Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 19:47
Static task
static1
Behavioral task
behavioral1
Sample
695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe
Resource
win7-20240903-en
General
-
Target
695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe
-
Size
49KB
-
MD5
3b9eedf4db998c4f18a0c7ce94a47e44
-
SHA1
8e68b50ae5c2f8b589727f0c9135da44646f03d8
-
SHA256
695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15
-
SHA512
173fc95204b3924949ee001675e653b40e8cafdc3ef0f9b7e5d9e870067eb55b01c6d62ec5b73ab1740733d0ba7d07a50a066fb636246c48b16ae9808e2dbcfc
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5bx7DUa:0cdpeeBSHHMHLf9Rybx7D5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2036-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2120-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-363-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/916-389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-414-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-419-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-438-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-458-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-507-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-610-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-629-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-738-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-857-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-909-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-931-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-1537-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-1662-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-1756-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vjpjd.exetnthnb.exe5hbbbb.exevjpdd.exexflfxff.exetbtttt.exevvddd.exexxffrll.exentnntt.exejjvvj.exejvvdd.exelfrlfff.exe5rfxrrl.exe5jppp.exe9dppp.exefxflxfx.exe3bhbhh.exepjpjd.exellxlxlr.exehbbtnn.exennbtbt.exevpvvv.exehhthtb.exedvdvv.exerflrrlf.exenhnbhb.exebtbtnn.exejvvvp.exerrrlllf.exe5bbtnn.exevvvvj.exejpppj.exe5rrrllf.exehthhhn.exedvppv.exelfrfllr.exerxxfrrx.exebhttbt.exeddjpp.exejdvjd.exefrfflrr.exennbnnt.exejpvvp.exejdddd.exeflfxrfl.exexlffxxx.exettntnb.exepvjjv.exerrxxrff.exerllfxfx.exehnbbbh.exe7dvjd.exelxxlrlr.exenbbbnn.exejjdpv.exevppdd.exexfrlflf.exebtbbbb.exepjppp.exefflfrxr.exebhbtnn.exejjpjp.exe5jddp.exellllfxr.exepid Process 1900 vjpjd.exe 2156 tnthnb.exe 2744 5hbbbb.exe 1304 vjpdd.exe 980 xflfxff.exe 4292 tbtttt.exe 2308 vvddd.exe 2844 xxffrll.exe 452 ntnntt.exe 4288 jjvvj.exe 2388 jvvdd.exe 548 lfrlfff.exe 2392 5rfxrrl.exe 628 5jppp.exe 2792 9dppp.exe 3420 fxflxfx.exe 936 3bhbhh.exe 5116 pjpjd.exe 3684 llxlxlr.exe 1948 hbbtnn.exe 2060 nnbtbt.exe 736 vpvvv.exe 1452 hhthtb.exe 1412 dvdvv.exe 1692 rflrrlf.exe 4540 nhnbhb.exe 4272 btbtnn.exe 4492 jvvvp.exe 3288 rrrlllf.exe 4444 5bbtnn.exe 1684 vvvvj.exe 1604 jpppj.exe 4904 