe -
resource yara_rule behavioral2/memory/3792-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3792-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/620-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3792 wrote to memory of 4900 3792 e9da72266fb5cd27bf8fccdaec67a2a0N.exe 85 PID 3792 wrote to memory of 4900 3792 e9da72266fb5cd27bf8fccdaec67a2a0N.exe 85 PID 3792 wrote to memory of 4900 3792 e9da72266fb5cd27bf8fccdaec67a2a0N.exe 85 PID 4900 wrote to memory of 3308 4900 jdvpd.exe 86 PID 4900 wrote to memory of 3308 4900 jdvpd.exe 86 PID 4900 wrote to memory of 3308 4900 jdvpd.exe 86 PID 3308 wrote to memory of 1196 3308 lxrlrrf.exe 87 PID 3308 wrote to memory of 1196 3308 lxrlrrf.exe 87 PID 3308 wrote to memory of 1196 3308 lxrlrrf.exe 87 PID 1196 wrote to memory of 4252 1196 htbtbb.exe 88 PID 1196 wrote to memory of 4252 1196 htbtbb.exe 88 PID 1196 wrote to memory of 4252 1196 htbtbb.exe 88 PID 4252 wrote to memory of 2784 4252 vvppp.exe 89 PID 4252 wrote to memory of 2784 4252 vvppp.exe 89 PID 4252 wrote to memory of 2784 4252 vvppp.exe 89 PID 2784 wrote to memory of 2836 2784 9rrrrrr.exe 90 PID 2784 wrote to memory of 2836 2784 9rrrrrr.exe 90 PID 2784 wrote to memory of 2836 2784 9rrrrrr.exe 90 PID 2836 wrote to memory of 4896 2836 tnbbtn.exe 91 PID 2836 wrote to memory of 4896 2836 tnbbtn.exe 91 PID 2836 wrote to memory of 4896 2836 tnbbtn.exe 91 PID 4896 wrote to memory of 4044 4896 pdjdd.exe 92 PID 4896 wrote to memory of 4044 4896 pdjdd.exe 92 PID 4896 wrote to memory of 4044 4896 pdjdd.exe 92 PID 4044 wrote to memory of 4052 4044 7bbbbb.exe 93 PID 4044 wrote to memory of 4052 4044 7bbbbb.exe 93 PID 4044 wrote to memory of 4052 4044 7bbbbb.exe 93 PID 4052 wrote to memory of 640 4052 5vdvv.exe 94 PID 4052 wrote to memory of 640 4052 5vdvv.exe 94 PID 4052 wrote to memory of 640 4052 5vdvv.exe 94 PID 640 wrote to memory of 404 640 xlrrrff.exe 95 PID 640 wrote to memory of 404 640 xlrrrff.exe 95 PID 640 wrote to memory of 404 640 xlrrrff.exe 95 PID 404 wrote to memory of 1348 404 frfxrrl.exe 96 PID 404 wrote to memory of 1348 404 frfxrrl.exe 96 PID 404 wrote to memory of 1348 404 frfxrrl.exe 96 PID 1348 wrote to memory of 3936 1348 ppvvp.exe 97 PID 1348 wrote to memory of 3936 1348 ppvvp.exe 97 PID 1348 wrote to memory of 3936 1348 ppvvp.exe 97 PID 3936 wrote to memory of 2008 3936 rlrfxxx.exe 98 PID 3936 wrote to memory of 2008 3936 rlrfxxx.exe 98 PID 3936 wrote to memory of 2008 3936 rlrfxxx.exe 98 PID 2008 wrote to memory of 3748 2008 xlxffff.exe 100 PID 2008 wrote to memory of 3748 2008 xlxffff.exe 100 PID 2008 wrote to memory of 3748 2008 xlxffff.exe 100 PID 3748 wrote to memory of 3008 3748 ddddp.exe 101 PID 3748 wrote to memory of 3008 3748 ddddp.exe 101 