Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 01:56
Static task
static1
Behavioral task
behavioral1
Sample
2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0N.exe
Resource
win7-20240708-en
General
-
Target
2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0N.exe
-
Size
73KB
-
MD5
1bfabca692d1249f8d78d83756c40ae0
-
SHA1
c96e937d4bcb2123238e10fbd4a0255563b334d6
-
SHA256
2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0
-
SHA512
816e3d97199cd9a60484d6d22cb6735555da24211ceb603e91e0052eabf3e3ed79fe738bbc35ef4eb12d7ab10045ad5a643f25478c36878030eefa687583b413
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfUcicP/f69q:ymb3NkkiQ3mdBjFI4V4ci2/fOq
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/2296-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2176-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4192 rrxlffx.exe 3592 nbhhbh.exe 3976 jddvv.exe 1804 dvjdv.exe 4508 lffxrrl.exe 3052 9hnhhh.exe 3220 tnbtnn.exe 1920 jdvpd.exe 3376 rlxlxxl.exe 3740 llfxllx.exe 3248 btthbb.exe 4292 jjjvj.exe 1040 xfxfffr.exe 4060 xlrrllf.exe 3188 1tbttt.exe 4936 pjddp.exe 728 vpddv.exe 1816 bnnhhb.exe 400 3ffxxxx.exe 2176 rlflrfl.exe 1456 nbhhbb.exe 4376 dvppp.exe 1828 rrxxllf.exe 2360 httnhh.exe 1752 tnhbbn.exe 3280 ppjvp.exe 2968 vvvvp.exe 872 fffxrrl.exe 2288 thnbhb.exe 1888 ppddd.exe 1484 vpvdv.exe 3424 rffxllf.exe 2052 9xxrrxr.exe 2852 7btnhh.exe 1408 5nnhtt.exe 820 pjjdp.exe 1316 jdpjv.exe 4868 lfllfff.exe 3336 rrllffx.exe 2988 nbbbnn.exe 4228 nnhbnn.exe 1800 jjjvp.exe 4988 7fllfll.exe 1152 9ffflll.exe 4420 btnnhh.exe 4020 pppvp.exe 4248 vddvj.exe 4136 xrrrffx.exe 4948 5fffxrl.exe 3520 tnnnbb.exe 816 tnbtnh.exe 4332 vjpjd.exe 1180 lfxlfxr.exe 4044 5xxfrlx.exe 3644 hntnnh.exe 4784 thhnth.exe 560 vpvpj.exe 4572 dpjpv.exe 2672 frrxrrl.exe 3032 hnnnth.exe 228 9bbtbn.exe 4520 pdjdp.exe 2916 fxffrxl.exe 3952 3xfxxrr.exe -
resource yara_rule behavioral2/memory/2296-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2176-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2360-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2296 wrote to memory of 4192 2296 2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0N.exe 82 PID 2296 wrote to memory of 4192 2296 2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0N.exe 82 PID 2296 wrote to memory of 4192 2296 2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0N.exe 82 PID 4192 wrote to memory of 3592 4192 rrxlffx.exe 83 PID 4192 wrote to memory of 3592 4192 rrxlffx.exe 83 PID 4192 wrote to memory of 3592 4192 rrxlffx.exe 83 PID 3592 wrote to memory of 3976 3592 nbhhbh.exe 84 PID 3592 wrote to memory of 3976 3592 nbhhbh.exe 84 PID 3592 wrote to memory of 3976 3592 nbhhbh.exe 84 PID 3976 wrote to memory of 1804 3976 jddvv.exe 85 PID 3976 wrote to memory of 1804 3976 jddvv.exe 85 PID 3976 wrote to memory of 1804 3976 jddvv.exe 85 PID 1804 wrote to memory of 4508 1804 dvjdv.exe 86 PID 1804 wrote to memory of 4508 1804 dvjdv.exe 86 PID 1804 wrote to memory of 4508 1804 dvjdv.exe 86 PID 4508 wrote to memory of 3052 4508 lffxrrl.exe 87 PID 4508 wrote to memory of 3052 4508 lffxrrl.exe 87 PID 4508 wrote to memory of 3052 4508 lffxrrl.exe 87 PID 3052 wrote to memory of 