Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe
Resource
win7-20240708-en
6 signatures
150 seconds
General
-
Target
6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe
-
Size
911KB
-
MD5
a7c13c67f5de73babde428bc0e05dbf4
-
SHA1
3d8a9529529ec44fc8ab1efa76f28423f6353f8a
-
SHA256
6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071
-
SHA512
6e1a7836076bc960a0d1d204f0cf3e03658ca19aecf1d93ea22601edd7b4f097c869e12dbe42992544c341bf5d9208b87e30dceb4fa2625a97068392da23948c
-
SSDEEP
24576:OY+UB5TsjZ03clghyKm1QgRHYKPUQ4U3yzZy5gFxopB:OUbAjZ035mMOyDFxon
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2988-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3312-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/740-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2344-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1848-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1332-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2260-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1904-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1556-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2628-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4192-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4176-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3468-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/820-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1568-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/556-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/832-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1808-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1256-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/556-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2540-569-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-894-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-952-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-1315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4188 nhbtnh.exe 4736 9hbnhh.exe 2064 3xfrrxl.exe 3312 flxllxl.exe 4568 dpjdv.exe 740 tbbthb.exe 2344 llxlfxl.exe 4584 xlfrfxl.exe 1848 bhbthb.exe 2060 9ddpv.exe 1332 bbbbnt.exe 4428 rfxlrlr.exe 4224 tbbthb.exe 1476 vvpjj.exe 2260 xrllxlf.exe 1904 pdjvp.exe 1684 lrxrlfx.exe 1556 nbbthb.exe 2628 frlfrlf.exe 1516 tnthbt.exe 3992 vjjvd.exe 3148 tttthb.exe 4860 1rfrffr.exe 3236 pjdvj.exe 4956 7fffrrf.exe 3228 bnthbb.exe 1404 vjdpp.exe 4192 bthbnt.exe 396 fllfxxr.exe 1512 btnhhb.exe 2568 pjjdp.exe 3340 xfrllff.exe 2332 ntnhnn.exe 2144 1jpjj.exe 4176 rffxrrl.exe 756 nntttt.exe 3468 9dvpv.exe 4420 rfxrffr.exe 2912 tnnhhb.exe 820 7vvpj.exe 872 fffrlfx.exe 1568 hbhtnh.exe 4440 hnnbhb.exe 556 xffxrrr.exe 3948 7hbhbh.exe 832 hbnhbt.exe 112 pjjvj.exe 1808 rlrfxxl.exe 4148 tnhbbt.exe 1256 1xfxrff.exe 3536 bnnhtn.exe 1384 ppppp.exe 1468 5pvpj.exe 4616 pddvp.exe 2584 fllfflf.exe 4936 3bttbb.exe 4312 jpvpp.exe 2268 ffrflll.exe 3668 htbthh.exe 3588 3ddvp.exe 3444 nhnhhb.exe 3420 btnbtt.exe 2644 frrfrrl.exe 1616 7hhbth.