Analysis
-
max time kernel
120s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 00:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
818145332fb7ccc416c0925eafa5c3d0N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
818145332fb7ccc416c0925eafa5c3d0N.exe
-
Size
134KB
-
MD5
818145332fb7ccc416c0925eafa5c3d0
-
SHA1
f9815ff540681cb0eb1249506bb43d0c40f5f5ca
-
SHA256
44562a784cf9a5af76e5fd4d09e8d5ac571d31484adfbdf312106d5f3eb71f58
-
SHA512
ad6547eb5ef9e3b0ee6c51d587985d09697c17cbe00bf4f93ba1115afc3515cb86c63814bbfb449cf4628f88aa7fa782b658c0f5751ddb8d13db164f084fedc3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73oYUCD7R2F2UVbyy0Nb7mr7fT:ymb3NkkiQ3mdBjFo73HUoMsAbrwpS9
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3560-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4308 nnnbtn.exe 2800 5jpjd.exe 1068 xllllfl.exe 2636 dpvjd.exe 2864 rxlfxrr.exe 3536 djddd.exe 640 rlrrxxx.exe 2968 nhbbhn.exe 220 dppvv.exe 3224 nbhbtn.exe 2292 jjjjp.exe 2952 jppjj.exe 4692 rllrrxf.exe 4080 hntnnn.exe 1284 dvpjj.exe 4584 xrfxrrl.exe 2380 3tnnhh.exe 1296 nhttth.exe 404 vpjjd.exe 664 flxlrxr.exe 4400 tbbttt.exe 2432 jjdjj.exe 1736 3rrlfll.exe 4388 hbbhbn.exe 2744 9nhthb.exe 1268 vjvpv.exe 3936 pdjdv.exe 3580 bhbbtb.exe 2884 ddvvp.exe 3160 vppjd.exe 2204 lflfffx.exe 4580 nhhhbh.exe 2936 ddpjd.exe 4404 xxfrrlr.exe 1788 flxrrxx.exe 1980 7nnhhh.exe 3620 vjpjd.exe 4116 7jjjd.exe 936 xllrrff.exe 2208 fllflfx.exe 1236 nnhhbh.exe 4412 ddvvj.exe 512 vjjvp.exe 2872 5xfxxxr.exe 3536 xxxxxxr.exe 4968 5ttnhb.exe 4440 ppjdd.exe 2968 pppdp.exe 3940 ffxxlll.exe 4948 xxlfxrl.exe 4996 btnhbb.exe 2476 jdjvd.exe 4348 vjppd.exe 1548 fxxlffx.exe 5060 3rrlfxl.exe 548 btnhht.exe 2688 dvpjj.exe 4648 pvddd.exe 4284 xrfrxxl.exe 1468 rlrrxxf.exe 740 bhhhhh.exe 4636 thnttt.exe 2616 7jpvp.exe 2380 lfffxxl.exe -
resource yara_rule behavioral2/memory/3560-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2800-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3560 wrote to memory of 4308 3560 818145332fb7ccc416c0925eafa5c3d0N.exe 84 PID 3560 wrote to memory of 4308 3560 818145332fb7ccc416c0925eafa5c3d0N.exe 84 PID 3560 wrote to memory of 4308 3560 818145332fb7ccc416c0925eafa5c3d0N.exe 84 PID 4308 wrote to memory of 2800 4308 nnnbtn.exe 85 PID 4308 wrote to memory of 2800 4308 nnnbtn.exe 85 PID 4308 wrote to memory of 2800 4308 nnnbtn.exe 85 PID 2800 wrote to memory of 1068 2800 5jpjd.exe 86 PID 2800 wrote to memory of 1068 2800 5jpjd.exe 86 PID 2800 wrote to memory of 1068 2800 5jpjd.exe 86 PID 1068 wrote to memory of 2636 1068 xllllfl.exe 87 PID 1068 wrote to memory of 2636 1068 xllllfl.exe 87 PID 1068 wrote to memory of 2636 1068 xllllfl.exe 87 PID 2636 wrote to memory of 2864 2636 dpvjd.exe 88 PID 2636 wrote to memory of 2864 2636 dpvjd.exe 88 PID 2636 wrote to memory of 2864 2636 dpvjd.exe 88 PID 2864 wrote to memory of 3536 2864 rxlfxrr.exe 89 PID 2864 wrote to memory of 3536 2864 rxlfxrr.exe 89 PID 2864 wrote to memory of 3536 2864 rxlfxrr.exe 89 PID 3536 wrote to memory of 640 3536 djddd.exe 90 PID 3536 wrote to memory of 640 3536 djddd.exe 90 PID 3536 wrote to memory of 640 3536 djddd.exe 