Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 12:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bbcbc89c52699aa7a6841287619ffec0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
bbcbc89c52699aa7a6841287619ffec0N.exe
-
Size
70KB
-
MD5
bbcbc89c52699aa7a6841287619ffec0
-
SHA1
c78f0ffe144e9094968fa283cf28a348fc25d18f
-
SHA256
35175234c8e6192338a30c4b955daad9e403656167eda8d40d385bc75d216ecd
-
SHA512
8f777e0e4904e27c317e4620d93d11799d995ee5ba5774d18e537172abfce3ded57255d7a6325ee9dae8b1756ea86ea4a3a4e47721f658b5562a85e1e194589f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJ/RWPqBr3:ymb3NkkiQ3mdBjFIqsr3
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3104-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2472-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2992 hbtnhh.exe 4592 vpjjd.exe 996 fxxrllf.exe 2248 bnhtnh.exe 3252 7ppjj.exe 4824 vpvpp.exe 2080 9xlflrx.exe 3536 hbbbtt.exe 1072 9dppp.exe 1668 jvdvp.exe 116 3ffrrll.exe 212 rlrlllf.exe 4584 9thbbb.exe 4576 dvpjd.exe 3000 7rxrlrr.exe 3272 xxfffff.exe 1620 tbbbbb.exe 3184 nttnnn.exe 2284 jvpjd.exe 1776 rrxxllx.exe 4624 hhnnnn.exe 4812 ttttnh.exe 3460 jvvvj.exe 3960 frlfrrl.exe 3376 7bbbtt.exe 2472 dvppj.exe 1592 lfxrlll.exe 3524 5xfxxxx.exe 1988 httnbt.exe 3504 jdjdd.exe 3256 dvjpj.exe 1944 lfrrllf.exe 4988 hhbhhh.exe 4404 dvddv.exe 4108 flrrlxr.exe 2320 rlfrlxx.exe 5116 hbbttt.exe 632 1jpjj.exe 1720 vjjdd.exe 4504 rlfffff.exe 3952 flxrrrr.exe 2992 5nnhbb.exe 3756 dvjpj.exe 3652 dvvpp.exe 428 xfrlllf.exe 4628 xxxxrrr.exe 4524 rlrrlll.exe 4060 thttnt.exe 4924 dvjdj.exe 4188 vppjj.exe 1300 5llfxxx.exe 3120 rflfffx.exe 1124 hhtthh.exe 32 hbhbbb.exe 244 3vdvp.exe 3140 dvjjv.exe 116 lflfxrl.exe 212 9bhtnn.exe 708 ddjdj.exe 2480 lxxrxxr.exe 3200 3ffxxxr.exe 4632 hbhtnn.exe 3336 pjppj.exe 536 rrrlfll.exe -
resource yara_rule behavioral2/memory/3104-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2472-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3104 wrote to memory of 2992 3104 bbcbc89c52699aa7a6841287619ffec0N.exe 83 PID 3104 wrote to memory of 2992 3104 bbcbc89c52699aa7a6841287619ffec0N.exe 83 PID 3104 wrote to memory of 2992 3104 bbcbc89c52699aa7a6841287619ffec0N.exe 83 PID 2992 wrote to memory of 4592 2992 hbtnhh.exe 84 PID 2992 wrote to memory of 4592 2992 hbtnhh.exe 84 PID 2992 wrote to memory of 4592 2992 hbtnhh.exe 84 PID 4592 wrote to memory of 996 4592 vpjjd.exe 85 PID 4592 wrote to memory of 996 4592 vpjjd.exe 85 PID 4592 wrote to memory of 996 4592 vpjjd.exe 85 PID 996 wrote to memory of 2248 996 fxxrllf.exe 86 PID 996 wrote to memory of 2248 996 fxxrllf.exe 86 PID 996 wrote to memory of 2248 996 fxxrllf.exe 86 PID 2248 wrote to memory of 3252 2248 bnhtnh.exe 87 PID 2248 wrote to memory of 3252 2248 bnhtnh.exe 87 PID 2248 wrote to memory of 3252 2248 bnhtnh.exe 87 PID 3252 wrote to memory of 4824 3252 7ppjj.exe 88 PID 3252 wrote to memory of 4824 3252 7ppjj.exe 88 PID 3252 wrote to memory of 4824 3252 7ppjj.exe 88 PID 4824 wrote to memory of 2080 4824 vpvpp.exe 89 PID 4824 wrote to memory of 2080 4824 vpvpp.exe 89 PID 4824 wrote to memory of 2080 4824 vpvpp.exe 89 PID 2080 wrote to memory of 3536 2080 9xlflrx.exe 