Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 20:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe
-
Size
54KB
-
MD5
b286483fb6d61f417c889121666538d6
-
SHA1
d84d87728b018c74ec989cf5f5b353555b90b678
-
SHA256
21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0
-
SHA512
7890f8e102c7e8d5877661704722c838f9268b3ce18f49ef90b9810f1427ec940c1df24c6c070a2a07e9ad63afafdf396fa897462bb00af084301034a2e79202
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJt:0cdpeeBSHHMHLf9RyIET
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2844-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/652-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/720-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-350-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-388-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-413-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-420-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-446-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-465-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-481-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-524-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-642-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-697-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-740-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-759-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-803-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-849-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-905-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-921-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-1066-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-1215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1724 5hbbtn.exe 4056 pppjj.exe 2420 fffxrrl.exe 3748 fxrllfx.exe 4748 bhbttt.exe 2396 dvpjv.exe 1472 pjjdv.exe 3944 nbhhtb.exe 1436 bhhbnn.exe 4128 jpvpd.exe 1708 rxfrlfx.exe 652 lxxrrxr.exe 4600 bnhhtt.exe 3040 jvvpj.exe 3184 vppdj.exe 3840 fffrfrl.exe 4960 7nnnnn.exe 3104 dppjj.exe 4328 dvvvp.exe 4660 7xrrlff.exe 1256 vjvpp.exe 3676 pjvpj.exe 4936 xllfxxr.exe 540 nnhttn.exe 1952 htbtnb.exe 4004 pjdvp.exe 4928 rrfxlfx.exe 2688 fflxfxr.exe 3984 btttnn.exe 4668 xlllfff.exe 2508 lxrrllx.exe 2288 hhhbtt.exe 3668 vpvvd.exe 1296 pjjvd.exe 3112 rxffxxx.exe 4992 ffrlffx.exe 4724 ttnnnn.exe 4308 htbhbh.exe 2280 jvpjd.exe 4204 hbhhbb.exe 4840 hbhbbh.exe 228 vjvvj.exe 400 vvdpv.exe 4820 3llxlff.exe 4888 rlffxrr.exe 5004 3ntbbb.exe 764 tbhhbt.exe 4920 xrxrrxx.exe 1956 nnnnhh.exe 4416 ppvvv.exe 1884 1rfxfxr.exe 4284 bthbtn.exe 3636 xfxrlfx.exe 4868 bnhhbb.exe 720 jddpd.exe 5088 xlrrllf.exe 516 hhhbnt.exe 2308 vvdpd.exe 4208 5rrfrrx.exe 2816 rrrrxrr.exe 1932 7hhbtn.exe 4968 btnnhb.exe 1308 vpdpp.exe 1964 jdvjv.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2844 wrote to memory of 1724 2844 21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe 84 PID 2844 wrote to memory of 1724 2844 21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe 84 PID 2844 wrote to memory of 1724 2844 21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe 84 PID 1724 wrote to memory of 4056 1724 5hbbtn.exe 85 PID 1724 wrote to memory of 4056 1724 5hbbtn.exe 85 PID 1724 wrote to memory of 4056 1724 5hbbtn.exe 85 PID 4056 wrote to memory of 2420 4056 pppjj.exe 86 PID 4056 wrote to memory of 2420 4056 