Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 23:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b.exe
Resource
win7-20240708-en
6 signatures
150 seconds
General
-
Target
97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b.exe
-
Size
71KB
-
MD5
3c687c9e6027f523f3566aafd37a3b4d
-
SHA1
9b404be7c0c4b5a2c81f41f35a4905e0907973c9
-
SHA256
97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b
-
SHA512
c6504e32f1c6107e97072e25a9ceec38ce0ebe0e384cf6cc2f7575cab6c2eeec89602d90e059471751b6ab2cb1a7fdbf673f63cd812962bc1c3a29da05ac5419
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjW:ymb3NkkiQ3mdBjFI4Vm
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2828-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/312-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1624 5nnbbb.exe 368 ppjjj.exe 3732 rxfrlll.exe 2140 rlllrxx.exe 5092 hhbbtn.exe 312 hbttbb.exe 4856 dpppp.exe 2820 dvdjv.exe 2076 rrrrrll.exe 4820 1fffxxx.exe 812 hbttnt.exe 4256 pjjjj.exe 5044 7xxrllf.exe 3244 flllffx.exe 1112 tbbbbb.exe 3852 bnbtth.exe 4020 ddjjv.exe 468 dvvvp.exe 2100 xfxxrxr.exe 3132 xlrllff.exe 1092 ttnnhn.exe 4224 nhhhtb.exe 2716 dddpp.exe 2840 jjppv.exe 3684 lrxxxfx.exe 3604 lllrllx.exe 4292 5thbhb.exe 4692 nhhnnn.exe 3876 pddvv.exe 3088 jvppj.exe 5116 9fllfrr.exe 4448 7rffxll.exe 3892 bhhhbb.exe 1560 thhbtt.exe 4548 vdpjd.exe 624 dppjv.exe 4276 3xxxxff.exe 4376 ffrlfxx.exe 4800 1xlxxxr.exe 4008 tthhhh.exe 4544 htnnnn.exe 4104 5pppp.exe 3136 vpvpp.exe 4964 jjjdp.exe 4216 frxrrrx.exe 4864 fxfxfff.exe 312 bbhhhh.exe 2504 bbhhbh.exe 4144 hthntn.exe 1576 djppv.exe 4380 7ppvj.exe 4820 1xffflx.exe 736 rlfffll.exe 4980 3xxfflr.exe 4612 thtnnn.exe 2640 nhtttb.exe 3372 5tbnnn.exe 4572 ddjdd.exe 2836 vpvpv.exe 2784 3xffflf.exe 2168 lrxxffx.exe 1464 lfrflrx.exe 1176 nhbbtn.exe 1500 bbbbbh.exe -
resource yara_rule behavioral2/memory/2828-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-19-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2828 wrote to memory of 1624 2828 97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b.exe 83 PID 2828 wrote to memory of 1624 2828 97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b.exe 83 PID 2828 wrote to memory of 1624 2828 97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b.exe 83 PID 1624 wrote to memory of 368 1624 5nnbbb.exe 84 PID 1624 wrote to memory of 368 1624 5nnbbb.exe 84 PID 1624 wrote to memory of 368 1624 5nnbbb.exe 84 PID 368 wrote to memory of 3732 368 ppjjj.exe 85 PID 368 wrote to memory of 3732 368 ppjjj.exe 85 PID 368 wrote to memory of 3732 368 ppjjj.exe 85 PID 3732 wrote to memory of 2140 3732 rxfrlll.exe 86 PID 3732 wrote to memory of 2140 3732 rxfrlll.exe 86 PID 3732 wrote to memory of 2140 3732 rxfrlll.exe 86 PID 2140 wrote to memory of 5092 2140 rlllrxx.exe 87 PID 2140 wrote to memory of 5092 2140 rlllrxx.exe 87 PID 2140 wrote to memory of 5092 2140 rlllrxx.exe 87 PID 5092 wrote to memory of 312 5092 hhbbtn.exe 132 PID 5092 wrote to memory of 312 5092 hhbbtn.exe 132 PID 5092 wrote to memory of 312 5092 hhbbtn.exe 132 PID 312 wrote to memory of 4856 312 hbttbb.exe 89 PID 312 wrote to memory of 4856 312 hbttbb.exe 89 PID 312 wrote to memory