Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 04:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe
-
Size
59KB
-
MD5
c6b0004e44a84f3897464ef81e6b0964
-
SHA1
7e91a91f43e3f6b3b4cfb3b43a93012c480f4ed8
-
SHA256
cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b
-
SHA512
90cbcae3e89b6b6e9a82033f650433e71a1770ba62f3d1589b461df0da995d13ae0d399d83c31e24989698d9c981391483870977838ba2fe911580eb4547eeb0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFYuS:ymb3NkkiQ3mdBjFIFnS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2256-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/672-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1032-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4432 8448282.exe 4916 8448264.exe 1556 lxxrxrr.exe 672 5ffxrll.exe 4296 9btnnn.exe 3500 ddppd.exe 1668 6422000.exe 3064 3jvpj.exe 1032 rxrfxfr.exe 5044 86006.exe 3652 jppjd.exe 3032 nhbttb.exe 3576 ttnnbh.exe 3740 9nhbtn.exe 2616 rfffrrl.exe 4268 1bhnhb.exe 1372 jvdvv.exe 2888 2608080.exe 4636 vvjpj.exe 1124 i864006.exe 3696 04202.exe 3156 xlfflfl.exe 1148 02080.exe 4424 44604.exe 4176 9tnhtt.exe 2948 fxlrflr.exe 1988 fxrlxrl.exe 2772 060804.exe 3412 xrxrlll.exe 408 jvdvv.exe 3940 26806.exe 3596 nhbthb.exe 452 pjppj.exe 4328 484006.exe 4060 26626.exe 2640 8000826.exe 1816 dpppj.exe 5112 88460.exe 4532 bnbhnt.exe 5096 40604.exe 4364 ppjdv.exe 3164 nnnhbt.exe 4564 lfffxxx.exe 1476 ttnnhh.exe 4796 httbnn.exe 4444 480484.exe 3356 bttntb.exe 4552 o444888.exe 3908 nhbhth.exe 4848 vpjjj.exe 1556 xrrfxxr.exe 2920 btbbbb.exe 3096 rrrfrrf.exe 2700 m4000.exe 5060 048284.exe 1580 hbhtth.exe 3500 s4044.exe 4948 3pvvj.exe 1384 9bhbbh.exe 1156 4806006.exe 2548 bhtnbb.exe 3188 04222.exe 4312 6284848.exe 512 bnntnt.exe -
resource yara_rule behavioral2/memory/2256-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/672-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ffxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04426.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44008.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 064884.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2256 wrote to memory of 4432 2256 cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe 83 PID 2256 wrote to memory of 4432 2256 cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe 83 PID 2256 wrote to memory of 4432 2256 cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe 83 PID 4432 wrote to memory of 4916 4432 8448282.exe 84 PID 4432 wrote to memory of 4916 4432 8448282.exe 84 PID 4432 wrote to memory of 4916 4432 8448282.exe 84 PID 4916 wrote to memory of 1556 4916 8448264.exe 85 PID 4916 wrote to memory of 1556 4916 8448264.exe 85 PID 4916 wrote to memory of 1556 4916 8448264.exe 85 PID 1556 wrote to memory of 672 1556 lxxrxrr.exe 86 PID 1556 wrote to memory of 672 1556 lxxrxrr.exe 86 PID 1556 wrote to memory of 672 1556 lxxrxrr.exe 86 PID 672 wrote to memory of 4296 672 5ffxrll.exe 87 PID 672 wrote to memory of 4296 672 5ffxrll.exe 87 PID 672 wrote to memory of 4296 672 5ffxrll.exe 87 PID 4296 wrote to memory of 3500 4296 9btnnn.exe 88 PID 4296 wrote to memory of 3500 4296 9btnnn.exe 88 PID 4296 wrote to memory of 3500 4296 9btnnn.exe 