PID 3748 wrote to memory of 3008 3748 ddddp.exe 101 PID 3008 wrote to memory of 1720 3008 jvvpj.exe 102 PID 3008 wrote to memory of 1720 3008 jvvpj.exe 102 PID 3008 wrote to memory of 1720 3008 jvvpj.exe 102 PID 1720 wrote to memory of 1028 1720 lxxxlrl.exe 103 PID 1720 wrote to memory of 1028 1720 lxxxlrl.exe 103 PID 1720 wrote to memory of 1028 1720 lxxxlrl.exe 103 PID 1028 wrote to memory of 4760 1028 rrxlffx.exe 104 PID 1028 wrote to memory of 4760 1028 rrxlffx.exe 104 PID 1028 wrote to memory of 4760 1028 rrxlffx.exe 104 PID 4760 wrote to memory of 2824 4760 httnhn.exe 105 PID 4760 wrote to memory of 2824 4760 httnhn.exe 105 PID 4760 wrote to memory of 2824 4760 httnhn.exe 105 PID 2824 wrote to memory of 4064 2824 dvdvj.exe 106 PID 2824 wrote to memory of 4064 2824 dvdvj.exe 106 PID 2824 wrote to memory of 4064 2824 dvdvj.exe 106 PID 4064 wrote to memory of 620 4064 rlrlfff.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9da72266fb5cd27bf8fccdaec67a2a0N.exe"C:\Users\Admin\AppData\Local\Temp\e9da72266fb5cd27bf8fccdaec67a2a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\jdvpd.exec:\jdvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\lxrlrrf.exec:\lxrlrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\htbtbb.exec:\htbtbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\vvppp.exec:\vvppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\9rrrrrr.exec:\9rrrrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\tnbbtn.exec:\tnbbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\pdjdd.exec:\pdjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\7bbbbb.exec:\7bbbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\5vdvv.exec:\5vdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\xlrrrff.exec:\xlrrrff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\frfxrrl.exec:\frfxrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\ppvvp.exec:\ppvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\rlrfxxx.exec:\rlrfxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\xlxffff.exec:\xlxffff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\ddddp.exec:\ddddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\jvvpj.exec:\jvvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\lxxxlrl.exec:\lxxxlrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\rrxlffx.exec:\rrxlffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\httnhn.exec:\httnhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\dvdvj.exec:\dvdvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\rlrlfff.exec:\rlrlfff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\fxlfllr.exec:\fxlfllr.exe23⤵
- Executes dropped EXE
PID:620 -
\??\c:\5tbtth.exec:\5tbtth.exe24⤵
- Executes dropped EXE
