Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 21:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01N.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01N.exe
-
Size
79KB
-
MD5
c7f3544c6cb49e9b7e6290069813b5b0
-
SHA1
984448f3a738ed2d811de5f4addfe0e77c813f9c
-
SHA256
93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01
-
SHA512
de3f47d691d41493493ed986cc67a0ec84749541a7934efb909bd7aa9e7c0504fa07000e3f3ee2dc366ac61b0728a429f0636e3cf08a7c507fcf69a3992bdf02
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5bx7DUQeDac7Akc:0cdpeeBSHHMHLf9Rybx7DYec7Fc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/400-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-335-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-353-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-364-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-368-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-387-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/952-391-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-426-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-467-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-482-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-513-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-517-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-540-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-592-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-707-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-741-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-760-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-813-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-936-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3368 vvvjv.exe 3704 fxlxfrf.exe 4516 xrrfrlx.exe 4164 nttnbn.exe 4168 7flxfrf.exe 820 lfflxrf.exe 5068 nhbtbb.exe 3576 jpvdp.exe 4848 fxrflfr.exe 2580 rxfffll.exe 4448 jvvjj.exe 2692 5vdpp.exe 3948 flfrrxf.exe 4708 5bbtbn.exe 2916 bthtnh.exe 1616 jvpjv.exe 4980 xflfxrl.exe 3960 1bbbtb.exe 1500 pjvjp.exe 2880 rflfrrx.exe 1236 nhhbhb.exe 1128 vppdd.exe 4320 pjpjd.exe 4112 jdjdj.exe 1692 xlrlrlf.exe 2284 nbbttt.exe 2040 hbttnh.exe 5016 frfxfxf.exe 4660 xlfrlxr.exe 1644 htntnh.exe 4612 vjdvj.exe 4904 rlfxffr.exe 4984 lxxrlrf.exe 924 htbbtb.exe 2244 jdvjd.exe 2168 vdjdp.exe 4244 fxfxxxr.exe 1660 9fllfxx.exe 1852 3nnhbb.exe 2084 vjpdp.exe 4504 7xrfrfr.exe 4104 fxfxxrr.exe 4728 lfxrfxr.exe 2888 bthhbt.exe 312 dvdvp.exe 4944 jdvpd.exe 3996 xrxxxff.exe 392 7fxlxrf.exe 3548 1hhtnh.exe 1664 nnhthb.exe 1772 dvvjv.exe 860 jdjvj.exe 1564 lrrlrlx.exe 4484 xfffrlx.exe 1856 hhthtn.exe 400 tbbhtn.exe 828 jdppj.exe 5060 jppjp.exe 5088 frrfrfr.exe 664 frlxrlx.exe 4164 bthbnh.exe 2392 bthhtn.exe 3536 9vjdj.exe 4192 xfrxlxr.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 400 wrote to memory of 3368 400 93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01N.exe 82 PID 400 wrote to memory of 3368 400 93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01N.exe 82 PID 400 wrote to memory of 3368 400 93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01N.exe 82 PID 3368 wrote to memory of 3704 3368 vvvjv.exe 83 PID 3368 wrote to memory of 3704 3368 vvvjv.exe 83 PID 3368 wrote to memory of 3704 3368 vvvjv.exe 83 PID 3704 wrote to memory of 4516 3704 fxlxfrf.exe 84 PID 3704 wrote to memory of 4516 3704 fxlxfrf.exe 84 PID 3704 wrote