Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 10:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e8c1f161f1101b62d4bba66eeba39fd0N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
e8c1f161f1101b62d4bba66eeba39fd0N.exe
-
Size
74KB
-
MD5
e8c1f161f1101b62d4bba66eeba39fd0
-
SHA1
cd9347de9c77ae9e20239667c9b9c895f41b2d0a
-
SHA256
ac0b63a32bfb85674d6bd1cc2a3d58680a918e5cfa469cf77e1228a7b5f5dd4e
-
SHA512
6985a82f8f73ac70eccc9eade04f7598d19fba2e4599c4bb057cfa06dbb844ab916e10a56a1daad2a196627ebaa235e0e240defc74e7fd20d78513b4f9324297
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmPR:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHW
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral2/memory/716-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/716-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/892-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/892-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1612 xlllfrr.exe 4444 pdjjj.exe 4908 jvppd.exe 2368 ppddv.exe 892 ffffffr.exe 1800 hhhthh.exe 3772 ffxxxfx.exe 3412 tbtbbh.exe 2904 jjjvp.exe 4592 rrffxrx.exe 1872 hnbhbn.exe 1360 3dddd.exe 1272 lxxfrrx.exe 3780 bhnttb.exe 516 vjppp.exe 4636 fxxrffl.exe 1916 thhnht.exe 2060 ttbtht.exe 2124 fxxrfxl.exe 3368 htnhbt.exe 3104 3pddd.exe 2512 xfxxxxx.exe 3240 ttttbb.exe 1472 vpvpp.exe 4688 dvvjd.exe 4992 lrrxxff.exe 2436 ntthbh.exe 4696 vpdpp.exe 3108 rffxrrl.exe 3008 lrxxffx.exe 404 tnhhbt.exe 1388 vpdvd.exe 4460 rlxlrrr.exe 1648 bnthtb.exe 5016 pddvv.exe 3436 vjvvj.exe 1604 fxxxxll.exe 4356 nnnnnn.exe 4248 djppp.exe 3952 vjpdd.exe 1084 fflxxrx.exe 1704 nnhtbh.exe 1356 hhhhbh.exe 5064 djppv.exe 4876 3rlfllf.exe 4568 ntbbnb.exe 3660 nhhnhn.exe 1608 9jvpp.exe 4892 fxfxflf.exe 456 rxffxfr.exe 4188 tttthn.exe 5080 jvdvv.exe 3628 ddjdv.exe 1272 rrrxrlr.exe 2104 bttntt.exe 644 tnhbhh.exe 1684 fxxfllr.exe 4732 nhtntb.exe 3408 btnnnn.exe 2100 pvjjd.exe 4076 llffxxf.exe 1764 tbtbbh.exe 4116 btttnn.exe 1844 dvjvp.exe -
resource yara_rule behavioral2/memory/716-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/716-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/892-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/892-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/892-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/892-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1360-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 716 wrote to memory of 1612 716 e8c1f161f1101b62d4bba66eeba39fd0N.exe 83 PID 716 wrote to memory of 1612 716 e8c1f161f1101b62d4bba66eeba39fd0N.exe 83 PID 716 wrote to memory of 1612 716 e8c1f161f1101b62d4bba66eeba39fd0N.exe 83 PID 1612 wrote to memory of 4444 1612 xlllfrr.exe 84 PID 1612 wrote to memory of 4444 1612 xlllfrr.exe 84 PID 1612 wrote to memory of 4444 1612 xlllfrr.exe 84 PID 4444 wrote to memory of 4908 4444 pdjjj.exe 85 PID 4444 wrote to memory of 4908 4444 pdjjj.exe 85 PID 4444 wrote to memory of 4908 4444 pdjjj.exe 85 PID 4908 wrote to memory of 2368 4908 jvppd.exe 86 PID 4908 wrote to memory of 2368 4908 jvppd.exe 86 PID 4908 wrote to memory of 2368 4908 jvppd.exe 86 PID 2368 wrote to memory of 892 2368 ppddv.exe 87 PID 2368 wrote to memory of 892 2368 ppddv.exe 87 PID 2368 wrote to memory of 892 2368 ppddv.exe 87 PID 892 