PID:2564 -
\??\c:\7djdp.exec:\7djdp.exe25⤵
- Executes dropped EXE
PID:4636 -
\??\c:\rfxrlfx.exec:\rfxrlfx.exe26⤵
- Executes dropped EXE
PID:1736 -
\??\c:\ttbbtn.exec:\ttbbtn.exe27⤵
- Executes dropped EXE
PID:4868 -
\??\c:\bnbtnt.exec:\bnbtnt.exe28⤵
- Executes dropped EXE
PID:1408 -
\??\c:\1jdvp.exec:\1jdvp.exe29⤵
- Executes dropped EXE
PID:4312 -
\??\c:\pdpdv.exec:\pdpdv.exe30⤵
- Executes dropped EXE
PID:4908 -
\??\c:\lrrlxxr.exec:\lrrlxxr.exe31⤵
- Executes dropped EXE
PID:4964 -
\??\c:\rlxxllf.exec:\rlxxllf.exe32⤵
- Executes dropped EXE
PID:5080 -
\??\c:\5hnnhh.exec:\5hnnhh.exe33⤵
- Executes dropped EXE
PID:1048 -
\??\c:\9vjjd.exec:\9vjjd.exe34⤵
- Executes dropped EXE
PID:2700 -
\??\c:\pddpp.exec:\pddpp.exe35⤵
- Executes dropped EXE
PID:4712 -
\??\c:\frlfxxx.exec:\frlfxxx.exe36⤵
- Executes dropped EXE
PID:4284 -
\??\c:\frrxrrl.exec:\frrxrrl.exe37⤵
- Executes dropped EXE
PID:2488 -
\??\c:\thtnbt.exec:\thtnbt.exe38⤵
- Executes dropped EXE
PID:3724 -
\??\c:\7nnnhn.exec:\7nnnhn.exe39⤵
- Executes dropped EXE
PID:3480 -
\??\c:\jjvpj.exec:\jjvpj.exe40⤵
- Executes dropped EXE
PID:4984 -
\??\c:\dvdvj.exec:\dvdvj.exe41⤵
- Executes dropped EXE
PID:2492 -
\??\c:\lffxllf.exec:\lffxllf.exe42⤵
- Executes dropped EXE
PID:2516 -
\??\c:\bhbbtt.exec:\bhbbtt.exe43⤵
- Executes dropped EXE
PID:4252 -
\??\c:\hnnnhh.exec:\hnnnhh.exe44⤵
- Executes dropped EXE
PID:2460 -
\??\c:\djjjv.exec:\djjjv.exe45⤵
- Executes dropped EXE
PID:2256 -
\??\c:\1djvp.exec:\1djvp.exe46⤵
- Executes dropped EXE
PID:1120 -
\??\c:\5lflfxr.exec:\5lflfxr.exe47⤵
- Executes dropped EXE
PID:4160 -
\??\c:\rffrlll.exec:\rffrlll.exe48⤵
- Executes dropped EXE
PID:3296 -
\??\c:\xffrlfx.exec:\xffrlfx.exe49⤵
- Executes dropped EXE
PID:3208 -
\??\c:\tnnhhb.exec:\tnnhhb.exe50⤵
- Executes dropped EXE
PID:5104 -
\??\c:\pvdvj.exec:\pvdvj.exe51⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9vpjd.exec:\9vpjd.exe52⤵
- Executes dropped EXE
PID:1172 -
\??\c:\rflrxrf.exec:\rflrxrf.exe53⤵
- Executes dropped EXE
PID:1984 -
\??\c:\llxrlxr.exec:\llxrlxr.exe54⤵
- Executes dropped EXE
PID:3288 -
\??\c:\nhttnt.exec:\nhttnt.exe55⤵
- Executes dropped EXE
PID:1516 -
\??\c:\bnbtnh.exec:\bnbtnh.exe56⤵
- Executes dropped EXE
PID:1348 -
\??\c:\ddvpj.exec:\ddvpj.exe57⤵
- Executes dropped EXE
PID:1096 -
\??\c:\pjvpj.exec:\pjvpj.exe58⤵
- Executes dropped EXE
PID:4316 -
\??\c:\7ffrlrf.exec:\7ffrlrf.exe59⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rxllffx.exec:\rxllffx.exe60⤵
- Executes dropped EXE
PID:536 -
\??\c:\bnhbnh.exec:\bnhbnh.exe61⤵
- Executes dropped EXE
PID:3008 -
\??\c:\5tnhhh.exec:\5tnhhh.exe62⤵
- Executes dropped EXE
PID:3948 -
\??\c:\jdvpj.exec:\jdvpj.exe63⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jpvjd.exec:\jpvjd.exe64⤵