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2988 wrote to memory of 4188 2988 6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe 82 PID 2988 wrote to memory of 4188 2988 6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe 82 PID 2988 wrote to memory of 4188 2988 6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe 82 PID 4188 wrote to memory of 4736 4188 nhbtnh.exe 83 PID 4188 wrote to memory of 4736 4188 nhbtnh.exe 83 PID 4188 wrote to memory of 4736 4188 nhbtnh.exe 83 PID 4736 wrote to memory of 2064 4736 9hbnhh.exe 84 PID 4736 wrote to memory of 2064 4736 9hbnhh.exe 84 PID 4736 wrote to memory of 2064 4736 9hbnhh.exe 84 PID 2064 wrote to memory of 3312 2064 3xfrrxl.exe 85 PID 2064 wrote to memory of 3312 2064 3xfrrxl.exe 85 PID 2064 wrote to memory of 3312 2064 3xfrrxl.exe 85 PID 3312 wrote to memory of 4568 3312 flxllxl.exe 86 PID 3312 wrote to memory of 4568 3312 flxllxl.exe 86 PID 3312 wrote to memory of 4568 3312 flxllxl.exe 86 PID 4568 wrote to memory of 740 4568 dpjdv.exe 87 PID 4568 wrote to memory of 740 4568 dpjdv.exe 87 PID 4568 wrote to memory of 740 4568 dpjdv.exe 87 PID 740 wrote to memory of 2344 740 tbbthb.exe 88 PID 740 wrote to memory of 2344 740 tbbthb.exe 88 PID 740 wrote to memory of 2344 740 tbbthb.exe 88 PID 2344 wrote to memory of 4584 2344 llxlfxl.exe 89 PID 2344 wrote to memory of 4584 2344 llxlfxl.exe 89 PID 2344 wrote to memory of 4584 2344 llxlfxl.exe 89 PID 4584 wrote to memory of 1848 4584 xlfrfxl.exe 90 PID 4584 wrote to memory of 1848 4584 xlfrfxl.exe 90 PID 4584 wrote to memory of 1848 4584 xlfrfxl.exe 90 PID 1848 wrote to memory of 2060 1848 bhbthb.exe 91 PID 1848 wrote to memory of 2060 1848 bhbthb.exe 91 PID 1848 wrote to memory of 2060 1848 bhbthb.exe 91 PID 2060 wrote to memory of 1332 2060 9ddpv.exe 92 PID 2060 wrote to memory of 1332 2060 9ddpv.exe 92 PID 2060 wrote to memory of 1332 2060 9ddpv.exe 92 PID 1332 wrote to memory of 4428 1332 bbbbnt.exe 93 PID 1332 wrote to memory of 4428 1332 bbbbnt.exe 93 PID 1332 wrote to memory of 4428 1332 bbbbnt.exe 93 PID 4428 wrote to memory of 4224 4428 rfxlrlr.exe 94 PID 4428 wrote to memory of 4224 4428 rfxlrlr.exe 94 PID 4428 wrote to memory of 4224 4428 rfxlrlr.exe 94 PID 4224 wrote to memory of 1476 4224 tbbthb.exe 95 PID 4224 wrote to memory of 1476 4224 tbbthb.exe 95 PID 4224 wrote to memory of 1476 4224 tbbthb.exe 95 PID 1476 wrote to memory of 2260 1476 vvpjj.exe 96 PID 1476 wrote to memory of 2260 1476 vvpjj.exe 96 PID 1476 wrote to memory of 2260 1476 vvpjj.exe 96 PID 2260 wrote to memory of 1904 2260 xrllxlf.exe 97 PID 2260 wrote to memory of 1904 2260 xrllxlf.exe 97 PID 2260 wrote to memory of 1904 2260 xrllxlf.exe 97 PID 1904 wrote to memory of 1684 1904 pdjvp.exe 98 PID 1904 wrote to memory of 1684 1904 pdjvp.exe 98 PID 1904 wrote to memory of 1684 1904 pdjvp.exe 98 PID 1684 wrote to memory of 1556 1684 lrxrlfx.exe 99 PID 1684 wrote to memory of 1556 1684 lrxrlfx.exe 99 PID 1684 wrote to memory of 1556 1684 lrxrlfx.exe 99 PID 1556 wrote to memory of 2628 1556 nbbthb.exe 100 PID 1556 wrote to memory of 2628 1556 nbbthb.exe 100 PID 1556 wrote to memory of 2628 1556 nbbthb.exe 100 PID 2628 wrote to memory of 1516 2628 frlfrlf.exe 101 PID 2628 wrote to memory of 1516 2628 frlfrlf.exe 101 PID 2628 wrote to memory of 1516 2628 frlfrlf.exe 101 PID 1516 wrote to memory of 3992 1516 tnthbt.exe 102 PID 1516 wrote to memory of 3992 1516 tnthbt.exe 102 PID 1516 wrote to memory of 3992 1516 tnthbt.exe 102 PID 3992 wrote to memory of 3148 3992 