wrote to memory of 1800 892 ffffffr.exe 88 PID 892 wrote to memory of 1800 892 ffffffr.exe 88 PID 892 wrote to memory of 1800 892 ffffffr.exe 88 PID 1800 wrote to memory of 3772 1800 hhhthh.exe 89 PID 1800 wrote to memory of 3772 1800 hhhthh.exe 89 PID 1800 wrote to memory of 3772 1800 hhhthh.exe 89 PID 3772 wrote to memory of 3412 3772 ffxxxfx.exe 90 PID 3772 wrote to memory of 3412 3772 ffxxxfx.exe 90 PID 3772 wrote to memory of 3412 3772 ffxxxfx.exe 90 PID 3412 wrote to memory of 2904 3412 tbtbbh.exe 92 PID 3412 wrote to memory of 2904 3412 tbtbbh.exe 92 PID 3412 wrote to memory of 2904 3412 tbtbbh.exe 92 PID 2904 wrote to memory of 4592 2904 jjjvp.exe 93 PID 2904 wrote to memory of 4592 2904 jjjvp.exe 93 PID 2904 wrote to memory of 4592 2904 jjjvp.exe 93 PID 4592 wrote to memory of 1872 4592 rrffxrx.exe 94 PID 4592 wrote to memory of 1872 4592 rrffxrx.exe 94 PID 4592 wrote to memory of 1872 4592 rrffxrx.exe 94 PID 1872 wrote to memory of 1360 1872 hnbhbn.exe 95 PID 1872 wrote to memory of 1360 1872 hnbhbn.exe 95 PID 1872 wrote to memory of 1360 1872 hnbhbn.exe 95 PID 1360 wrote to memory of 1272 1360 3dddd.exe 96 PID 1360 wrote to memory of 1272 1360 3dddd.exe 96 PID 1360 wrote to memory of 1272 1360 3dddd.exe 96 PID 1272 wrote to memory of 3780 1272 lxxfrrx.exe 97 PID 1272 wrote to memory of 3780 1272 lxxfrrx.exe 97 PID 1272 wrote to memory of 3780 1272 lxxfrrx.exe 97 PID 3780 wrote to memory of 516 3780 bhnttb.exe 98 PID 3780 wrote to memory of 516 3780 bhnttb.exe 98 PID 3780 wrote to memory of 516 3780 bhnttb.exe 98 PID 516 wrote to memory of 4636 516 vjppp.exe 99 PID 516 wrote to memory of 4636 516 vjppp.exe 99 PID 516 wrote to memory of 4636 516 vjppp.exe 99 PID 4636 wrote to memory of 1916 4636 fxxrffl.exe 100 PID 4636 wrote to memory of 1916 4636 fxxrffl.exe 100 PID 4636 wrote to memory of 1916 4636 fxxrffl.exe 100 PID 1916 wrote to memory of 2060 1916 thhnht.exe 101 PID 1916 wrote to memory of 2060 1916 thhnht.exe 101 PID 1916 wrote to memory of 2060 1916 thhnht.exe 101 PID 2060 wrote to memory of 2124 2060 ttbtht.exe 103 PID 2060 wrote to memory of 2124 2060 ttbtht.exe 103 PID 2060 wrote to memory of 2124 2060 ttbtht.exe 103 PID 2124 wrote to memory of 3368 2124 fxxrfxl.exe 104 PID 2124 wrote to memory of 3368 2124 fxxrfxl.exe 104 PID 2124 wrote to memory of 3368 2124 fxxrfxl.exe 104 PID 3368 wrote to memory of 3104 3368 htnhbt.exe 105 PID 3368 wrote to memory of 3104 3368 htnhbt.exe 105 PID 3368 wrote to memory of 3104 3368 htnhbt.exe 105 PID 3104 wrote to memory of 2512 3104 3pddd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8c1f161f1101b62d4bba66eeba39fd0N.exe"C:\Users\Admin\AppData\Local\Temp\e8c1f161f1101b62d4bba66eeba39fd0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\xlllfrr.exec:\xlllfrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\pdjjj.exec:\pdjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\jvppd.exec:\jvppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\ppddv.exec:\ppddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\ffffffr.exec:\ffffffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\hhhthh.exec:\hhhthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\ffxxxfx.exec:\ffxxxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\tbtbbh.exec:\tbtbbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\jjjvp.exec:\jjjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\rrffxrx.exec:\rrffxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\hnbhbn.exec:\hnbhbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\3dddd.exec:\3dddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\lxxfrrx.exec:\lxxfrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\bhnttb.exec:\bhnttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\vjppp.exec:\vjppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\fxxrffl.exec:\fxxrffl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\thhnht.exec:\thhnht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\ttbtht.exec:\ttbtht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\fxxrfxl.exec:\fxxrfxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\htnhbt.exec:\htnhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\3pddd.exec:\3pddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\xfxxxxx.exec:\xfxxxxx.exe23⤵
- Executes dropped EXE
PID:2512 -
\??\c:\ttttbb.exec:\ttttbb.exe24⤵
- Executes dropped EXE
PID:3240 -
\??\c:\vpvpp.exec:\vpvpp.exe25⤵
- Executes dropped EXE
PID:1472 -
\??\c:\dvvjd.exec:\dvvjd.exe26⤵
- Executes dropped EXE
PID:4688 -
\??\c:\lrrxxff.exec:\lrrxxff.exe27⤵
- Executes dropped EXE
PID:4992 -
\??\c:\ntthbh.exec:\ntthbh.exe28⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vpdpp.exec:\vpdpp.exe29⤵
- Executes dropped EXE
PID:4696 -
\??\c:\rffxrrl.exec:\rffxrrl.exe30⤵
- Executes dropped EXE
PID:3108 -
\??\c:\lrxxffx.exec:\lrxxffx.exe31⤵
- Executes dropped EXE
PID:3008 -
\??\c:\tnhhbt.exec:\tnhhbt.exe32⤵
- Executes dropped EXE
PID:404 -
\??\c:\vpdvd.exec:\vpdvd.exe33⤵
- Executes dropped EXE
PID:1388 -
\??\c:\rlxlrrr.exec:\rlxlrrr.exe34⤵
- Executes dropped EXE
PID:4460 -
\??\c:\bnthtb.exec:\bnthtb.exe35⤵
- Executes dropped EXE
PID:1648 -
\??\c:\pddvv.exec:\pddvv.exe36⤵
- Executes dropped EXE
PID:5016 -
\??\c:\vjvvj.exec:\vjvvj.exe37⤵
- Executes dropped EXE
PID:3436 -
\??\c:\fxxxxll.exec:\fxxxxll.exe38⤵
- Executes dropped EXE
PID:1604 -
\??\c:\nnnnnn.exec:\nnnnnn.exe39⤵
- Executes dropped EXE
PID:4356 -
\??\c:\djppp.exec:\djppp.exe40⤵
- Executes dropped EXE
PID:4248 -
\??\c:\vjpdd.exec:\vjpdd.exe41⤵
- Executes dropped EXE
PID:3952 -
\??\c:\fflxxrx.exec:\fflxxrx.exe42⤵
- Executes dropped EXE
PID:1084 -
\??\c:\nnhtbh.exec:\nnhtbh.exe43⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hhhhbh.exec:\hhhhbh.exe44⤵
- Executes dropped EXE
PID:1356 -
\??\c:\djppv.exec:\djppv.exe45⤵
- Executes dropped EXE
PID:5064 -
\??\c:\3rlfllf.exec:\3rlfllf.exe46⤵
- Executes dropped EXE
PID:4876 -
\??\c:\ntbbnb.exec:\ntbbnb.exe47⤵
- Executes dropped EXE
PID:4568 -
\??\c:\nhhnhn.exec:\nhhnhn.exe48⤵
- Executes dropped EXE
PID:3660 -
\??\c:\9jvpp.exec:\9jvpp.exe49⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fxfxflf.exec:\fxfxflf.exe50⤵
- Executes dropped EXE
PID:4892 -
\??\c:\rxffxfr.exec:\rxffxfr.exe51⤵
- Executes dropped EXE
PID:456 -
\??\c:\tttthn.exec:\tttthn.exe52⤵
- Executes dropped EXE
PID:4188 -
\??\c:\jvdvv.exec:\jvdvv.exe53⤵
- Executes dropped EXE
PID:5080 -
\??\c:\ddjdv.exec:\ddjdv.exe54⤵
- Executes dropped EXE
PID:3628 -
\??\c:\rrrxrlr.exec:\rrrxrlr.exe55⤵
- Executes dropped EXE
PID:1272 -
