Analysis
-
max time kernel
120s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 14:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
daa38c5425a152ed2629c15d7d8a0620N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
daa38c5425a152ed2629c15d7d8a0620N.exe
-
Size
123KB
-
MD5
daa38c5425a152ed2629c15d7d8a0620
-
SHA1
2ea2d0b8ebfa7f66992faba82abec3b7e5ff4e4b
-
SHA256
4d75e56cf9ee9cf345ba509f02d9f8b1ce381f235028f25d94721acfbf8f82fb
-
SHA512
b6980345a8d86298c656a01701bdf1e507b6b208d8aeddbbcaf887a22734ae8e9d034d15214524372126c0000257cfead9253c125eec70dfb38f8fa797809e12
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDomRGApSuLAR2yPBCQ1nDFu1Q8so:ymb3NkkiQ3mdBjFomR7UsyJC+n0Gsgcb
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4960-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/800-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/800-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3784-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/656-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4960 pvdvp.exe 4968 rlrlffx.exe 2712 nhbntn.exe 3936 htbtnn.exe 1940 dvpjj.exe 2604 rffrxxf.exe 3324 nbbhtt.exe 1332 bttbhn.exe 2776 lxllxll.exe 800 ffrxrfl.exe 1792 tbhntn.exe 1440 jvvpj.exe 4684 xlrllll.exe 1156 htbtbh.exe 2880 ttnhbt.exe 3784 vjpjj.exe 4852 frlfxlf.exe 1740 ttnhnh.exe 1012 3pjdd.exe 4160 jvpjv.exe 4824 ffrffxr.exe 656 ntbtbb.exe 4232 jpjjp.exe 3308 fllfxxx.exe 5036 thhthh.exe 3628 pvvpj.exe 1600 llxrrxf.exe 5000 htbhtb.exe 3032 vpppj.exe 880 1xllflr.exe 4384 frllflr.exe 2320 tnnhnn.exe 5044 jjvpv.exe 532 jddvp.exe 3892 xlxrllx.exe 4316 xlrffrr.exe 3776 hhhnnb.exe 1540 btnhbb.exe 836 pjppd.exe 2068 xrflllf.exe 3324 xrfrllf.exe 440 bttnhn.exe 4776 nbbnbt.exe 1444 jpppp.exe 4832 rffxxxr.exe 1020 fxrxrff.exe 1412 5bhbhh.exe 4860 bntntn.exe 2920 jvddv.exe 4060 ppdvj.exe 5104 llfxllf.exe 2888 xfxrllf.exe 4372 bttnht.exe 4064 hbnhbb.exe 768 jddpd.exe 1276 rrrlfll.exe 4288 rxllffx.exe 4160 hhbbtt.exe 2464 hhttbb.exe 1136 jjjdd.exe 3248 djjdd.exe 4116 llrlfxr.exe 4364 lffrllf.exe 540 hntnhb.exe -
resource yara_rule behavioral2/memory/2356-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/800-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/800-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1792-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3784-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 4960 2356 daa38c5425a152ed2629c15d7d8a0620N.exe 85 PID 2356 wrote to memory of 4960 2356 daa38c5425a152ed2629c15d7d8a0620N.exe 85 PID 2356 wrote to memory of 4960 2356 daa38c5425a152ed2629c15d7d8a0620N.exe 85 PID 4960 wrote to memory of 4968 4960 pvdvp.exe 86 PID 4960 wrote to memory of 4968 4960 pvdvp.exe 86 PID 4960 wrote to memory of 4968 4960 pvdvp.exe 86 PID 4968 wrote to memory of 2712 4968 rlrlffx.exe 87 PID 4968 wrote to memory of 2712 4968 rlrlffx.exe 87 PID 4968 wrote to memory of 2712 4968 rlrlffx.exe 87 PID 2712 wrote to memory of 3936 2712 nhbntn.exe 88 PID 2712 wrote to memory of 3936 2712 nhbntn.exe 88 PID 2712 wrote to memory of 3936 2712 nhbntn.exe 88 PID 3936 wrote to memory of 1940 3936 htbtnn.exe 89 PID 3936 wrote to memory of 1940 3936 htbtnn.exe 89 PID 3936 wrote to memory of 1940 3936 htbtnn.exe 89 PID 1940 wrote to memory of 2604 1940 dvpjj.exe 90 PID 1940 wrote to memory