5rrrllf.exe 4360 hthhhn.exe 2880 dvppv.exe 3472 lfrfllr.exe 4544 rxxfrrx.exe 3488 bhttbt.exe 2220 ddjpp.exe 3388 jdvjd.exe 3512 frfflrr.exe 1404 nnbnnt.exe 1208 jpvvp.exe 640 jdddd.exe 4632 flfxrfl.exe 2260 xlffxxx.exe 2120 ttntnb.exe 1768 pvjjv.exe 1888 rrxxrff.exe 3944 rllfxfx.exe 2424 hnbbbh.exe 1676 7dvjd.exe 3092 lxxlrlr.exe 3348 nbbbnn.exe 2716 jjdpv.exe 3128 vppdd.exe 3556 xfrlflf.exe 3040 btbbbb.exe 2148 pjppp.exe 4292 fflfrxr.exe 4876 bhbtnn.exe 1456 jjpjp.exe 2644 5jddp.exe 2728 llllfxr.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ffflfll.exerflfrrr.exerrxlflf.exeddjdp.exe9jpjp.exelllrrrr.exebhbtnb.exebbtnnh.exelrffrxx.exexxrlffx.exe695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exexxrlxxr.exexxlfxxx.exehhtnhh.exefxrlllr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exevjpjd.exetnthnb.exe5hbbbb.exevjpdd.exexflfxff.exetbtttt.exevvddd.exexxffrll.exentnntt.exejjvvj.exejvvdd.exelfrlfff.exe5rfxrrl.exe5jppp.exe9dppp.exefxflxfx.exe3bhbhh.exepjpjd.exellxlxlr.exehbbtnn.exennbtbt.exedescription pid Process procid_target PID 2036 wrote to memory of 1900 2036 695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe 83 PID 2036 wrote to memory of 1900 2036 695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe 83 PID 2036 wrote to memory of 1900 2036 695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe 83 PID 1900 wrote to memory of 2156 1900 vjpjd.exe 84 PID 1900 wrote to memory of 2156 1900 vjpjd.exe 84 PID 1900 wrote to memory of 2156 1900 vjpjd.exe 84 PID 2156 wrote to memory of 2744 2156 tnthnb.exe 85 PID 2156 wrote to memory of 2744 2156 tnthnb.exe 85 PID 2156 wrote to memory of 2744 2156 tnthnb.exe 85 PID 2744 wrote to memory of 1304 2744 5hbbbb.exe 86 PID 2744 wrote to memory of 1304 2744 5hbbbb.exe 86 PID 2744 wrote to memory of 1304 2744 5hbbbb.exe 86 PID 1304 wrote to memory of 980 1304 vjpdd.exe 87 PID 1304 wrote to memory of 980 1304 vjpdd.exe 87 PID 1304 wrote to memory of 980 1304 vjpdd.exe 87 PID 980 wrote to memory of 4292 980 xflfxff.exe 88 PID 980 wrote to memory of 4292 980 xflfxff.exe 88 PID 980 wrote to memory of 4292 980 xflfxff.exe 88 PID 4292 wrote to memory of 2308 4292 tbtttt.exe 89 PID 4292 wrote to memory of 2308 4292 tbtttt.exe 89 PID 4292 wrote to memory of 2308 4292 tbtttt.exe 89 PID 2308 wrote to memory of 2844 2308 vvddd.exe 90 PID 2308 wrote to memory of 2844 2308 vvddd.exe 90 PID 2308 wrote to memory of 2844 2308 vvddd.exe 90 PID 2844 wrote to memory of 452 2844 xxffrll.exe 91 PID 2844 wrote to memory of 452 2844 xxffrll.exe 91 PID 2844 wrote to memory of 452 2844 xxffrll.exe 91 PID 452 wrote to memory of 4288 452 ntnntt.exe 92 PID 452 wrote to memory of 4288 452 ntnntt.exe 92 PID 452 wrote to memory of 4288 452 ntnntt.exe 92 PID 4288 wrote to memory of 2388 4288 jjvvj.exe 93 PID 4288 wrote to memory of 2388 4288 jjvvj.exe 93 PID 4288 wrote to memory of 2388 4288 jjvvj.exe 93 PID 2388 wrote to memory of 