Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 21:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588.exe
-
Size
63KB
-
MD5
01ed081145016b0815622ffea253bdec
-
SHA1
459bf75133c4bbd502d907b5ca9472c39afb03e7
-
SHA256
4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588
-
SHA512
97b279f59c94c62168ad825808bda79b3e5a9acae6a8116c5a0045e628dfea4820152d6f02bf5ef27c3a1089d4dc1c8c9e8e42fd4f7977c384db50e62325430d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbW:ymb3NkkiQ3mdBjF0y7kbW
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/412-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/632-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/348-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1580 vpvpp.exe 4376 rrlrxfx.exe 3980 nthhnh.exe 3312 3tbttb.exe 2988 3xrlffx.exe 2532 5hhhhn.exe 4064 hnnnnn.exe 2920 ddvdp.exe 4424 xrfxrrl.exe 4872 hntttt.exe 632 thnnhh.exe 5072 xrfxffl.exe 1516 xrrlfff.exe 1556 thhbtt.exe 3816 ddpvd.exe 348 xxfflrx.exe 392 thhbth.exe 816 vdvpp.exe 436 rffllrf.exe 2228 nhttbb.exe 2144 1nhbnh.exe 5024 xlxrrrl.exe 3604 htthbt.exe 2624 pvvdv.exe 3720 1jpjv.exe 3924 xfxlfrl.exe 2352 bbbbtn.exe 4776 jpdpd.exe 2044 rxxlffr.exe 4904 fxffxrx.exe 4652 nbnhbt.exe 2984 nbtnnh.exe 2916 3vvpd.exe 4492 xrxrfxl.exe 4088 xllxxfr.exe 2540 thnhnb.exe 2192 dvjdv.exe 4296 9lrfrrf.exe 3868 fxfxxxx.exe 1788 hhnhbb.exe 2516 bnnbbt.exe 5084 djjjv.exe 5048 jdvjp.exe 4760 rffrffx.exe 3896 3nhbtt.exe 1296 1hbthh.exe 4736 vvpjv.exe 4648 djpjj.exe 2184 9xllrlx.exe 4304 rxxxrrl.exe 4064 nhthbb.exe 4724 hhbnbb.exe 2520 9dvvd.exe 2524 fllxrrf.exe 5080 xrlxllx.exe 4272 ttnnhb.exe 4428 httbbb.exe 408 jdvvj.exe 2216 xrlfrrr.exe 2376 hbbnbh.exe 2656 bbntth.exe 3540 ddjjp.exe 4008 pdvpd.exe 2292 llrrllf.exe -
resource yara_rule behavioral2/memory/412-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/348-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 412 wrote to memory of 1580 412 4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588.exe 84 PID 412 wrote to memory of 1580 412 4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588.exe 84 PID 412 wrote to memory of 1580 412 4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588.exe 84 PID 1580 wrote to memory of 4376 1580 vpvpp.exe 85 PID 1580 wrote to memory of 4376 1580 vpvpp.exe 85 PID 1580 wrote to memory of 4376 1580 vpvpp.exe 85 PID 4376 wrote to memory of 3980 4376 rrlrxfx.exe 86 PID 4376 wrote to memory of 3980 4376 rrlrxfx.exe 86 PID 4376 wrote to memory of 3980 4376 rrlrxfx.exe 86 PID 3980 wrote to memory of 3312 3980 nthhnh.exe 87 PID 3980 wrote to memory of 3312 3980 nthhnh.exe 87 PID 3980 wrote to memory of 3312 3980 nthhnh.exe 87 PID 3312 wrote to memory of 2988 3312 3tbttb.exe 88 PID 3312 wrote to memory of 2988 3312 3tbttb.exe 88 PID 3312 wrote to memory of 2988 3312 3tbttb.exe 88 PID 2988 wrote to memory of 2532 2988 3xrlffx.exe 89 PID 2988 wrote to memory of 2532 2988 3xrlffx.exe 89 PID 2988 wrote to memory of 2532 2988 3xrlffx.exe 89 PID 2532 wrote to memory of 4064 2532 5hhhhn.exe 90 PID 2532 wrote to memory of 4064 2532 5hhhhn.exe 90 PID 2532 wrote to memory of 4064 2532 5hhhhn.exe 90 PID 