Analysis
-
max time kernel
120s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 12:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a181273cbab61f0b2b491cd220320920N.exe
Resource
win7-20240704-en
5 signatures
120 seconds
General
-
Target
a181273cbab61f0b2b491cd220320920N.exe
-
Size
50KB
-
MD5
a181273cbab61f0b2b491cd220320920
-
SHA1
be97c90acfe719a8605d7221c69b15e30bb4e96e
-
SHA256
5133c6ed9b7fdf2c4a52648f61e44e19e3c32aad5e33fd9b5eee3279ec0a536f
-
SHA512
0212ca5c41b32f1ba4d76782606d955296fff0ad5c41f3b18c77745e6d6f845ed1254bae12a09b2c64b7dc9dfc90b292c2b33d8bc5d6e0dbcf2f5abc4fdbb472
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvWwH:0cdpeeBSHHMHLf9RyIq
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/732-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3352-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1032-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/860-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-339-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-343-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-356-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1324-364-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-374-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-409-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-413-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-420-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-430-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-449-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-453-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-487-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-587-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-657-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-670-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-682-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-687-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-742-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-764-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-829-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-856-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-1194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-1399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3036 hbnbnh.exe 740 vddjd.exe 3076 3lrfxrr.exe 3680 7xfxlfx.exe 3556 nnbtnh.exe 1176 7pdvp.exe 3676 lfffxxr.exe 3376 bbthbt.exe 1600 pjjdd.exe 528 pjppd.exe 864 flrfrrl.exe 880 1bbhbh.exe 2272 pjvpp.exe 4364 ppdvj.exe 2476 fxxrffx.exe 3124 7hhhtb.exe 1532 dpvpj.exe 4860 5xfxlff.exe 3548 9rlxrrl.exe 3912 nhhbnn.exe 1228 djdjd.exe 2012 3djvp.exe 2064 rllrrxl.exe 4856 lrllxll.exe 5116 bbbnhh.exe 680 ffrlfxr.exe 3352 llrflll.exe 744 nntnhb.exe 804 djjvp.exe 1548 rlfxfxr.exe 888 nnhbnh.exe 3300 ntttnb.exe 904 