3220 3052 9hnhhh.exe 88 PID 3052 wrote to memory of 3220 3052 9hnhhh.exe 88 PID 3052 wrote to memory of 3220 3052 9hnhhh.exe 88 PID 3220 wrote to memory of 1920 3220 tnbtnn.exe 89 PID 3220 wrote to memory of 1920 3220 tnbtnn.exe 89 PID 3220 wrote to memory of 1920 3220 tnbtnn.exe 89 PID 1920 wrote to memory of 3376 1920 jdvpd.exe 90 PID 1920 wrote to memory of 3376 1920 jdvpd.exe 90 PID 1920 wrote to memory of 3376 1920 jdvpd.exe 90 PID 3376 wrote to memory of 3740 3376 rlxlxxl.exe 91 PID 3376 wrote to memory of 3740 3376 rlxlxxl.exe 91 PID 3376 wrote to memory of 3740 3376 rlxlxxl.exe 91 PID 3740 wrote to memory of 3248 3740 llfxllx.exe 92 PID 3740 wrote to memory of 3248 3740 llfxllx.exe 92 PID 3740 wrote to memory of 3248 3740 llfxllx.exe 92 PID 3248 wrote to memory of 4292 3248 btthbb.exe 93 PID 3248 wrote to memory of 4292 3248 btthbb.exe 93 PID 3248 wrote to memory of 4292 3248 btthbb.exe 93 PID 4292 wrote to memory of 1040 4292 jjjvj.exe 94 PID 4292 wrote to memory of 1040 4292 jjjvj.exe 94 PID 4292 wrote to memory of 1040 4292 jjjvj.exe 94 PID 1040 wrote to memory of 4060 1040 xfxfffr.exe 95 PID 1040 wrote to memory of 4060 1040 xfxfffr.exe 95 PID 1040 wrote to memory of 4060 1040 xfxfffr.exe 95 PID 4060 wrote to memory of 3188 4060 xlrrllf.exe 96 PID 4060 wrote to memory of 3188 4060 xlrrllf.exe 96 PID 4060 wrote to memory of 3188 4060 xlrrllf.exe 96 PID 3188 wrote to memory of 4936 3188 1tbttt.exe 97 PID 3188 wrote to memory of 4936 3188 1tbttt.exe 97 PID 3188 wrote to memory of 4936 3188 1tbttt.exe 97 PID 4936 wrote to memory of 728 4936 pjddp.exe 98 PID 4936 wrote to memory of 728 4936 pjddp.exe 98 PID 4936 wrote to memory of 728 4936 pjddp.exe 98 PID 728 wrote to memory of 1816 728 vpddv.exe 99 PID 728 wrote to memory of 1816 728 vpddv.exe 99 PID 728 wrote to memory of 1816 728 vpddv.exe 99 PID 1816 wrote to memory of 400 1816 bnnhhb.exe 100 PID 1816 wrote to memory of 400 1816 bnnhhb.exe 100 PID 1816 wrote to memory of 400 1816 bnnhhb.exe 100 PID 400 wrote to memory of 2176 400 3ffxxxx.exe 101 PID 400 wrote to memory of 2176 400 3ffxxxx.exe 101 PID 400 wrote to memory of 2176 400 3ffxxxx.exe 101 PID 2176 wrote to memory of 1456 2176 rlflrfl.exe 102 PID 2176 wrote to memory of 1456 2176 rlflrfl.exe 102 PID 2176 wrote to memory of 1456 2176 rlflrfl.exe 102 PID 1456 wrote to memory of 4376 1456 nbhhbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0N.exe"C:\Users\Admin\AppData\Local\Temp\2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\rrxlffx.exec:\rrxlffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\nbhhbh.exec:\nbhhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\jddvv.exec:\jddvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\dvjdv.exec:\dvjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\lffxrrl.exec:\lffxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\9hnhhh.exec:\9hnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\tnbtnn.exec:\tnbtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\jdvpd.exec:\jdvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\rlxlxxl.exec:\rlxlxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\llfxllx.exec:\llfxllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\btthbb.exec:\btthbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\jjjvj.exec:\jjjvj.