548 2388 jvvdd.exe 94 PID 2388 wrote to memory of 548 2388 jvvdd.exe 94 PID 2388 wrote to memory of 548 2388 jvvdd.exe 94 PID 548 wrote to memory of 2392 548 lfrlfff.exe 95 PID 548 wrote to memory of 2392 548 lfrlfff.exe 95 PID 548 wrote to memory of 2392 548 lfrlfff.exe 95 PID 2392 wrote to memory of 628 2392 5rfxrrl.exe 96 PID 2392 wrote to memory of 628 2392 5rfxrrl.exe 96 PID 2392 wrote to memory of 628 2392 5rfxrrl.exe 96 PID 628 wrote to memory of 2792 628 5jppp.exe 97 PID 628 wrote to memory of 2792 628 5jppp.exe 97 PID 628 wrote to memory of 2792 628 5jppp.exe 97 PID 2792 wrote to memory of 3420 2792 9dppp.exe 98 PID 2792 wrote to memory of 3420 2792 9dppp.exe 98 PID 2792 wrote to memory of 3420 2792 9dppp.exe 98 PID 3420 wrote to memory of 936 3420 fxflxfx.exe 99 PID 3420 wrote to memory of 936 3420 fxflxfx.exe 99 PID 3420 wrote to memory of 936 3420 fxflxfx.exe 99 PID 936 wrote to memory of 5116 936 3bhbhh.exe 100 PID 936 wrote to memory of 5116 936 3bhbhh.exe 100 PID 936 wrote to memory of 5116 936 3bhbhh.exe 100 PID 5116 wrote to memory of 3684 5116 pjpjd.exe 101 PID 5116 wrote to memory of 3684 5116 pjpjd.exe 101 PID 5116 wrote to memory of 3684 5116 pjpjd.exe 101 PID 3684 wrote to memory of 1948 3684 llxlxlr.exe 102 PID 3684 wrote to memory of 1948 3684 llxlxlr.exe 102 PID 3684 wrote to memory of 1948 3684 llxlxlr.exe 102 PID 1948 wrote to memory of 2060 1948 hbbtnn.exe 103 PID 1948 wrote to memory of 2060 1948 hbbtnn.exe 103 PID 1948 wrote to memory of 2060 1948 hbbtnn.exe 103 PID 2060 wrote to memory of 736 2060 nnbtbt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe"C:\Users\Admin\AppData\Local\Temp\695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\vjpjd.exec:\vjpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\tnthnb.exec:\tnthnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\5hbbbb.exec:\5hbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\vjpdd.exec:\vjpdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\xflfxff.exec:\xflfxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\tbtttt.exec:\tbtttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\vvddd.exec:\vvddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\xxffrll.exec:\xxffrll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\ntnntt.exec:\ntnntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\jjvvj.exec:\jjvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\jvvdd.exec:\jvvdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\lfrlfff.exec:\lfrlfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\5rfxrrl.exec:\5rfxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\5jppp.exec:\5jppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\9dppp.exec:\9dppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\fxflxfx.exec:\fxflxfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\3bhbhh.exec:\3bhbhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\pjpjd.exec:\pjpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\llxlxlr.exec:\llxlxlr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\hbbtnn.exec:\hbbtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\nnbtbt.exec:\nnbtbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\vpvvv.exec:\vpvvv.exe23⤵