vjjvd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe"C:\Users\Admin\AppData\Local\Temp\6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\nhbtnh.exec:\nhbtnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\9hbnhh.exec:\9hbnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\3xfrrxl.exec:\3xfrrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\flxllxl.exec:\flxllxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\dpjdv.exec:\dpjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\tbbthb.exec:\tbbthb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\llxlfxl.exec:\llxlfxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\bhbthb.exec:\bhbthb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\9ddpv.exec:\9ddpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\bbbbnt.exec:\bbbbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\rfxlrlr.exec:\rfxlrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\tbbthb.exec:\tbbthb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\vvpjj.exec:\vvpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\xrllxlf.exec:\xrllxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\pdjvp.exec:\pdjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\nbbthb.exec:\nbbthb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\frlfrlf.exec:\frlfrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\tnthbt.exec:\tnthbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\vjjvd.exec:\vjjvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\tttthb.exec:\tttthb.exe23⤵
- Executes dropped EXE
PID:3148 -
\??\c:\1rfrffr.exec:\1rfrffr.exe24⤵
- Executes dropped EXE
PID:4860 -
\??\c:\pjdvj.exec:\pjdvj.exe25⤵
- Executes dropped EXE
PID:3236 -
\??\c:\7fffrrf.exec:\7fffrrf.exe26⤵
- Executes dropped EXE
PID:4956 -
\??\c:\bnthbb.exec:\bnthbb.exe27⤵
- Executes dropped EXE
PID:3228 -
\??\c:\vjdpp.exec:\vjdpp.exe28⤵
- Executes dropped EXE
PID:1404 -
\??\c:\bthbnt.exec:\bthbnt.exe29⤵
- Executes dropped EXE
PID:4192 -
\??\c:\fllfxxr.exec:\fllfxxr.exe30⤵
- Executes dropped EXE
PID:396 -
\??\c:\btnhhb.exec:\btnhhb.exe31⤵
- Executes dropped EXE
PID:1512 -
\??\c:\pjjdp.exec:\pjjdp.exe32⤵
- Executes dropped EXE
PID:2568 -
\??\c:\xfrllff.exec:\xfrllff.exe33⤵
- Executes dropped EXE
PID:3340 -
\??\c:\ntnhnn.exec:\ntnhnn.exe34⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1jpjj.exec:\1jpjj.exe35⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rffxrrl.exec:\rffxrrl.exe36⤵
- Executes dropped EXE
PID:4176 -
\??\c:\nntttt.exec:\nntttt.exe37⤵
- Executes dropped EXE
PID:756 -
\??\c:\9dvpv.exec:\9dvpv.exe38⤵
- Executes dropped EXE
PID:3468 -
\??\c:\rfxrffr.exec:\rfxrffr.exe39⤵
- Executes dropped EXE
PID:4420 -
\??\c:\tnnhhb.exec:\tnnhhb.exe40⤵
- Executes dropped EXE
PID:2912 -
\??\c:\7vvpj.exec:\7vvpj.exe41⤵
- Executes dropped EXE
PID:820 -
\??\c:\fffrlfx.exec:\fffrlfx.exe42⤵
- Executes dropped EXE
PID:872 -
\??\c:\hbhtnh.exec:\hbhtnh.exe43⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hnnbhb.exec:\hnnbhb.exe44⤵
- Executes dropped EXE
PID:4440 -
\??\c:\xffxrrr.exec:\xffxrrr.exe45⤵
- Executes dropped EXE
PID:556 -
\??\c:\7hbhbh.exec:\7hbhbh.exe46⤵
- Executes dropped EXE
PID:3948 -
\??\c:\hbnhbt.exec:\hbnhbt.exe47⤵
- Executes dropped EXE
PID:832 -
\??\c:\pjjvj.exec:\pjjvj.exe48⤵
- Executes dropped EXE
PID:112 -
\??\c:\rlrfxxl.exec:\rlrfxxl.exe49⤵
- Executes dropped EXE
PID:1808 -
\??\c:\tnhbbt.exec:\tnhbbt.exe50⤵
- Executes dropped EXE
PID:4148 -
\??\c:\1xfxrff.exec:\1xfxrff.exe51⤵
- Executes dropped EXE
PID:1256 -
\??\c:\bnnhtn.exec:\bnnhtn.exe52⤵
- Executes dropped EXE
PID:3536 -
\??\c:\ppppp.exec:\ppppp.exe53⤵
- Executes dropped EXE
PID:1384 -
\??\c:\5pvpj.exec:\5pvpj.exe54⤵
- Executes dropped EXE
PID:1468 -
\??\c:\pddvp.exec:\pddvp.exe55⤵
- Executes dropped EXE
PID:4616 -
