Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 04:52
Static task
static1
Behavioral task
behavioral1
Sample
e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe
Resource
win7-20241010-en
General
-
Target
e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe
-
Size
82KB
-
MD5
48a60f2e9b09bd24a19e7ce6dc415cf3
-
SHA1
60348bdcdf996e8dd035fdf23d459115d81e48f4
-
SHA256
e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e
-
SHA512
321db70d68349bbdeaafa4ad2bc1fa1fb37fc3281bf04256f2fb9b89167ae2926d033727661a10949e2b5c9102a57c89cbbe2bcd85d435f1e93c497c9d3e4112
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmB5Gtb:ymb3NkkiQ3mdBjFo73thgQ/wEk0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4940-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/520-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2112-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3596 hhhbbb.exe 920 7jjdd.exe 520 vvvpj.exe 1016 fllfxxr.exe 2684 tnttht.exe 2632 ppvvj.exe 3860 9flfrfx.exe 1668 bhnhnh.exe 5044 3lxrffx.exe 1816 7hhhhh.exe 3604 jppjd.exe 4288 jvvvv.exe 4828 nhbbhh.exe 2480 5nnhtt.exe 2360 jdddp.exe 4240 pjdvp.exe 2352 lfllffx.exe 5096 9tttnn.exe 1688 ddjpj.exe 3856 xxxfffx.exe 2692 xxrlxxx.exe 376 nbhhhh.exe 4692 jpppp.exe 2112 fxrlxfx.exe 3540 1hhttt.exe 5084 jvvpj.exe 3456 1flfllx.exe 1044 btnhbn.exe 1924 jvvjv.exe 1072 lxffrxl.exe 1396 9xxxrrl.exe 2912 hhhhhn.exe 1412 jjjdv.exe 1004 9xxrfxl.exe 1472 nhhnth.exe 4232 lrllfff.exe 5080 nnnnnt.exe 5024 ntntbn.exe 3276 dpppj.exe 4736 lxxrfrx.exe 4816 3lrlfrl.exe 1796 bbtnhh.exe 1620 7djdj.exe 3428 xxxlflf.exe 4840 hhhhbb.exe 2612 bhbtnt.exe 2244 dvvjd.exe 5072 9vdjd.exe 1976 rlrrrxx.exe 3100 3ntbbh.exe 644 vddjj.exe 1496 jdjdj.exe 2276 fffxllx.exe 1352 nnhhhh.exe 1228 jdvvv.exe 180 pjppv.exe 3008 rlfxllf.exe 4688 xrrrrrr.exe 1768 vdvvd.exe 1732 xfxflrx.exe 1104 lflrxxl.exe 1448 btttnn.exe 4540 tntttb.exe 316 xflfxxx.exe -
resource yara_rule behavioral2/memory/4940-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/520-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/520-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/520-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2360-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2112-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4940 wrote to memory of 3596 4940 e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe 83 PID 4940 wrote to memory of 3596 4940 e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe 83 PID 4940 wrote to memory of 3596 4940 e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe 83 PID 3596 wrote to memory of 920 3596 hhhbbb.exe 84 PID 3596 wrote to memory of 920 3596 hhhbbb.exe 84 PID 3596 wrote to memory of 920 3596 hhhbbb.exe 84 PID 920 wrote to memory of 520 920 7jjdd.exe 85 PID 920 wrote to memory of 520 920 7jjdd.exe 85 PID 920 wrote to memory of 520 920 7jjdd.exe 85 PID 520 wrote to memory of 1016 520 vvvpj.exe 86 PID 520 wrote to memory of 1016 520 vvvpj.exe 86 PID 520 wrote to memory of 1016 520 vvvpj.exe 86 PID 1016 wrote to memory of 2684 1016 fllfxxr.exe 87 PID 1016 wrote to memory of 2684 1016 fllfxxr.exe 87 PID 1016 wrote to memory of 2684 1016 fllfxxr.exe 87 PID 2684 wrote to memory of 2632 2684 tnttht.exe 88 