of 2604 1940 dvpjj.exe 90 PID 1940 wrote to memory of 2604 1940 dvpjj.exe 90 PID 2604 wrote to memory of 3324 2604 rffrxxf.exe 91 PID 2604 wrote to memory of 3324 2604 rffrxxf.exe 91 PID 2604 wrote to memory of 3324 2604 rffrxxf.exe 91 PID 3324 wrote to memory of 1332 3324 nbbhtt.exe 92 PID 3324 wrote to memory of 1332 3324 nbbhtt.exe 92 PID 3324 wrote to memory of 1332 3324 nbbhtt.exe 92 PID 1332 wrote to memory of 2776 1332 bttbhn.exe 93 PID 1332 wrote to memory of 2776 1332 bttbhn.exe 93 PID 1332 wrote to memory of 2776 1332 bttbhn.exe 93 PID 2776 wrote to memory of 800 2776 lxllxll.exe 94 PID 2776 wrote to memory of 800 2776 lxllxll.exe 94 PID 2776 wrote to memory of 800 2776 lxllxll.exe 94 PID 800 wrote to memory of 1792 800 ffrxrfl.exe 95 PID 800 wrote to memory of 1792 800 ffrxrfl.exe 95 PID 800 wrote to memory of 1792 800 ffrxrfl.exe 95 PID 1792 wrote to memory of 1440 1792 tbhntn.exe 96 PID 1792 wrote to memory of 1440 1792 tbhntn.exe 96 PID 1792 wrote to memory of 1440 1792 tbhntn.exe 96 PID 1440 wrote to memory of 4684 1440 jvvpj.exe 97 PID 1440 wrote to memory of 4684 1440 jvvpj.exe 97 PID 1440 wrote to memory of 4684 1440 jvvpj.exe 97 PID 4684 wrote to memory of 1156 4684 xlrllll.exe 98 PID 4684 wrote to memory of 1156 4684 xlrllll.exe 98 PID 4684 wrote to memory of 1156 4684 xlrllll.exe 98 PID 1156 wrote to memory of 2880 1156 htbtbh.exe 99 PID 1156 wrote to memory of 2880 1156 htbtbh.exe 99 PID 1156 wrote to memory of 2880 1156 htbtbh.exe 99 PID 2880 wrote to memory of 3784 2880 ttnhbt.exe 100 PID 2880 wrote to memory of 3784 2880 ttnhbt.exe 100 PID 2880 wrote to memory of 3784 2880 ttnhbt.exe 100 PID 3784 wrote to memory of 4852 3784 vjpjj.exe 101 PID 3784 wrote to memory of 4852 3784 vjpjj.exe 101 PID 3784 wrote to memory of 4852 3784 vjpjj.exe 101 PID 4852 wrote to memory of 1740 4852 frlfxlf.exe 102 PID 4852 wrote to memory of 1740 4852 frlfxlf.exe 102 PID 4852 wrote to memory of 1740 4852 frlfxlf.exe 102 PID 1740 wrote to memory of 1012 1740 ttnhnh.exe 103 PID 1740 wrote to memory of 1012 1740 ttnhnh.exe 103 PID 1740 wrote to memory of 1012 1740 ttnhnh.exe 103 PID 1012 wrote to memory of 4160 1012 3pjdd.exe 105 PID 1012 wrote to memory of 4160 1012 3pjdd.exe 105 PID 1012 wrote to memory of 4160 1012 3pjdd.exe 105 PID 4160 wrote to memory of 4824 4160 jvpjv.exe 106 PID 4160 wrote to memory of 4824 4160 jvpjv.exe 106 PID 4160 wrote to memory of 4824 4160 jvpjv.exe 106 PID 4824 wrote to memory of 656 4824 ffrffxr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\daa38c5425a152ed2629c15d7d8a0620N.exe"C:\Users\Admin\AppData\Local\Temp\daa38c5425a152ed2629c15d7d8a0620N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\pvdvp.exec:\pvdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\rlrlffx.exec:\rlrlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\nhbntn.exec:\nhbntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\htbtnn.exec:\htbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\dvpjj.exec:\dvpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\rffrxxf.exec:\rffrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\nbbhtt.exec:\nbbhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\bttbhn.exec:\bttbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\lxllxll.exec:\lxllxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\ffrxrfl.exec:\ffrxrfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\tbhntn.exec:\tbhntn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\jvvpj.exec:\jvvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\xlrllll.exec:\xlrllll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\htbtbh.exec:\htbtbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\ttnhbt.exec:\ttnhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\vjpjj.exec:\vjpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\frlfxlf.exec:\frlfxlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\ttnhnh.exec:\ttnhnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\3pjdd.exec:\3pjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\jvpjv.exec:\jvpjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\ffrffxr.exec:\ffrffxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\ntbtbb.exec:\ntbtbb.exe23⤵
- Executes dropped EXE
PID:656 -
\??\c:\jpjjp.exec:\jpjjp.exe24⤵
- Executes dropped EXE
PID:4232 -
\??\c:\fllfxxx.exec:\fllfxxx.exe25⤵
- Executes dropped EXE
PID:3308 -
\??\c:\thhthh.exec:\thhthh.exe26⤵
- Executes dropped EXE
PID:5036 -
\??\c:\pvvpj.exec:\pvvpj.exe27⤵
- Executes dropped EXE
PID:3628 -
\??\c:\llxrrxf.exec:\llxrrxf.exe28⤵
- Executes dropped EXE
PID:1600 -
\??\c:\htbhtb.exec:\htbhtb.exe29⤵
- Executes dropped EXE
PID:5000 -
\??\c:\vpppj.exec:\vpppj.exe30⤵
- Executes dropped EXE
PID:3032 -
\??\c:\1xllflr.exec:\1xllflr.exe31⤵
- Executes dropped EXE
PID:880 -
\??\c:\frllflr.exec:\frllflr.exe32⤵
- Executes dropped EXE
PID:4384 -
\??\c:\tnnhnn.exec:\tnnhnn.exe33⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jjvpv.exec:\jjvpv.exe34⤵
- Executes dropped EXE
PID:5044 -
\??\c:\jddvp.exec:\jddvp.exe35⤵
- Executes dropped EXE
PID:532 -
\??\c:\xlxrllx.exec:\xlxrllx.exe36⤵
- Executes dropped EXE
PID:3892 -
\??\c:\xlrffrr.exec:\xlrffrr.exe37⤵
- Executes dropped EXE
PID:4316 -
\??\c:\hhhnnb.exec:\hhhnnb.exe38⤵
- Executes dropped EXE
PID:3776 -
\??\c:\btnhbb.exec:\btnhbb.exe39⤵
- Executes dropped EXE
PID:1540 -
\??\c:\pjppd.exec:\pjppd.exe40⤵
- Executes dropped EXE
PID:836 -
\??\c:\xrflllf.exec:\xrflllf.exe41⤵
- Executes dropped EXE
PID:2068 -
\??\c:\xrfrllf.exec:\xrfrllf.exe42⤵
- Executes dropped EXE
PID:3324 -
\??\c:\bttnhn.exec:\bttnhn.exe43⤵
- Executes dropped EXE
PID:440 -
\??\c:\nbbnbt.exec:\nbbnbt.exe44⤵
- Executes dropped EXE
PID:4776 -
\??\c:\jpppp.exec:\jpppp.exe45⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rffxxxr.exec:\rffxxxr.exe46⤵
- Executes dropped EXE
PID:4832 -
\??\c:\fxrxrff.exec:\fxrxrff.exe47⤵
- Executes dropped EXE
PID:1020 -
\??\c:\5bhbhh.exec:\5bhbhh.exe48⤵
- Executes dropped EXE
PID:1412 -
\??\c:\bntntn.exec:\bntntn.exe49⤵
- Executes dropped EXE
PID:4860 -
\??\c:\jvddv.exec:\jvddv.exe50⤵
- Executes dropped EXE
PID:2920 -
\??\c:\ppdvj.exec:\ppdvj.exe51⤵
- Executes dropped EXE
PID:4060 -
\??\c:\llfxllf.exec:\llfxllf.exe52⤵
- Executes dropped EXE
PID:5104 -
\??\c:\xfxrllf.exec:\xfxrllf.exe53⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bttnht.exec:\bttnht.exe54⤵
- Executes dropped EXE
PID:4372 -
\??\c:\hbnhbb.exec:\hbnhbb.exe55⤵
- Executes dropped EXE
PID:4064 -
\??\c:\jddpd.exec:\jddpd.exe56⤵
- Executes dropped EXE
PID:768 -
\??\c:\rrrlfll.exec:\rrrlfll.exe57⤵
- Executes dropped EXE
