Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2024, 01:17
Static task
static1
Behavioral task
behavioral1
Sample
96e64327ec919d6ec12ff9672b7c1e6f7f579e9d0040de9bb3bd38867481d976.exe
Resource
win7-20240903-en
General
-
Target
96e64327ec919d6ec12ff9672b7c1e6f7f579e9d0040de9bb3bd38867481d976.exe
-
Size
83KB
-
MD5
15a5868ca8b660b7c8fb5b5c3cf50107
-
SHA1
29e1dd79de18a86c68c95dc9c199ef702c7627b8
-
SHA256
96e64327ec919d6ec12ff9672b7c1e6f7f579e9d0040de9bb3bd38867481d976
-
SHA512
a2a4a320293cda2b399f1d0babcd8fe8330e9047c65d002ac32b864a71c77d1c47b353226a3874800afcc8450949d0af235a1320a7248bea4bdb5b9ba1337945
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Q8:ymb3NkkiQ3mdBjFIIp9L9QrrA8D
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4856-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4856 pdddv.exe 4688 dppvp.exe 628 fffxxxx.exe 4300 nbbbbn.exe 3236 jjpjp.exe 1016 9lrrlff.exe 2328 lrrrfxf.exe 3472 nhnhtt.exe 2020 jvvpj.exe 3652 fflfrlr.exe 1468 nbbttn.exe 2856 7vjjd.exe 3436 flrllrf.exe 4672 httnnn.exe 4984 7pdpv.exe 2420 lllfxxr.exe 2576 ffrxfxf.exe 764 nbbhhn.exe 400 5jjvj.exe 2976 rlfxxll.exe 1276 frrrlll.exe 4164 htnnhb.exe 1064 vjjpp.exe 2208 5dpjd.exe 2364 fxlflll.exe 4376 rlrrrxx.exe 2024 tnbhbb.exe 2164 hbbbnn.exe 3616 5pvpp.exe 5072 thhhhn.exe 3912 pppjj.exe 1912 vdddv.exe 3672 rlxlxrf.exe 2192 7lrrlfx.exe 780 9hbbtt.exe 5008 pvvpp.exe 1048 dddvv.exe 1680 llxrxxf.exe 336 7nnhnn.exe 4832 5jddv.exe 3148 1xxrffx.exe 2608 nhnhhb.exe 3948 ppvpj.exe 3232 xrxrfrl.exe 2256 tntntt.exe 1820 nnnnbb.exe 2604 1vdvj.exe 2144 lffffrl.exe 4824 hhbbnn.exe 916 1vjpj.exe 1188 xrxrrrx.exe 3472 fxxxrrr.exe 4840 thbbbt.exe 2780 ppjdv.exe 1764 rxfxrll.exe 4724 3bbnhb.exe 4484 ththbb.exe 2720 dvjvd.exe 4848 rlfflrl.exe 4456 xlrllrl.exe 4928 hthhht.exe 1700 3nnttb.exe 1712 dvddj.exe 4332 lfffxfr.exe -
resource yara_rule behavioral2/memory/212-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 212 wrote to memory of 4856 212 96e64327ec919d6ec12ff9672b7c1e6f7f579e9d0040de9bb3bd38867481d976.exe 83 PID 212 wrote to memory of 4856 212 96e64327ec919d6ec12ff9672b7c1e6f7f579e9d0040de9bb3bd38867481d976.exe 83 PID 212 wrote to memory of 4856 212 96e64327ec919d6ec12ff9672b7c1e6f7f579e9d0040de9bb3bd38867481d976.exe 83 PID 4856 wrote to memory of 4688 4856 pdddv.exe 84 PID 4856 wrote to memory of 4688 4856 pdddv.exe 84 PID 4856 wrote to memory of 4688 4856 pdddv.exe 84 PID 4688 wrote to memory of 628 4688 dppvp.exe 85 PID 4688 wrote to memory of 628 4688 dppvp.exe 85 PID 4688 wrote to memory of 628 4688 dppvp.exe 85 PID 628 wrote to memory of 4300 628 fffxxxx.exe 86 PID 628 wrote to memory of 4300 628 fffxxxx.exe 86 PID 628 wrote to memory of 4300 628 fffxxxx.exe 86 PID 4300 wrote to memory of 3236 4300 nbbbbn.exe 87 PID 4300 wrote to memory of 3236 4300 nbbbbn.exe 87 PID 4300 wrote to memory of 3236 4300 nbbbbn.exe 87 PID 3236 wrote to memory of 1016 3236 jjpjp.exe 88 PID 3236 wrote to memory of 1016 3236 jjpjp.exe 88 PID 3236 wrote to memory of 1016 3236 jjpjp.exe 88 PID 1016 wrote to memory of 2328 1016 9lrrlff.exe 89 PID 1016 wrote to memory of 2328 1016 9lrrlff.exe 89 PID 1016 wrote to memory of 2328 1016 9lrrlff.exe 89 PID 2328 wrote to memory of 3472 2328 