Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2024 00:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe
-
Size
63KB
-
MD5
10e1f626dd3e7530f75c5816a8890950
-
SHA1
029bbb574f7451444a374c3c6e02465a1cb67e94
-
SHA256
fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0
-
SHA512
89c317b59e31810986a70ff7ea89fc29a7d220f5cf8dbaae5c733a13f52e6123f64bc38e35a4af52fc5ebf068cb689ff3ee105ba01cdb0b9ea0cc39925cc8055
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxi03:ymb3NkkiQ3mdBjF0y7kbD
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2772-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/504-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4864 fflxxrr.exe 2516 rrxrlfx.exe 4296 9dvdv.exe 2208 lfrlxff.exe 3132 lrxrrrl.exe 3800 hbttnn.exe 2864 vjpdv.exe 3284 fxlflll.exe 4932 hbtbtt.exe 4592 thnhbb.exe 3244 fflfrrl.exe 3872 xlllfxr.exe 992 nttttn.exe 1976 jvpjd.exe 3140 9lrlxrx.exe 2324 rllffff.exe 4844 jjjjd.exe 3032 nnbbtt.exe 4204 btnhbb.exe 2012 pjvdv.exe 3264 7fflfll.exe 3348 frffxff.exe 5084 tnbtbh.exe 3260 bhnnbb.exe 5116 5vjjp.exe 2868 jdjdp.exe 2016 lfrrlll.exe 504 thtnhb.exe 4488 7btnhh.exe 2524 hthbhh.exe 4264 pjjjp.exe 3980 bbbthn.exe 2768 ddpvj.exe 3572 xflfrrr.exe 1432 5xllxxf.exe 320 nbhnhh.exe 4640 5jppj.exe 3524 9jjvp.exe 2136 7fxrxxr.exe 1676 ffllffx.exe 3788 bnbbtt.exe 908 vpdpd.exe 2220 5jjjv.exe 5052 9rxxffl.exe 3132 rllfxxr.exe 444 9nnnnh.exe 2944 tnthhh.exe 2496 7vvpv.exe 4552 rllfxff.exe 2044 rrlfxxx.exe 2556 bbtnhn.exe 4964 bbhhbb.exe 2100 pjjdv.exe 4044 jdvpj.exe 652 fflxxxr.exe 5076 flxrllr.exe 4460 btbbth.exe 2132 nhnnhn.exe 1568 djpjd.exe 1744 pdjvv.exe 1872 9xxrffr.exe 388 1nthhb.exe 1940 hbhnht.exe 912 vjpjd.exe -
resource yara_rule behavioral2/memory/2772-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3800-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/504-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 4864 2772 fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe 82 PID 2772 wrote to memory of 4864 2772 fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe 82 PID 2772 wrote to memory of 4864 2772 fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe 82 PID 4864 wrote to memory of 2516 4864 fflxxrr.exe 83 PID 4864 wrote to memory of 2516 4864 fflxxrr.exe 83 PID 4864 wrote to memory of 2516 4864 fflxxrr.exe 83 PID 2516 wrote to memory of 4296 2516 rrxrlfx.exe 84 PID 2516 wrote to memory of 4296 2516 rrxrlfx.exe 84 PID 2516 wrote to memory of 4296 2516 rrxrlfx.exe 84 PID 4296 wrote to memory of 2208 4296 9dvdv.exe 85 PID 4296 wrote to memory of 2208 4296 9dvdv.exe 85 PID 4296 wrote to memory of 2208 4296 9dvdv.exe 85 PID 2208 wrote to memory of 3132 2208 lfrlxff.exe 86 PID 2208 wrote to memory of 3132 2208 lfrlxff.exe 86 PID 2208 wrote to memory of 3132 2208 lfrlxff.exe 86 PID 3132 wrote to memory of 3800 3132 lrxrrrl.exe 87 PID 3132 wrote to memory of 3800 3132 lrxrrrl.exe 87 PID 3132 wrote to memory of 3800 3132 lrxrrrl.exe 87 PID 3800 wrote to memory of 2864 3800 hbttnn.exe 88 PID 3800 wrote to memory of 2864 3800 hbttnn.exe 88 PID 3800 wrote to memory of 2864 3800 hbttnn.exe 88 PID 2864 wrote to memory of 3284 2864 vjpdv.exe 89 PID 