4064 wrote to memory of 2920 4064 hnnnnn.exe 91 PID 4064 wrote to memory of 2920 4064 hnnnnn.exe 91 PID 4064 wrote to memory of 2920 4064 hnnnnn.exe 91 PID 2920 wrote to memory of 4424 2920 ddvdp.exe 92 PID 2920 wrote to memory of 4424 2920 ddvdp.exe 92 PID 2920 wrote to memory of 4424 2920 ddvdp.exe 92 PID 4424 wrote to memory of 4872 4424 xrfxrrl.exe 93 PID 4424 wrote to memory of 4872 4424 xrfxrrl.exe 93 PID 4424 wrote to memory of 4872 4424 xrfxrrl.exe 93 PID 4872 wrote to memory of 632 4872 hntttt.exe 95 PID 4872 wrote to memory of 632 4872 hntttt.exe 95 PID 4872 wrote to memory of 632 4872 hntttt.exe 95 PID 632 wrote to memory of 5072 632 thnnhh.exe 96 PID 632 wrote to memory of 5072 632 thnnhh.exe 96 PID 632 wrote to memory of 5072 632 thnnhh.exe 96 PID 5072 wrote to memory of 1516 5072 xrfxffl.exe 97 PID 5072 wrote to memory of 1516 5072 xrfxffl.exe 97 PID 5072 wrote to memory of 1516 5072 xrfxffl.exe 97 PID 1516 wrote to memory of 1556 1516 xrrlfff.exe 98 PID 1516 wrote to memory of 1556 1516 xrrlfff.exe 98 PID 1516 wrote to memory of 1556 1516 xrrlfff.exe 98 PID 1556 wrote to memory of 3816 1556 thhbtt.exe 99 PID 1556 wrote to memory of 3816 1556 thhbtt.exe 99 PID 1556 wrote to memory of 3816 1556 thhbtt.exe 99 PID 3816 wrote to memory of 348 3816 ddpvd.exe 100 PID 3816 wrote to memory of 348 3816 ddpvd.exe 100 PID 3816 wrote to memory of 348 3816 ddpvd.exe 100 PID 348 wrote to memory of 392 348 xxfflrx.exe 101 PID 348 wrote to memory of 392 348 xxfflrx.exe 101 PID 348 wrote to memory of 392 348 xxfflrx.exe 101 PID 392 wrote to memory of 816 392 thhbth.exe 103 PID 392 wrote to memory of 816 392 thhbth.exe 103 PID 392 wrote to memory of 816 392 thhbth.exe 103 PID 816 wrote to memory of 436 816 vdvpp.exe 104 PID 816 wrote to memory of 436 816 vdvpp.exe 104 PID 816 wrote to memory of 436 816 vdvpp.exe 104 PID 436 wrote to memory of 2228 436 rffllrf.exe 105 PID 436 wrote to memory of 2228 436 rffllrf.exe 105 PID 436 wrote to memory of 2228 436 rffllrf.exe 105 PID 2228 wrote to memory of 2144 2228 nhttbb.exe 106 PID 2228 wrote to memory of 2144 2228 nhttbb.exe 106 PID 2228 wrote to memory of 2144 2228 nhttbb.exe 106 PID 2144 wrote to memory of 5024 2144 1nhbnh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588.exe"C:\Users\Admin\AppData\Local\Temp\4488288ba43f22dc6de1c25638c1e4e52454afa5795df8e8994a88119b7ae588.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\vpvpp.exec:\vpvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\rrlrxfx.exec:\rrlrxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\nthhnh.exec:\nthhnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\3tbttb.exec:\3tbttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\3xrlffx.exec:\3xrlffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\5hhhhn.exec:\5hhhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\hnnnnn.exec:\hnnnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\ddvdp.exec:\ddvdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\hntttt.exec:\hntttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\thnnhh.exec:\thnnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\xrfxffl.exec:\xrfxffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\xrrlfff.exec:\xrrlfff.