PID:1276 -
\??\c:\rxllffx.exec:\rxllffx.exe58⤵
- Executes dropped EXE
PID:4288 -
\??\c:\hhbbtt.exec:\hhbbtt.exe59⤵
- Executes dropped EXE
PID:4160 -
\??\c:\hhttbb.exec:\hhttbb.exe60⤵
- Executes dropped EXE
PID:2464 -
\??\c:\jjjdd.exec:\jjjdd.exe61⤵
- Executes dropped EXE
PID:1136 -
\??\c:\djjdd.exec:\djjdd.exe62⤵
- Executes dropped EXE
PID:3248 -
\??\c:\llrlfxr.exec:\llrlfxr.exe63⤵
- Executes dropped EXE
PID:4116 -
\??\c:\lffrllf.exec:\lffrllf.exe64⤵
- Executes dropped EXE
PID:4364 -
\??\c:\hntnhb.exec:\hntnhb.exe65⤵
- Executes dropped EXE
PID:540 -
\??\c:\7tbthh.exec:\7tbthh.exe66⤵PID:220
-
\??\c:\vjvjj.exec:\vjvjj.exe67⤵PID:4428
-
\??\c:\xllfxxr.exec:\xllfxxr.exe68⤵PID:2936
-
\??\c:\flllffr.exec:\flllffr.exe69⤵PID:2660
-
\??\c:\bbhbtn.exec:\bbhbtn.exe70⤵PID:3048
-
\??\c:\tntnhb.exec:\tntnhb.exe71⤵PID:4068
-
\??\c:\9dpdv.exec:\9dpdv.exe72⤵PID:1188
-
\??\c:\xflfrrl.exec:\xflfrrl.exe73⤵PID:1784
-
\??\c:\rfrlffx.exec:\rfrlffx.exe74⤵PID:384
-
\??\c:\1bhtnt.exec:\1bhtnt.exe75⤵PID:3868
-
\??\c:\dpdvp.exec:\dpdvp.exe76⤵PID:228
-
\??\c:\jjppj.exec:\jjppj.exe77⤵PID:2348
-
\??\c:\xrrlllx.exec:\xrrlllx.exe78⤵PID:2764
-
\??\c:\ttntnt.exec:\ttntnt.exe79⤵PID:3892
-
\??\c:\pvvpp.exec:\pvvpp.exe80⤵PID:4316
-
\??\c:\5pjjj.exec:\5pjjj.exe81⤵PID:3776
-
\??\c:\xxrxrff.exec:\xxrxrff.exe82⤵PID:632
-
\??\c:\btbnnh.exec:\btbnnh.exe83⤵PID:4716
-
\??\c:\pvjdv.exec:\pvjdv.exe84⤵PID:2488
-
\??\c:\jjpvv.exec:\jjpvv.exe85⤵PID:4784
-
\??\c:\rrllxxx.exec:\rrllxxx.exe86⤵PID:4672
-
\??\c:\rxllffx.exec:\rxllffx.exe87⤵PID:4044
-
\??\c:\nhbbtt.exec:\nhbbtt.exe88⤵PID:3232
-
\??\c:\dvpjd.exec:\dvpjd.exe89⤵PID:1892
-
\??\c:\pjdpv.exec:\pjdpv.exe90⤵PID:2924
-
\??\c:\xxrlxxr.exec:\xxrlxxr.exe91⤵PID:1288
-
\??\c:\nbttnn.exec:\nbttnn.exe92⤵PID:2984
-
\??\c:\ntbtnn.exec:\ntbtnn.exe93⤵PID:1616
-
\??\c:\dvpvp.exec:\dvpvp.exe94⤵PID:1692
-
\??\c:\jpddd.exec:\jpddd.exe95⤵PID:1788
-
\??\c:\xlrllrl.exec:\xlrllrl.exe96⤵PID:4800
-
\??\c:\tnnntt.exec:\tnnntt.exe97⤵PID:896
-
\??\c:\bnnbbt.exec:\bnnbbt.exe98⤵PID:3616
-
\??\c:\djjdv.exec:\djjdv.exe99⤵PID:4372
-
\??\c:\vdpdd.exec:\vdpdd.exe100⤵PID:4400
-
\??\c:\lflfrrl.exec:\lflfrrl.exe101⤵PID:768
-
\??\c:\ffflfrx.exec:\ffflfrx.exe102⤵PID:1012
-
\??\c:\thtntt.exec:\thtntt.exe103⤵PID:3088
-
\??\c:\jdpjj.exec:\jdpjj.exe104⤵
- System Location Discovery: System Language Discovery
PID:2748 -
\??\c:\jjjdp.exec:\jjjdp.exe105⤵PID:3828
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe106⤵PID:1468
-
\??\c:\lrfrrll.exec:\lrfrrll.exe107⤵PID:2256
-
\??\c:\5bbtnb.exec:\5bbtnb.exe108⤵PID:1820
-
\??\c:\btbhbb.exec:\btbhbb.exe109⤵PID:4840
-
\??\c:\ppjvv.exec:\ppjvv.exe110⤵PID:1484
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe111⤵PID:232
-
\??\c:\lfxxlfx.exec:\lfxxlfx.exe112⤵PID:3716
-
\??\c:\tntntn.exec:\tntntn.exe113⤵
- System Location Discovery: System Language Discovery
PID:2080 -
\??\c:\bthbnn.exec:\bthbnn.exe114⤵PID:3448
-
\??\c:\7vpjv.exec:\7vpjv.exe115⤵PID:4844
-
\??\c:\pvdvj.exec:\pvdvj.exe116⤵PID:4656
-
\??\c:\xlrxllf.exec:\xlrxllf.exe117⤵PID:3948
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe118⤵PID:3068
-
\??\c:\nhhhhb.exec:\nhhhhb.exe119⤵PID:5088
-
\??\c:\3vdvj.exec:\3vdvj.exe120⤵PID:2708
-
\??\c:\5vdvv.exec:\5vdvv.exe121⤵PID:4528
-
\??\c:\xxrrllx.exec:\xxrrllx.exe122⤵PID:3116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-