2864 wrote to memory of 3284 2864 vjpdv.exe 89 PID 2864 wrote to memory of 3284 2864 vjpdv.exe 89 PID 3284 wrote to memory of 4932 3284 fxlflll.exe 90 PID 3284 wrote to memory of 4932 3284 fxlflll.exe 90 PID 3284 wrote to memory of 4932 3284 fxlflll.exe 90 PID 4932 wrote to memory of 4592 4932 hbtbtt.exe 91 PID 4932 wrote to memory of 4592 4932 hbtbtt.exe 91 PID 4932 wrote to memory of 4592 4932 hbtbtt.exe 91 PID 4592 wrote to memory of 3244 4592 thnhbb.exe 92 PID 4592 wrote to memory of 3244 4592 thnhbb.exe 92 PID 4592 wrote to memory of 3244 4592 thnhbb.exe 92 PID 3244 wrote to memory of 3872 3244 fflfrrl.exe 93 PID 3244 wrote to memory of 3872 3244 fflfrrl.exe 93 PID 3244 wrote to memory of 3872 3244 fflfrrl.exe 93 PID 3872 wrote to memory of 992 3872 xlllfxr.exe 94 PID 3872 wrote to memory of 992 3872 xlllfxr.exe 94 PID 3872 wrote to memory of 992 3872 xlllfxr.exe 94 PID 992 wrote to memory of 1976 992 nttttn.exe 95 PID 992 wrote to memory of 1976 992 nttttn.exe 95 PID 992 wrote to memory of 1976 992 nttttn.exe 95 PID 1976 wrote to memory of 3140 1976 jvpjd.exe 96 PID 1976 wrote to memory of 3140 1976 jvpjd.exe 96 PID 1976 wrote to memory of 3140 1976 jvpjd.exe 96 PID 3140 wrote to memory of 2324 3140 9lrlxrx.exe 97 PID 3140 wrote to memory of 2324 3140 9lrlxrx.exe 97 PID 3140 wrote to memory of 2324 3140 9lrlxrx.exe 97 PID 2324 wrote to memory of 4844 2324 rllffff.exe 98 PID 2324 wrote to memory of 4844 2324 rllffff.exe 98 PID 2324 wrote to memory of 4844 2324 rllffff.exe 98 PID 4844 wrote to memory of 3032 4844 jjjjd.exe 99 PID 4844 wrote to memory of 3032 4844 jjjjd.exe 99 PID 4844 wrote to memory of 3032 4844 jjjjd.exe 99 PID 3032 wrote to memory of 4204 3032 nnbbtt.exe 100 PID 3032 wrote to memory of 4204 3032 nnbbtt.exe 100 PID 3032 wrote to memory of 4204 3032 nnbbtt.exe 100 PID 4204 wrote to memory of 2012 4204 btnhbb.exe 101 PID 4204 wrote to memory of 2012 4204 btnhbb.exe 101 PID 4204 wrote to memory of 2012 4204 btnhbb.exe 101 PID 2012 wrote to memory of 3264 2012 pjvdv.exe 102 PID 2012 wrote to memory of 3264 2012 pjvdv.exe 102 PID 2012 wrote to memory of 3264 2012 pjvdv.exe 102 PID 3264 wrote to memory of 3348 3264 7fflfll.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe"C:\Users\Admin\AppData\Local\Temp\fb74807dba0e18f5a469ff30266096767623dd5cbced9196ad54814175682ef0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\fflxxrr.exec:\fflxxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\rrxrlfx.exec:\rrxrlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\9dvdv.exec:\9dvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\lfrlxff.exec:\lfrlxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\lrxrrrl.exec:\lrxrrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\hbttnn.exec:\hbttnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\vjpdv.exec:\vjpdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\fxlflll.exec:\fxlflll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\hbtbtt.exec:\hbtbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\thnhbb.exec:\thnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\fflfrrl.exec:\fflfrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