Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2024 05:20
Static task
static1
Behavioral task
behavioral1
Sample
8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7N.exe
Resource
win7-20240903-en
General
-
Target
8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7N.exe
-
Size
82KB
-
MD5
646462650ef09a5934afdd3a59580db0
-
SHA1
101cb20d74cf74724941662c0ca64863a14b4ad1
-
SHA256
8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7
-
SHA512
3853f23078ec8a600e2d42ddd5eb652e20feaa58319974ad013174b9f3ab677117a04b6833074e27e9ab0fdbe6d6690cc853f017292e91af97e56a01fc738055
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89L:ymb3NkkiQ3mdBjFIIp9L9QrrA8l
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/224-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1032-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1352-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5076 pvpjd.exe 1104 rlfxlfx.exe 3892 7llfxfx.exe 2888 5thbnn.exe 3712 dvjvj.exe 1032 xlrlfxl.exe 8 thnnhh.exe 2288 dvpvv.exe 1544 lfxlrrx.exe 2976 nhhbtt.exe 3224 vpvvv.exe 1352 jjddv.exe 3972 nbhnnh.exe 4036 thbtnh.exe 4844 rrxlfrr.exe 4484 lfffrfr.exe 3684 bbhhbh.exe 2516 pdddd.exe 3984 7llfxxr.exe 1356 nthbtt.exe 1492 vvdvv.exe 3908 frllfff.exe 3116 btntnh.exe 4776 1fxlxxr.exe 2636 5bhbbt.exe 2424 nntnhh.exe 4492 fffxffx.exe 2956 frrlffr.exe 4836 ntttnn.exe 912 vpvvv.exe 936 frflfff.exe 2688 bttttb.exe 4124 pjjvp.exe 3652 rllxlfr.exe 2104 9hbthh.exe 2456 btnbnn.exe 3048 jvjdp.exe 916 3lxrffx.exe 4676 tnnhbt.exe 2760 bnhhtt.exe 1740 dddvp.exe 2916 rrxxrxr.exe 1512 ffxxrrl.exe 1196 nbbnhb.exe 4320 nbbnbb.exe 4296 vppjv.exe 3088 lxfxlfx.exe 4504 thhtnh.exe 1408 bthbhh.exe 4856 pjdjv.exe 2564 xxlxfxr.exe 3892 rfxfflr.exe 3668 htthbt.exe 2380 ddvvv.exe 1108 dvddp.exe 4640 5fxlxrl.exe 5028 9thbnh.exe 2800 jvvpj.exe 1564 vpjvj.exe 2712 fxxrlrf.exe 2780 hhnnbb.exe 4712 9tthtn.exe 3696 djjdp.exe 2976 jdjdd.exe -
resource yara_rule behavioral2/memory/224-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 224 wrote to memory of 5076 224 8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7N.exe 82 PID 224 wrote to memory of 5076 224 8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7N.exe 82 PID 224 wrote to memory of 5076 224 8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7N.exe 82 PID 5076 wrote to memory of 1104 5076 pvpjd.exe 83 PID 5076 wrote to memory of 1104 5076 pvpjd.exe 83 PID 5076 wrote to memory of 1104 5076 pvpjd.exe 83 PID 1104 wrote to memory of 3892 1104 rlfxlfx.exe 84 PID 1104 wrote to memory of 3892 1104 rlfxlfx.exe 84 PID 1104 wrote to memory of 3892 1104 rlfxlfx.exe 84 PID 3892 wrote to memory of 2888 3892 7llfxfx.exe 85 PID 3892 wrote to memory of 2888 3892 7llfxfx.exe 85 PID 3892 wrote to memory of 2888 3892 7llfxfx.exe 85 PID 2888 wrote to memory of 3712 2888 5thbnn.exe 86 PID 2888 wrote to memory of 3712 2888 5thbnn.exe 86 PID 2888 wrote to memory of 3712 2888 5thbnn.exe 86 PID 3712 wrote to memory of 1032 3712 dvjvj.exe 87 PID 3712 wrote to memory of 1032 3712 dvjvj.exe 87 PID 3712 wrote to memory of 1032 3712 dvjvj.exe 87 PID 1032 wrote to memory of 8 1032 xlrlfxl.exe 88 PID 1032 wrote to memory of 8 1032 xlrlfxl.exe 88 PID 1032 wrote