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\thhbtt.exec:\thhbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\ddpvd.exec:\ddpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\xxfflrx.exec:\xxfflrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\thhbth.exec:\thhbth.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\vdvpp.exec:\vdvpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\rffllrf.exec:\rffllrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\nhttbb.exec:\nhttbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\1nhbnh.exec:\1nhbnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\xlxrrrl.exec:\xlxrrrl.exe23⤵
- Executes dropped EXE
PID:5024 -
\??\c:\htthbt.exec:\htthbt.exe24⤵
- Executes dropped EXE
PID:3604 -
\??\c:\pvvdv.exec:\pvvdv.exe25⤵
- Executes dropped EXE
PID:2624 -
\??\c:\1jpjv.exec:\1jpjv.exe26⤵
- Executes dropped EXE
PID:3720 -
\??\c:\xfxlfrl.exec:\xfxlfrl.exe27⤵
- Executes dropped EXE
PID:3924 -
\??\c:\bbbbtn.exec:\bbbbtn.exe28⤵
- Executes dropped EXE
PID:2352 -
\??\c:\jpdpd.exec:\jpdpd.exe29⤵
- Executes dropped EXE
PID:4776 -
\??\c:\rxxlffr.exec:\rxxlffr.exe30⤵
- Executes dropped EXE
PID:2044 -
\??\c:\fxffxrx.exec:\fxffxrx.exe31⤵
- Executes dropped EXE
PID:4904 -
\??\c:\nbnhbt.exec:\nbnhbt.exe32⤵
- Executes dropped EXE
PID:4652 -
\??\c:\nbtnnh.exec:\nbtnnh.exe33⤵
- Executes dropped EXE
PID:2984 -
\??\c:\3vvpd.exec:\3vvpd.exe34⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xrxrfxl.exec:\xrxrfxl.exe35⤵
- Executes dropped EXE
PID:4492 -
\??\c:\xllxxfr.exec:\xllxxfr.exe36⤵
- Executes dropped EXE
PID:4088 -
\??\c:\thnhnb.exec:\thnhnb.exe37⤵
- Executes dropped EXE
PID:2540 -
\??\c:\dvjdv.exec:\dvjdv.exe38⤵
- Executes dropped EXE
PID:2192 -
\??\c:\9lrfrrf.exec:\9lrfrrf.exe39⤵
- Executes dropped EXE
PID:4296 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe40⤵
- Executes dropped EXE
PID:3868 -
\??\c:\hhnhbb.exec:\hhnhbb.exe41⤵
- Executes dropped EXE
PID:1788 -
\??\c:\bnnbbt.exec:\bnnbbt.exe42⤵
- Executes dropped EXE
PID:2516 -
\??\c:\djjjv.exec:\djjjv.exe43⤵
- Executes dropped EXE
PID:5084 -
\??\c:\jdvjp.exec:\jdvjp.exe44⤵
- Executes dropped EXE
PID:5048 -
\??\c:\rffrffx.exec:\rffrffx.exe45⤵
- Executes dropped EXE
PID:4760 -
\??\c:\3nhbtt.exec:\3nhbtt.exe46⤵
- Executes dropped EXE
PID:3896 -
\??\c:\1hbthh.exec:\1hbthh.exe47⤵
- Executes dropped EXE
PID:1296 -
\??\c:\vvpjv.exec:\vvpjv.exe48⤵
- Executes dropped EXE
PID:4736 -
\??\c:\djpjj.exec:\djpjj.exe49⤵
- Executes dropped EXE
PID:4648 -
\??\c:\9xllrlx.exec:\9xllrlx.exe50⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rxxxrrl.exec:\rxxxrrl.exe51⤵
- Executes dropped EXE
PID:4304 -
\??\c:\nhthbb.exec:\nhthbb.exe52⤵
- Executes dropped EXE
PID:4064 -
\??\c:\hhbnbb.exec:\hhbnbb.exe53⤵
- Executes dropped EXE
PID:4724 -
\??\c:\9dvvd.exec:\9dvvd.exe54⤵
- Executes dropped EXE
PID:2520 -
\??\c:\fllxrrf.exec:\fllxrrf.exe55⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xrlxllx.exec:\xrlxllx.exe56⤵
- Executes dropped EXE
PID:5080 -
\??\c:\ttnnhb.exec:\ttnnhb.exe57⤵
- Executes dropped EXE
PID:4272 -