88 PID 3500 wrote to memory of 1668 3500 ddppd.exe 89 PID 3500 wrote to memory of 1668 3500 ddppd.exe 89 PID 3500 wrote to memory of 1668 3500 ddppd.exe 89 PID 1668 wrote to memory of 3064 1668 6422000.exe 90 PID 1668 wrote to memory of 3064 1668 6422000.exe 90 PID 1668 wrote to memory of 3064 1668 6422000.exe 90 PID 3064 wrote to memory of 1032 3064 3jvpj.exe 91 PID 3064 wrote to memory of 1032 3064 3jvpj.exe 91 PID 3064 wrote to memory of 1032 3064 3jvpj.exe 91 PID 1032 wrote to memory of 5044 1032 rxrfxfr.exe 92 PID 1032 wrote to memory of 5044 1032 rxrfxfr.exe 92 PID 1032 wrote to memory of 5044 1032 rxrfxfr.exe 92 PID 5044 wrote to memory of 3652 5044 86006.exe 93 PID 5044 wrote to memory of 3652 5044 86006.exe 93 PID 5044 wrote to memory of 3652 5044 86006.exe 93 PID 3652 wrote to memory of 3032 3652 jppjd.exe 94 PID 3652 wrote to memory of 3032 3652 jppjd.exe 94 PID 3652 wrote to memory of 3032 3652 jppjd.exe 94 PID 3032 wrote to memory of 3576 3032 nhbttb.exe 95 PID 3032 wrote to memory of 3576 3032 nhbttb.exe 95 PID 3032 wrote to memory of 3576 3032 nhbttb.exe 95 PID 3576 wrote to memory of 3740 3576 ttnnbh.exe 96 PID 3576 wrote to memory of 3740 3576 ttnnbh.exe 96 PID 3576 wrote to memory of 3740 3576 ttnnbh.exe 96 PID 3740 wrote to memory of 2616 3740 9nhbtn.exe 97 PID 3740 wrote to memory of 2616 3740 9nhbtn.exe 97 PID 3740 wrote to memory of 2616 3740 9nhbtn.exe 97 PID 2616 wrote to memory of 4268 2616 rfffrrl.exe 98 PID 2616 wrote to memory of 4268 2616 rfffrrl.exe 98 PID 2616 wrote to memory of 4268 2616 rfffrrl.exe 98 PID 4268 wrote to memory of 1372 4268 1bhnhb.exe 99 PID 4268 wrote to memory of 1372 4268 1bhnhb.exe 99 PID 4268 wrote to memory of 1372 4268 1bhnhb.exe 99 PID 1372 wrote to memory of 2888 1372 jvdvv.exe 100 PID 1372 wrote to memory of 2888 1372 jvdvv.exe 100 PID 1372 wrote to memory of 2888 1372 jvdvv.exe 100 PID 2888 wrote to memory of 4636 2888 2608080.exe 101 PID 2888 wrote to memory of 4636 2888 2608080.exe 101 PID 2888 wrote to memory of 4636 2888 2608080.exe 101 PID 4636 wrote to memory of 1124 4636 vvjpj.exe 102 PID 4636 wrote to memory of 1124 4636 vvjpj.exe 102 PID 4636 wrote to memory of 1124 4636 vvjpj.exe 102 PID 1124 wrote to memory of 3696 1124 i864006.exe 103 PID 1124 wrote to memory of 3696 1124 i864006.exe 103 PID 1124 wrote to memory of 3696 1124 i864006.exe 103 PID 3696 wrote to memory of 3156 3696 04202.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe"C:\Users\Admin\AppData\Local\Temp\cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\8448282.exec:\8448282.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\8448264.exec:\8448264.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\lxxrxrr.exec:\lxxrxrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\5ffxrll.exec:\5ffxrll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\9btnnn.exec:\9btnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\ddppd.exec:\ddppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\6422000.exec:\6422000.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\3jvpj.exec:\3jvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\rxrfxfr.exec:\rxrfxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\86006.exec:\86006.