pppjj.exe 86 PID 4056 wrote to memory of 2420 4056 pppjj.exe 86 PID 2420 wrote to memory of 3748 2420 fffxrrl.exe 87 PID 2420 wrote to memory of 3748 2420 fffxrrl.exe 87 PID 2420 wrote to memory of 3748 2420 fffxrrl.exe 87 PID 3748 wrote to memory of 4748 3748 fxrllfx.exe 88 PID 3748 wrote to memory of 4748 3748 fxrllfx.exe 88 PID 3748 wrote to memory of 4748 3748 fxrllfx.exe 88 PID 4748 wrote to memory of 2396 4748 bhbttt.exe 89 PID 4748 wrote to memory of 2396 4748 bhbttt.exe 89 PID 4748 wrote to memory of 2396 4748 bhbttt.exe 89 PID 2396 wrote to memory of 1472 2396 dvpjv.exe 90 PID 2396 wrote to memory of 1472 2396 dvpjv.exe 90 PID 2396 wrote to memory of 1472 2396 dvpjv.exe 90 PID 1472 wrote to memory of 3944 1472 pjjdv.exe 91 PID 1472 wrote to memory of 3944 1472 pjjdv.exe 91 PID 1472 wrote to memory of 3944 1472 pjjdv.exe 91 PID 3944 wrote to memory of 1436 3944 nbhhtb.exe 92 PID 3944 wrote to memory of 1436 3944 nbhhtb.exe 92 PID 3944 wrote to memory of 1436 3944 nbhhtb.exe 92 PID 1436 wrote to memory of 4128 1436 bhhbnn.exe 93 PID 1436 wrote to memory of 4128 1436 bhhbnn.exe 93 PID 1436 wrote to memory of 4128 1436 bhhbnn.exe 93 PID 4128 wrote to memory of 1708 4128 jpvpd.exe 94 PID 4128 wrote to memory of 1708 4128 jpvpd.exe 94 PID 4128 wrote to memory of 1708 4128 jpvpd.exe 94 PID 1708 wrote to memory of 652 1708 rxfrlfx.exe 95 PID 1708 wrote to memory of 652 1708 rxfrlfx.exe 95 PID 1708 wrote to memory of 652 1708 rxfrlfx.exe 95 PID 652 wrote to memory of 4600 652 lxxrrxr.exe 96 PID 652 wrote to memory of 4600 652 lxxrrxr.exe 96 PID 652 wrote to memory of 4600 652 lxxrrxr.exe 96 PID 4600 wrote to memory of 3040 4600 bnhhtt.exe 97 PID 4600 wrote to memory of 3040 4600 bnhhtt.exe 97 PID 4600 wrote to memory of 3040 4600 bnhhtt.exe 97 PID 3040 wrote to memory of 3184 3040 jvvpj.exe 98 PID 3040 wrote to memory of 3184 3040 jvvpj.exe 98 PID 3040 wrote to memory of 3184 3040 jvvpj.exe 98 PID 3184 wrote to memory of 3840 3184 vppdj.exe 99 PID 3184 wrote to memory of 3840 3184 vppdj.exe 99 PID 3184 wrote to memory of 3840 3184 vppdj.exe 99 PID 3840 wrote to memory of 4960 3840 fffrfrl.exe 100 PID 3840 wrote to memory of 4960 3840 fffrfrl.exe 100 PID 3840 wrote to memory of 4960 3840 fffrfrl.exe 100 PID 4960 wrote to memory of 3104 4960 7nnnnn.exe 101 PID 4960 wrote to memory of 3104 4960 7nnnnn.exe 101 PID 4960 wrote to memory of 3104 4960 7nnnnn.exe 101 PID 3104 wrote to memory of 4328 3104 dppjj.exe 102 PID 3104 wrote to memory of 4328 3104 dppjj.exe 102 PID 3104 wrote to memory of 4328 3104 dppjj.exe 102 PID 4328 wrote to memory of 4660 4328 dvvvp.exe 103 PID 4328 wrote to memory of 4660 4328 dvvvp.exe 103 PID 4328 wrote to memory of 4660 4328 dvvvp.exe 103 PID 4660 wrote to memory of 1256 4660 7xrrlff.exe 104 PID 4660 wrote to memory of 1256 4660 7xrrlff.exe 104 PID 4660 wrote to memory of 1256 4660 7xrrlff.exe 104 PID 1256 wrote to memory of 3676 1256 vjvpp.