Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
15/09/2024, 08:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c9e7780cef3b232ce9d4ebf13bbc6f10N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
c9e7780cef3b232ce9d4ebf13bbc6f10N.exe
-
Size
63KB
-
MD5
c9e7780cef3b232ce9d4ebf13bbc6f10
-
SHA1
3b27de6970169396ad39d1552444ee632a308117
-
SHA256
4610b4a5b1c8426b11db18a751258992b3f4978706aaa81182637b6667e9e6c6
-
SHA512
d75477827677e8e07feb0ef4510b0c5dd2bafcb10d018373cb9b4ca852052d07788e4cff92d5f50702bb0ccf0f124224fdc6aec706617eda83cef65c475747cc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIrmCeRT:ymb3NkkiQ3mdBjFIje5
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4104-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4764 lfllrrx.exe 728 frffxxx.exe 4644 hhnhbb.exe 1216 hhbbbh.exe 5016 3lfxrlf.exe 4212 lfffffx.exe 3424 tntntt.exe 2880 bbbtnn.exe 3652 lxxxrlf.exe 5088 lfflffx.exe 3220 hhttnt.exe 5008 pjvvv.exe 3276 vdppd.exe 5104 xrxrlfx.exe 2152 hbbtbt.exe 1064 djdvj.exe 456 jjvvp.exe 3120 xlrllxx.exe 4012 nbhbbh.exe 4836 btbtbb.exe 1396 vvpjd.exe 4596 flllrxr.exe 2396 flxrlll.exe 2188 nnbhnn.exe 980 dddvv.exe 1684 dvpjd.exe 3240 5lxrrrr.exe 4100 hbbbbb.exe 2848 nbbbnn.exe 336 1ppjd.exe 3404 fflllll.exe 788 5flllll.exe 4680 ntbtnn.exe 4548 bnbtbb.exe 4724 vdjjj.exe 4008 flxxrll.exe 1900 nhnhbb.exe 4236 pvjdj.exe 2476 fxxrlll.exe 4436 btttnn.exe 2952 nbnttb.exe 3516 jjjjp.exe 4764 lllfrfx.exe 1252 bhntnn.exe 2364 jddvv.exe 5108 xrxrllf.exe 4208 flllrll.exe 3492 jppjd.exe 1016 jpvpd.exe 4224 3frfffx.exe 2540 xrllfff.exe 1984 htnnhh.exe 2880 jdvdd.exe 3820 rlrxrrx.exe 2376 lxlfxxr.exe 3996 tbbbtb.exe 4612 9nhhtt.exe 1152 jddjd.exe 1420 lrrrfxx.exe 1160 5hhhbt.exe 3824 tnbthh.exe 1340 jvpjv.exe 2868 vjdvv.exe 3956 1xrlxrl.exe -
resource yara_rule behavioral2/memory/4104-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4104 wrote to memory of 4764 4104 c9e7780cef3b232ce9d4ebf13bbc6f10N.exe 84 PID 4104 wrote to memory of 4764 4104 c9e7780cef3b232ce9d4ebf13bbc6f10N.exe 84 PID 4104 wrote to memory of 4764 4104 c9e7780cef3b232ce9d4ebf13bbc6f10N.exe 84 PID 4764 wrote to memory of 728 4764 lfllrrx.exe 85 PID 4764 wrote to memory of 728 4764 lfllrrx.exe 85 PID 4764 wrote to memory of 728 4764 lfllrrx.exe 85 PID 728 wrote to memory of 4644 728 frffxxx.exe 86 PID 728 wrote to memory of 4644 728 frffxxx.exe 86 PID 728 wrote to memory of 4644 728 frffxxx.exe 86 PID 4644 wrote to memory of 1216 4644 hhnhbb.exe 87 PID 4644 wrote to memory of 1216 4644 hhnhbb.exe 87 PID 4644 wrote to memory of 1216 4644 hhnhbb.exe 87 PID 1216 wrote to memory of 5016 1216 hhbbbh.exe 88 PID 1216 wrote to memory of 5016 1216 hhbbbh.exe 88 PID 1216 wrote to memory of 5016 1216 hhbbbh.exe 88 PID 5016 wrote to memory of 4212 5016 3lfxrlf.exe 89 PID 5016 wrote to memory of 4212 5016 3lfxrlf.exe 89 PID 5016 wrote to memory of 4212 5016 3lfxrlf.exe 89 PID 4212 wrote to memory of 3424 4212 lfffffx.exe 90 PID 4212 wrote to memory of 3424 4212 lfffffx.exe 90 PID 4212 wrote to memory of 3424 4212 lfffffx.exe 90 PID 3424 wrote to memory of 2880 3424 tntntt.exe 91 PID 3424 wrote to memory of 2880 3424 tntntt.exe 91 PID 