90 PID 2080 wrote to memory of 3536 2080 9xlflrx.exe 90 PID 2080 wrote to memory of 3536 2080 9xlflrx.exe 90 PID 3536 wrote to memory of 1072 3536 hbbbtt.exe 91 PID 3536 wrote to memory of 1072 3536 hbbbtt.exe 91 PID 3536 wrote to memory of 1072 3536 hbbbtt.exe 91 PID 1072 wrote to memory of 1668 1072 9dppp.exe 92 PID 1072 wrote to memory of 1668 1072 9dppp.exe 92 PID 1072 wrote to memory of 1668 1072 9dppp.exe 92 PID 1668 wrote to memory of 116 1668 jvdvp.exe 93 PID 1668 wrote to memory of 116 1668 jvdvp.exe 93 PID 1668 wrote to memory of 116 1668 jvdvp.exe 93 PID 116 wrote to memory of 212 116 3ffrrll.exe 94 PID 116 wrote to memory of 212 116 3ffrrll.exe 94 PID 116 wrote to memory of 212 116 3ffrrll.exe 94 PID 212 wrote to memory of 4584 212 rlrlllf.exe 95 PID 212 wrote to memory of 4584 212 rlrlllf.exe 95 PID 212 wrote to memory of 4584 212 rlrlllf.exe 95 PID 4584 wrote to memory of 4576 4584 9thbbb.exe 97 PID 4584 wrote to memory of 4576 4584 9thbbb.exe 97 PID 4584 wrote to memory of 4576 4584 9thbbb.exe 97 PID 4576 wrote to memory of 3000 4576 dvpjd.exe 98 PID 4576 wrote to memory of 3000 4576 dvpjd.exe 98 PID 4576 wrote to memory of 3000 4576 dvpjd.exe 98 PID 3000 wrote to memory of 3272 3000 7rxrlrr.exe 99 PID 3000 wrote to memory of 3272 3000 7rxrlrr.exe 99 PID 3000 wrote to memory of 3272 3000 7rxrlrr.exe 99 PID 3272 wrote to memory of 1620 3272 xxfffff.exe 100 PID 3272 wrote to memory of 1620 3272 xxfffff.exe 100 PID 3272 wrote to memory of 1620 3272 xxfffff.exe 100 PID 1620 wrote to memory of 3184 1620 tbbbbb.exe 101 PID 1620 wrote to memory of 3184 1620 tbbbbb.exe 101 PID 1620 wrote to memory of 3184 1620 tbbbbb.exe 101 PID 3184 wrote to memory of 2284 3184 nttnnn.exe 102 PID 3184 wrote to memory of 2284 3184 nttnnn.exe 102 PID 3184 wrote to memory of 2284 3184 nttnnn.exe 102 PID 2284 wrote to memory of 1776 2284 jvpjd.exe 103 PID 2284 wrote to memory of 1776 2284 jvpjd.exe 103 PID 2284 wrote to memory of 1776 2284 jvpjd.exe 103 PID 1776 wrote to memory of 4624 1776 rrxxllx.exe 104 PID 1776 wrote to memory of 4624 1776 rrxxllx.exe 104 PID 1776 wrote to memory of 4624 1776 rrxxllx.exe 104 PID 4624 wrote to memory of 4812 4624 hhnnnn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbcbc89c52699aa7a6841287619ffec0N.exe"C:\Users\Admin\AppData\Local\Temp\bbcbc89c52699aa7a6841287619ffec0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\hbtnhh.exec:\hbtnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\vpjjd.exec:\vpjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\fxxrllf.exec:\fxxrllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\bnhtnh.exec:\bnhtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\7ppjj.exec:\7ppjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\vpvpp.exec:\vpvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\9xlflrx.exec:\9xlflrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\hbbbtt.exec:\hbbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\9dppp.exec:\9dppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\jvdvp.exec:\jvdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\3ffrrll.exec:\3ffrrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