pppjd.exe 2316 pvdvd.exe 1056 1flffff.exe 2420 llxrxrf.exe 4828 5tbhhh.exe 3216 jjjvp.exe 4988 1dvjv.exe 1032 xrlxrlx.exe 2412 nhnhbb.exe 4352 1btnhb.exe 2564 vddpd.exe 232 3ppjv.exe 3160 rlffxxr.exe 4840 5flxlfr.exe 3572 9bhbhb.exe 2060 dvvvj.exe 3700 3jpdj.exe 1360 lrrfxrl.exe 1348 frlxllx.exe 860 tbhbth.exe 4952 5pppd.exe 3000 9vpjv.exe 4396 rfllrlr.exe 2040 7ttbbb.exe 1748 nnhhnn.exe 3812 vpjjj.exe 5104 dppjv.exe 464 fxffrxr.exe 3864 9tttnn.exe 1084 tnhbhh.exe 1020 pvdjp.exe 2488 3jppv.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 732 wrote to memory of 3036 732 a181273cbab61f0b2b491cd220320920N.exe 85 PID 732 wrote to memory of 3036 732 a181273cbab61f0b2b491cd220320920N.exe 85 PID 732 wrote to memory of 3036 732 a181273cbab61f0b2b491cd220320920N.exe 85 PID 3036 wrote to memory of 740 3036 hbnbnh.exe 86 PID 3036 wrote to memory of 740 3036 hbnbnh.exe 86 PID 3036 wrote to memory of 740 3036 hbnbnh.exe 86 PID 740 wrote to memory of 3076 740 vddjd.exe 87 PID 740 wrote to memory of 3076 740 vddjd.exe 87 PID 740 wrote to memory of 3076 740 vddjd.exe 87 PID 3076 wrote to memory of 3680 3076 3lrfxrr.exe 88 PID 3076 wrote to memory of 3680 3076 3lrfxrr.exe 88 PID 3076 wrote to memory of 3680 3076 3lrfxrr.exe 88 PID 3680 wrote to memory of 3556 3680 7xfxlfx.exe 89 PID 3680 wrote to memory of 3556 3680 7xfxlfx.exe 89 PID 3680 wrote to memory of 3556 3680 7xfxlfx.exe 89 PID 3556 wrote to memory of 1176 3556 nnbtnh.exe 90 PID 3556 wrote to memory of 1176 3556 nnbtnh.exe 90 PID 3556 wrote to memory of 1176 3556 nnbtnh.exe 90 PID 1176 wrote to memory of 3676 1176 7pdvp.exe 91 PID 1176 wrote to memory of 3676 1176 7pdvp.exe 91 PID 1176 wrote to memory of 3676 1176 7pdvp.exe 91 PID 3676 wrote to memory of 3376 3676 lfffxxr.exe 92 PID 3676 wrote to memory of 3376 3676 lfffxxr.exe 92 PID 3676 wrote to memory of 3376 3676 lfffxxr.exe 92 PID 3376 wrote to memory of 1600 3376 bbthbt.exe 93 PID 3376 wrote to memory of 1600 3376 bbthbt.exe 93 PID 3376 wrote to memory of 1600 3376 bbthbt.exe 93 PID 1600 wrote to memory of 528 1600 pjjdd.exe 94 PID 1600 wrote to memory of 528 1600 pjjdd.exe 94 PID 1600 wrote to memory of 528 1600 pjjdd.exe 94 PID 528 wrote to memory of 864 528 pjppd.exe 95 PID 528 wrote to memory of 864 528 pjppd.exe 95 PID 528 wrote to memory of 864 528 pjppd.exe 95 PID 864 wrote to memory of 880 864 flrfrrl.exe 96 PID 864 wrote to memory of 880 864 flrfrrl.exe 96 PID 864 wrote to memory of 880 864 flrfrrl.exe 96 PID 880 wrote to memory of 2272 880 1bbhbh.exe 97 PID 880 wrote to memory of 2272 880 1bbhbh.exe 97 PID 880 wrote to memory of 2272 880 1bbhbh.exe 97 PID 2272 wrote to memory of 4364 2272 pjvpp.exe 98 PID 2272 wrote to memory of 4364 2272 pjvpp.exe 98 PID 2272 wrote to memory of 4364 2272 pjvpp.exe 98 PID 4364 wrote to memory of 2476 4364 