to memory of 4516 3704 fxlxfrf.exe 84 PID 4516 wrote to memory of 4164 4516 xrrfrlx.exe 85 PID 4516 wrote to memory of 4164 4516 xrrfrlx.exe 85 PID 4516 wrote to memory of 4164 4516 xrrfrlx.exe 85 PID 4164 wrote to memory of 4168 4164 nttnbn.exe 86 PID 4164 wrote to memory of 4168 4164 nttnbn.exe 86 PID 4164 wrote to memory of 4168 4164 nttnbn.exe 86 PID 4168 wrote to memory of 820 4168 7flxfrf.exe 87 PID 4168 wrote to memory of 820 4168 7flxfrf.exe 87 PID 4168 wrote to memory of 820 4168 7flxfrf.exe 87 PID 820 wrote to memory of 5068 820 lfflxrf.exe 88 PID 820 wrote to memory of 5068 820 lfflxrf.exe 88 PID 820 wrote to memory of 5068 820 lfflxrf.exe 88 PID 5068 wrote to memory of 3576 5068 nhbtbb.exe 89 PID 5068 wrote to memory of 3576 5068 nhbtbb.exe 89 PID 5068 wrote to memory of 3576 5068 nhbtbb.exe 89 PID 3576 wrote to memory of 4848 3576 jpvdp.exe 90 PID 3576 wrote to memory of 4848 3576 jpvdp.exe 90 PID 3576 wrote to memory of 4848 3576 jpvdp.exe 90 PID 4848 wrote to memory of 2580 4848 fxrflfr.exe 91 PID 4848 wrote to memory of 2580 4848 fxrflfr.exe 91 PID 4848 wrote to memory of 2580 4848 fxrflfr.exe 91 PID 2580 wrote to memory of 4448 2580 rxfffll.exe 92 PID 2580 wrote to memory of 4448 2580 rxfffll.exe 92 PID 2580 wrote to memory of 4448 2580 rxfffll.exe 92 PID 4448 wrote to memory of 2692 4448 jvvjj.exe 93 PID 4448 wrote to memory of 2692 4448 jvvjj.exe 93 PID 4448 wrote to memory of 2692 4448 jvvjj.exe 93 PID 2692 wrote to memory of 3948 2692 5vdpp.exe 94 PID 2692 wrote to memory of 3948 2692 5vdpp.exe 94 PID 2692 wrote to memory of 3948 2692 5vdpp.exe 94 PID 3948 wrote to memory of 4708 3948 flfrrxf.exe 95 PID 3948 wrote to memory of 4708 3948 flfrrxf.exe 95 PID 3948 wrote to memory of 4708 3948 flfrrxf.exe 95 PID 4708 wrote to memory of 2916 4708 5bbtbn.exe 96 PID 4708 wrote to memory of 2916 4708 5bbtbn.exe 96 PID 4708 wrote to memory of 2916 4708 5bbtbn.exe 96 PID 2916 wrote to memory of 1616 2916 bthtnh.exe 97 PID 2916 wrote to memory of 1616 2916 bthtnh.exe 97 PID 2916 wrote to memory of 1616 2916 bthtnh.exe 97 PID 1616 wrote to memory of 4980 1616 jvpjv.exe 98 PID 1616 wrote to memory of 4980 1616 jvpjv.exe 98 PID 1616 wrote to memory of 4980 1616 jvpjv.exe 98 PID 4980 wrote to memory of 3960 4980 xflfxrl.exe 99 PID 4980 wrote to memory of 3960 4980 xflfxrl.exe 99 PID 4980 wrote to memory of 3960 4980 xflfxrl.exe 99 PID 3960 wrote to memory of 1500 3960 1bbbtb.exe 100 PID 3960 wrote to memory of 1500 3960 1bbbtb.exe 100 PID 3960 wrote to memory of 1500 3960 1bbbtb.exe 100 PID 1500 wrote to memory of 2880 1500 pjvjp.exe 101 PID 1500 wrote to memory of 2880 1500 pjvjp.exe 101 PID 1500 wrote to memory of 2880 1500 pjvjp.exe 101 PID 2880 wrote to memory of 1236 2880 rflfrrx.exe 102 PID 2880 wrote to memory of 1236 2880 rflfrrx.exe 102 PID 2880 wrote to memory of 1236 2880 rflfrrx.exe 102 PID 1236 wrote to memory of 1128 1236 