\rlrlllf.exec:\rlrlllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\9thbbb.exec:\9thbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\dvpjd.exec:\dvpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\7rxrlrr.exec:\7rxrlrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\xxfffff.exec:\xxfffff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\tbbbbb.exec:\tbbbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\nttnnn.exec:\nttnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\jvpjd.exec:\jvpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\rrxxllx.exec:\rrxxllx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\hhnnnn.exec:\hhnnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\ttttnh.exec:\ttttnh.exe23⤵
- Executes dropped EXE
PID:4812 -
\??\c:\jvvvj.exec:\jvvvj.exe24⤵
- Executes dropped EXE
PID:3460 -
\??\c:\frlfrrl.exec:\frlfrrl.exe25⤵
- Executes dropped EXE
PID:3960 -
\??\c:\7bbbtt.exec:\7bbbtt.exe26⤵
- Executes dropped EXE
PID:3376 -
\??\c:\dvppj.exec:\dvppj.exe27⤵
- Executes dropped EXE
PID:2472 -
\??\c:\lfxrlll.exec:\lfxrlll.exe28⤵
- Executes dropped EXE
PID:1592 -
\??\c:\5xfxxxx.exec:\5xfxxxx.exe29⤵
- Executes dropped EXE
PID:3524 -
\??\c:\httnbt.exec:\httnbt.exe30⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jdjdd.exec:\jdjdd.exe31⤵
- Executes dropped EXE
PID:3504 -
\??\c:\dvjpj.exec:\dvjpj.exe32⤵
- Executes dropped EXE
PID:3256 -
\??\c:\lfrrllf.exec:\lfrrllf.exe33⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hhbhhh.exec:\hhbhhh.exe34⤵
- Executes dropped EXE
PID:4988 -
\??\c:\dvddv.exec:\dvddv.exe35⤵
- Executes dropped EXE
PID:4404 -
\??\c:\flrrlxr.exec:\flrrlxr.exe36⤵
- Executes dropped EXE
PID:4108 -
\??\c:\rlfrlxx.exec:\rlfrlxx.exe37⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hbbttt.exec:\hbbttt.exe38⤵
- Executes dropped EXE
PID:5116 -
\??\c:\1jpjj.exec:\1jpjj.exe39⤵
- Executes dropped EXE
PID:632 -
\??\c:\vjjdd.exec:\vjjdd.exe40⤵
- Executes dropped EXE
PID:1720 -
\??\c:\rlfffff.exec:\rlfffff.exe41⤵
- Executes dropped EXE
PID:4504 -
\??\c:\flxrrrr.exec:\flxrrrr.exe42⤵
- Executes dropped EXE
PID:3952 -
\??\c:\5nnhbb.exec:\5nnhbb.exe43⤵
- Executes dropped EXE
PID:2992 -
\??\c:\dvjpj.exec:\dvjpj.exe44⤵
- Executes dropped EXE
PID:3756 -
\??\c:\dvvpp.exec:\dvvpp.exe45⤵
- Executes dropped EXE
PID:3652 -
\??\c:\xfrlllf.exec:\xfrlllf.exe46⤵
- Executes dropped EXE
PID:428 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe47⤵
- Executes dropped EXE
PID:4628 -
\??\c:\rlrrlll.exec:\rlrrlll.exe48⤵
- Executes dropped EXE
PID:4524 -
\??\c:\thttnt.exec:\thttnt.exe49⤵
- Executes dropped EXE
PID:4060 -
\??\c:\dvjdj.exec:\dvjdj.exe50⤵
- Executes dropped EXE
PID:4924 -
\??\c:\vppjj.exec:\vppjj.exe51⤵
- Executes dropped EXE
PID:4188 -
\??\c:\5llfxxx.exec:\5llfxxx.exe52⤵
- Executes dropped EXE
PID:1300 -
\??\c:\rflfffx.exec:\rflfffx.exe53⤵
- Executes dropped EXE
PID:3120 -
\??\c:\hhtthh.exec:\hhtthh.exe54⤵
- Executes dropped EXE
PID:1124 -
\??\c:\hbhbbb.exec:\hbhbbb.exe55⤵
- Executes dropped EXE
PID:32 -
\??\c:\3vdvp.exec:\3vdvp.exe56⤵
- Executes dropped EXE
PID:244 -
\??\c:\dvjjv.exec:\dvjjv.exe57⤵
- Executes dropped EXE
PID:3140 -