ppdvj.exe 99 PID 4364 wrote to memory of 2476 4364 ppdvj.exe 99 PID 4364 wrote to memory of 2476 4364 ppdvj.exe 99 PID 2476 wrote to memory of 3124 2476 fxxrffx.exe 100 PID 2476 wrote to memory of 3124 2476 fxxrffx.exe 100 PID 2476 wrote to memory of 3124 2476 fxxrffx.exe 100 PID 3124 wrote to memory of 1532 3124 7hhhtb.exe 101 PID 3124 wrote to memory of 1532 3124 7hhhtb.exe 101 PID 3124 wrote to memory of 1532 3124 7hhhtb.exe 101 PID 1532 wrote to memory of 4860 1532 dpvpj.exe 103 PID 1532 wrote to memory of 4860 1532 dpvpj.exe 103 PID 1532 wrote to memory of 4860 1532 dpvpj.exe 103 PID 4860 wrote to memory of 3548 4860 5xfxlff.exe 104 PID 4860 wrote to memory of 3548 4860 5xfxlff.exe 104 PID 4860 wrote to memory of 3548 4860 5xfxlff.exe 104 PID 3548 wrote to memory of 3912 3548 9rlxrrl.exe 105 PID 3548 wrote to memory of 3912 3548 9rlxrrl.exe 105 PID 3548 wrote to memory of 3912 3548 9rlxrrl.exe 105 PID 3912 wrote to memory of 1228 3912 nhhbnn.exe 106 PID 3912 wrote to memory of 1228 3912 nhhbnn.exe 106 PID 3912 wrote to memory of 1228 3912 nhhbnn.exe 106 PID 1228 wrote to memory of 2012 1228 djdjd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\a181273cbab61f0b2b491cd220320920N.exe"C:\Users\Admin\AppData\Local\Temp\a181273cbab61f0b2b491cd220320920N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\hbnbnh.exec:\hbnbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\vddjd.exec:\vddjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\3lrfxrr.exec:\3lrfxrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\7xfxlfx.exec:\7xfxlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\nnbtnh.exec:\nnbtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\7pdvp.exec:\7pdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\lfffxxr.exec:\lfffxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\bbthbt.exec:\bbthbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\pjjdd.exec:\pjjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\pjppd.exec:\pjppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\flrfrrl.exec:\flrfrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\1bbhbh.exec:\1bbhbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\pjvpp.exec:\pjvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\ppdvj.exec:\ppdvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\fxxrffx.exec:\fxxrffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\7hhhtb.exec:\7hhhtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\dpvpj.exec:\dpvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\5xfxlff.exec:\5xfxlff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\9rlxrrl.exec:\9rlxrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\nhhbnn.exec:\nhhbnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\djdjd.exec:\djdjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\3djvp.exec:\3djvp.exe23⤵