PID 2684 wrote to memory of 2632 2684 tnttht.exe 88 PID 2684 wrote to memory of 2632 2684 tnttht.exe 88 PID 2632 wrote to memory of 3860 2632 ppvvj.exe 89 PID 2632 wrote to memory of 3860 2632 ppvvj.exe 89 PID 2632 wrote to memory of 3860 2632 ppvvj.exe 89 PID 3860 wrote to memory of 1668 3860 9flfrfx.exe 90 PID 3860 wrote to memory of 1668 3860 9flfrfx.exe 90 PID 3860 wrote to memory of 1668 3860 9flfrfx.exe 90 PID 1668 wrote to memory of 5044 1668 bhnhnh.exe 91 PID 1668 wrote to memory of 5044 1668 bhnhnh.exe 91 PID 1668 wrote to memory of 5044 1668 bhnhnh.exe 91 PID 5044 wrote to memory of 1816 5044 3lxrffx.exe 92 PID 5044 wrote to memory of 1816 5044 3lxrffx.exe 92 PID 5044 wrote to memory of 1816 5044 3lxrffx.exe 92 PID 1816 wrote to memory of 3604 1816 7hhhhh.exe 93 PID 1816 wrote to memory of 3604 1816 7hhhhh.exe 93 PID 1816 wrote to memory of 3604 1816 7hhhhh.exe 93 PID 3604 wrote to memory of 4288 3604 jppjd.exe 94 PID 3604 wrote to memory of 4288 3604 jppjd.exe 94 PID 3604 wrote to memory of 4288 3604 jppjd.exe 94 PID 4288 wrote to memory of 4828 4288 jvvvv.exe 95 PID 4288 wrote to memory of 4828 4288 jvvvv.exe 95 PID 4288 wrote to memory of 4828 4288 jvvvv.exe 95 PID 4828 wrote to memory of 2480 4828 nhbbhh.exe 96 PID 4828 wrote to memory of 2480 4828 nhbbhh.exe 96 PID 4828 wrote to memory of 2480 4828 nhbbhh.exe 96 PID 2480 wrote to memory of 2360 2480 5nnhtt.exe 97 PID 2480 wrote to memory of 2360 2480 5nnhtt.exe 97 PID 2480 wrote to memory of 2360 2480 5nnhtt.exe 97 PID 2360 wrote to memory of 4240 2360 jdddp.exe 98 PID 2360 wrote to memory of 4240 2360 jdddp.exe 98 PID 2360 wrote to memory of 4240 2360 jdddp.exe 98 PID 4240 wrote to memory of 2352 4240 pjdvp.exe 99 PID 4240 wrote to memory of 2352 4240 pjdvp.exe 99 PID 4240 wrote to memory of 2352 4240 pjdvp.exe 99 PID 2352 wrote to memory of 5096 2352 lfllffx.exe 100 PID 2352 wrote to memory of 5096 2352 lfllffx.exe 100 PID 2352 wrote to memory of 5096 2352 lfllffx.exe 100 PID 5096 wrote to memory of 1688 5096 9tttnn.exe 101 PID 5096 wrote to memory of 1688 5096 9tttnn.exe 101 PID 5096 wrote to memory of 1688 5096 9tttnn.exe 101 PID 1688 wrote to memory of 3856 1688 ddjpj.exe 102 PID 1688 wrote to memory of 3856 1688 ddjpj.exe 102 PID 1688 wrote to memory of 3856 1688 ddjpj.exe 102 PID 3856 wrote to memory of 2692 3856 xxxfffx.exe 103 PID 3856 wrote to memory of 2692 3856 xxxfffx.exe 103 PID 3856 wrote to memory of 2692 3856 xxxfffx.exe 103 PID 2692 wrote to memory of 376 2692 xxrlxxx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe"C:\Users\Admin\AppData\Local\Temp\e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\hhhbbb.exec:\hhhbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\7jjdd.exec:\7jjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\vvvpj.exec:\vvvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