\??\c:\lflfxrl.exec:\lflfxrl.exe58⤵
- Executes dropped EXE
PID:116 -
\??\c:\9bhtnn.exec:\9bhtnn.exe59⤵
- Executes dropped EXE
PID:212 -
\??\c:\ddjdj.exec:\ddjdj.exe60⤵
- Executes dropped EXE
PID:708 -
\??\c:\lxxrxxr.exec:\lxxrxxr.exe61⤵
- Executes dropped EXE
PID:2480 -
\??\c:\3ffxxxr.exec:\3ffxxxr.exe62⤵
- Executes dropped EXE
PID:3200 -
\??\c:\hbhtnn.exec:\hbhtnn.exe63⤵
- Executes dropped EXE
PID:4632 -
\??\c:\pjppj.exec:\pjppj.exe64⤵
- Executes dropped EXE
PID:3336 -
\??\c:\rrrlfll.exec:\rrrlfll.exe65⤵
- Executes dropped EXE
PID:536 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe66⤵PID:2760
-
\??\c:\htbttt.exec:\htbttt.exe67⤵PID:2208
-
\??\c:\thbnnt.exec:\thbnnt.exe68⤵PID:2324
-
\??\c:\jddvp.exec:\jddvp.exe69⤵PID:3156
-
\??\c:\9djdv.exec:\9djdv.exe70⤵PID:4540
-
\??\c:\pjjdd.exec:\pjjdd.exe71⤵PID:3348
-
\??\c:\rfllfll.exec:\rfllfll.exe72⤵PID:3960
-
\??\c:\nnnnht.exec:\nnnnht.exe73⤵PID:3376
-
\??\c:\btbthh.exec:\btbthh.exe74⤵PID:3340
-
\??\c:\7pjpp.exec:\7pjpp.exe75⤵PID:1396
-
\??\c:\5vpjd.exec:\5vpjd.exe76⤵PID:2740
-
\??\c:\xrxxxlf.exec:\xrxxxlf.exe77⤵PID:1608
-
\??\c:\xxxlfrl.exec:\xxxlfrl.exe78⤵PID:3384
-
\??\c:\thbtbb.exec:\thbtbb.exe79⤵PID:4184
-
\??\c:\hbhbhh.exec:\hbhbhh.exe80⤵PID:2020
-
\??\c:\dvjvj.exec:\dvjvj.exe81⤵PID:2696
-
\??\c:\rrlllll.exec:\rrlllll.exe82⤵PID:3964
-
\??\c:\5frrlrl.exec:\5frrlrl.exe83⤵PID:2420
-
\??\c:\frxrlll.exec:\frxrlll.exe84⤵PID:5092
-
\??\c:\bthhbb.exec:\bthhbb.exe85⤵PID:3880
-
\??\c:\vpvdd.exec:\vpvdd.exe86⤵PID:3396
-
\??\c:\jpvvv.exec:\jpvvv.exe87⤵PID:3456
-
\??\c:\rlffxxx.exec:\rlffxxx.exe88⤵PID:2940
-
\??\c:\xxffllr.exec:\xxffllr.exe89⤵PID:2320
-
\??\c:\1hbttt.exec:\1hbttt.exe90⤵PID:1856
-
\??\c:\hbbbtt.exec:\hbbbtt.exe91⤵PID:4368
-
\??\c:\jjvdv.exec:\jjvdv.exe92⤵PID:1720
-
\??\c:\ppjdv.exec:\ppjdv.exe93⤵PID:3560
-
\??\c:\9rfrllf.exec:\9rfrllf.exe94⤵PID:4744
-
\??\c:\3lfrlrr.exec:\3lfrlrr.exe95⤵PID:3104
-
\??\c:\btbnnn.exec:\btbnnn.exe96⤵PID:2436
-
\??\c:\hhtntt.exec:\hhtntt.exe97⤵PID:3608
-
\??\c:\pjpdv.exec:\pjpdv.exe98⤵PID:3404
-
\??\c:\dvdpj.exec:\dvdpj.exe99⤵PID:3032
-
\??\c:\ppjdv.exec:\ppjdv.exe100⤵PID:1452
-
\??\c:\9xlfxxx.exec:\9xlfxxx.exe101⤵PID:4164
-
\??\c:\lrrllxx.exec:\lrrllxx.exe102⤵PID:8
-
\??\c:\3bbttt.exec:\3bbttt.exe103⤵PID:2816
-
\??\c:\ttbbtt.exec:\ttbbtt.exe104⤵PID:1060
-
\??\c:\pdddv.exec:\pdddv.exe105⤵PID:3536
-
\??\c:\fxlfrlx.exec:\fxlfrlx.exe106⤵PID:216
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe107⤵PID:2660
-
\??\c:\nttbbb.exec:\nttbbb.exe108⤵PID:452
-
\??\c:\3htnhh.exec:\3htnhh.exe109⤵PID:1952
-
\??\c:\jjddj.exec:\jjddj.exe110⤵PID:228
-
\??\c:\pjdvp.exec:\pjdvp.exe111⤵PID:3888
-
\??\c:\1lrrlxr.exec:\1lrrlxr.exe112⤵PID:4608
-
\??\c:\ffrxffl.exec:\ffrxffl.exe113⤵PID:1088
-
\??\c:\nbbnbb.exec:\nbbnbb.exe114⤵PID:4528
-
\??\c:\hnnhbb.exec:\hnnhbb.exe115⤵PID:1924
-
\??\c:\1dvpj.exec:\1dvpj.exe116⤵PID:4900
-
\??\c:\jddvp.exec:\jddvp.exe117⤵PID:2284
-
\??\c:\rrxfffl.exec:\rrxfffl.exe118⤵PID:1776
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe119⤵PID:4072
-
\??\c:\bhhhbn.exec:\bhhhbn.exe120⤵PID:3460
-
\??\c:\tnnnbn.exec:\tnnnbn.exe121⤵PID:3292
-
\??\c:\jddvp.exec:\jddvp.exe122⤵PID:3216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-