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe"C:\Users\Admin\AppData\Local\Temp\21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\5hbbtn.exec:\5hbbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\pppjj.exec:\pppjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\fffxrrl.exec:\fffxrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\fxrllfx.exec:\fxrllfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\bhbttt.exec:\bhbttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\dvpjv.exec:\dvpjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\pjjdv.exec:\pjjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\nbhhtb.exec:\nbhhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\bhhbnn.exec:\bhhbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\jpvpd.exec:\jpvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\rxfrlfx.exec:\rxfrlfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\lxxrrxr.exec:\lxxrrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\bnhhtt.exec:\bnhhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\jvvpj.exec:\jvvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\vppdj.exec:\vppdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\fffrfrl.exec:\fffrfrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\7nnnnn.exec:\7nnnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\dppjj.exec:\dppjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\dvvvp.exec:\dvvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\7xrrlff.exec:\7xrrlff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\vjvpp.exec:\vjvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\pjvpj.exec:\pjvpj.exe23⤵
- Executes dropped EXE
PID:3676 -
\??\c:\xllfxxr.exec:\xllfxxr.exe24⤵
- Executes dropped EXE
PID:4936 -
\??\c:\nnhttn.exec:\nnhttn.exe25⤵
- Executes dropped EXE
PID:540 -
\??\c:\htbtnb.exec:\htbtnb.exe26⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pjdvp.exec:\pjdvp.exe27⤵
- Executes dropped EXE
PID:4004 -
\??\c:\rrfxlfx.exec:\rrfxlfx.exe28⤵
- Executes dropped EXE
PID:4928 -
\??\c:\fflxfxr.exec:\fflxfxr.exe29⤵
- Executes dropped EXE
PID:2688 -
\??\c:\btttnn.exec:\btttnn.exe30⤵
- Executes dropped EXE
PID:3984 -
\??\c:\xlllfff.exec:\xlllfff.exe31⤵
- Executes dropped EXE
PID:4668 -
\??\c:\lxrrllx.exec:\lxrrllx.exe32⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hhhbtt.exec:\hhhbtt.exe33⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vpvvd.exec:\vpvvd.exe34⤵
- Executes dropped EXE
PID:3668 -
\??\c:\pjjvd.exec:\pjjvd.exe35⤵
- Executes dropped EXE
PID:1296 -
\??\c:\rxffxxx.exec:\rxffxxx.exe36⤵
- Executes dropped EXE
PID:3112 -
\??\c:\ffrlffx.exec:\ffrlffx.exe37⤵
- Executes dropped EXE
PID:4992 -
\??\c:\ttnnnn.exec:\ttnnnn.exe38⤵
- Executes dropped EXE
PID:4724 -
\??\c:\htbhbh.exec:\htbhbh.exe39⤵
- Executes dropped EXE
PID:4308 -
\??\c:\jvpjd.exec:\jvpjd.exe40⤵
- Executes dropped EXE
PID:2280 -
\??\c:\hbhhbb.exec:\hbhhbb.exe41⤵
- Executes dropped EXE
PID:4204 -
\??\c:\hbhbbh.exec:\hbhbbh.exe42⤵
- Executes dropped EXE
PID:4840 -
\??\c:\vjvvj.exec:\vjvvj.exe43⤵
- Executes dropped EXE
PID:228 -
\??\c:\vvdpv.exec:\vvdpv.exe44⤵
- Executes dropped EXE
PID:400 -
\??\c:\3llxlff.exec:\3llxlff.exe45⤵
- Executes dropped EXE
PID:4820 -
\??\c:\rlffxrr.exec:\rlffxrr.exe46⤵
- Executes dropped EXE
PID:4888 -
\??\c:\3ntbbb.exec:\3ntbbb.exe47⤵
- Executes dropped EXE
PID:5004 -
\??\c:\tbhhbt.exec:\tbhhbt.exe48⤵
- Executes dropped EXE
PID:764 -
\??\c:\xrxrrxx.exec:\xrxrrxx.exe49⤵
- Executes dropped EXE
PID:4920 -
\??\c:\nnnnhh.exec:\nnnnhh.exe50⤵
- Executes dropped EXE
PID:1956 -
\??\c:\ppvvv.exec:\ppvvv.exe51⤵
- Executes dropped EXE
PID:4416 -
\??\c:\1rfxfxr.exec:\1rfxfxr.exe52⤵
- Executes dropped EXE
PID:1884 -
\??\c:\bthbtn.exec:\bthbtn.exe53⤵
- Executes dropped EXE
PID:4284 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe54⤵