3424 wrote to memory of 2880 3424 tntntt.exe 91 PID 2880 wrote to memory of 3652 2880 bbbtnn.exe 93 PID 2880 wrote to memory of 3652 2880 bbbtnn.exe 93 PID 2880 wrote to memory of 3652 2880 bbbtnn.exe 93 PID 3652 wrote to memory of 5088 3652 lxxxrlf.exe 94 PID 3652 wrote to memory of 5088 3652 lxxxrlf.exe 94 PID 3652 wrote to memory of 5088 3652 lxxxrlf.exe 94 PID 5088 wrote to memory of 3220 5088 lfflffx.exe 95 PID 5088 wrote to memory of 3220 5088 lfflffx.exe 95 PID 5088 wrote to memory of 3220 5088 lfflffx.exe 95 PID 3220 wrote to memory of 5008 3220 hhttnt.exe 96 PID 3220 wrote to memory of 5008 3220 hhttnt.exe 96 PID 3220 wrote to memory of 5008 3220 hhttnt.exe 96 PID 5008 wrote to memory of 3276 5008 pjvvv.exe 97 PID 5008 wrote to memory of 3276 5008 pjvvv.exe 97 PID 5008 wrote to memory of 3276 5008 pjvvv.exe 97 PID 3276 wrote to memory of 5104 3276 vdppd.exe 98 PID 3276 wrote to memory of 5104 3276 vdppd.exe 98 PID 3276 wrote to memory of 5104 3276 vdppd.exe 98 PID 5104 wrote to memory of 2152 5104 xrxrlfx.exe 99 PID 5104 wrote to memory of 2152 5104 xrxrlfx.exe 99 PID 5104 wrote to memory of 2152 5104 xrxrlfx.exe 99 PID 2152 wrote to memory of 1064 2152 hbbtbt.exe 100 PID 2152 wrote to memory of 1064 2152 hbbtbt.exe 100 PID 2152 wrote to memory of 1064 2152 hbbtbt.exe 100 PID 1064 wrote to memory of 456 1064 djdvj.exe 101 PID 1064 wrote to memory of 456 1064 djdvj.exe 101 PID 1064 wrote to memory of 456 1064 djdvj.exe 101 PID 456 wrote to memory of 3120 456 jjvvp.exe 102 PID 456 wrote to memory of 3120 456 jjvvp.exe 102 PID 456 wrote to memory of 3120 456 jjvvp.exe 102 PID 3120 wrote to memory of 4012 3120 xlrllxx.exe 103 PID 3120 wrote to memory of 4012 3120 xlrllxx.exe 103 PID 3120 wrote to memory of 4012 3120 xlrllxx.exe 103 PID 4012 wrote to memory of 4836 4012 nbhbbh.exe 105 PID 4012 wrote to memory of 4836 4012 nbhbbh.exe 105 PID 4012 wrote to memory of 4836 4012 nbhbbh.exe 105 PID 4836 wrote to memory of 1396 4836 btbtbb.exe 106 PID 4836 wrote to memory of 1396 4836 btbtbb.exe 106 PID 4836 wrote to memory of 1396 4836 btbtbb.exe 106 PID 1396 wrote to memory of 4596 1396 vvpjd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9e7780cef3b232ce9d4ebf13bbc6f10N.exe"C:\Users\Admin\AppData\Local\Temp\c9e7780cef3b232ce9d4ebf13bbc6f10N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\lfllrrx.exec:\lfllrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\frffxxx.exec:\frffxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\hhnhbb.exec:\hhnhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\hhbbbh.exec:\hhbbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\3lfxrlf.exec:\3lfxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\lfffffx.exec:\lfffffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\tntntt.exec:\tntntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\bbbtnn.exec:\bbbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\lxxxrlf.exec:\lxxxrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\lfflffx.exec:\lfflffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\hhttnt.exec:\hhttnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\pjvvv.exec:\pjvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\vdppd.exec:\vdppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\xrxrlfx.exec:\xrxrlfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\hbbtbt.exec:\hbbtbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\djdvj.exec:\djdvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\jjvvp.exec:\jjvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\xlrllxx.exec:\xlrllxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\nbhbbh.exec:\nbhbbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\btbtbb.exec:\btbtbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\vvpjd.exec:\vvpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\flllrxr.exec:\flllrxr.exe23⤵
- Executes dropped EXE
PID:4596 -
\??\c:\flxrlll.exec:\flxrlll.exe24⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nnbhnn.exec:\nnbhnn.exe25⤵
- Executes dropped EXE
PID:2188 -
\??\c:\dddvv.exec:\dddvv.exe26⤵
- Executes dropped EXE
PID:980 -
\??\c:\dvpjd.exec:\dvpjd.exe27⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5lxrrrr.exec:\5lxrrrr.exe28⤵
- Executes dropped EXE
PID:3240 -
\??\c:\hbbbbb.exec:\hbbbbb.exe29⤵
- Executes dropped EXE
PID:4100 -
\??\c:\nbbbnn.exec:\nbbbnn.exe30⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1ppjd.exec:\1ppjd.exe31⤵
- Executes dropped EXE
PID:336 -
\??\c:\fflllll.exec:\fflllll.exe32⤵
- Executes dropped EXE
PID:3404 -
\??\c:\5flllll.exec:\5flllll.exe33⤵
- Executes dropped EXE
PID:788 -
\??\c:\ntbtnn.exec:\ntbtnn.exe34⤵
- Executes dropped EXE
PID:4680 -
\??\c:\bnbtbb.exec:\bnbtbb.exe35⤵
- Executes dropped EXE
PID:4548 -
\??\c:\vdjjj.exec:\vdjjj.exe36⤵
- Executes dropped EXE
PID:4724 -
\??\c:\flxxrll.exec:\flxxrll.exe37⤵
- Executes dropped EXE
PID:4008 -
\??\c:\nhnhbb.exec:\nhnhbb.exe38⤵
- Executes dropped EXE
PID:1900 -
\??\c:\pvjdj.exec:\pvjdj.exe39⤵
- Executes dropped EXE
PID:4236 -
\??\c:\fxxrlll.exec:\fxxrlll.exe40⤵
- Executes dropped EXE
PID:2476 -
\??\c:\btttnn.exec:\btttnn.exe41⤵
- Executes dropped EXE
PID:4436 -
\??\c:\nbnttb.exec:\nbnttb.exe42⤵
- Executes dropped EXE
PID:2952 -
\??\c:\jjjjp.exec:\jjjjp.exe43⤵
- Executes dropped EXE
PID:3516 -
\??\c:\lllfrfx.exec:\lllfrfx.exe44⤵
- Executes dropped EXE
PID:4764 -
\??\c:\bhntnn.exec:\bhntnn.exe45⤵
- Executes dropped EXE
PID:1252 -
\??\c:\jddvv.exec:\jddvv.exe46⤵
- Executes dropped EXE
PID:2364 -
\??\c:\xrxrllf.exec:\xrxrllf.exe47⤵
- Executes dropped EXE
PID:5108 -
\??\c:\flllrll.exec:\flllrll.exe48⤵
- Executes dropped EXE
PID:4208 -
\??\c:\jppjd.exec:\jppjd.exe49⤵
- Executes dropped EXE
PID:3492 -
\??\c:\jpvpd.exec:\jpvpd.exe50⤵
- Executes dropped EXE
PID:1016 -
\??\c:\3frfffx.exec:\3frfffx.exe51⤵
- Executes dropped EXE
PID:4224 -
\??\c:\xrllfff.exec:\xrllfff.exe52⤵
- Executes dropped EXE
PID:2540 -
\??\c:\htnnhh.exec:\htnnhh.exe53⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jdvdd.exec:\jdvdd.exe54⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rlrxrrx.exec:\rlrxrrx.exe55⤵
- Executes dropped EXE
PID:3820 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe56⤵
- Executes dropped EXE
PID:2376 -
\??\c:\tbbbtb.exec:\tbbbtb.exe57⤵
- Executes dropped EXE
PID:3996 -