nhhbhb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01N.exe"C:\Users\Admin\AppData\Local\Temp\93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\vvvjv.exec:\vvvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\fxlxfrf.exec:\fxlxfrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\xrrfrlx.exec:\xrrfrlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\nttnbn.exec:\nttnbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\7flxfrf.exec:\7flxfrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\lfflxrf.exec:\lfflxrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\nhbtbb.exec:\nhbtbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\jpvdp.exec:\jpvdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\fxrflfr.exec:\fxrflfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\rxfffll.exec:\rxfffll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\jvvjj.exec:\jvvjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\5vdpp.exec:\5vdpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\flfrrxf.exec:\flfrrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\5bbtbn.exec:\5bbtbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\bthtnh.exec:\bthtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\jvpjv.exec:\jvpjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\xflfxrl.exec:\xflfxrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\1bbbtb.exec:\1bbbtb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\pjvjp.exec:\pjvjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\rflfrrx.exec:\rflfrrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\nhhbhb.exec:\nhhbhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\vppdd.exec:\vppdd.exe23⤵
- Executes dropped EXE
PID:1128 -
\??\c:\pjpjd.exec:\pjpjd.exe24⤵
- Executes dropped EXE
PID:4320 -
\??\c:\jdjdj.exec:\jdjdj.exe25⤵
- Executes dropped EXE
PID:4112 -
\??\c:\xlrlrlf.exec:\xlrlrlf.exe26⤵
- Executes dropped EXE
PID:1692 -
\??\c:\nbbttt.exec:\nbbttt.exe27⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hbttnh.exec:\hbttnh.exe28⤵
- Executes dropped EXE
PID:2040 -
\??\c:\frfxfxf.exec:\frfxfxf.exe29⤵
- Executes dropped EXE
PID:5016 -
\??\c:\xlfrlxr.exec:\xlfrlxr.exe30⤵
- Executes dropped EXE
PID:4660 -
\??\c:\htntnh.exec:\htntnh.exe31⤵
- Executes dropped EXE
PID:1644 -
\??\c:\vjdvj.exec:\vjdvj.exe32⤵
- Executes dropped EXE
PID:4612 -
\??\c:\rlfxffr.exec:\rlfxffr.exe33⤵
- Executes dropped EXE
PID:4904 -
\??\c:\lxxrlrf.exec:\lxxrlrf.exe34⤵
- Executes dropped EXE
PID:4984 -
\??\c:\htbbtb.exec:\htbbtb.exe35⤵
- Executes dropped EXE
PID:924 -
\??\c:\jdvjd.exec:\jdvjd.exe36⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vdjdp.exec:\vdjdp.exe37⤵
- Executes dropped EXE
PID:2168 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe38⤵
- Executes dropped EXE
PID:4244 -
\??\c:\9fllfxx.exec:\9fllfxx.exe39⤵
- Executes dropped EXE
PID:1660 -
\??\c:\3nnhbb.exec:\3nnhbb.exe40⤵
- Executes dropped EXE
PID:1852 -
\??\c:\vjpdp.exec:\vjpdp.exe41⤵
- Executes dropped EXE
PID:2084 -
\??\c:\7xrfrfr.exec:\7xrfrfr.exe42⤵
- Executes dropped EXE
PID:4504 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe43⤵
- Executes dropped EXE
PID:4104 -
\??\c:\lfxrfxr.exec:\lfxrfxr.exe44⤵
- Executes dropped EXE
PID:4728 -
\??\c:\bthhbt.exec:\bthhbt.exe45⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dvdvp.exec:\dvdvp.exe46⤵
- Executes dropped EXE
PID:312 -
\??\c:\jdvpd.exec:\jdvpd.exe47⤵
- Executes dropped EXE
PID:4944 -
\??\c:\xrxxxff.exec:\xrxxxff.exe48⤵
- Executes dropped EXE
PID:3996 -
\??\c:\7fxlxrf.exec:\7fxlxrf.exe49⤵
- Executes dropped EXE
PID:392 -
\??\c:\1hhtnh.exec:\1hhtnh.exe50⤵
- Executes dropped EXE
PID:3548 -
\??\c:\nnhthb.exec:\nnhthb.exe51⤵
- Executes dropped EXE
PID:1664 -
\??\c:\dvvjv.exec:\dvvjv.exe52⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jdjvj.exec:\jdjvj.exe53⤵
- Executes dropped EXE
PID:860 -