of 4856 312 hbttbb.exe 89 PID 4856 wrote to memory of 2820 4856 dpppp.exe 90 PID 4856 wrote to memory of 2820 4856 dpppp.exe 90 PID 4856 wrote to memory of 2820 4856 dpppp.exe 90 PID 2820 wrote to memory of 2076 2820 dvdjv.exe 91 PID 2820 wrote to memory of 2076 2820 dvdjv.exe 91 PID 2820 wrote to memory of 2076 2820 dvdjv.exe 91 PID 2076 wrote to memory of 4820 2076 rrrrrll.exe 137 PID 2076 wrote to memory of 4820 2076 rrrrrll.exe 137 PID 2076 wrote to memory of 4820 2076 rrrrrll.exe 137 PID 4820 wrote to memory of 812 4820 1fffxxx.exe 94 PID 4820 wrote to memory of 812 4820 1fffxxx.exe 94 PID 4820 wrote to memory of 812 4820 1fffxxx.exe 94 PID 812 wrote to memory of 4256 812 hbttnt.exe 95 PID 812 wrote to memory of 4256 812 hbttnt.exe 95 PID 812 wrote to memory of 4256 812 hbttnt.exe 95 PID 4256 wrote to memory of 5044 4256 pjjjj.exe 97 PID 4256 wrote to memory of 5044 4256 pjjjj.exe 97 PID 4256 wrote to memory of 5044 4256 pjjjj.exe 97 PID 5044 wrote to memory of 3244 5044 7xxrllf.exe 98 PID 5044 wrote to memory of 3244 5044 7xxrllf.exe 98 PID 5044 wrote to memory of 3244 5044 7xxrllf.exe 98 PID 3244 wrote to memory of 1112 3244 flllffx.exe 100 PID 3244 wrote to memory of 1112 3244 flllffx.exe 100 PID 3244 wrote to memory of 1112 3244 flllffx.exe 100 PID 1112 wrote to memory of 3852 1112 tbbbbb.exe 101 PID 1112 wrote to memory of 3852 1112 tbbbbb.exe 101 PID 1112 wrote to memory of 3852 1112 tbbbbb.exe 101 PID 3852 wrote to memory of 4020 3852 bnbtth.exe 102 PID 3852 wrote to memory of 4020 3852 bnbtth.exe 102 PID 3852 wrote to memory of 4020 3852 bnbtth.exe 102 PID 4020 wrote to memory of 468 4020 ddjjv.exe 103 PID 4020 wrote to memory of 468 4020 ddjjv.exe 103 PID 4020 wrote to memory of 468 4020 ddjjv.exe 103 PID 468 wrote to memory of 2100 468 dvvvp.exe 104 PID 468 wrote to memory of 2100 468 dvvvp.exe 104 PID 468 wrote to memory of 2100 468 dvvvp.exe 104 PID 2100 wrote to memory of 3132 2100 xfxxrxr.exe 105 PID 2100 wrote to memory of 3132 2100 xfxxrxr.exe 105 PID 2100 wrote to memory of 3132 2100 xfxxrxr.exe 105 PID 3132 wrote to memory of 1092 3132 xlrllff.exe 106 PID 3132 wrote to memory of 1092 3132 xlrllff.exe 106 PID 3132 wrote to memory of 1092 3132 xlrllff.exe 106 PID 1092 wrote to memory of 4224 1092 ttnnhn.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b.exe"C:\Users\Admin\AppData\Local\Temp\97236effe0ba091fe2415d628070874ad7358ad06254c5072efa2c648d9fb83b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\5nnbbb.exec:\5nnbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\ppjjj.exec:\ppjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\rxfrlll.exec:\rxfrlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\rlllrxx.exec:\rlllrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\hhbbtn.exec:\hhbbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\hbttbb.exec:\hbttbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\dpppp.exec:\dpppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\dvdjv.exec:\dvdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\rrrrrll.exec:\rrrrrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\1fffxxx.exec:\1fffxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