to memory of 8 1032 xlrlfxl.exe 88 PID 8 wrote to memory of 2288 8 thnnhh.exe 89 PID 8 wrote to memory of 2288 8 thnnhh.exe 89 PID 8 wrote to memory of 2288 8 thnnhh.exe 89 PID 2288 wrote to memory of 1544 2288 dvpvv.exe 90 PID 2288 wrote to memory of 1544 2288 dvpvv.exe 90 PID 2288 wrote to memory of 1544 2288 dvpvv.exe 90 PID 1544 wrote to memory of 2976 1544 lfxlrrx.exe 91 PID 1544 wrote to memory of 2976 1544 lfxlrrx.exe 91 PID 1544 wrote to memory of 2976 1544 lfxlrrx.exe 91 PID 2976 wrote to memory of 3224 2976 nhhbtt.exe 92 PID 2976 wrote to memory of 3224 2976 nhhbtt.exe 92 PID 2976 wrote to memory of 3224 2976 nhhbtt.exe 92 PID 3224 wrote to memory of 1352 3224 vpvvv.exe 93 PID 3224 wrote to memory of 1352 3224 vpvvv.exe 93 PID 3224 wrote to memory of 1352 3224 vpvvv.exe 93 PID 1352 wrote to memory of 3972 1352 jjddv.exe 94 PID 1352 wrote to memory of 3972 1352 jjddv.exe 94 PID 1352 wrote to memory of 3972 1352 jjddv.exe 94 PID 3972 wrote to memory of 4036 3972 nbhnnh.exe 95 PID 3972 wrote to memory of 4036 3972 nbhnnh.exe 95 PID 3972 wrote to memory of 4036 3972 nbhnnh.exe 95 PID 4036 wrote to memory of 4844 4036 thbtnh.exe 96 PID 4036 wrote to memory of 4844 4036 thbtnh.exe 96 PID 4036 wrote to memory of 4844 4036 thbtnh.exe 96 PID 4844 wrote to memory of 4484 4844 rrxlfrr.exe 97 PID 4844 wrote to memory of 4484 4844 rrxlfrr.exe 97 PID 4844 wrote to memory of 4484 4844 rrxlfrr.exe 97 PID 4484 wrote to memory of 3684 4484 lfffrfr.exe 98 PID 4484 wrote to memory of 3684 4484 lfffrfr.exe 98 PID 4484 wrote to memory of 3684 4484 lfffrfr.exe 98 PID 3684 wrote to memory of 2516 3684 bbhhbh.exe 99 PID 3684 wrote to memory of 2516 3684 bbhhbh.exe 99 PID 3684 wrote to memory of 2516 3684 bbhhbh.exe 99 PID 2516 wrote to memory of 3984 2516 pdddd.exe 100 PID 2516 wrote to memory of 3984 2516 pdddd.exe 100 PID 2516 wrote to memory of 3984 2516 pdddd.exe 100 PID 3984 wrote to memory of 1356 3984 7llfxxr.exe 101 PID 3984 wrote to memory of 1356 3984 7llfxxr.exe 101 PID 3984 wrote to memory of 1356 3984 7llfxxr.exe 101 PID 1356 wrote to memory of 1492 1356 nthbtt.exe 102 PID 1356 wrote to memory of 1492 1356 nthbtt.exe 102 PID 1356 wrote to memory of 1492 1356 nthbtt.exe 102 PID 1492 wrote to memory of 3908 1492 vvdvv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7N.exe"C:\Users\Admin\AppData\Local\Temp\8b7bafccbe2843d2808c1dbc99c059fb12db5fe650b4901cc80dec521a57c5c7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\pvpjd.exec:\pvpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\rlfxlfx.exec:\rlfxlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\7llfxfx.exec:\7llfxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\5thbnn.exec:\5thbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\dvjvj.exec:\dvjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\xlrlfxl.exec:\xlrlfxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\thnnhh.exec:\thnnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\dvpvv.exec:\dvpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\lfxlrrx.exec:\lfxlrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\nhhbtt.exec:\nhhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\vpvvv.exec:\vpvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\jjddv.exec:\jjddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\nbhnnh.exec:\nbhnnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\thbtnh.exec:\thbtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\rrxlfrr.exec:\rrxlfrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\lfffrfr.exec:\lfffrfr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\bbhhbh.exec:\bbhhbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\pdddd.exec:\pdddd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\7llfxxr.exec:\7llfxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\nthbtt.exec:\nthbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\vvdvv.exec:\vvdvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\frllfff.exec:\frllfff.exe23⤵
- Executes dropped EXE
PID:3908 -
\??\c:\btntnh.exec:\btntnh.exe24⤵
- Executes dropped EXE
PID:3116 -
\??\c:\1fxlxxr.exec:\1fxlxxr.exe25⤵
- Executes dropped EXE
PID:4776 -
\??\c:\5bhbbt.exec:\5bhbbt.exe26⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nntnhh.exec:\nntnhh.exe27⤵
- Executes dropped EXE
PID:2424 -
\??\c:\fffxffx.exec:\fffxffx.exe28⤵
- Executes dropped EXE
PID:4492 -
\??\c:\frrlffr.exec:\frrlffr.exe29⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ntttnn.exec:\ntttnn.exe30⤵
- Executes dropped EXE
PID:4836 -
\??\c:\vpvvv.exec:\vpvvv.exe31⤵
- Executes dropped EXE
PID:912 -
\??\c:\frflfff.exec:\frflfff.exe32⤵
- Executes dropped EXE
PID:936 -
\??\c:\bttttb.exec:\bttttb.exe33⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pjjvp.exec:\pjjvp.exe34⤵
- Executes dropped EXE
PID:4124 -
\??\c:\rllxlfr.exec:\rllxlfr.exe35⤵
- Executes dropped EXE
PID:3652 -
\??\c:\9hbthh.exec:\9hbthh.exe36⤵
- Executes dropped EXE
PID:2104 -
\??\c:\btnbnn.exec:\btnbnn.exe37⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jvjdp.exec:\jvjdp.exe38⤵
- Executes dropped EXE
PID:3048 -
\??\c:\3lxrffx.exec:\3lxrffx.exe39⤵
- Executes dropped EXE
PID:916 -
\??\c:\tnnhbt.exec:\tnnhbt.exe40⤵
- Executes dropped EXE
PID:4676 -
\??\c:\bnhhtt.exec:\bnhhtt.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\dddvp.exec:\dddvp.exe42⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rrxxrxr.exec:\rrxxrxr.exe43⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ffxxrrl.exec:\ffxxrrl.exe44⤵
- Executes dropped EXE
PID:1512 -
\??\c:\nbbnhb.exec:\nbbnhb.exe45⤵
- Executes dropped EXE
PID:1196 -
\??\c:\nbbnbb.exec:\nbbnbb.exe46⤵
- Executes dropped EXE
PID:4320 -
\??\c:\vppjv.exec:\vppjv.exe47⤵
- Executes dropped EXE
PID:4296 -
\??\c:\lxfxlfx.exec:\lxfxlfx.exe48⤵
- Executes dropped EXE
PID:3088 -
\??\c:\thhtnh.exec:\thhtnh.exe49⤵
- Executes dropped EXE
PID:4504 -
\??\c:\bthbhh.exec:\bthbhh.exe50⤵
- Executes dropped EXE
PID:1408 -
\??\c:\pjdjv.exec:\pjdjv.exe51⤵
- Executes dropped EXE
PID:4856 -
\??\c:\xxlxfxr.exec:\xxlxfxr.exe52⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rfxfflr.exec:\rfxfflr.exe53⤵
- Executes dropped EXE
PID:3892 -
\??\c:\htthbt.exec:\htthbt.exe54⤵
- Executes dropped EXE
PID:3668 -
\??\c:\ddvvv.exec:\ddvvv.exe55⤵
- Executes dropped EXE
PID:2380 -
\??\c:\dvddp.exec:\dvddp.exe56⤵
- Executes dropped EXE
PID:1108 -
\??\c:\5fxlxrl.exec:\5fxlxrl.exe57⤵
- Executes dropped EXE