\??\c:\lrrlrlx.exec:\lrrlrlx.exe54⤵
- Executes dropped EXE
PID:1564 -
\??\c:\xfffrlx.exec:\xfffrlx.exe55⤵
- Executes dropped EXE
PID:4484 -
\??\c:\hhthtn.exec:\hhthtn.exe56⤵
- Executes dropped EXE
PID:1856 -
\??\c:\tbbhtn.exec:\tbbhtn.exe57⤵
- Executes dropped EXE
PID:400 -
\??\c:\jdppj.exec:\jdppj.exe58⤵
- Executes dropped EXE
PID:828 -
\??\c:\jppjp.exec:\jppjp.exe59⤵
- Executes dropped EXE
PID:5060 -
\??\c:\frrfrfr.exec:\frrfrfr.exe60⤵
- Executes dropped EXE
PID:5088 -
\??\c:\frlxrlx.exec:\frlxrlx.exe61⤵
- Executes dropped EXE
PID:664 -
\??\c:\bthbnh.exec:\bthbnh.exe62⤵
- Executes dropped EXE
PID:4164 -
\??\c:\bthhtn.exec:\bthhtn.exe63⤵
- Executes dropped EXE
PID:2392 -
\??\c:\9vjdj.exec:\9vjdj.exe64⤵
- Executes dropped EXE
PID:3536 -
\??\c:\xfrxlxr.exec:\xfrxlxr.exe65⤵
- Executes dropped EXE
PID:4192 -
\??\c:\lrxrffx.exec:\lrxrffx.exe66⤵PID:5068
-
\??\c:\thhthb.exec:\thhthb.exe67⤵PID:2528
-
\??\c:\dppdp.exec:\dppdp.exe68⤵PID:2552
-
\??\c:\dvdpv.exec:\dvdpv.exe69⤵PID:1560
-
\??\c:\fxxlfxx.exec:\fxxlfxx.exe70⤵PID:4364
-
\??\c:\5rxlxrf.exec:\5rxlxrf.exe71⤵PID:5044
-
\??\c:\hnnbnb.exec:\hnnbnb.exe72⤵PID:1244
-
\??\c:\bbbbnh.exec:\bbbbnh.exe73⤵PID:2212
-
\??\c:\pddvj.exec:\pddvj.exe74⤵PID:3132
-
\??\c:\dvjdj.exec:\dvjdj.exe75⤵PID:2196
-
\??\c:\5llxfxl.exec:\5llxfxl.exe76⤵PID:912
-
\??\c:\lxfxlfr.exec:\lxfxlfr.exe77⤵PID:3356
-
\??\c:\hhbhbt.exec:\hhbhbt.exe78⤵PID:5048
-
\??\c:\nbbnbt.exec:\nbbnbt.exe79⤵PID:2220
-
\??\c:\dvjvj.exec:\dvjvj.exe80⤵PID:908
-
\??\c:\ppvpd.exec:\ppvpd.exe81⤵PID:2640
-
\??\c:\lrrlrlf.exec:\lrrlrlf.exe82⤵PID:824
-
\??\c:\hhnhtn.exec:\hhnhtn.exe83⤵PID:1468
-
\??\c:\nhhnbt.exec:\nhhnbt.exe84⤵PID:2068
-
\??\c:\vjjvd.exec:\vjjvd.exe85⤵PID:4692
-
\??\c:\vpjdp.exec:\vpjdp.exe86⤵PID:3364
-
\??\c:\pvvjv.exec:\pvvjv.exe87⤵PID:3516
-
\??\c:\5ffxfrf.exec:\5ffxfrf.exe88⤵PID:4144
-
\??\c:\rlffxxr.exec:\rlffxxr.exe89⤵PID:2028
-
\??\c:\rffxrfx.exec:\rffxrfx.exe90⤵PID:4424
-
\??\c:\nbtnbt.exec:\nbtnbt.exe91⤵PID:4920
-
\??\c:\bbbntb.exec:\bbbntb.exe92⤵PID:3128
-
\??\c:\vpjvd.exec:\vpjvd.exe93⤵PID:952
-
\??\c:\fxrlrlf.exec:\fxrlrlf.exe94⤵PID:2224
-
\??\c:\fxfrlrl.exec:\fxfrlrl.exe95⤵PID:3056
-
\??\c:\nbbhbh.exec:\nbbhbh.exe96⤵PID:1584
-
\??\c:\pdvpv.exec:\pdvpv.exe97⤵PID:3584
-
\??\c:\lffrlfl.exec:\lffrlfl.exe98⤵PID:2448
-
\??\c:\xfllrrl.exec:\xfllrrl.exe99⤵PID:2848
-
\??\c:\ntttnt.exec:\ntttnt.exe100⤵PID:4568
-
\??\c:\thbnbt.exec:\thbnbt.exe101⤵PID:3700
-
\??\c:\pvvjp.exec:\pvvjp.exe102⤵PID:1188
-
\??\c:\jdvjd.exec:\jdvjd.exe103⤵PID:3332
-
\??\c:\9lrlfff.exec:\9lrlfff.exe104⤵PID:2260
-
\??\c:\xllfxrr.exec:\xllfxrr.exe105⤵PID:5036
-
\??\c:\hhhbbt.exec:\hhhbbt.exe106⤵PID:3792
-
\??\c:\jvvjd.exec:\jvvjd.exe107⤵PID:4648
-
\??\c:\jvvvd.exec:\jvvvd.exe108⤵PID:2456
-
\??\c:\rrfxlfr.exec:\rrfxlfr.exe109⤵PID:4696
-
\??\c:\3flrxlr.exec:\3flrxlr.exe110⤵PID:4936
-
\??\c:\thntth.exec:\thntth.exe111⤵PID:4832
-
\??\c:\hbbntn.exec:\hbbntn.exe112⤵PID:560
-
\??\c:\3pjdj.exec:\3pjdj.exe113⤵PID:1324
-
\??\c:\jppdj.exec:\jppdj.exe114⤵PID:2312
-
\??\c:\rlrffff.exec:\rlrffff.exe115⤵PID:2864
-
\??\c:\fxlfxrr.exec:\fxlfxrr.exe116⤵PID:3008
-
\??\c:\tnbthb.exec:\tnbthb.exe117⤵PID:1424
-
\??\c:\bbbtbb.exec:\bbbtbb.exe118⤵PID:3548
-
\??\c:\pddpj.exec:\pddpj.exe119⤵PID:4964
-
\??\c:\dvjvd.exec:\dvjvd.exe120⤵PID:732
-
\??\c:\fxfrxlr.exec:\fxfrxlr.exe121⤵PID:2292
-
\??\c:\lxxlxrl.exec:\lxxlxrl.exe122⤵PID:4608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-