\xlllfxr.exec:\xlllfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\nttttn.exec:\nttttn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\jvpjd.exec:\jvpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\9lrlxrx.exec:\9lrlxrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\rllffff.exec:\rllffff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\jjjjd.exec:\jjjjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\nnbbtt.exec:\nnbbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\btnhbb.exec:\btnhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\pjvdv.exec:\pjvdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\7fflfll.exec:\7fflfll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\frffxff.exec:\frffxff.exe23⤵
- Executes dropped EXE
PID:3348 -
\??\c:\tnbtbh.exec:\tnbtbh.exe24⤵
- Executes dropped EXE
PID:5084 -
\??\c:\bhnnbb.exec:\bhnnbb.exe25⤵
- Executes dropped EXE
PID:3260 -
\??\c:\5vjjp.exec:\5vjjp.exe26⤵
- Executes dropped EXE
PID:5116 -
\??\c:\jdjdp.exec:\jdjdp.exe27⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lfrrlll.exec:\lfrrlll.exe28⤵
- Executes dropped EXE
PID:2016 -
\??\c:\thtnhb.exec:\thtnhb.exe29⤵
- Executes dropped EXE
PID:504 -
\??\c:\7btnhh.exec:\7btnhh.exe30⤵
- Executes dropped EXE
PID:4488 -
\??\c:\hthbhh.exec:\hthbhh.exe31⤵
- Executes dropped EXE
PID:2524 -
\??\c:\pjjjp.exec:\pjjjp.exe32⤵
- Executes dropped EXE
PID:4264 -
\??\c:\bbbthn.exec:\bbbthn.exe33⤵
- Executes dropped EXE
PID:3980 -
\??\c:\ddpvj.exec:\ddpvj.exe34⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xflfrrr.exec:\xflfrrr.exe35⤵
- Executes dropped EXE
PID:3572 -
\??\c:\5xllxxf.exec:\5xllxxf.exe36⤵
- Executes dropped EXE
PID:1432 -
\??\c:\nbhnhh.exec:\nbhnhh.exe37⤵
- Executes dropped EXE
PID:320 -
\??\c:\5jppj.exec:\5jppj.exe38⤵
- Executes dropped EXE
PID:4640 -
\??\c:\9jjvp.exec:\9jjvp.exe39⤵
- Executes dropped EXE
PID:3524 -
\??\c:\7fxrxxr.exec:\7fxrxxr.exe40⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ffllffx.exec:\ffllffx.exe41⤵
- Executes dropped EXE
PID:1676 -
\??\c:\bnbbtt.exec:\bnbbtt.exe42⤵
- Executes dropped EXE
PID:3788 -
\??\c:\vpdpd.exec:\vpdpd.exe43⤵
- Executes dropped EXE
PID:908 -
\??\c:\5jjjv.exec:\5jjjv.exe44⤵
- Executes dropped EXE
PID:2220 -
\??\c:\9rxxffl.exec:\9rxxffl.exe45⤵
- Executes dropped EXE
PID:5052 -
\??\c:\rllfxxr.exec:\rllfxxr.exe46⤵
- Executes dropped EXE
PID:3132 -
\??\c:\9nnnnh.exec:\9nnnnh.exe47⤵
- Executes dropped EXE
PID:444 -
\??\c:\tnthhh.exec:\tnthhh.exe48⤵
- Executes dropped EXE
PID:2944 -
\??\c:\7vvpv.exec:\7vvpv.exe49⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rllfxff.exec:\rllfxff.exe50⤵
- Executes dropped EXE
PID:4552 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe51⤵
- Executes dropped EXE
PID:2044 -
\??\c:\bbtnhn.exec:\bbtnhn.exe52⤵
- Executes dropped EXE
PID:2556 -
\??\c:\bbhhbb.exec:\bbhhbb.exe53⤵
- Executes dropped EXE
PID:4964 -
\??\c:\pjjdv.exec:\pjjdv.exe54⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jdvpj.exec:\jdvpj.exe55⤵
- Executes dropped EXE
PID:4044 -
\??\c:\fflxxxr.exec:\fflxxxr.exe56⤵
- Executes dropped EXE
PID:652 -
\??\c:\flxrllr.exec:\flxrllr.exe57⤵
- Executes dropped EXE