lrrrfxf.exe 90 PID 2328 wrote to memory of 3472 2328 lrrrfxf.exe 90 PID 2328 wrote to memory of 3472 2328 lrrrfxf.exe 90 PID 3472 wrote to memory of 2020 3472 nhnhtt.exe 91 PID 3472 wrote to memory of 2020 3472 nhnhtt.exe 91 PID 3472 wrote to memory of 2020 3472 nhnhtt.exe 91 PID 2020 wrote to memory of 3652 2020 jvvpj.exe 92 PID 2020 wrote to memory of 3652 2020 jvvpj.exe 92 PID 2020 wrote to memory of 3652 2020 jvvpj.exe 92 PID 3652 wrote to memory of 1468 3652 fflfrlr.exe 93 PID 3652 wrote to memory of 1468 3652 fflfrlr.exe 93 PID 3652 wrote to memory of 1468 3652 fflfrlr.exe 93 PID 1468 wrote to memory of 2856 1468 nbbttn.exe 94 PID 1468 wrote to memory of 2856 1468 nbbttn.exe 94 PID 1468 wrote to memory of 2856 1468 nbbttn.exe 94 PID 2856 wrote to memory of 3436 2856 7vjjd.exe 95 PID 2856 wrote to memory of 3436 2856 7vjjd.exe 95 PID 2856 wrote to memory of 3436 2856 7vjjd.exe 95 PID 3436 wrote to memory of 4672 3436 flrllrf.exe 96 PID 3436 wrote to memory of 4672 3436 flrllrf.exe 96 PID 3436 wrote to memory of 4672 3436 flrllrf.exe 96 PID 4672 wrote to memory of 4984 4672 httnnn.exe 97 PID 4672 wrote to memory of 4984 4672 httnnn.exe 97 PID 4672 wrote to memory of 4984 4672 httnnn.exe 97 PID 4984 wrote to memory of 2420 4984 7pdpv.exe 98 PID 4984 wrote to memory of 2420 4984 7pdpv.exe 98 PID 4984 wrote to memory of 2420 4984 7pdpv.exe 98 PID 2420 wrote to memory of 2576 2420 lllfxxr.exe 99 PID 2420 wrote to memory of 2576 2420 lllfxxr.exe 99 PID 2420 wrote to memory of 2576 2420 lllfxxr.exe 99 PID 2576 wrote to memory of 764 2576 ffrxfxf.exe 100 PID 2576 wrote to memory of 764 2576 ffrxfxf.exe 100 PID 2576 wrote to memory of 764 2576 ffrxfxf.exe 100 PID 764 wrote to memory of 400 764 nbbhhn.exe 101 PID 764 wrote to memory of 400 764 nbbhhn.exe 101 PID 764 wrote to memory of 400 764 nbbhhn.exe 101 PID 400 wrote to memory of 2976 400 5jjvj.exe 102 PID 400 wrote to memory of 2976 400 5jjvj.exe 102 PID 400 wrote to memory of 2976 400 5jjvj.exe 102 PID 2976 wrote to memory of 1276 2976 rlfxxll.exe 103 PID 2976 wrote to memory of 1276 2976 rlfxxll.exe 103 PID 2976 wrote to memory of 1276 2976 rlfxxll.exe 103 PID 1276 wrote to memory of 4164 1276 frrrlll.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\96e64327ec919d6ec12ff9672b7c1e6f7f579e9d0040de9bb3bd38867481d976.exe"C:\Users\Admin\AppData\Local\Temp\96e64327ec919d6ec12ff9672b7c1e6f7f579e9d0040de9bb3bd38867481d976.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\pdddv.exec:\pdddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\dppvp.exec:\dppvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\fffxxxx.exec:\fffxxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\nbbbbn.exec:\nbbbbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\jjpjp.exec:\jjpjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\9lrrlff.exec:\9lrrlff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\lrrrfxf.exec:\lrrrfxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\nhnhtt.exec:\nhnhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\jvvpj.exec:\jvvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\fflfrlr.exec:\fflfrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\nbbttn.exec:\nbbttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\7vjjd.exec:\7vjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\flrllrf.exec:\flrllrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\httnnn.exec:\httnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\7pdpv.exec:\7pdpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\lllfxxr.exec:\lllfxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\ffrxfxf.exec:\ffrxfxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\nbbhhn.exec:\nbbhhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\5jjvj.exec:\5jjvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\rlfxxll.exec:\rlfxxll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\frrrlll.exec:\frrrlll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\htnnhb.exec:\htnnhb.exe23⤵
- Executes dropped EXE
PID:4164 -
\??\c:\vjjpp.exec:\vjjpp.exe24⤵
- Executes dropped EXE
PID:1064 -
\??\c:\5dpjd.exec:\5dpjd.exe25⤵
- Executes dropped EXE
PID:2208 -
\??\c:\fxlflll.exec:\fxlflll.exe26⤵
- Executes dropped EXE
PID:2364 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe27⤵
- Executes dropped EXE
PID:4376 -
\??\c:\tnbhbb.exec:\tnbhbb.exe28⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hbbbnn.exec:\hbbbnn.exe29⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5pvpp.exec:\5pvpp.exe30⤵
- Executes dropped EXE
PID:3616 -
\??\c:\thhhhn.exec:\thhhhn.exe31⤵
- Executes dropped EXE
PID:5072 -
\??\c:\pppjj.exec:\pppjj.exe32⤵
- Executes dropped EXE
PID:3912 -
\??\c:\vdddv.exec:\vdddv.exe33⤵
- Executes dropped EXE
PID:1912 -
\??\c:\rlxlxrf.exec:\rlxlxrf.exe34⤵
- Executes dropped EXE
PID:3672 -
\??\c:\7lrrlfx.exec:\7lrrlfx.exe35⤵
- Executes dropped EXE
PID:2192 -
\??\c:\9hbbtt.exec:\9hbbtt.exe36⤵
- Executes dropped EXE
PID:780 -
\??\c:\pvvpp.exec:\pvvpp.exe37⤵
- Executes dropped EXE
PID:5008 -
\??\c:\dddvv.exec:\dddvv.exe38⤵
- Executes dropped EXE
PID:1048 -
\??\c:\rflrllf.exec:\rflrllf.exe39⤵PID:4420
-
\??\c:\llxrxxf.exec:\llxrxxf.exe40⤵
- Executes dropped EXE
PID:1680 -
\??\c:\7nnhnn.exec:\7nnhnn.exe41⤵
- Executes dropped EXE
PID:336 -
\??\c:\5jddv.exec:\5jddv.exe42⤵
- Executes dropped EXE
PID:4832 -
\??\c:\1xxrffx.exec:\1xxrffx.exe43⤵
- Executes dropped EXE
PID:3148 -
\??\c:\nhnhhb.exec:\nhnhhb.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\ppvpj.exec:\ppvpj.exe45⤵
- Executes dropped EXE
PID:3948 -
\??\c:\xrxrfrl.exec:\xrxrfrl.exe46⤵
- Executes dropped EXE
PID:3232 -
\??\c:\tntntt.exec:\tntntt.exe47⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nnnnbb.exec:\nnnnbb.exe48⤵
- Executes dropped EXE
PID:1820 -
\??\c:\1vdvj.exec:\1vdvj.exe49⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lffffrl.exec:\lffffrl.exe50⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hhbbnn.exec:\hhbbnn.exe51⤵
- Executes dropped EXE
PID:4824 -
\??\c:\1vjpj.exec:\1vjpj.exe52⤵
- Executes dropped EXE
PID:916 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe53⤵
- Executes dropped EXE
PID:1188 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe54⤵
- Executes dropped EXE
PID:3472 -
\??\c:\thbbbt.exec:\thbbbt.exe55⤵
- Executes dropped EXE
PID:4840 -
\??\c:\ppjdv.exec:\ppjdv.exe56⤵
- Executes dropped EXE
PID:2780 -
\??\c:\rxfxrll.exec:\rxfxrll.exe57⤵