\??\c:\fllfflf.exec:\fllfflf.exe56⤵
- Executes dropped EXE
PID:2584 -
\??\c:\3bttbb.exec:\3bttbb.exe57⤵
- Executes dropped EXE
PID:4936 -
\??\c:\jpvpp.exec:\jpvpp.exe58⤵
- Executes dropped EXE
PID:4312 -
\??\c:\ffrflll.exec:\ffrflll.exe59⤵
- Executes dropped EXE
PID:2268 -
\??\c:\htbthh.exec:\htbthh.exe60⤵
- Executes dropped EXE
PID:3668 -
\??\c:\3ddvp.exec:\3ddvp.exe61⤵
- Executes dropped EXE
PID:3588 -
\??\c:\nhnhhb.exec:\nhnhhb.exe62⤵
- Executes dropped EXE
PID:3444 -
\??\c:\btnbtt.exec:\btnbtt.exe63⤵
- Executes dropped EXE
PID:3420 -
\??\c:\frrfrrl.exec:\frrfrrl.exe64⤵
- Executes dropped EXE
PID:2644 -
\??\c:\7hhbth.exec:\7hhbth.exe65⤵
- Executes dropped EXE
PID:1616 -
\??\c:\pvdpp.exec:\pvdpp.exe66⤵PID:2252
-
\??\c:\1xrlfxr.exec:\1xrlfxr.exe67⤵PID:228
-
\??\c:\tbbhtn.exec:\tbbhtn.exe68⤵PID:1904
-
\??\c:\jvvpj.exec:\jvvpj.exe69⤵PID:2872
-
\??\c:\flrlfxr.exec:\flrlfxr.exe70⤵PID:4676
-
\??\c:\7thbbb.exec:\7thbbb.exe71⤵PID:2852
-
\??\c:\jdjvv.exec:\jdjvv.exe72⤵PID:1156
-
\??\c:\flrlfff.exec:\flrlfff.exe73⤵PID:1076
-
\??\c:\tbtnbt.exec:\tbtnbt.exe74⤵PID:4588
-
\??\c:\pjpjd.exec:\pjpjd.exe75⤵PID:5024
-
\??\c:\7rlfxxf.exec:\7rlfxxf.exe76⤵PID:2008
-
\??\c:\nbbthh.exec:\nbbthh.exe77⤵
- System Location Discovery: System Language Discovery
PID:4128 -
\??\c:\9vdvj.exec:\9vdvj.exe78⤵PID:3220
-
\??\c:\7hhthh.exec:\7hhthh.exe79⤵PID:3548
-
\??\c:\pjjpj.exec:\pjjpj.exe80⤵PID:3076
-
\??\c:\lrlrlfx.exec:\lrlrlfx.exe81⤵PID:2176
-
\??\c:\3jdvp.exec:\3jdvp.exe82⤵PID:4080
-
\??\c:\5xfxrxr.exec:\5xfxrxr.exe83⤵PID:1672
-
\??\c:\hnbthb.exec:\hnbthb.exe84⤵PID:4500
-
\??\c:\vpvpp.exec:\vpvpp.exe85⤵
- System Location Discovery: System Language Discovery
PID:2440 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe86⤵PID:2784
-
\??\c:\bnnbbt.exec:\bnnbbt.exe87⤵PID:2764
-
\??\c:\jvvvd.exec:\jvvvd.exe88⤵PID:4292
-
\??\c:\rrrfxll.exec:\rrrfxll.exe89⤵PID:3340
-
\??\c:\nhbbtn.exec:\nhbbtn.exe90⤵PID:8
-
\??\c:\flrlfxr.exec:\flrlfxr.exe91⤵PID:1500
-
\??\c:\nnhttt.exec:\nnhttt.exe92⤵PID:1160
-
\??\c:\jdvjd.exec:\jdvjd.exe93⤵PID:2868
-
\??\c:\9xxxrxr.exec:\9xxxrxr.exe94⤵PID:756
-
\??\c:\bttnbh.exec:\bttnbh.exe95⤵PID:1080
-
\??\c:\pvvpj.exec:\pvvpj.exe96⤵
- System Location Discovery: System Language Discovery
PID:4420 -
\??\c:\frlfxrr.exec:\frlfxrr.exe97⤵PID:2912
-
\??\c:\5htnnn.exec:\5htnnn.exe98⤵PID:820
-
\??\c:\frrrlfx.exec:\frrrlfx.exe99⤵PID:1644
-
\??\c:\bhnnhh.exec:\bhnnhh.exe100⤵PID:4400
-
\??\c:\jjjdv.exec:\jjjdv.exe101⤵PID:5112
-
\??\c:\lrxrffx.exec:\lrxrffx.exe102⤵PID:3464
-
\??\c:\bnbnnh.exec:\bnbnnh.exe103⤵PID:556
-
\??\c:\pvdvp.exec:\pvdvp.exe104⤵PID:5052
-
\??\c:\rrlfrrf.exec:\rrlfrrf.exe105⤵PID:4736
-
\??\c:\vdvdv.exec:\vdvdv.exe106⤵PID:4188
-
\??\c:\rlfxllf.exec:\rlfxllf.exe107⤵PID:1604
-
\??\c:\3nbnhh.exec:\3nbnhh.exe108⤵PID:812
-
\??\c:\dvpdv.exec:\dvpdv.exe109⤵PID:1032
-
\??\c:\9rxrllf.exec:\9rxrllf.exe110⤵PID:3540
-
\??\c:\bttnhh.exec:\bttnhh.exe111⤵PID:5092
-
\??\c:\jddvp.exec:\jddvp.exe112⤵PID:2256
-
\??\c:\3rfxllx.exec:\3rfxllx.exe113⤵PID:3232
-
\??\c:\tnnnhb.exec:\tnnnhb.exe114⤵PID:4300
-
\??\c:\3dvpj.exec:\3dvpj.exe115⤵PID:3708
-
\??\c:\fxrlfff.exec:\fxrlfff.exe116⤵PID:1384
-
\??\c:\nnbbbt.exec:\nnbbbt.exe117⤵PID:512
-
\??\c:\dpjdv.exec:\dpjdv.exe118⤵PID:3664
-
\??\c:\3frlfxr.exec:\3frlfxr.exe119⤵PID:4584
-
\??\c:\tnbtnh.exec:\tnbtnh.exe120⤵PID:1996
-
\??\c:\pjvpj.exec:\pjvpj.exe121⤵PID:2772
-
\??\c:\xfrlxxr.exec:\xfrlxxr.exe122⤵PID:828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-