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\jppjd.exec:\jppjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\nhbttb.exec:\nhbttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\ttnnbh.exec:\ttnnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\9nhbtn.exec:\9nhbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\rfffrrl.exec:\rfffrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\1bhnhb.exec:\1bhnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\jvdvv.exec:\jvdvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\2608080.exec:\2608080.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\vvjpj.exec:\vvjpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\i864006.exec:\i864006.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\04202.exec:\04202.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\xlfflfl.exec:\xlfflfl.exe23⤵
- Executes dropped EXE
PID:3156 -
\??\c:\02080.exec:\02080.exe24⤵
- Executes dropped EXE
PID:1148 -
\??\c:\44604.exec:\44604.exe25⤵
- Executes dropped EXE
PID:4424 -
\??\c:\9tnhtt.exec:\9tnhtt.exe26⤵
- Executes dropped EXE
PID:4176 -
\??\c:\fxlrflr.exec:\fxlrflr.exe27⤵
- Executes dropped EXE
PID:2948 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe28⤵
- Executes dropped EXE
PID:1988 -
\??\c:\060804.exec:\060804.exe29⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xrxrlll.exec:\xrxrlll.exe30⤵
- Executes dropped EXE
PID:3412 -
\??\c:\jvdvv.exec:\jvdvv.exe31⤵
- Executes dropped EXE
PID:408 -
\??\c:\26806.exec:\26806.exe32⤵
- Executes dropped EXE
PID:3940 -
\??\c:\nhbthb.exec:\nhbthb.exe33⤵
- Executes dropped EXE
PID:3596 -
\??\c:\pjppj.exec:\pjppj.exe34⤵
- Executes dropped EXE
PID:452 -
\??\c:\484006.exec:\484006.exe35⤵
- Executes dropped EXE
PID:4328 -
\??\c:\26626.exec:\26626.exe36⤵
- Executes dropped EXE
PID:4060 -
\??\c:\8000826.exec:\8000826.exe37⤵
- Executes dropped EXE
PID:2640 -
\??\c:\dpppj.exec:\dpppj.exe38⤵
- Executes dropped EXE
PID:1816 -
\??\c:\88460.exec:\88460.exe39⤵
- Executes dropped EXE
PID:5112 -
\??\c:\bnbhnt.exec:\bnbhnt.exe40⤵
- Executes dropped EXE
PID:4532 -
\??\c:\40604.exec:\40604.exe41⤵
- Executes dropped EXE
PID:5096 -
\??\c:\ppjdv.exec:\ppjdv.exe42⤵
- Executes dropped EXE
PID:4364 -
\??\c:\nnnhbt.exec:\nnnhbt.exe43⤵
- Executes dropped EXE
PID:3164 -
\??\c:\lfffxxx.exec:\lfffxxx.exe44⤵
- Executes dropped EXE
PID:4564 -
\??\c:\ttnnhh.exec:\ttnnhh.exe45⤵
- Executes dropped EXE
PID:1476 -
\??\c:\httbnn.exec:\httbnn.exe46⤵
- Executes dropped EXE
PID:4796 -
\??\c:\480484.exec:\480484.exe47⤵
- Executes dropped EXE
PID:4444 -
\??\c:\bttntb.exec:\bttntb.exe48⤵
- Executes dropped EXE
PID:3356 -
\??\c:\o444888.exec:\o444888.exe49⤵
- Executes dropped EXE
PID:4552 -
\??\c:\nhbhth.exec:\nhbhth.exe50⤵
- Executes dropped EXE
PID:3908 -
\??\c:\vpjjj.exec:\vpjjj.exe51⤵
- Executes dropped EXE
PID:4848 -
\??\c:\xrrfxxr.exec:\xrrfxxr.exe52⤵
- Executes dropped EXE
PID:1556 -
\??\c:\btbbbb.exec:\btbbbb.exe53⤵
- Executes dropped EXE
PID:2920 -
\??\c:\rrrfrrf.exec:\rrrfrrf.exe54⤵
- Executes dropped EXE
PID:3096 -
\??\c:\m4000.exec:\m4000.exe55⤵
- Executes dropped EXE
PID:2700 -
\??\c:\048284.exec:\048284.exe56⤵
- Executes dropped EXE