PID:4640 -
\??\c:\9thbnh.exec:\9thbnh.exe58⤵
- Executes dropped EXE
PID:5028 -
\??\c:\jvvpj.exec:\jvvpj.exe59⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vpjvj.exec:\vpjvj.exe60⤵
- Executes dropped EXE
PID:1564 -
\??\c:\fxxrlrf.exec:\fxxrlrf.exe61⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hhnnbb.exec:\hhnnbb.exe62⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9tthtn.exec:\9tthtn.exe63⤵
- Executes dropped EXE
PID:4712 -
\??\c:\djjdp.exec:\djjdp.exe64⤵
- Executes dropped EXE
PID:3696 -
\??\c:\jdjdd.exec:\jdjdd.exe65⤵
- Executes dropped EXE
PID:2976 -
\??\c:\fllxrlf.exec:\fllxrlf.exe66⤵PID:2064
-
\??\c:\thnhtt.exec:\thnhtt.exe67⤵PID:4940
-
\??\c:\rflxrlx.exec:\rflxrlx.exe68⤵PID:1548
-
\??\c:\ntbtnn.exec:\ntbtnn.exe69⤵PID:2284
-
\??\c:\tnbhht.exec:\tnbhht.exe70⤵PID:4468
-
\??\c:\7ppjd.exec:\7ppjd.exe71⤵PID:5000
-
\??\c:\pvdpj.exec:\pvdpj.exe72⤵PID:3584
-
\??\c:\rrxrfxr.exec:\rrxrfxr.exe73⤵PID:4604
-
\??\c:\3nhbtt.exec:\3nhbtt.exe74⤵PID:3920
-
\??\c:\jdjdv.exec:\jdjdv.exe75⤵PID:3984
-
\??\c:\7ddpd.exec:\7ddpd.exe76⤵PID:4800
-
\??\c:\rfrlxxr.exec:\rfrlxxr.exe77⤵PID:3596
-
\??\c:\nhttbb.exec:\nhttbb.exe78⤵PID:4496
-
\??\c:\jddvp.exec:\jddvp.exe79⤵PID:2964
-
\??\c:\jdjjd.exec:\jdjjd.exe80⤵PID:2928
-
\??\c:\fxfxlrr.exec:\fxfxlrr.exe81⤵PID:4488
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe82⤵PID:528
-
\??\c:\7bhhhh.exec:\7bhhhh.exe83⤵PID:1940
-
\??\c:\vpvpp.exec:\vpvpp.exe84⤵PID:3460
-
\??\c:\lfllfll.exec:\lfllfll.exe85⤵PID:2640
-
\??\c:\3flrfff.exec:\3flrfff.exe86⤵PID:1444
-
\??\c:\nntntt.exec:\nntntt.exe87⤵PID:2376
-
\??\c:\tnhnbn.exec:\tnhnbn.exe88⤵PID:5084
-
\??\c:\dpddp.exec:\dpddp.exe89⤵PID:888
-
\??\c:\lrlffrx.exec:\lrlffrx.exe90⤵PID:1320
-
\??\c:\ffrrllf.exec:\ffrrllf.exe91⤵PID:2692
-
\??\c:\tbtttt.exec:\tbtttt.exe92⤵PID:1712
-
\??\c:\vpjjd.exec:\vpjjd.exe93⤵PID:3212
-
\??\c:\vjpjj.exec:\vjpjj.exe94⤵PID:1120
-
\??\c:\lxflfff.exec:\lxflfff.exe95⤵PID:5032
-
\??\c:\lrffrrr.exec:\lrffrrr.exe96⤵PID:1144
-
\??\c:\ththbt.exec:\ththbt.exe97⤵PID:3940
-
\??\c:\tntthh.exec:\tntthh.exe98⤵PID:4672
-
\??\c:\vdvdv.exec:\vdvdv.exe99⤵PID:4908
-
\??\c:\vdjdp.exec:\vdjdp.exe100⤵PID:2236
-
\??\c:\lrrllxl.exec:\lrrllxl.exe101⤵PID:2760
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe102⤵PID:3392
-
\??\c:\thhtbt.exec:\thhtbt.exe103⤵PID:1524
-
\??\c:\jpjvp.exec:\jpjvp.exe104⤵PID:4648
-
\??\c:\djjvj.exec:\djjvj.exe105⤵PID:3768
-
\??\c:\7rxrllf.exec:\7rxrllf.exe106⤵PID:4324
-
\??\c:\tnnnhh.exec:\tnnnhh.exe107⤵PID:3060
-
\??\c:\hnbnnb.exec:\hnbnnb.exe108⤵PID:632
-
\??\c:\nbtnbb.exec:\nbtnbb.exe109⤵PID:4632
-
\??\c:\1vjvj.exec:\1vjvj.exe110⤵PID:4704
-
\??\c:\9jjdd.exec:\9jjdd.exe111⤵PID:3716
-
\??\c:\xflxlfx.exec:\xflxlfx.exe112⤵PID:3020
-
\??\c:\9bnhtt.exec:\9bnhtt.exe113⤵PID:4264
-
\??\c:\1lfrfxr.exec:\1lfrfxr.exe114⤵PID:4260
-
\??\c:\5fxrfxr.exec:\5fxrfxr.exe115⤵PID:3672
-
\??\c:\hbtnbt.exec:\hbtnbt.exe116⤵PID:920
-
\??\c:\nnhtnn.exec:\nnhtnn.exe117⤵PID:4052
-
\??\c:\vjpvp.exec:\vjpvp.exe118⤵PID:4136
-
\??\c:\xrlrlff.exec:\xrlrlff.exe119⤵PID:3148
-
\??\c:\lxflrrl.exec:\lxflrrl.exe120⤵PID:2860
-
\??\c:\5hhthb.exec:\5hhthb.exe121⤵PID:4600
-
\??\c:\bbhbnh.exec:\bbhbnh.exe122⤵PID:4932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-