\hbttnt.exec:\hbttnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\pjjjj.exec:\pjjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\7xxrllf.exec:\7xxrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\flllffx.exec:\flllffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\tbbbbb.exec:\tbbbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\bnbtth.exec:\bnbtth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\ddjjv.exec:\ddjjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\dvvvp.exec:\dvvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\xfxxrxr.exec:\xfxxrxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\xlrllff.exec:\xlrllff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\ttnnhn.exec:\ttnnhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\nhhhtb.exec:\nhhhtb.exe23⤵
- Executes dropped EXE
PID:4224 -
\??\c:\dddpp.exec:\dddpp.exe24⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jjppv.exec:\jjppv.exe25⤵
- Executes dropped EXE
PID:2840 -
\??\c:\lrxxxfx.exec:\lrxxxfx.exe26⤵
- Executes dropped EXE
PID:3684 -
\??\c:\lllrllx.exec:\lllrllx.exe27⤵
- Executes dropped EXE
PID:3604 -
\??\c:\5thbhb.exec:\5thbhb.exe28⤵
- Executes dropped EXE
PID:4292 -
\??\c:\nhhnnn.exec:\nhhnnn.exe29⤵
- Executes dropped EXE
PID:4692 -
\??\c:\pddvv.exec:\pddvv.exe30⤵
- Executes dropped EXE
PID:3876 -
\??\c:\jvppj.exec:\jvppj.exe31⤵
- Executes dropped EXE
PID:3088 -
\??\c:\9fllfrr.exec:\9fllfrr.exe32⤵
- Executes dropped EXE
PID:5116 -
\??\c:\7rffxll.exec:\7rffxll.exe33⤵
- Executes dropped EXE
PID:4448 -
\??\c:\bhhhbb.exec:\bhhhbb.exe34⤵
- Executes dropped EXE
PID:3892 -
\??\c:\thhbtt.exec:\thhbtt.exe35⤵
- Executes dropped EXE
PID:1560 -
\??\c:\vdpjd.exec:\vdpjd.exe36⤵
- Executes dropped EXE
PID:4548 -
\??\c:\dppjv.exec:\dppjv.exe37⤵
- Executes dropped EXE
PID:624 -
\??\c:\3xxxxff.exec:\3xxxxff.exe38⤵
- Executes dropped EXE
PID:4276 -
\??\c:\ffrlfxx.exec:\ffrlfxx.exe39⤵
- Executes dropped EXE
PID:4376 -
\??\c:\1xlxxxr.exec:\1xlxxxr.exe40⤵
- Executes dropped EXE
PID:4800 -
\??\c:\tthhhh.exec:\tthhhh.exe41⤵
- Executes dropped EXE
PID:4008 -
\??\c:\htnnnn.exec:\htnnnn.exe42⤵
- Executes dropped EXE
PID:4544 -
\??\c:\5pppp.exec:\5pppp.exe43⤵
- Executes dropped EXE
PID:4104 -
\??\c:\vpvpp.exec:\vpvpp.exe44⤵
- Executes dropped EXE
PID:3136 -
\??\c:\jjjdp.exec:\jjjdp.exe45⤵
- Executes dropped EXE
PID:4964 -
\??\c:\frxrrrx.exec:\frxrrrx.exe46⤵
- Executes dropped EXE
PID:4216 -
\??\c:\fxfxfff.exec:\fxfxfff.exe47⤵
- Executes dropped EXE
PID:4864 -
\??\c:\bbhhhh.exec:\bbhhhh.exe48⤵
- Executes dropped EXE
PID:312 -
\??\c:\bbhhbh.exec:\bbhhbh.exe49⤵
- Executes dropped EXE
PID:2504 -
\??\c:\hthntn.exec:\hthntn.exe50⤵
- Executes dropped EXE
PID:4144 -
\??\c:\djppv.exec:\djppv.exe51⤵
- Executes dropped EXE
PID:1576 -
\??\c:\7ppvj.exec:\7ppvj.exe52⤵
- Executes dropped EXE
PID:4380 -
\??\c:\1xffflx.exec:\1xffflx.exe53⤵
- Executes dropped EXE
PID:4820 -
\??\c:\rlfffll.exec:\rlfffll.exe54⤵
- Executes dropped EXE
PID:736 -
\??\c:\3xxfflr.exec:\3xxfflr.exe55⤵
- Executes dropped EXE
PID:4980 -
\??\c:\thtnnn.exec:\thtnnn.exe56⤵
- Executes dropped EXE
PID:4612 -
\??\c:\nhtttb.exec:\nhtttb.exe57⤵
- Executes dropped EXE