\??\c:\bttntt.exec:\bttntt.exe56⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tnhbhh.exec:\tnhbhh.exe57⤵
- Executes dropped EXE
PID:644 -
\??\c:\fxxfllr.exec:\fxxfllr.exe58⤵
- Executes dropped EXE
PID:1684 -
\??\c:\nhtntb.exec:\nhtntb.exe59⤵
- Executes dropped EXE
PID:4732 -
\??\c:\btnnnn.exec:\btnnnn.exe60⤵
- Executes dropped EXE
PID:3408 -
\??\c:\pvjjd.exec:\pvjjd.exe61⤵
- Executes dropped EXE
PID:2100 -
\??\c:\llffxxf.exec:\llffxxf.exe62⤵
- Executes dropped EXE
PID:4076 -
\??\c:\tbtbbh.exec:\tbtbbh.exe63⤵
- Executes dropped EXE
PID:1764 -
\??\c:\btttnn.exec:\btttnn.exe64⤵
- Executes dropped EXE
PID:4116 -
\??\c:\dvjvp.exec:\dvjvp.exe65⤵
- Executes dropped EXE
PID:1844 -
\??\c:\xllllrf.exec:\xllllrf.exe66⤵PID:4816
-
\??\c:\tnbtnh.exec:\tnbtnh.exe67⤵PID:1840
-
\??\c:\ppppj.exec:\ppppj.exe68⤵PID:4412
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe69⤵PID:2808
-
\??\c:\1lxlxfx.exec:\1lxlxfx.exe70⤵PID:3800
-
\??\c:\jdjdd.exec:\jdjdd.exe71⤵PID:8
-
\??\c:\ppdjp.exec:\ppdjp.exe72⤵PID:1584
-
\??\c:\rxrfxrl.exec:\rxrfxrl.exe73⤵PID:4716
-
\??\c:\nhhbtb.exec:\nhhbtb.exe74⤵PID:3276
-
\??\c:\vpjvp.exec:\vpjvp.exe75⤵PID:1936
-
\??\c:\xrxrxlr.exec:\xrxrxlr.exe76⤵PID:4484
-
\??\c:\bhnnbn.exec:\bhnnbn.exe77⤵PID:748
-
\??\c:\nhbhhn.exec:\nhbhhn.exe78⤵PID:1996
-
\??\c:\vpppj.exec:\vpppj.exe79⤵PID:4452
-
\??\c:\xfxxlrl.exec:\xfxxlrl.exe80⤵PID:3252
-
\??\c:\7rfrllf.exec:\7rfrllf.exe81⤵PID:4408
-
\??\c:\nbttnb.exec:\nbttnb.exe82⤵PID:1820
-
\??\c:\jpdvv.exec:\jpdvv.exe83⤵PID:2016
-
\??\c:\rrlflrr.exec:\rrlflrr.exe84⤵PID:1816
-
\??\c:\flrlfrr.exec:\flrlfrr.exe85⤵PID:4044
-
\??\c:\tnttbn.exec:\tnttbn.exe86⤵PID:1552
-
\??\c:\bthhbt.exec:\bthhbt.exe87⤵PID:2600
-
\??\c:\ddvpd.exec:\ddvpd.exe88⤵PID:4248
-
\??\c:\xxflxxf.exec:\xxflxxf.exe89⤵PID:1700
-
\??\c:\fxxxxrr.exec:\fxxxxrr.exe90⤵PID:4824
-
\??\c:\ntbttn.exec:\ntbttn.exe91⤵PID:4548
-
\??\c:\vppjd.exec:\vppjd.exe92⤵PID:4420
-
\??\c:\jvpvv.exec:\jvpvv.exe93⤵PID:4240
-
\??\c:\lffllrx.exec:\lffllrx.exe94⤵PID:3260
-
\??\c:\llxrlrx.exec:\llxrlrx.exe95⤵PID:2688
-
\??\c:\tnhntn.exec:\tnhntn.exe96⤵PID:3904
-
\??\c:\tthhtb.exec:\tthhtb.exe97⤵PID:5024
-
\??\c:\nttnnn.exec:\nttnnn.exe98⤵PID:2176
-
\??\c:\jpjdd.exec:\jpjdd.exe99⤵PID:4812
-
\??\c:\jjvvd.exec:\jjvvd.exe100⤵PID:4056
-
\??\c:\rxxrrxr.exec:\rxxrrxr.exe101⤵PID:1872
-
\??\c:\7tnbbt.exec:\7tnbbt.exe102⤵PID:3732
-
\??\c:\vpvpp.exec:\vpvpp.exe103⤵PID:4188
-
\??\c:\dvdvd.exec:\dvdvd.exe104⤵PID:1156
-
\??\c:\rfxlrrr.exec:\rfxlrrr.exe105⤵PID:3236
-
\??\c:\xxlrlrr.exec:\xxlrlrr.exe106⤵PID:2128
-
\??\c:\tbnnnb.exec:\tbnnnb.exe107⤵PID:1372
-
\??\c:\djvvj.exec:\djvvj.exe108⤵PID:4636
-
\??\c:\vjjdv.exec:\vjjdv.exe109⤵PID:3300
-
\??\c:\lflrrfx.exec:\lflrrfx.exe110⤵PID:4912
-
\??\c:\lxxrrfl.exec:\lxxrrfl.exe111⤵PID:3408
-
\??\c:\thhttt.exec:\thhttt.exe112⤵PID:4040
-
\??\c:\pjdjp.exec:\pjdjp.exe113⤵PID:3368
-
\??\c:\jjppd.exec:\jjppd.exe114⤵PID:1488
-
\??\c:\lfxllrl.exec:\lfxllrl.exe115⤵PID:4252
-
\??\c:\hbhhnb.exec:\hbhhnb.exe116⤵PID:4352
-
\??\c:\nttbtt.exec:\nttbtt.exe117⤵PID:3600
-
\??\c:\dpvpp.exec:\dpvpp.exe118⤵PID:1652
-
\??\c:\frfflfx.exec:\frfflfx.exe119⤵PID:4132
-
\??\c:\fxxfxll.exec:\fxxfxll.exe120⤵PID:1472
-
\??\c:\nhbthn.exec:\nhbthn.exe121⤵PID:3092
-
\??\c:\5nhnnn.exec:\5nhnnn.exe122⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-