\??\c:\fllfxxr.exec:\fllfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\tnttht.exec:\tnttht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\ppvvj.exec:\ppvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\9flfrfx.exec:\9flfrfx.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\bhnhnh.exec:\bhnhnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\3lxrffx.exec:\3lxrffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\7hhhhh.exec:\7hhhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\jppjd.exec:\jppjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\jvvvv.exec:\jvvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\nhbbhh.exec:\nhbbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\5nnhtt.exec:\5nnhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\jdddp.exec:\jdddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\pjdvp.exec:\pjdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\lfllffx.exec:\lfllffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\9tttnn.exec:\9tttnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\ddjpj.exec:\ddjpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\xxxfffx.exec:\xxxfffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\xxrlxxx.exec:\xxrlxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\nbhhhh.exec:\nbhhhh.exe23⤵
- Executes dropped EXE
PID:376 -
\??\c:\jpppp.exec:\jpppp.exe24⤵
- Executes dropped EXE
PID:4692 -
\??\c:\fxrlxfx.exec:\fxrlxfx.exe25⤵
- Executes dropped EXE
PID:2112 -
\??\c:\1hhttt.exec:\1hhttt.exe26⤵
- Executes dropped EXE
PID:3540 -
\??\c:\jvvpj.exec:\jvvpj.exe27⤵
- Executes dropped EXE
PID:5084 -
\??\c:\1flfllx.exec:\1flfllx.exe28⤵
- Executes dropped EXE
PID:3456 -
\??\c:\btnhbn.exec:\btnhbn.exe29⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jvvjv.exec:\jvvjv.exe30⤵
- Executes dropped EXE
PID:1924 -
\??\c:\lxffrxl.exec:\lxffrxl.exe31⤵
- Executes dropped EXE
PID:1072 -
\??\c:\9xxxrrl.exec:\9xxxrrl.exe32⤵
- Executes dropped EXE
PID:1396 -
\??\c:\hhhhhn.exec:\hhhhhn.exe33⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jjjdv.exec:\jjjdv.exe34⤵
- Executes dropped EXE
PID:1412 -
\??\c:\9xxrfxl.exec:\9xxrfxl.exe35⤵
- Executes dropped EXE
PID:1004 -
\??\c:\nhhnth.exec:\nhhnth.exe36⤵
- Executes dropped EXE
PID:1472 -
\??\c:\lrllfff.exec:\lrllfff.exe37⤵
- Executes dropped EXE
PID:4232 -
\??\c:\nnnnnt.exec:\nnnnnt.exe38⤵
- Executes dropped EXE
PID:5080 -
\??\c:\ntntbn.exec:\ntntbn.exe39⤵
- Executes dropped EXE
PID:5024 -
\??\c:\dpppj.exec:\dpppj.exe40⤵
- Executes dropped EXE
PID:3276 -
\??\c:\lxxrfrx.exec:\lxxrfrx.exe41⤵
- Executes dropped EXE
PID:4736 -
\??\c:\3lrlfrl.exec:\3lrlfrl.exe42⤵
- Executes dropped EXE
PID:4816 -
\??\c:\bbtnhh.exec:\bbtnhh.exe43⤵
- Executes dropped EXE
PID:1796 -
\??\c:\7djdj.exec:\7djdj.exe44⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jjjvp.exec:\jjjvp.exe45⤵PID:4040
-
\??\c:\xxxlflf.exec:\xxxlflf.exe46⤵
- Executes dropped EXE
PID:3428 -
\??\c:\hhhhbb.exec:\hhhhbb.exe47⤵
- Executes dropped EXE
PID:4840 -
\??\c:\bhbtnt.exec:\bhbtnt.exe48⤵
- Executes dropped EXE
PID:2612 -
\??\c:\dvvjd.exec:\dvvjd.exe49⤵
- Executes dropped EXE
PID:2244 -
\??\c:\9vdjd.exec:\9vdjd.exe50⤵
- Executes dropped EXE
PID:5072 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe51⤵
- Executes dropped EXE
PID:1976 -
\??\c:\3ntbbh.exec:\3ntbbh.exe52⤵
- Executes dropped EXE
PID:3100 -
\??\c:\vddjj.exec:\vddjj.exe53⤵
- Executes dropped EXE
PID:644 -
\??\c:\jdjdj.exec:\jdjdj.exe54⤵
- Executes dropped EXE
PID:1496 -
\??\c:\fffxllx.exec:\fffxllx.exe55⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nnhhhh.exec:\nnhhhh.exe56⤵
- Executes dropped EXE