- Executes dropped EXE
PID:736 -
\??\c:\hhthtb.exec:\hhthtb.exe24⤵
- Executes dropped EXE
PID:1452 -
\??\c:\dvdvv.exec:\dvdvv.exe25⤵
- Executes dropped EXE
PID:1412 -
\??\c:\rflrrlf.exec:\rflrrlf.exe26⤵
- Executes dropped EXE
PID:1692 -
\??\c:\nhnbhb.exec:\nhnbhb.exe27⤵
- Executes dropped EXE
PID:4540 -
\??\c:\btbtnn.exec:\btbtnn.exe28⤵
- Executes dropped EXE
PID:4272 -
\??\c:\jvvvp.exec:\jvvvp.exe29⤵
- Executes dropped EXE
PID:4492 -
\??\c:\rrrlllf.exec:\rrrlllf.exe30⤵
- Executes dropped EXE
PID:3288 -
\??\c:\5bbtnn.exec:\5bbtnn.exe31⤵
- Executes dropped EXE
PID:4444 -
\??\c:\vvvvj.exec:\vvvvj.exe32⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jpppj.exec:\jpppj.exe33⤵
- Executes dropped EXE
PID:1604 -
\??\c:\5rrrllf.exec:\5rrrllf.exe34⤵
- Executes dropped EXE
PID:4904 -
\??\c:\hthhhn.exec:\hthhhn.exe35⤵
- Executes dropped EXE
PID:4360 -
\??\c:\dvppv.exec:\dvppv.exe36⤵
- Executes dropped EXE
PID:2880 -
\??\c:\lfrfllr.exec:\lfrfllr.exe37⤵
- Executes dropped EXE
PID:3472 -
\??\c:\rxxfrrx.exec:\rxxfrrx.exe38⤵
- Executes dropped EXE
PID:4544 -
\??\c:\bhttbt.exec:\bhttbt.exe39⤵
- Executes dropped EXE
PID:3488 -
\??\c:\ddjpp.exec:\ddjpp.exe40⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jdvjd.exec:\jdvjd.exe41⤵
- Executes dropped EXE
PID:3388 -
\??\c:\frfflrr.exec:\frfflrr.exe42⤵
- Executes dropped EXE
PID:3512 -
\??\c:\nnbnnt.exec:\nnbnnt.exe43⤵
- Executes dropped EXE
PID:1404 -
\??\c:\jpvvp.exec:\jpvvp.exe44⤵
- Executes dropped EXE
PID:1208 -
\??\c:\jdddd.exec:\jdddd.exe45⤵
- Executes dropped EXE
PID:640 -
\??\c:\flfxrfl.exec:\flfxrfl.exe46⤵
- Executes dropped EXE
PID:4632 -
\??\c:\xlffxxx.exec:\xlffxxx.exe47⤵
- Executes dropped EXE
PID:2260 -
\??\c:\ttntnb.exec:\ttntnb.exe48⤵
- Executes dropped EXE
PID:2120 -
\??\c:\pvjjv.exec:\pvjjv.exe49⤵
- Executes dropped EXE
PID:1768 -
\??\c:\rrxxrff.exec:\rrxxrff.exe50⤵
- Executes dropped EXE
PID:1888 -
\??\c:\rllfxfx.exec:\rllfxfx.exe51⤵
- Executes dropped EXE
PID:3944 -
\??\c:\hnbbbh.exec:\hnbbbh.exe52⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7dvjd.exec:\7dvjd.exe53⤵
- Executes dropped EXE
PID:1676 -
\??\c:\lxxlrlr.exec:\lxxlrlr.exe54⤵
- Executes dropped EXE
PID:3092 -
\??\c:\nbbbnn.exec:\nbbbnn.exe55⤵
- Executes dropped EXE
PID:3348 -
\??\c:\jjdpv.exec:\jjdpv.exe56⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vppdd.exec:\vppdd.exe57⤵
- Executes dropped EXE
PID:3128 -
\??\c:\xfrlflf.exec:\xfrlflf.exe58⤵
- Executes dropped EXE
PID:3556 -
\??\c:\btbbbb.exec:\btbbbb.exe59⤵
- Executes dropped EXE
PID:3040 -
\??\c:\pjppp.exec:\pjppp.exe60⤵
- Executes dropped EXE
PID:2148 -
\??\c:\fflfrxr.exec:\fflfrxr.exe61⤵