- Executes dropped EXE
PID:2012 -
\??\c:\rllrrxl.exec:\rllrrxl.exe24⤵
- Executes dropped EXE
PID:2064 -
\??\c:\lrllxll.exec:\lrllxll.exe25⤵
- Executes dropped EXE
PID:4856 -
\??\c:\bbbnhh.exec:\bbbnhh.exe26⤵
- Executes dropped EXE
PID:5116 -
\??\c:\ffrlfxr.exec:\ffrlfxr.exe27⤵
- Executes dropped EXE
PID:680 -
\??\c:\llrflll.exec:\llrflll.exe28⤵
- Executes dropped EXE
PID:3352 -
\??\c:\nntnhb.exec:\nntnhb.exe29⤵
- Executes dropped EXE
PID:744 -
\??\c:\djjvp.exec:\djjvp.exe30⤵
- Executes dropped EXE
PID:804 -
\??\c:\rlfxfxr.exec:\rlfxfxr.exe31⤵
- Executes dropped EXE
PID:1548 -
\??\c:\nnhbnh.exec:\nnhbnh.exe32⤵
- Executes dropped EXE
PID:888 -
\??\c:\ntttnb.exec:\ntttnb.exe33⤵
- Executes dropped EXE
PID:3300 -
\??\c:\pppjd.exec:\pppjd.exe34⤵
- Executes dropped EXE
PID:904 -
\??\c:\pvdvd.exec:\pvdvd.exe35⤵
- Executes dropped EXE
PID:2316 -
\??\c:\1flffff.exec:\1flffff.exe36⤵
- Executes dropped EXE
PID:1056 -
\??\c:\llxrxrf.exec:\llxrxrf.exe37⤵
- Executes dropped EXE
PID:2420 -
\??\c:\5tbhhh.exec:\5tbhhh.exe38⤵
- Executes dropped EXE
PID:4828 -
\??\c:\jjjvp.exec:\jjjvp.exe39⤵
- Executes dropped EXE
PID:3216 -
\??\c:\1dvjv.exec:\1dvjv.exe40⤵
- Executes dropped EXE
PID:4988 -
\??\c:\xrlxrlx.exec:\xrlxrlx.exe41⤵
- Executes dropped EXE
PID:1032 -
\??\c:\nhnhbb.exec:\nhnhbb.exe42⤵
- Executes dropped EXE
PID:2412 -
\??\c:\1btnhb.exec:\1btnhb.exe43⤵
- Executes dropped EXE
PID:4352 -
\??\c:\vddpd.exec:\vddpd.exe44⤵
- Executes dropped EXE
PID:2564 -
\??\c:\3ppjv.exec:\3ppjv.exe45⤵
- Executes dropped EXE
PID:232 -
\??\c:\rlffxxr.exec:\rlffxxr.exe46⤵
- Executes dropped EXE
PID:3160 -
\??\c:\5flxlfr.exec:\5flxlfr.exe47⤵
- Executes dropped EXE
PID:4840 -
\??\c:\9bhbhb.exec:\9bhbhb.exe48⤵
- Executes dropped EXE
PID:3572 -
\??\c:\dvvvj.exec:\dvvvj.exe49⤵
- Executes dropped EXE
PID:2060 -
\??\c:\3jpdj.exec:\3jpdj.exe50⤵
- Executes dropped EXE
PID:3700 -
\??\c:\lrrfxrl.exec:\lrrfxrl.exe51⤵
- Executes dropped EXE
PID:1360 -
\??\c:\frlxllx.exec:\frlxllx.exe52⤵
- Executes dropped EXE
PID:1348 -
\??\c:\tbhbth.exec:\tbhbth.exe53⤵
- Executes dropped EXE
PID:860 -
\??\c:\5pppd.exec:\5pppd.exe54⤵
- Executes dropped EXE
PID:4952 -
\??\c:\9vpjv.exec:\9vpjv.exe55⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rfllrlr.exec:\rfllrlr.exe56⤵
- Executes dropped EXE
PID:4396 -
\??\c:\7ttbbb.exec:\7ttbbb.exe57⤵
- Executes dropped EXE
PID:2040 -
\??\c:\nnhhnn.exec:\nnhhnn.exe58⤵
- Executes dropped EXE
PID:1748 -
\??\c:\vpjjj.exec:\vpjjj.exe59⤵
- Executes dropped EXE
PID:3812 -
\??\c:\dppjv.exec:\dppjv.exe60⤵
- Executes dropped EXE
PID:5104 -
\??\c:\fxffrxr.exec:\fxffrxr.exe61⤵
- Executes dropped EXE
PID:464 -
\??\c:\9tttnn.exec:\9tttnn.exe62⤵
- Executes dropped EXE
PID:3864 -
\??\c:\tnhbhh.exec:\tnhbhh.exe63⤵
- Executes dropped EXE
PID:1084 -