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\xfxfffr.exec:\xfxfffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\xlrrllf.exec:\xlrrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\1tbttt.exec:\1tbttt.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\pjddp.exec:\pjddp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\vpddv.exec:\vpddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\bnnhhb.exec:\bnnhhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\3ffxxxx.exec:\3ffxxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\rlflrfl.exec:\rlflrfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\nbhhbb.exec:\nbhhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\dvppp.exec:\dvppp.exe23⤵
- Executes dropped EXE
PID:4376 -
\??\c:\rrxxllf.exec:\rrxxllf.exe24⤵
- Executes dropped EXE
PID:1828 -
\??\c:\httnhh.exec:\httnhh.exe25⤵
- Executes dropped EXE
PID:2360 -
\??\c:\tnhbbn.exec:\tnhbbn.exe26⤵
- Executes dropped EXE
PID:1752 -
\??\c:\ppjvp.exec:\ppjvp.exe27⤵
- Executes dropped EXE
PID:3280 -
\??\c:\vvvvp.exec:\vvvvp.exe28⤵
- Executes dropped EXE
PID:2968 -
\??\c:\fffxrrl.exec:\fffxrrl.exe29⤵
- Executes dropped EXE
PID:872 -
\??\c:\thnbhb.exec:\thnbhb.exe30⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ppddd.exec:\ppddd.exe31⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vpvdv.exec:\vpvdv.exe32⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rffxllf.exec:\rffxllf.exe33⤵
- Executes dropped EXE
PID:3424 -
\??\c:\9xxrrxr.exec:\9xxrrxr.exe34⤵
- Executes dropped EXE
PID:2052 -
\??\c:\7btnhh.exec:\7btnhh.exe35⤵
- Executes dropped EXE
PID:2852 -
\??\c:\5nnhtt.exec:\5nnhtt.exe36⤵
- Executes dropped EXE
PID:1408 -
\??\c:\pjjdp.exec:\pjjdp.exe37⤵
- Executes dropped EXE
PID:820 -
\??\c:\jdpjv.exec:\jdpjv.exe38⤵
- Executes dropped EXE
PID:1316 -
\??\c:\lfllfff.exec:\lfllfff.exe39⤵
- Executes dropped EXE
PID:4868 -
\??\c:\rrllffx.exec:\rrllffx.exe40⤵
- Executes dropped EXE
PID:3336 -
\??\c:\nbbbnn.exec:\nbbbnn.exe41⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nnhbnn.exec:\nnhbnn.exe42⤵
- Executes dropped EXE
PID:4228 -
\??\c:\jjjvp.exec:\jjjvp.exe43⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7fllfll.exec:\7fllfll.exe44⤵
- Executes dropped EXE
PID:4988 -
\??\c:\9ffflll.exec:\9ffflll.exe45⤵
- Executes dropped EXE
PID:1152 -
\??\c:\btnnhh.exec:\btnnhh.exe46⤵
- Executes dropped EXE
PID:4420 -
\??\c:\pppvp.exec:\pppvp.exe47⤵
- Executes dropped EXE
PID:4020 -
\??\c:\vppdv.exec:\vppdv.exe48⤵PID:4652
-
\??\c:\vddvj.exec:\vddvj.exe49⤵
- Executes dropped EXE
PID:4248 -
\??\c:\xrrrffx.exec:\xrrrffx.exe50⤵
- Executes dropped EXE
PID:4136 -
\??\c:\5fffxrl.exec:\5fffxrl.exe51⤵
- Executes dropped EXE
PID:4948 -
\??\c:\tnnnbb.exec:\tnnnbb.exe52⤵
- Executes dropped EXE
PID:3520 -
\??\c:\tnbtnh.exec:\tnbtnh.exe53⤵
- Executes dropped EXE
PID:816 -
\??\c:\vjpjd.exec:\vjpjd.exe54⤵
- Executes dropped EXE
PID:4332 -
\??\c:\lfxlfxr.exec:\lfxlfxr.exe55⤵
- Executes dropped EXE
PID:1180 -
\??\c:\5xxfrlx.exec:\5xxfrlx.exe56⤵
- Executes dropped EXE
PID:4044 -
\??\c:\hntnnh.exec:\hntnnh.exe57⤵