PID:5060 -
\??\c:\hbhtth.exec:\hbhtth.exe57⤵
- Executes dropped EXE
PID:1580 -
\??\c:\s4044.exec:\s4044.exe58⤵
- Executes dropped EXE
PID:3500 -
\??\c:\3pvvj.exec:\3pvvj.exe59⤵
- Executes dropped EXE
PID:4948 -
\??\c:\9bhbbh.exec:\9bhbbh.exe60⤵
- Executes dropped EXE
PID:1384 -
\??\c:\4806006.exec:\4806006.exe61⤵
- Executes dropped EXE
PID:1156 -
\??\c:\bhtnbb.exec:\bhtnbb.exe62⤵
- Executes dropped EXE
PID:2548 -
\??\c:\04222.exec:\04222.exe63⤵
- Executes dropped EXE
PID:3188 -
\??\c:\6284848.exec:\6284848.exe64⤵
- Executes dropped EXE
PID:4312 -
\??\c:\bnntnt.exec:\bnntnt.exe65⤵
- Executes dropped EXE
PID:512 -
\??\c:\ddvvd.exec:\ddvvd.exe66⤵PID:2220
-
\??\c:\jpvvp.exec:\jpvvp.exe67⤵PID:3032
-
\??\c:\60244.exec:\60244.exe68⤵PID:4104
-
\??\c:\xxlfrlx.exec:\xxlfrlx.exe69⤵PID:3724
-
\??\c:\8400866.exec:\8400866.exe70⤵PID:2528
-
\??\c:\04428.exec:\04428.exe71⤵PID:2532
-
\??\c:\0204226.exec:\0204226.exe72⤵PID:3944
-
\??\c:\nhttnn.exec:\nhttnn.exe73⤵PID:1220
-
\??\c:\xrfrrfl.exec:\xrfrrfl.exe74⤵PID:772
-
\??\c:\48822.exec:\48822.exe75⤵PID:3768
-
\??\c:\6282046.exec:\6282046.exe76⤵PID:4800
-
\??\c:\ppjdj.exec:\ppjdj.exe77⤵PID:3696
-
\??\c:\i240684.exec:\i240684.exe78⤵PID:3240
-
\??\c:\6448406.exec:\6448406.exe79⤵PID:1148
-
\??\c:\88488.exec:\88488.exe80⤵PID:3868
-
\??\c:\5djdv.exec:\5djdv.exe81⤵PID:4176
-
\??\c:\fxllrrl.exec:\fxllrrl.exe82⤵PID:1616
-
\??\c:\i060222.exec:\i060222.exe83⤵PID:636
-
\??\c:\60040.exec:\60040.exe84⤵PID:3004
-
\??\c:\llffxfx.exec:\llffxfx.exe85⤵PID:1012
-
\??\c:\s8444.exec:\s8444.exe86⤵PID:1644
-
\??\c:\u406868.exec:\u406868.exe87⤵PID:3412
-
\??\c:\ttntnn.exec:\ttntnn.exe88⤵PID:4764
-
\??\c:\208262.exec:\208262.exe89⤵PID:3940
-
\??\c:\7pvvp.exec:\7pvvp.exe90⤵PID:2260
-
\??\c:\46826.exec:\46826.exe91⤵PID:2164
-
\??\c:\vdpjd.exec:\vdpjd.exe92⤵PID:2860
-
\??\c:\e06044.exec:\e06044.exe93⤵PID:432
-
\??\c:\4288280.exec:\4288280.exe94⤵PID:624
-
\??\c:\rxfffff.exec:\rxfffff.exe95⤵PID:5000
-
\??\c:\btnhhh.exec:\btnhhh.exe96⤵PID:5112
-
\??\c:\c400448.exec:\c400448.exe97⤵PID:3056
-
\??\c:\nntttb.exec:\nntttb.exe98⤵PID:5068
-
\??\c:\04468.exec:\04468.exe99⤵PID:2376
-
\??\c:\nhnnnn.exec:\nhnnnn.exe100⤵PID:4464
-
\??\c:\206606.exec:\206606.exe101⤵PID:4872
-
\??\c:\nnnnhn.exec:\nnnnhn.exe102⤵PID:3908
-
\??\c:\486066.exec:\486066.exe103⤵PID:3324
-
\??\c:\88262.exec:\88262.exe104⤵PID:4632
-
\??\c:\hntnhh.exec:\hntnhh.exe105⤵PID:2920
-
\??\c:\3lxrxfl.exec:\3lxrxfl.exe106⤵PID:4296
-
\??\c:\xxrllrr.exec:\xxrllrr.exe107⤵PID:2768
-
\??\c:\vvvvv.exec:\vvvvv.exe108⤵PID:3512
-
\??\c:\jpvvp.exec:\jpvvp.exe109⤵PID:4180
-
\??\c:\w22266.exec:\w22266.exe110⤵PID:3616
-
\??\c:\00226.exec:\00226.exe111⤵PID:1992
-
\??\c:\dpvpv.exec:\dpvpv.exe112⤵PID:464
-
\??\c:\o866000.exec:\o866000.exe113⤵PID:4576
-
\??\c:\66400.exec:\66400.exe114⤵PID:3188
-
\??\c:\5vjjd.exec:\5vjjd.exe115⤵PID:3692
-
\??\c:\060462.exec:\060462.exe116⤵PID:1548
-
\??\c:\42820.exec:\42820.exe117⤵PID:1964
-
\??\c:\24266.exec:\24266.exe118⤵PID:3604
-
\??\c:\0426220.exec:\0426220.exe119⤵PID:2228
-
\??\c:\22222.exec:\22222.exe120⤵PID:2880
-
\??\c:\22822.exec:\22822.exe121⤵PID:700
-
\??\c:\668244.exec:\668244.exe122⤵PID:4220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-