90 PID 640 wrote to memory of 2968 640 rlrrxxx.exe 91 PID 640 wrote to memory of 2968 640 rlrrxxx.exe 91 PID 640 wrote to memory of 2968 640 rlrrxxx.exe 91 PID 2968 wrote to memory of 220 2968 nhbbhn.exe 92 PID 2968 wrote to memory of 220 2968 nhbbhn.exe 92 PID 2968 wrote to memory of 220 2968 nhbbhn.exe 92 PID 220 wrote to memory of 3224 220 dppvv.exe 94 PID 220 wrote to memory of 3224 220 dppvv.exe 94 PID 220 wrote to memory of 3224 220 dppvv.exe 94 PID 3224 wrote to memory of 2292 3224 nbhbtn.exe 95 PID 3224 wrote to memory of 2292 3224 nbhbtn.exe 95 PID 3224 wrote to memory of 2292 3224 nbhbtn.exe 95 PID 2292 wrote to memory of 2952 2292 jjjjp.exe 96 PID 2292 wrote to memory of 2952 2292 jjjjp.exe 96 PID 2292 wrote to memory of 2952 2292 jjjjp.exe 96 PID 2952 wrote to memory of 4692 2952 jppjj.exe 97 PID 2952 wrote to memory of 4692 2952 jppjj.exe 97 PID 2952 wrote to memory of 4692 2952 jppjj.exe 97 PID 4692 wrote to memory of 4080 4692 rllrrxf.exe 99 PID 4692 wrote to memory of 4080 4692 rllrrxf.exe 99 PID 4692 wrote to memory of 4080 4692 rllrrxf.exe 99 PID 4080 wrote to memory of 1284 4080 hntnnn.exe 100 PID 4080 wrote to memory of 1284 4080 hntnnn.exe 100 PID 4080 wrote to memory of 1284 4080 hntnnn.exe 100 PID 1284 wrote to memory of 4584 1284 dvpjj.exe 101 PID 1284 wrote to memory of 4584 1284 dvpjj.exe 101 PID 1284 wrote to memory of 4584 1284 dvpjj.exe 101 PID 4584 wrote to memory of 2380 4584 xrfxrrl.exe 102 PID 4584 wrote to memory of 2380 4584 xrfxrrl.exe 102 PID 4584 wrote to memory of 2380 4584 xrfxrrl.exe 102 PID 2380 wrote to memory of 1296 2380 3tnnhh.exe 103 PID 2380 wrote to memory of 1296 2380 3tnnhh.exe 103 PID 2380 wrote to memory of 1296 2380 3tnnhh.exe 103 PID 1296 wrote to memory of 404 1296 nhttth.exe 105 PID 1296 wrote to memory of 404 1296 nhttth.exe 105 PID 1296 wrote to memory of 404 1296 nhttth.exe 105 PID 404 wrote to memory of 664 404 vpjjd.exe 106 PID 404 wrote to memory of 664 404 vpjjd.exe 106 PID 404 wrote to memory of 664 404 vpjjd.exe 106 PID 664 wrote to memory of 4400 664 flxlrxr.exe 107 PID 664 wrote to memory of 4400 664 flxlrxr.exe 107 PID 664 wrote to memory of 4400 664 flxlrxr.exe 107 PID 4400 wrote to memory of 2432 4400 tbbttt.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\818145332fb7ccc416c0925eafa5c3d0N.exe"C:\Users\Admin\AppData\Local\Temp\818145332fb7ccc416c0925eafa5c3d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\nnnbtn.exec:\nnnbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\5jpjd.exec:\5jpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\xllllfl.exec:\xllllfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\dpvjd.exec:\dpvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rxlfxrr.exec:\rxlfxrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\djddd.exec:\djddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\rlrrxxx.exec:\rlrrxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\nhbbhn.exec:\nhbbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\dppvv.exec:\dppvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\nbhbtn.exec:\nbhbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