- Executes dropped EXE
PID:1764 -
\??\c:\3bbnhb.exec:\3bbnhb.exe58⤵
- Executes dropped EXE
PID:4724 -
\??\c:\ththbb.exec:\ththbb.exe59⤵
- Executes dropped EXE
PID:4484 -
\??\c:\dvjvd.exec:\dvjvd.exe60⤵
- Executes dropped EXE
PID:2720 -
\??\c:\rlfflrl.exec:\rlfflrl.exe61⤵
- Executes dropped EXE
PID:4848 -
\??\c:\xlrllrl.exec:\xlrllrl.exe62⤵
- Executes dropped EXE
PID:4456 -
\??\c:\hthhht.exec:\hthhht.exe63⤵
- Executes dropped EXE
PID:4928 -
\??\c:\3nnttb.exec:\3nnttb.exe64⤵
- Executes dropped EXE
PID:1700 -
\??\c:\dvddj.exec:\dvddj.exe65⤵
- Executes dropped EXE
PID:1712 -
\??\c:\lfffxfr.exec:\lfffxfr.exe66⤵
- Executes dropped EXE
PID:4332 -
\??\c:\3hhnnh.exec:\3hhnnh.exe67⤵PID:316
-
\??\c:\7bhbnn.exec:\7bhbnn.exe68⤵PID:3580
-
\??\c:\rfxllrl.exec:\rfxllrl.exe69⤵PID:2160
-
\??\c:\xrlffxx.exec:\xrlffxx.exe70⤵PID:764
-
\??\c:\tnnhnh.exec:\tnnhnh.exe71⤵PID:3680
-
\??\c:\nnbbht.exec:\nnbbht.exe72⤵PID:1696
-
\??\c:\ttnnhh.exec:\ttnnhh.exe73⤵PID:1888
-
\??\c:\nnthnh.exec:\nnthnh.exe74⤵PID:4700
-
\??\c:\9pjpv.exec:\9pjpv.exe75⤵PID:1028
-
\??\c:\jjppd.exec:\jjppd.exe76⤵PID:1064
-
\??\c:\fxxxfff.exec:\fxxxfff.exe77⤵PID:2080
-
\??\c:\nbbtnh.exec:\nbbtnh.exe78⤵PID:3604
-
\??\c:\fxxlfxx.exec:\fxxlfxx.exe79⤵PID:3024
-
\??\c:\rffllrl.exec:\rffllrl.exe80⤵PID:2600
-
\??\c:\1tnhbb.exec:\1tnhbb.exe81⤵PID:4564
-
\??\c:\vvppj.exec:\vvppj.exe82⤵PID:4680
-
\??\c:\5vvvp.exec:\5vvvp.exe83⤵PID:3704
-
\??\c:\rrrrflf.exec:\rrrrflf.exe84⤵PID:3988
-
\??\c:\hbtnhb.exec:\hbtnhb.exe85⤵PID:5072
-
\??\c:\9nthhn.exec:\9nthhn.exe86⤵PID:2788
-
\??\c:\dvvvj.exec:\dvvvj.exe87⤵PID:2092
-
\??\c:\vppjv.exec:\vppjv.exe88⤵PID:1720
-
\??\c:\xxrlfff.exec:\xxrlfff.exe89⤵PID:3384
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe90⤵PID:1304
-
\??\c:\9nthnn.exec:\9nthnn.exe91⤵PID:3664
-
\??\c:\ddvvp.exec:\ddvvp.exe92⤵PID:4652
-
\??\c:\7ddvj.exec:\7ddvj.exe93⤵PID:4324
-
\??\c:\xxllrrx.exec:\xxllrrx.exe94⤵PID:4728
-
\??\c:\bnbtbh.exec:\bnbtbh.exe95⤵PID:2740
-
\??\c:\3bhtnh.exec:\3bhtnh.exe96⤵PID:5088
-
\??\c:\vpppv.exec:\vpppv.exe97⤵PID:336
-
\??\c:\pdppp.exec:\pdppp.exe98⤵PID:4792
-
\??\c:\lxffxxx.exec:\lxffxxx.exe99⤵PID:3148
-
\??\c:\flxlrxl.exec:\flxlrxl.exe100⤵PID:2608
-
\??\c:\hhtntt.exec:\hhtntt.exe101⤵PID:2380
-
\??\c:\dpjdv.exec:\dpjdv.exe102⤵PID:4472
-
\??\c:\xxlxllf.exec:\xxlxllf.exe103⤵PID:3236
-
\??\c:\thhbtb.exec:\thhbtb.exe104⤵PID:2596
-
\??\c:\djpjd.exec:\djpjd.exe105⤵PID:2764
-
\??\c:\vpvpj.exec:\vpvpj.exe106⤵PID:4572
-
\??\c:\3vpjj.exec:\3vpjj.exe107⤵PID:4292
-
\??\c:\lrxrxxx.exec:\lrxrxxx.exe108⤵PID:1188
-
\??\c:\nhhttt.exec:\nhhttt.exe109⤵PID:3928
-
\??\c:\bhnbtn.exec:\bhnbtn.exe110⤵PID:1032
-
\??\c:\9ddvp.exec:\9ddvp.exe111⤵PID:1568
-
\??\c:\rfxrlff.exec:\rfxrlff.exe112⤵PID:1564
-
\??\c:\fxrrxrx.exec:\fxrrxrx.exe113⤵PID:3508
-
\??\c:\nhnnhb.exec:\nhnnhb.exe114⤵PID:1800
-
\??\c:\hnnnhh.exec:\hnnnhh.exe115⤵PID:2844
-
\??\c:\5jpjp.exec:\5jpjp.exe116⤵PID:4672
-
\??\c:\rllfxxx.exec:\rllfxxx.exe117⤵PID:2232
-
\??\c:\xrrrllf.exec:\xrrrllf.exe118⤵PID:3296
-
\??\c:\7ttbbb.exec:\7ttbbb.exe119⤵PID:316
-
\??\c:\btbbhh.exec:\btbbhh.exe120⤵PID:3580
-
\??\c:\5vddp.exec:\5vddp.exe121⤵PID:1384
-
\??\c:\vvpvp.exec:\vvpvp.exe122⤵PID:4416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-