PID:2640 -
\??\c:\5tbnnn.exec:\5tbnnn.exe58⤵
- Executes dropped EXE
PID:3372 -
\??\c:\ddjdd.exec:\ddjdd.exe59⤵
- Executes dropped EXE
PID:4572 -
\??\c:\vpvpv.exec:\vpvpv.exe60⤵
- Executes dropped EXE
PID:2836 -
\??\c:\3xffflf.exec:\3xffflf.exe61⤵
- Executes dropped EXE
PID:2784 -
\??\c:\lrxxffx.exec:\lrxxffx.exe62⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lfrflrx.exec:\lfrflrx.exe63⤵
- Executes dropped EXE
PID:1464 -
\??\c:\nhbbtn.exec:\nhbbtn.exe64⤵
- Executes dropped EXE
PID:1176 -
\??\c:\bbbbbh.exec:\bbbbbh.exe65⤵
- Executes dropped EXE
PID:1500 -
\??\c:\vdjjp.exec:\vdjjp.exe66⤵PID:1960
-
\??\c:\dvvpj.exec:\dvvpj.exe67⤵PID:5096
-
\??\c:\7ffxrrl.exec:\7ffxrrl.exe68⤵PID:2152
-
\??\c:\rrxxllx.exec:\rrxxllx.exe69⤵PID:3040
-
\??\c:\frfrlll.exec:\frfrlll.exe70⤵PID:2320
-
\??\c:\1tbbtt.exec:\1tbbtt.exe71⤵PID:3472
-
\??\c:\nbhhhh.exec:\nbhhhh.exe72⤵PID:2916
-
\??\c:\dvjjp.exec:\dvjjp.exe73⤵PID:2840
-
\??\c:\llxflxl.exec:\llxflxl.exe74⤵PID:1444
-
\??\c:\xxfffff.exec:\xxfffff.exe75⤵PID:4528
-
\??\c:\tbttnt.exec:\tbttnt.exe76⤵PID:2616
-
\??\c:\nhhbtt.exec:\nhhbtt.exe77⤵PID:2144
-
\??\c:\vpjjd.exec:\vpjjd.exe78⤵PID:4692
-
\??\c:\pdppp.exec:\pdppp.exe79⤵PID:908
-
\??\c:\xrlrlxx.exec:\xrlrlxx.exe80⤵PID:3232
-
\??\c:\1lrlfxr.exec:\1lrlfxr.exe81⤵PID:4932
-
\??\c:\tbhhhb.exec:\tbhhhb.exe82⤵PID:2160
-
\??\c:\9djjj.exec:\9djjj.exe83⤵PID:1688
-
\??\c:\1jjdp.exec:\1jjdp.exe84⤵PID:3124
-
\??\c:\9pppj.exec:\9pppj.exe85⤵PID:4268
-
\??\c:\1rlrlll.exec:\1rlrlll.exe86⤵PID:2756
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe87⤵PID:1880
-
\??\c:\thbtnn.exec:\thbtnn.exe88⤵PID:4928
-
\??\c:\ttnnnt.exec:\ttnnnt.exe89⤵PID:4536
-
\??\c:\3vvvv.exec:\3vvvv.exe90⤵PID:4500
-
\??\c:\7vdvv.exec:\7vdvv.exe91⤵PID:2256
-
\??\c:\dpvjd.exec:\dpvjd.exe92⤵PID:632
-
\??\c:\rffxxxr.exec:\rffxxxr.exe93⤵PID:4540
-
\??\c:\hntbtt.exec:\hntbtt.exe94⤵PID:2428
-
\??\c:\ntbhbb.exec:\ntbhbb.exe95⤵PID:3784
-
\??\c:\jddvp.exec:\jddvp.exe96⤵PID:1656
-
\??\c:\ddjdj.exec:\ddjdj.exe97⤵PID:2720
-
\??\c:\jdvpp.exec:\jdvpp.exe98⤵PID:1240
-
\??\c:\flrllff.exec:\flrllff.exe99⤵PID:4864
-
\??\c:\1lfffff.exec:\1lfffff.exe100⤵PID:1200
-
\??\c:\1rrxxrl.exec:\1rrxxrl.exe101⤵PID:2504
-
\??\c:\nnnnnn.exec:\nnnnnn.exe102⤵PID:3828
-
\??\c:\3nbtht.exec:\3nbtht.exe103⤵PID:1576
-
\??\c:\dvpjj.exec:\dvpjj.exe104⤵PID:1068
-
\??\c:\jddvv.exec:\jddvv.exe105⤵PID:4488
-
\??\c:\rxffffx.exec:\rxffffx.exe106⤵PID:3676
-
\??\c:\ffrllrr.exec:\ffrllrr.exe107⤵PID:1428
-
\??\c:\tnnnth.exec:\tnnnth.exe108⤵PID:3144
-
\??\c:\hbtnnt.exec:\hbtnnt.exe109⤵PID:2164
-
\??\c:\7tbbhh.exec:\7tbbhh.exe110⤵PID:464
-
\??\c:\1dppv.exec:\1dppv.exe111⤵PID:1308
-
\??\c:\bhtnnn.exec:\bhtnnn.exe112⤵PID:2836
-
\??\c:\9djjd.exec:\9djjd.exe113⤵PID:4952
-
\??\c:\fxrlfff.exec:\fxrlfff.exe114⤵PID:2168
-
\??\c:\1rxrrlx.exec:\1rxrrlx.exe115⤵PID:2176
-
\??\c:\hbhttt.exec:\hbhttt.exe116⤵PID:5080
-
\??\c:\dvvjd.exec:\dvvjd.exe117⤵PID:1500
-
\??\c:\ppjdp.exec:\ppjdp.exe118⤵PID:1884
-
\??\c:\jjvvd.exec:\jjvvd.exe119⤵PID:3948
-
\??\c:\flxrfxx.exec:\flxrfxx.exe120⤵PID:1592
-
\??\c:\tttttn.exec:\tttttn.exe121⤵PID:3304
-
\??\c:\7jjjd.exec:\7jjjd.exe122⤵PID:2716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-