\??\c:\httbbb.exec:\httbbb.exe58⤵
- Executes dropped EXE
PID:4428 -
\??\c:\jdvvj.exec:\jdvvj.exe59⤵
- Executes dropped EXE
PID:408 -
\??\c:\xrlfrrr.exec:\xrlfrrr.exe60⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hbbnbh.exec:\hbbnbh.exe61⤵
- Executes dropped EXE
PID:2376 -
\??\c:\bbntth.exec:\bbntth.exe62⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ddjjp.exec:\ddjjp.exe63⤵
- Executes dropped EXE
PID:3540 -
\??\c:\pdvpd.exec:\pdvpd.exe64⤵
- Executes dropped EXE
PID:4008 -
\??\c:\llrrllf.exec:\llrrllf.exe65⤵
- Executes dropped EXE
PID:2292 -
\??\c:\hbnhbt.exec:\hbnhbt.exe66⤵PID:3724
-
\??\c:\pddvp.exec:\pddvp.exe67⤵PID:3840
-
\??\c:\vddjv.exec:\vddjv.exe68⤵PID:3500
-
\??\c:\frrlflf.exec:\frrlflf.exe69⤵PID:3176
-
\??\c:\5lflxxx.exec:\5lflxxx.exe70⤵PID:4908
-
\??\c:\nhtbtn.exec:\nhtbtn.exe71⤵PID:2020
-
\??\c:\htthtt.exec:\htthtt.exe72⤵PID:3612
-
\??\c:\pjddd.exec:\pjddd.exe73⤵PID:1828
-
\??\c:\jppjp.exec:\jppjp.exe74⤵PID:2128
-
\??\c:\3xxrfxl.exec:\3xxrfxl.exe75⤵PID:4592
-
\??\c:\bttnbn.exec:\bttnbn.exe76⤵PID:1240
-
\??\c:\3hbnhb.exec:\3hbnhb.exe77⤵PID:4580
-
\??\c:\ppvdp.exec:\ppvdp.exe78⤵PID:4636
-
\??\c:\vdvdv.exec:\vdvdv.exe79⤵PID:4784
-
\??\c:\rlfrfxl.exec:\rlfrfxl.exe80⤵PID:2712
-
\??\c:\9ntntn.exec:\9ntntn.exe81⤵PID:3664
-
\??\c:\9bhthh.exec:\9bhthh.exe82⤵PID:512
-
\??\c:\jdjdv.exec:\jdjdv.exe83⤵PID:2044
-
\??\c:\pjjdv.exec:\pjjdv.exe84⤵PID:2124
-
\??\c:\3lffrfr.exec:\3lffrfr.exe85⤵PID:3384
-
\??\c:\hhbbhb.exec:\hhbbhb.exe86⤵PID:2288
-
\??\c:\thbtnh.exec:\thbtnh.exe87⤵PID:4368
-
\??\c:\djdvp.exec:\djdvp.exe88⤵PID:5104
-
\??\c:\vdddv.exec:\vdddv.exe89⤵PID:3216
-
\??\c:\rlxrfxr.exec:\rlxrfxr.exe90⤵PID:4812
-
\??\c:\fxrxrlr.exec:\fxrxrlr.exe91⤵PID:4464
-
\??\c:\hnhhbt.exec:\hnhhbt.exe92⤵PID:1552
-
\??\c:\nhbtnh.exec:\nhbtnh.exe93⤵PID:4584
-
\??\c:\9ddvj.exec:\9ddvj.exe94⤵PID:1636
-
\??\c:\pjddp.exec:\pjddp.exe95⤵PID:3504
-
\??\c:\xrrlxrl.exec:\xrrlxrl.exe96⤵PID:3256
-
\??\c:\bhttbn.exec:\bhttbn.exe97⤵PID:5048
-
\??\c:\5dvjv.exec:\5dvjv.exe98⤵PID:4760
-
\??\c:\tnnbnh.exec:\tnnbnh.exe99⤵PID:4856
-
\??\c:\ppvvp.exec:\ppvvp.exe100⤵PID:3272
-
\??\c:\rlxlrfx.exec:\rlxlrfx.exe101⤵PID:2596
-
\??\c:\xflxfxl.exec:\xflxfxl.exe102⤵PID:1236
-
\??\c:\ddvdd.exec:\ddvdd.exe103⤵PID:4136
-
\??\c:\pvpjd.exec:\pvpjd.exe104⤵PID:4304
-
\??\c:\frlfrrl.exec:\frlfrrl.exe105⤵PID:1124
-
\??\c:\5frlflf.exec:\5frlflf.exe106⤵PID:4724
-
\??\c:\nnhhhh.exec:\nnhhhh.exe107⤵PID:4664
-
\??\c:\3hnbnn.exec:\3hnbnn.exe108⤵PID:2524
-
\??\c:\5jjdv.exec:\5jjdv.exe109⤵PID:3264
-
\??\c:\xrxrffx.exec:\xrxrffx.exe110⤵PID:3936
-
\??\c:\nbhnbh.exec:\nbhnbh.exe111⤵PID:4428
-
\??\c:\9tthbt.exec:\9tthbt.exe112⤵PID:2784
-
\??\c:\1vvpd.exec:\1vvpd.exe113⤵PID:3440
-
\??\c:\djjdv.exec:\djjdv.exe114⤵PID:2376
-
\??\c:\9xxlxxl.exec:\9xxlxxl.exe115⤵PID:2960
-
\??\c:\lffrrfr.exec:\lffrrfr.exe116⤵PID:4608
-
\??\c:\bhbbnh.exec:\bhbbnh.exe117⤵PID:4008
-
\??\c:\tttthb.exec:\tttthb.exe118⤵PID:2292
-
\??\c:\djpjj.exec:\djpjj.exe119⤵PID:772
-
\??\c:\ppvvj.exec:\ppvvj.exe120⤵PID:2160
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe121⤵PID:2936
-
\??\c:\nhhhbh.exec:\nhhhbh.exe122⤵PID:3176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-