- Executes dropped EXE
PID:3636 -
\??\c:\bnhhbb.exec:\bnhhbb.exe55⤵
- Executes dropped EXE
PID:4868 -
\??\c:\jddpd.exec:\jddpd.exe56⤵
- Executes dropped EXE
PID:720 -
\??\c:\xlrrllf.exec:\xlrrllf.exe57⤵
- Executes dropped EXE
PID:5088 -
\??\c:\hhhbnt.exec:\hhhbnt.exe58⤵
- Executes dropped EXE
PID:516 -
\??\c:\vvdpd.exec:\vvdpd.exe59⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5rrfrrx.exec:\5rrfrrx.exe60⤵
- Executes dropped EXE
PID:4208 -
\??\c:\rrrrxrr.exec:\rrrrxrr.exe61⤵
- Executes dropped EXE
PID:2816 -
\??\c:\7hhbtn.exec:\7hhbtn.exe62⤵
- Executes dropped EXE
PID:1932 -
\??\c:\btnnhb.exec:\btnnhb.exe63⤵
- Executes dropped EXE
PID:4968 -
\??\c:\vpdpp.exec:\vpdpp.exe64⤵
- Executes dropped EXE
PID:1308 -
\??\c:\jdvjv.exec:\jdvjv.exe65⤵
- Executes dropped EXE
PID:1964 -
\??\c:\1llfxrl.exec:\1llfxrl.exe66⤵PID:1020
-
\??\c:\hbnhtb.exec:\hbnhtb.exe67⤵PID:2144
-
\??\c:\thhbnb.exec:\thhbnb.exe68⤵PID:4128
-
\??\c:\jjvvv.exec:\jjvvv.exe69⤵PID:976
-
\??\c:\7ffxxxr.exec:\7ffxxxr.exe70⤵PID:380
-
\??\c:\lxxrrfx.exec:\lxxrrfx.exe71⤵PID:3036
-
\??\c:\vdjdp.exec:\vdjdp.exe72⤵PID:5024
-
\??\c:\rfllfff.exec:\rfllfff.exe73⤵PID:4428
-
\??\c:\nhnhbh.exec:\nhnhbh.exe74⤵PID:1928
-
\??\c:\nhhbtt.exec:\nhhbtt.exe75⤵PID:4632
-
\??\c:\pjjvj.exec:\pjjvj.exe76⤵PID:3468
-
\??\c:\pvpjd.exec:\pvpjd.exe77⤵PID:3588
-
\??\c:\3frlxrl.exec:\3frlxrl.exe78⤵PID:2852
-
\??\c:\hnnbbt.exec:\hnnbbt.exe79⤵PID:932
-
\??\c:\htthtn.exec:\htthtn.exe80⤵PID:1628
-
\??\c:\pppjd.exec:\pppjd.exe81⤵PID:2756
-
\??\c:\rxxfrrr.exec:\rxxfrrr.exe82⤵PID:2208
-
\??\c:\xfrlffx.exec:\xfrlffx.exe83⤵PID:2328
-
\??\c:\xfxxrlx.exec:\xfxxrlx.exe84⤵PID:1332
-
\??\c:\5ttttn.exec:\5ttttn.exe85⤵PID:1744
-
\??\c:\dppjv.exec:\dppjv.exe86⤵PID:4404
-
\??\c:\jjpjd.exec:\jjpjd.exe87⤵PID:4384
-
\??\c:\rflfxxr.exec:\rflfxxr.exe88⤵PID:448
-
\??\c:\lflrxxx.exec:\lflrxxx.exe89⤵PID:3672
-
\??\c:\nhbthb.exec:\nhbthb.exe90⤵PID:1156
-
\??\c:\hbtnnn.exec:\hbtnnn.exe91⤵PID:4388
-
\??\c:\dvjdd.exec:\dvjdd.exe92⤵PID:4524
-
\??\c:\pdjjj.exec:\pdjjj.exe93⤵PID:4092
-
\??\c:\rllfxrl.exec:\rllfxrl.exe94⤵PID:4164
-
\??\c:\rxxrlrl.exec:\rxxrlrl.exe95⤵PID:3984
-
\??\c:\bhhhhb.exec:\bhhhhb.exe96⤵PID:4812
-
\??\c:\bhnhbt.exec:\bhnhbt.exe97⤵PID:1188
-
\??\c:\ppjjd.exec:\ppjjd.exe98⤵PID:4892
-
\??\c:\vpdvv.exec:\vpdvv.exe99⤵PID:1012
-
\??\c:\3lrrffl.exec:\3lrrffl.exe100⤵PID:2548
-
\??\c:\xfxxrrl.exec:\xfxxrrl.exe101⤵PID:1876
-
\??\c:\5nttht.exec:\5nttht.exe102⤵PID:4828
-
\??\c:\5dpjj.exec:\5dpjj.exe103⤵PID:4816
-
\??\c:\dvvpd.exec:\dvvpd.exe104⤵PID:3516
-
\??\c:\lrlfxxr.exec:\lrlfxxr.exe105⤵PID:4184
-
\??\c:\tttnhb.exec:\tttnhb.exe106⤵PID:1736
-
\??\c:\hhhbnn.exec:\hhhbnn.exe107⤵PID:1988
-
\??\c:\jppjv.exec:\jppjv.exe108⤵PID:3452
-
\??\c:\dvjdv.exec:\dvjdv.exe109⤵PID:208
-
\??\c:\3lffxrr.exec:\3lffxrr.exe110⤵PID:400
-
\??\c:\btnbbt.exec:\btnbbt.exe111⤵PID:4768
-
\??\c:\1hbtht.exec:\1hbtht.exe112⤵PID:3148
-
\??\c:\9ppjd.exec:\9ppjd.exe113⤵PID:3712
-
\??\c:\jvdvp.exec:\jvdvp.exe114⤵PID:3376
-
\??\c:\lxxrllf.exec:\lxxrllf.exe115⤵PID:940
-
\??\c:\9fxxllf.exec:\9fxxllf.exe116⤵PID:944
-
\??\c:\thhbtn.exec:\thhbtn.exe117⤵PID:2876
-
\??\c:\bhthtt.exec:\bhthtt.exe118⤵PID:4360
-
\??\c:\pvjdp.exec:\pvjdp.exe119⤵PID:2040
-
\??\c:\vjdvj.exec:\vjdvj.exe120⤵PID:3124
-
\??\c:\1fffxrr.exec:\1fffxrr.exe121⤵PID:5032
-
\??\c:\nhhbnh.exec:\nhhbnh.exe122⤵PID:116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-