PID:1352 -
\??\c:\jdvvv.exec:\jdvvv.exe57⤵
- Executes dropped EXE
PID:1228 -
\??\c:\pjppv.exec:\pjppv.exe58⤵
- Executes dropped EXE
PID:180 -
\??\c:\rlfxllf.exec:\rlfxllf.exe59⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe60⤵
- Executes dropped EXE
PID:4688 -
\??\c:\vdvvd.exec:\vdvvd.exe61⤵
- Executes dropped EXE
PID:1768 -
\??\c:\xfxflrx.exec:\xfxflrx.exe62⤵
- Executes dropped EXE
PID:1732 -
\??\c:\lflrxxl.exec:\lflrxxl.exe63⤵
- Executes dropped EXE
PID:1104 -
\??\c:\btttnn.exec:\btttnn.exe64⤵
- Executes dropped EXE
PID:1448 -
\??\c:\tntttb.exec:\tntttb.exe65⤵
- Executes dropped EXE
PID:4540 -
\??\c:\xflfxxx.exec:\xflfxxx.exe66⤵
- Executes dropped EXE
PID:316 -
\??\c:\nhnhtt.exec:\nhnhtt.exe67⤵PID:2620
-
\??\c:\nntntt.exec:\nntntt.exe68⤵PID:932
-
\??\c:\7djdp.exec:\7djdp.exe69⤵PID:3780
-
\??\c:\dpvpj.exec:\dpvpj.exe70⤵PID:2064
-
\??\c:\rfflfxr.exec:\rfflfxr.exe71⤵PID:2340
-
\??\c:\hhbnhb.exec:\hhbnhb.exe72⤵PID:468
-
\??\c:\bttbbb.exec:\bttbbb.exe73⤵PID:2604
-
\??\c:\vjpvj.exec:\vjpvj.exe74⤵PID:3856
-
\??\c:\lrlrrlr.exec:\lrlrrlr.exe75⤵PID:4956
-
\??\c:\bnntnh.exec:\bnntnh.exe76⤵PID:376
-
\??\c:\1hbbtn.exec:\1hbbtn.exe77⤵PID:224
-
\??\c:\7vpdv.exec:\7vpdv.exe78⤵PID:4524
-
\??\c:\1dpjd.exec:\1dpjd.exe79⤵PID:2112
-
\??\c:\lxllflf.exec:\lxllflf.exe80⤵PID:4832
-
\??\c:\tnnnnh.exec:\tnnnnh.exe81⤵PID:4564
-
\??\c:\bbnnbh.exec:\bbnnbh.exe82⤵PID:1500
-
\??\c:\5ddvv.exec:\5ddvv.exe83⤵PID:1696
-
\??\c:\ffxrllf.exec:\ffxrllf.exe84⤵PID:3316
-
\??\c:\frlxrrr.exec:\frlxrrr.exe85⤵PID:912
-
\??\c:\vpvjd.exec:\vpvjd.exe86⤵PID:552
-
\??\c:\pddjd.exec:\pddjd.exe87⤵PID:4880
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe88⤵PID:1396
-
\??\c:\5lffrrr.exec:\5lffrrr.exe89⤵PID:4316
-
\??\c:\nnhnhh.exec:\nnhnhh.exe90⤵PID:2232
-
\??\c:\jpppj.exec:\jpppj.exe91⤵PID:456
-
\??\c:\fxrrlrl.exec:\fxrrlrl.exe92⤵PID:2812
-
\??\c:\xxllrrf.exec:\xxllrrf.exe93⤵PID:868
-
\??\c:\nhtttt.exec:\nhtttt.exe94⤵PID:2768
-
\??\c:\bhhbtt.exec:\bhhbtt.exe95⤵PID:1848
-
\??\c:\pjpvp.exec:\pjpvp.exe96⤵PID:1640
-
\??\c:\jddvj.exec:\jddvj.exe97⤵PID:4132
-
\??\c:\1flrlrr.exec:\1flrlrr.exe98⤵PID:672
-
\??\c:\hbnhtt.exec:\hbnhtt.exe99⤵PID:4464
-
\??\c:\bbnhbt.exec:\bbnhbt.exe100⤵PID:2220
-
\??\c:\djpvp.exec:\djpvp.exe101⤵PID:4940
-
\??\c:\xflllff.exec:\xflllff.exe102⤵PID:2308
-
\??\c:\nhnhhh.exec:\nhnhhh.exe103⤵PID:3764
-
\??\c:\jjjdv.exec:\jjjdv.exe104⤵PID:3628
-
\??\c:\vvjjj.exec:\vvjjj.exe105⤵PID:5072
-
\??\c:\frrlrll.exec:\frrlrll.exe106⤵PID:2576
-
\??\c:\rfrrlrr.exec:\rfrrlrr.exe107⤵PID:1164
-
\??\c:\nbhhhh.exec:\nbhhhh.exe108⤵PID:3600
-
\??\c:\1nnhbb.exec:\1nnhbb.exe109⤵PID:3860
-
\??\c:\dvjdv.exec:\dvjdv.exe110⤵PID:1228
-
\??\c:\1djvp.exec:\1djvp.exe111⤵PID:3492
-
\??\c:\lffxlrl.exec:\lffxlrl.exe112⤵PID:1836
-
\??\c:\xfxrllf.exec:\xfxrllf.exe113⤵PID:444
-
\??\c:\rlfxrrf.exec:\rlfxrrf.exe114⤵PID:1664
-
\??\c:\nhbnhh.exec:\nhbnhh.exe115⤵PID:4540
-
\??\c:\pppjj.exec:\pppjj.exe116⤵PID:3016
-
\??\c:\1jjvv.exec:\1jjvv.exe117⤵PID:2480
-
\??\c:\rrllxxr.exec:\rrllxxr.exe118⤵PID:4240
-
\??\c:\btbbbb.exec:\btbbbb.exe119⤵PID:4340
-
\??\c:\vpvpj.exec:\vpvpj.exe120⤵PID:4964
-
\??\c:\frrxfxf.exec:\frrxfxf.exe121⤵PID:3052
-
\??\c:\hbbbbh.exec:\hbbbbh.exe122⤵PID:4748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-