\jjjjp.exec:\jjjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\jppjj.exec:\jppjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\rllrrxf.exec:\rllrrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\hntnnn.exec:\hntnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\dvpjj.exec:\dvpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\3tnnhh.exec:\3tnnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\nhttth.exec:\nhttth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\vpjjd.exec:\vpjjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\flxlrxr.exec:\flxlrxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\tbbttt.exec:\tbbttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\jjdjj.exec:\jjdjj.exe23⤵
- Executes dropped EXE
PID:2432 -
\??\c:\3rrlfll.exec:\3rrlfll.exe24⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hbbhbn.exec:\hbbhbn.exe25⤵
- Executes dropped EXE
PID:4388 -
\??\c:\9nhthb.exec:\9nhthb.exe26⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vjvpv.exec:\vjvpv.exe27⤵
- Executes dropped EXE
PID:1268 -
\??\c:\pdjdv.exec:\pdjdv.exe28⤵
- Executes dropped EXE
PID:3936 -
\??\c:\bhbbtb.exec:\bhbbtb.exe29⤵
- Executes dropped EXE
PID:3580 -
\??\c:\ddvvp.exec:\ddvvp.exe30⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vppjd.exec:\vppjd.exe31⤵
- Executes dropped EXE
PID:3160 -
\??\c:\lflfffx.exec:\lflfffx.exe32⤵
- Executes dropped EXE
PID:2204 -
\??\c:\nhhhbh.exec:\nhhhbh.exe33⤵
- Executes dropped EXE
PID:4580 -
\??\c:\ddpjd.exec:\ddpjd.exe34⤵
- Executes dropped EXE
PID:2936 -
\??\c:\xxfrrlr.exec:\xxfrrlr.exe35⤵
- Executes dropped EXE
PID:4404 -
\??\c:\flxrrxx.exec:\flxrrxx.exe36⤵
- Executes dropped EXE
PID:1788 -
\??\c:\7nnhhh.exec:\7nnhhh.exe37⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vjpjd.exec:\vjpjd.exe38⤵
- Executes dropped EXE
PID:3620 -
\??\c:\7jjjd.exec:\7jjjd.exe39⤵
- Executes dropped EXE
PID:4116 -
\??\c:\xllrrff.exec:\xllrrff.exe40⤵
- Executes dropped EXE
PID:936 -
\??\c:\fllflfx.exec:\fllflfx.exe41⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nnhhbh.exec:\nnhhbh.exe42⤵
- Executes dropped EXE
PID:1236 -
\??\c:\ddvvj.exec:\ddvvj.exe43⤵
- Executes dropped EXE
PID:4412 -
\??\c:\vjjvp.exec:\vjjvp.exe44⤵
- Executes dropped EXE
PID:512 -
\??\c:\5xfxxxr.exec:\5xfxxxr.exe45⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xxxxxxr.exec:\xxxxxxr.exe46⤵
- Executes dropped EXE
PID:3536 -
\??\c:\5ttnhb.exec:\5ttnhb.exe47⤵
- Executes dropped EXE
PID:4968 -
\??\c:\ppjdd.exec:\ppjdd.exe48⤵
- Executes dropped EXE
PID:4440 -
\??\c:\pppdp.exec:\pppdp.exe49⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ffxxlll.exec:\ffxxlll.exe50⤵
- Executes dropped EXE
PID:3940 -
\??\c:\xxlfxrl.exec:\xxlfxrl.exe51⤵
- Executes dropped EXE
PID:4948 -
\??\c:\btnhbb.exec:\btnhbb.exe52⤵
- Executes dropped EXE
PID:4996 -
\??\c:\jdjvd.exec:\jdjvd.exe53⤵
- Executes dropped EXE
PID:2476 -
\??\c:\vjppd.exec:\vjppd.exe54⤵
- Executes dropped EXE
PID:4348 -
\??\c:\fxxlffx.exec:\fxxlffx.exe55⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3rrlfxl.exec:\3rrlfxl.exe56⤵
- Executes dropped EXE
PID:5060 -