\??\c:\pvdjp.exec:\pvdjp.exe64⤵
- Executes dropped EXE
PID:1020 -
\??\c:\3jppv.exec:\3jppv.exe65⤵
- Executes dropped EXE
PID:2488 -
\??\c:\flffxxl.exec:\flffxxl.exe66⤵PID:3640
-
\??\c:\xxfxxrl.exec:\xxfxxrl.exe67⤵PID:1608
-
\??\c:\ntbttb.exec:\ntbttb.exe68⤵PID:3092
-
\??\c:\nttntt.exec:\nttntt.exe69⤵PID:4788
-
\??\c:\jjvjv.exec:\jjvjv.exe70⤵PID:3968
-
\??\c:\vpjjv.exec:\vpjjv.exe71⤵PID:4512
-
\??\c:\1xffxlf.exec:\1xffxlf.exe72⤵PID:3492
-
\??\c:\1xfrlrr.exec:\1xfrlrr.exe73⤵PID:2852
-
\??\c:\3ttttn.exec:\3ttttn.exe74⤵PID:4836
-
\??\c:\hnhtnn.exec:\hnhtnn.exe75⤵PID:4012
-
\??\c:\1vvvv.exec:\1vvvv.exe76⤵PID:3248
-
\??\c:\5vppv.exec:\5vppv.exe77⤵PID:2732
-
\??\c:\fflfffr.exec:\fflfffr.exe78⤵PID:2968
-
\??\c:\bththb.exec:\bththb.exe79⤵PID:3468
-
\??\c:\tthhbb.exec:\tthhbb.exe80⤵PID:4348
-
\??\c:\vdppp.exec:\vdppp.exe81⤵PID:4736
-
\??\c:\hbtttn.exec:\hbtttn.exe82⤵PID:4588
-
\??\c:\tnthtt.exec:\tnthtt.exe83⤵PID:1564
-
\??\c:\pvdvd.exec:\pvdvd.exe84⤵PID:804
-
\??\c:\vpddv.exec:\vpddv.exe85⤵PID:1816
-
\??\c:\rfrrxll.exec:\rfrrxll.exe86⤵PID:1324
-
\??\c:\rxllxxl.exec:\rxllxxl.exe87⤵PID:888
-
\??\c:\hnnthb.exec:\hnnthb.exe88⤵PID:4712
-
\??\c:\hnttnt.exec:\hnttnt.exe89⤵PID:2764
-
\??\c:\jjvpp.exec:\jjvpp.exe90⤵PID:4912
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe91⤵PID:4872
-
\??\c:\rrlrlxr.exec:\rrlrlxr.exe92⤵PID:4388
-
\??\c:\htnnhh.exec:\htnnhh.exe93⤵PID:4828
-
\??\c:\bhhbtt.exec:\bhhbtt.exe94⤵PID:2972
-
\??\c:\jdpdp.exec:\jdpdp.exe95⤵PID:4992
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe96⤵PID:4344
-
\??\c:\1rrrlfr.exec:\1rrrlfr.exe97⤵PID:2296
-
\??\c:\bnnhnt.exec:\bnnhnt.exe98⤵PID:2564
-
\??\c:\9jdvj.exec:\9jdvj.exe99⤵PID:232
-
\??\c:\vdjdd.exec:\vdjdd.exe100⤵PID:1092
-
\??\c:\xffxrrl.exec:\xffxrrl.exe101⤵PID:3636
-
\??\c:\rxlfrrl.exec:\rxlfrrl.exe102⤵PID:3680
-
\??\c:\7ntnhb.exec:\7ntnhb.exe103⤵PID:3256
-
\??\c:\jdddv.exec:\jdddv.exe104⤵PID:4888
-
\??\c:\vjpjd.exec:\vjpjd.exe105⤵
- System Location Discovery: System Language Discovery
PID:1176 -
\??\c:\xflfrlx.exec:\xflfrlx.exe106⤵PID:4996
-
\??\c:\5flfrlf.exec:\5flfrlf.exe107⤵PID:3376
-
\??\c:\hbtnhh.exec:\hbtnhh.exe108⤵PID:1600
-
\??\c:\tbnhtn.exec:\tbnhtn.exe109⤵PID:452
-
\??\c:\jjjdp.exec:\jjjdp.exe110⤵PID:2728
-
\??\c:\dvpdj.exec:\dvpdj.exe111⤵PID:2432
-
\??\c:\lffxllf.exec:\lffxllf.exe112⤵PID:4212
-
\??\c:\lxxffxr.exec:\lxxffxr.exe113⤵PID:880
-
\??\c:\bhnhtn.exec:\bhnhtn.exe114⤵PID:4436
-
\??\c:\9tthtn.exec:\9tthtn.exe115⤵PID:3864
-
\??\c:\ppdvj.exec:\ppdvj.exe116⤵PID:1084
-
\??\c:\vvpvd.exec:\vvpvd.exe117⤵PID:1020
-
\??\c:\llfrrff.exec:\llfrrff.exe118⤵PID:2488
-
\??\c:\hthntt.exec:\hthntt.exe119⤵PID:1404
-
\??\c:\ttbntb.exec:\ttbntb.exe120⤵PID:3560
-
\??\c:\jjjjv.exec:\jjjjv.exe121⤵PID:5108
-
\??\c:\9ppvv.exec:\9ppvv.exe122⤵PID:2928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-