\??\c:\9nhhtt.exec:\9nhhtt.exe58⤵
- Executes dropped EXE
PID:4612 -
\??\c:\jddjd.exec:\jddjd.exe59⤵
- Executes dropped EXE
PID:1152 -
\??\c:\lrrrfxx.exec:\lrrrfxx.exe60⤵
- Executes dropped EXE
PID:1420 -
\??\c:\5hhhbt.exec:\5hhhbt.exe61⤵
- Executes dropped EXE
PID:1160 -
\??\c:\tnbthh.exec:\tnbthh.exe62⤵
- Executes dropped EXE
PID:3824 -
\??\c:\jvpjv.exec:\jvpjv.exe63⤵
- Executes dropped EXE
PID:1340 -
\??\c:\vjdvv.exec:\vjdvv.exe64⤵
- Executes dropped EXE
PID:2868 -
\??\c:\1xrlxrl.exec:\1xrlxrl.exe65⤵
- Executes dropped EXE
PID:3956 -
\??\c:\1rffffl.exec:\1rffffl.exe66⤵PID:628
-
\??\c:\thnhtt.exec:\thnhtt.exe67⤵PID:1824
-
\??\c:\btbbnt.exec:\btbbnt.exe68⤵PID:2804
-
\??\c:\vpppj.exec:\vpppj.exe69⤵PID:5080
-
\??\c:\rxfrllf.exec:\rxfrllf.exe70⤵PID:3868
-
\??\c:\hbbtnh.exec:\hbbtnh.exe71⤵PID:3112
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe72⤵PID:3684
-
\??\c:\hnnhbt.exec:\hnnhbt.exe73⤵PID:116
-
\??\c:\3vjdp.exec:\3vjdp.exe74⤵PID:324
-
\??\c:\fxrrffx.exec:\fxrrffx.exe75⤵PID:1188
-
\??\c:\nthbtn.exec:\nthbtn.exe76⤵PID:748
-
\??\c:\bhhbtt.exec:\bhhbtt.exe77⤵PID:3644
-
\??\c:\jdvpp.exec:\jdvpp.exe78⤵PID:1120
-
\??\c:\flrlxxr.exec:\flrlxxr.exe79⤵PID:1884
-
\??\c:\xflfrlf.exec:\xflfrlf.exe80⤵PID:1660
-
\??\c:\bbnnht.exec:\bbnnht.exe81⤵PID:516
-
\??\c:\djpjv.exec:\djpjv.exe82⤵PID:2652
-
\??\c:\llxlxlr.exec:\llxlxlr.exe83⤵PID:3592
-
\??\c:\nbtnhb.exec:\nbtnhb.exe84⤵PID:3608
-
\??\c:\tthhhb.exec:\tthhhb.exe85⤵PID:3636
-
\??\c:\1vvpd.exec:\1vvpd.exe86⤵PID:3900
-
\??\c:\xrlfrlx.exec:\xrlfrlx.exe87⤵PID:2920
-
\??\c:\5xxrxxl.exec:\5xxrxxl.exe88⤵PID:2612
-
\??\c:\tbnbhh.exec:\tbnbhh.exe89⤵PID:4608
-
\??\c:\jddvd.exec:\jddvd.exe90⤵PID:720
-
\??\c:\dpjvd.exec:\dpjvd.exe91⤵PID:1920
-
\??\c:\5rlfrlf.exec:\5rlfrlf.exe92⤵PID:3600
-
\??\c:\fffxrrf.exec:\fffxrrf.exe93⤵PID:3232
-
\??\c:\ttnbtn.exec:\ttnbtn.exe94⤵PID:4560
-
\??\c:\htbtnn.exec:\htbtnn.exe95⤵PID:3728
-
\??\c:\djjjv.exec:\djjjv.exe96⤵PID:4740
-
\??\c:\jvdvp.exec:\jvdvp.exe97⤵PID:3516
-
\??\c:\rffxrxr.exec:\rffxrxr.exe98⤵PID:1140
-
\??\c:\bntnhh.exec:\bntnhh.exe99⤵PID:2832
-
\??\c:\vpjjv.exec:\vpjjv.exe100⤵PID:4636
-
\??\c:\pdjdv.exec:\pdjdv.exe101⤵PID:3524
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe102⤵PID:2128
-
\??\c:\tbhbtt.exec:\tbhbtt.exe103⤵PID:3788
-
\??\c:\vjjjv.exec:\vjjjv.exe104⤵PID:4956
-
\??\c:\djpjv.exec:\djpjv.exe105⤵PID:1880
-
\??\c:\rrxfffx.exec:\rrxfffx.exe106⤵PID:4996
-
\??\c:\flflffx.exec:\flflffx.exe107⤵PID:4296
-
\??\c:\nbhhhh.exec:\nbhhhh.exe108⤵PID:3652
-
\??\c:\nbnnhh.exec:\nbnnhh.exe109⤵PID:1828
-
\??\c:\dvddj.exec:\dvddj.exe110⤵PID:3220
-
\??\c:\xrfxxrx.exec:\xrfxxrx.exe111⤵PID:484
-
\??\c:\5fffxxx.exec:\5fffxxx.exe112⤵PID:776
-
\??\c:\tnbbbb.exec:\tnbbbb.exe113⤵PID:1152
-
\??\c:\pjppp.exec:\pjppp.exe114⤵PID:1700
-
\??\c:\dvpjd.exec:\dvpjd.exe115⤵PID:2160
-
\??\c:\fxffrrr.exec:\fxffrrr.exe116⤵PID:3824
-
\??\c:\hhhbhh.exec:\hhhbhh.exe117⤵PID:2560
-
\??\c:\rxrlllf.exec:\rxrlllf.exe118⤵PID:4272
-
\??\c:\lxxrlxr.exec:\lxxrlxr.exe119⤵PID:2056
-
\??\c:\nnbtbt.exec:\nnbtbt.exe120⤵PID:628
-
\??\c:\pdvpd.exec:\pdvpd.exe121⤵PID:3076
-
\??\c:\dvppp.exec:\dvppp.exe122⤵PID:1116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-