PID:5076 -
\??\c:\btbbth.exec:\btbbth.exe58⤵
- Executes dropped EXE
PID:4460 -
\??\c:\nhnnhn.exec:\nhnnhn.exe59⤵
- Executes dropped EXE
PID:2132 -
\??\c:\djpjd.exec:\djpjd.exe60⤵
- Executes dropped EXE
PID:1568 -
\??\c:\pdjvv.exec:\pdjvv.exe61⤵
- Executes dropped EXE
PID:1744 -
\??\c:\9xxrffr.exec:\9xxrffr.exe62⤵
- Executes dropped EXE
PID:1872 -
\??\c:\1nthhb.exec:\1nthhb.exe63⤵
- Executes dropped EXE
PID:388 -
\??\c:\hbhnht.exec:\hbhnht.exe64⤵
- Executes dropped EXE
PID:1940 -
\??\c:\vjpjd.exec:\vjpjd.exe65⤵
- Executes dropped EXE
PID:912 -
\??\c:\pjpjd.exec:\pjpjd.exe66⤵PID:4256
-
\??\c:\xrrlffl.exec:\xrrlffl.exe67⤵PID:2056
-
\??\c:\5ffllll.exec:\5ffllll.exe68⤵PID:2336
-
\??\c:\bhnnhh.exec:\bhnnhh.exe69⤵PID:2324
-
\??\c:\bbhbht.exec:\bbhbht.exe70⤵PID:3280
-
\??\c:\7vddv.exec:\7vddv.exe71⤵PID:376
-
\??\c:\xflxrrl.exec:\xflxrrl.exe72⤵PID:3796
-
\??\c:\rfxxxxr.exec:\rfxxxxr.exe73⤵PID:1588
-
\??\c:\5httnn.exec:\5httnn.exe74⤵PID:1708
-
\??\c:\7jjjp.exec:\7jjjp.exe75⤵PID:3792
-
\??\c:\7jvpj.exec:\7jvpj.exe76⤵PID:1936
-
\??\c:\fxlfxll.exec:\fxlfxll.exe77⤵PID:2020
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe78⤵PID:4356
-
\??\c:\btnhnb.exec:\btnhnb.exe79⤵PID:1852
-
\??\c:\bntnbb.exec:\bntnbb.exe80⤵PID:2356
-
\??\c:\dpvdd.exec:\dpvdd.exe81⤵PID:2868
-
\??\c:\ffrlxxx.exec:\ffrlxxx.exe82⤵PID:760
-
\??\c:\3rrllll.exec:\3rrllll.exe83⤵PID:3300
-
\??\c:\bhhnnn.exec:\bhhnnn.exe84⤵PID:1260
-
\??\c:\hbbnbn.exec:\hbbnbn.exe85⤵PID:2896
-
\??\c:\pjdjp.exec:\pjdjp.exe86⤵PID:3928
-
\??\c:\dvvpj.exec:\dvvpj.exe87⤵PID:2024
-
\??\c:\frrlxxr.exec:\frrlxxr.exe88⤵PID:4264
-
\??\c:\lffxllf.exec:\lffxllf.exe89⤵PID:3756
-
\??\c:\3hnbtb.exec:\3hnbtb.exe90⤵PID:2768
-
\??\c:\ppjvj.exec:\ppjvj.exe91⤵PID:3452
-
\??\c:\vppjp.exec:\vppjp.exe92⤵PID:4332
-
\??\c:\ffrlrrr.exec:\ffrlrrr.exe93⤵PID:5096
-
\??\c:\3rxxxxr.exec:\3rxxxxr.exe94⤵PID:4968
-
\??\c:\hthbtn.exec:\hthbtn.exe95⤵PID:632
-
\??\c:\jpddv.exec:\jpddv.exe96⤵PID:4224
-
\??\c:\dvdvj.exec:\dvdvj.exe97⤵PID:3560
-
\??\c:\fllrrll.exec:\fllrrll.exe98⤵PID:4880
-
\??\c:\lffxxxr.exec:\lffxxxr.exe99⤵PID:4868
-
\??\c:\xfllflf.exec:\xfllflf.exe100⤵PID:2220
-
\??\c:\3hhbtt.exec:\3hhbtt.exe101⤵PID:4836
-
\??\c:\pdvjp.exec:\pdvjp.exe102⤵PID:3736
-
\??\c:\vdjvj.exec:\vdjvj.exe103⤵PID:444
-
\??\c:\frfxlff.exec:\frfxlff.exe104⤵PID:2944
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe105⤵PID:1580
-
\??\c:\thtttb.exec:\thtttb.exe106⤵PID:4552
-
\??\c:\pvddd.exec:\pvddd.exe107⤵PID:5048
-
\??\c:\dpvpp.exec:\dpvpp.exe108⤵PID:552
-
\??\c:\1llxrll.exec:\1llxrll.exe109⤵PID:4964
-
\??\c:\httnnn.exec:\httnnn.exe110⤵PID:472
-
\??\c:\3btthh.exec:\3btthh.exe111⤵PID:4044
-
\??\c:\vpjvj.exec:\vpjvj.exe112⤵PID:652
-
\??\c:\xfrrlff.exec:\xfrrlff.exe113⤵PID:5076
-
\??\c:\xfrlfxr.exec:\xfrlfxr.exe114⤵PID:2936
-
\??\c:\bbhbnh.exec:\bbhbnh.exe115⤵PID:4592
-
\??\c:\tthhhh.exec:\tthhhh.exe116⤵PID:2948
-
\??\c:\vpppd.exec:\vpppd.exe117⤵PID:4704
-
\??\c:\jjdvj.exec:\jjdvj.exe118⤵PID:3716
-
\??\c:\lxxfrlx.exec:\lxxfrlx.exe119⤵PID:4608
-
\??\c:\xxrlxxr.exec:\xxrlxxr.exe120⤵PID:1940
-
\??\c:\7hnnhh.exec:\7hnnhh.exe121⤵PID:2256
-
\??\c:\jpvpp.exec:\jpvpp.exe122⤵PID:3772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-