- Executes dropped EXE
PID:3644 -
\??\c:\thhnth.exec:\thhnth.exe58⤵
- Executes dropped EXE
PID:4784 -
\??\c:\vpvpj.exec:\vpvpj.exe59⤵
- Executes dropped EXE
PID:560 -
\??\c:\dpjpv.exec:\dpjpv.exe60⤵
- Executes dropped EXE
PID:4572 -
\??\c:\frrxrrl.exec:\frrxrrl.exe61⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hnnnth.exec:\hnnnth.exe62⤵
- Executes dropped EXE
PID:3032 -
\??\c:\9bbtbn.exec:\9bbtbn.exe63⤵
- Executes dropped EXE
PID:228 -
\??\c:\pdjdp.exec:\pdjdp.exe64⤵
- Executes dropped EXE
PID:4520 -
\??\c:\fxffrxl.exec:\fxffrxl.exe65⤵
- Executes dropped EXE
PID:2916 -
\??\c:\3xfxxrr.exec:\3xfxxrr.exe66⤵
- Executes dropped EXE
PID:3952 -
\??\c:\hhhhnn.exec:\hhhhnn.exe67⤵PID:472
-
\??\c:\hbttbb.exec:\hbttbb.exe68⤵PID:4812
-
\??\c:\3dpjv.exec:\3dpjv.exe69⤵PID:64
-
\??\c:\dddvv.exec:\dddvv.exe70⤵PID:4060
-
\??\c:\lffxrrl.exec:\lffxrrl.exe71⤵PID:3188
-
\??\c:\lrxxrlf.exec:\lrxxrlf.exe72⤵PID:1216
-
\??\c:\hhbbtt.exec:\hhbbtt.exe73⤵PID:2300
-
\??\c:\htnhbb.exec:\htnhbb.exe74⤵PID:1436
-
\??\c:\pppjv.exec:\pppjv.exe75⤵PID:760
-
\??\c:\jjdvv.exec:\jjdvv.exe76⤵PID:1016
-
\??\c:\rxxfrlf.exec:\rxxfrlf.exe77⤵PID:3040
-
\??\c:\fffxrxl.exec:\fffxrxl.exe78⤵PID:5044
-
\??\c:\5tttnn.exec:\5tttnn.exe79⤵PID:408
-
\??\c:\btttbn.exec:\btttbn.exe80⤵PID:4384
-
\??\c:\jvvpd.exec:\jvvpd.exe81⤵PID:4072
-
\??\c:\pvvvv.exec:\pvvvv.exe82⤵PID:4376
-
\??\c:\lfffrrl.exec:\lfffrrl.exe83⤵PID:744
-
\??\c:\lffxxxx.exec:\lffxxxx.exe84⤵PID:4732
-
\??\c:\bttnhh.exec:\bttnhh.exe85⤵PID:1504
-
\??\c:\bbhhth.exec:\bbhhth.exe86⤵PID:4496
-
\??\c:\vpjdv.exec:\vpjdv.exe87⤵PID:2016
-
\??\c:\1hnhbh.exec:\1hnhbh.exe88⤵PID:1660
-
\??\c:\vpdvj.exec:\vpdvj.exe89⤵PID:1492
-
\??\c:\vdpjd.exec:\vdpjd.exe90⤵PID:1908
-
\??\c:\7lrllfl.exec:\7lrllfl.exe91⤵PID:3612
-
\??\c:\nbbthh.exec:\nbbthh.exe92⤵PID:3372
-
\??\c:\tbbnhb.exec:\tbbnhb.exe93⤵PID:1484
-
\??\c:\jdpjd.exec:\jdpjd.exe94⤵PID:892
-
\??\c:\lfxrlll.exec:\lfxrlll.exe95⤵PID:3004
-
\??\c:\tnnnhh.exec:\tnnnhh.exe96⤵PID:2852
-
\??\c:\bbhbtt.exec:\bbhbtt.exe97⤵PID:2436
-
\??\c:\9pdvv.exec:\9pdvv.exe98⤵PID:2760
-
\??\c:\1jpjv.exec:\1jpjv.exe99⤵PID:5008
-
\??\c:\lxxrffr.exec:\lxxrffr.exe100⤵PID:1884
-
\??\c:\hnnnhb.exec:\hnnnhb.exe101⤵PID:4808
-
\??\c:\pdvjv.exec:\pdvjv.exe102⤵PID:3000
-
\??\c:\jvvpd.exec:\jvvpd.exe103⤵PID:2988
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe104⤵PID:4532
-
\??\c:\bnttnn.exec:\bnttnn.exe105⤵PID:3472
-
\??\c:\tbthnh.exec:\tbthnh.exe106⤵PID:4400
-
\??\c:\dpppj.exec:\dpppj.exe107⤵PID:4348
-
\??\c:\vppjd.exec:\vppjd.exe108⤵PID:1652
-
\??\c:\fxxlxxr.exec:\fxxlxxr.exe109⤵PID:2284
-
\??\c:\1lxrrrl.exec:\1lxrrrl.exe110⤵PID:2424
-
\??\c:\bttnhh.exec:\bttnhh.exe111⤵PID:4184
-
\??\c:\nbhhbt.exec:\nbhhbt.exe112⤵PID:3592
-
\??\c:\ppvpp.exec:\ppvpp.exe113⤵PID:2948
-
\??\c:\jppdp.exec:\jppdp.exe114⤵PID:4456
-
\??\c:\9llfrlf.exec:\9llfrlf.exe115⤵PID:3012
-
\??\c:\nnnnhh.exec:\nnnnhh.exe116⤵PID:2532
-
\??\c:\bbhnth.exec:\bbhnth.exe117⤵PID:4044
-
\??\c:\3vvjd.exec:\3vvjd.exe118⤵PID:3112
-
\??\c:\dppjj.exec:\dppjj.exe119⤵PID:4716
-
\??\c:\1rrrffx.exec:\1rrrffx.exe120⤵PID:4896
-
\??\c:\rxxlfll.exec:\rxxlfll.exe121⤵PID:716
-
\??\c:\thhtnn.exec:\thhtnn.exe122⤵PID:2244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-