- Executes dropped EXE
PID:4292 -
\??\c:\bhbtnn.exec:\bhbtnn.exe62⤵
- Executes dropped EXE
PID:4876 -
\??\c:\jjpjp.exec:\jjpjp.exe63⤵
- Executes dropped EXE
PID:1456 -
\??\c:\5jddp.exec:\5jddp.exe64⤵
- Executes dropped EXE
PID:2644 -
\??\c:\llllfxr.exec:\llllfxr.exe65⤵
- Executes dropped EXE
PID:2728 -
\??\c:\djjdv.exec:\djjdv.exe66⤵PID:3184
-
\??\c:\djjvv.exec:\djjvv.exe67⤵PID:1532
-
\??\c:\xlrlflf.exec:\xlrlflf.exe68⤵PID:2272
-
\??\c:\thnbht.exec:\thnbht.exe69⤵PID:2300
-
\??\c:\tnbnbt.exec:\tnbnbt.exe70⤵PID:4664
-
\??\c:\jvjdd.exec:\jvjdd.exe71⤵PID:3440
-
\??\c:\lxlxfrf.exec:\lxlxfrf.exe72⤵PID:1564
-
\??\c:\ffllxxf.exec:\ffllxxf.exe73⤵PID:3328
-
\??\c:\nnhnbh.exec:\nnhnbh.exe74⤵PID:3700
-
\??\c:\tnhhtn.exec:\tnhhtn.exe75⤵PID:4300
-
\??\c:\ppjpd.exec:\ppjpd.exe76⤵PID:4836
-
\??\c:\fflfrrl.exec:\fflfrrl.exe77⤵PID:4824
-
\??\c:\thnhhb.exec:\thnhhb.exe78⤵PID:4388
-
\??\c:\btnbtn.exec:\btnbtn.exe79⤵PID:1760
-
\??\c:\djjdp.exec:\djjdp.exe80⤵PID:2800
-
\??\c:\jdvpd.exec:\jdvpd.exe81⤵PID:4020
-
\??\c:\xxfrlfx.exec:\xxfrlfx.exe82⤵PID:1580
-
\??\c:\flffxfr.exec:\flffxfr.exe83⤵PID:1876
-
\??\c:\9hnhbb.exec:\9hnhbb.exe84⤵PID:4512
-
\??\c:\7vjdd.exec:\7vjdd.exe85⤵PID:5004
-
\??\c:\jdddp.exec:\jdddp.exe86⤵PID:1764
-
\??\c:\ffflfff.exec:\ffflfff.exe87⤵PID:4076
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe88⤵PID:2888
-
\??\c:\bhhhhh.exec:\bhhhhh.exe89⤵PID:3760
-
\??\c:\vvvdv.exec:\vvvdv.exe90⤵PID:4272
-
\??\c:\rrllxrx.exec:\rrllxrx.exe91⤵PID:4488
-
\??\c:\bbhbtn.exec:\bbhbtn.exe92⤵PID:916
-
\??\c:\pjpvp.exec:\pjpvp.exe93⤵PID:1736
-
\??\c:\lrxrffx.exec:\lrxrffx.exe94⤵PID:1684
-
\??\c:\fxxlfxr.exec:\fxxlfxr.exe95⤵PID:1600
-
\??\c:\ntbbnn.exec:\ntbbnn.exe96⤵PID:1688
-
\??\c:\httttn.exec:\httttn.exe97⤵PID:1448
-
\??\c:\3vdvj.exec:\3vdvj.exe98⤵PID:4052
-
\??\c:\1ddvd.exec:\1ddvd.exe99⤵PID:2880
-
\??\c:\rlffffr.exec:\rlffffr.exe100⤵PID:4944
-
\??\c:\ttbtht.exec:\ttbtht.exe101⤵PID:1880
-
\??\c:\nbhbtn.exec:\nbhbtn.exe102⤵PID:3488
-
\??\c:\ppvpp.exec:\ppvpp.exe103⤵PID:1816
-
\??\c:\lxlffxl.exec:\lxlffxl.exe104⤵PID:4424
-
\??\c:\btnhbb.exec:\btnhbb.exe105⤵PID:3124
-
\??\c:\nhhtth.exec:\nhhtth.exe106⤵PID:2024
-
\??\c:\7vjdp.exec:\7vjdp.exe107⤵PID:2304
-
\??\c:\ppvpv.exec:\ppvpv.exe108⤵PID:640
-
\??\c:\lxfxlfx.exec:\lxfxlfx.exe109⤵PID:2084
-
\??\c:\thbtnn.exec:\thbtnn.exe110⤵PID:3548
-
\??\c:\pppjd.exec:\pppjd.exe111⤵PID:4440
-
\??\c:\frrfrrf.exec:\frrfrrf.exe112⤵PID:4432
-
\??\c:\rfxrffr.exec:\rfxrffr.exe113⤵PID:4420
-
\??\c:\nhhbhh.exec:\nhhbhh.exe114⤵PID:1656
-
\??\c:\vddpj.exec:\vddpj.exe115⤵PID:3532
-
\??\c:\vdddd.exec:\vdddd.exe116⤵PID:4764
-
\??\c:\lfxlxrl.exec:\lfxlxrl.exe117⤵PID:3416
-
\??\c:\ttthbt.exec:\ttthbt.exe118⤵PID:400
-
\??\c:\djvdj.exec:\djvdj.exe119⤵PID:3128
-
\??\c:\1ffrffx.exec:\1ffrffx.exe120⤵PID:3556
-
\??\c:\ffrrlrx.exec:\ffrrlrx.exe121⤵PID:3040
-
\??\c:\bbbbhb.exec:\bbbbhb.exe122⤵PID:4296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-