- Executes dropped EXE
PID:5028 -
\??\c:\rrllxff.exec:\rrllxff.exe65⤵
- Executes dropped EXE
PID:4352 -
\??\c:\hntttt.exec:\hntttt.exe66⤵PID:2352
-
\??\c:\nnnnbb.exec:\nnnnbb.exe67⤵PID:3796
-
\??\c:\5vpjj.exec:\5vpjj.exe68⤵PID:4344
-
\??\c:\ddjdj.exec:\ddjdj.exe69⤵PID:3568
-
\??\c:\xxlfllx.exec:\xxlfllx.exe70⤵PID:620
-
\??\c:\frxrlff.exec:\frxrlff.exe71⤵PID:4732
-
\??\c:\tntntb.exec:\tntntb.exe72⤵PID:1528
-
\??\c:\tnhbtt.exec:\tnhbtt.exe73⤵PID:4220
-
\??\c:\dpvpj.exec:\dpvpj.exe74⤵PID:4684
-
\??\c:\vpvpd.exec:\vpvpd.exe75⤵PID:1760
-
\??\c:\lxflxrx.exec:\lxflxrx.exe76⤵PID:1408
-
\??\c:\lfrrlff.exec:\lfrrlff.exe77⤵PID:2168
-
\??\c:\bbhbbb.exec:\bbhbbb.exe78⤵PID:1208
-
\??\c:\hbbnhb.exec:\hbbnhb.exe79⤵PID:2324
-
\??\c:\dppvv.exec:\dppvv.exe80⤵PID:4964
-
\??\c:\ppvjv.exec:\ppvjv.exe81⤵PID:1108
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe82⤵PID:4856
-
\??\c:\lrfxllf.exec:\lrfxllf.exe83⤵PID:5020
-
\??\c:\bnnhbb.exec:\bnnhbb.exe84⤵PID:4812
-
\??\c:\vdvvv.exec:\vdvvv.exe85⤵PID:1376
-
\??\c:\7pvpv.exec:\7pvpv.exe86⤵PID:4276
-
\??\c:\hhbbtt.exec:\hhbbtt.exe87⤵PID:2924
-
\??\c:\vjjvj.exec:\vjjvj.exe88⤵PID:3924
-
\??\c:\vdvvv.exec:\vdvvv.exe89⤵PID:1552
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe90⤵PID:1648
-
\??\c:\fflllrr.exec:\fflllrr.exe91⤵PID:2636
-
\??\c:\bbhbtt.exec:\bbhbtt.exe92⤵PID:320
-
\??\c:\vvpjj.exec:\vvpjj.exe93⤵PID:2784
-
\??\c:\dpppv.exec:\dpppv.exe94⤵PID:696
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe95⤵PID:1360
-
\??\c:\fxfxrrf.exec:\fxfxrrf.exe96⤵PID:876
-
\??\c:\ntbbtn.exec:\ntbbtn.exe97⤵PID:3656
-
\??\c:\bnnhbt.exec:\bnnhbt.exe98⤵PID:3208
-
\??\c:\vdjjv.exec:\vdjjv.exe99⤵PID:5104
-
\??\c:\dddvj.exec:\dddvj.exe100⤵PID:2444
-
\??\c:\xxrlllf.exec:\xxrlllf.exe101⤵PID:856
-
\??\c:\7xfrffx.exec:\7xfrffx.exe102⤵PID:1984
-
\??\c:\1nhbtb.exec:\1nhbtb.exe103⤵PID:3828
-
\??\c:\thbbtn.exec:\thbbtn.exe104⤵PID:944
-
\??\c:\vpppd.exec:\vpppd.exe105⤵PID:1936
-
\??\c:\vjppp.exec:\vjppp.exe106⤵PID:3956
-
\??\c:\9rffxxr.exec:\9rffxxr.exe107⤵PID:1928
-
\??\c:\hhbttn.exec:\hhbttn.exe108⤵PID:4456
-
\??\c:\nhtnbb.exec:\nhtnbb.exe109⤵PID:2680
-
\??\c:\djppj.exec:\djppj.exe110⤵PID:1792
-
\??\c:\ppvdv.exec:\ppvdv.exe111⤵PID:3788
-
\??\c:\lxxrfff.exec:\lxxrfff.exe112⤵PID:4988
-
\??\c:\lrxrffx.exec:\lrxrffx.exe113⤵PID:3712
-
\??\c:\3tttnh.exec:\3tttnh.exe114⤵PID:4080
-
\??\c:\1ntthn.exec:\1ntthn.exe115⤵PID:4672
-
\??\c:\5jvpj.exec:\5jvpj.exe116⤵PID:4336
-
\??\c:\9vjdv.exec:\9vjdv.exe117⤵PID:2704
-
\??\c:\1xlfrrl.exec:\1xlfrrl.exe118⤵PID:1052
-
\??\c:\fxrxfrr.exec:\fxrxfrr.exe119⤵PID:744
-
\??\c:\tnhbtt.exec:\tnhbtt.exe120⤵PID:3644
-
\??\c:\nhnnbb.exec:\nhnnbb.exe121⤵PID:3968
-
\??\c:\jpddd.exec:\jpddd.exe122⤵PID:884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-