\??\c:\btnhht.exec:\btnhht.exe57⤵
- Executes dropped EXE
PID:548 -
\??\c:\dvpjj.exec:\dvpjj.exe58⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pvddd.exec:\pvddd.exe59⤵
- Executes dropped EXE
PID:4648 -
\??\c:\xrfrxxl.exec:\xrfrxxl.exe60⤵
- Executes dropped EXE
PID:4284 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe61⤵
- Executes dropped EXE
PID:1468 -
\??\c:\bhhhhh.exec:\bhhhhh.exe62⤵
- Executes dropped EXE
PID:740 -
\??\c:\thnttt.exec:\thnttt.exe63⤵
- Executes dropped EXE
PID:4636 -
\??\c:\7jpvp.exec:\7jpvp.exe64⤵
- Executes dropped EXE
PID:2616 -
\??\c:\lfffxxl.exec:\lfffxxl.exe65⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe66⤵PID:100
-
\??\c:\nthnnn.exec:\nthnnn.exe67⤵PID:1672
-
\??\c:\vpdjv.exec:\vpdjv.exe68⤵PID:3156
-
\??\c:\bnbbbb.exec:\bnbbbb.exe69⤵PID:4400
-
\??\c:\pjppj.exec:\pjppj.exe70⤵PID:720
-
\??\c:\pjpjj.exec:\pjpjj.exe71⤵PID:1032
-
\??\c:\flxxrrl.exec:\flxxrrl.exe72⤵PID:2844
-
\??\c:\rrxrrrl.exec:\rrxrrrl.exe73⤵PID:1308
-
\??\c:\tnbtnn.exec:\tnbtnn.exe74⤵PID:2744
-
\??\c:\1nhbtb.exec:\1nhbtb.exe75⤵PID:1912
-
\??\c:\djjjd.exec:\djjjd.exe76⤵PID:3760
-
\??\c:\1jpdj.exec:\1jpdj.exe77⤵PID:3672
-
\??\c:\xlxrlfx.exec:\xlxrlfx.exe78⤵PID:4868
-
\??\c:\nbhbtt.exec:\nbhbtt.exe79⤵PID:1028
-
\??\c:\5nnhtt.exec:\5nnhtt.exe80⤵PID:2304
-
\??\c:\dvdvv.exec:\dvdvv.exe81⤵PID:3436
-
\??\c:\jdjdv.exec:\jdjdv.exe82⤵PID:2204
-
\??\c:\frrlfxr.exec:\frrlfxr.exe83⤵
- System Location Discovery: System Language Discovery
PID:4304 -
\??\c:\flfxrrl.exec:\flfxrrl.exe84⤵PID:2936
-
\??\c:\3ttbnh.exec:\3ttbnh.exe85⤵PID:224
-
\??\c:\bttnhh.exec:\bttnhh.exe86⤵PID:2408
-
\??\c:\pjjdp.exec:\pjjdp.exe87⤵PID:3644
-
\??\c:\xflfxll.exec:\xflfxll.exe88⤵PID:2472
-
\??\c:\htbbbb.exec:\htbbbb.exe89⤵PID:3948
-
\??\c:\hnbhbb.exec:\hnbhbb.exe90⤵PID:668
-
\??\c:\5jjjd.exec:\5jjjd.exe91⤵PID:2796
-
\??\c:\jvdvj.exec:\jvdvj.exe92⤵PID:3068
-
\??\c:\frxxrrl.exec:\frxxrrl.exe93⤵PID:3764
-
\??\c:\nbnhhb.exec:\nbnhhb.exe94⤵PID:2108
-
\??\c:\5jjdp.exec:\5jjdp.exe95⤵PID:556
-
\??\c:\5djdj.exec:\5djdj.exe96⤵PID:2016
-
\??\c:\rffxfff.exec:\rffxfff.exe97⤵PID:4092
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe98⤵PID:4300
-
\??\c:\7nntth.exec:\7nntth.exe99⤵PID:620
-
\??\c:\1bttnt.exec:\1bttnt.exe100⤵PID:2824
-
\??\c:\5hhbtt.exec:\5hhbtt.exe101⤵PID:4932
-
\??\c:\pdvpd.exec:\pdvpd.exe102⤵PID:4824
-
\??\c:\pjddp.exec:\pjddp.exe103⤵PID:1564
-
\??\c:\fffxxff.exec:\fffxxff.exe104⤵PID:4188
-
\??\c:\fxxlfxf.exec:\fxxlfxf.exe105⤵PID:744
-
\??\c:\tnnnnh.exec:\tnnnnh.exe106⤵PID:1364
-
\??\c:\bttnbb.exec:\bttnbb.exe107⤵PID:4080
-
\??\c:\ppdpj.exec:\ppdpj.exe108⤵PID:2004
-
\??\c:\vpddp.exec:\vpddp.exe109⤵PID:3468
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe110⤵PID:3716
-
\??\c:\lfllffx.exec:\lfllffx.exe111⤵PID:2148
-
\??\c:\nbbtnn.exec:\nbbtnn.exe112⤵PID:1704
-
\??\c:\nnbhhn.exec:\nnbhhn.exe113⤵PID:3612
-
\??\c:\ppdjp.exec:\ppdjp.exe114⤵PID:2220
-
\??\c:\djvpd.exec:\djvpd.exe115⤵PID:4768
-
\??\c:\xllfflr.exec:\xllfflr.exe116⤵PID:1504
-
\??\c:\lfxlrrf.exec:\lfxlrrf.exe117⤵PID:4676
-
\??\c:\ttnbhb.exec:\ttnbhb.exe118⤵PID:3852
-
\??\c:\vpvvj.exec:\vpvvj.exe119⤵PID:1736
-
\??\c:\pdjdv.exec:\pdjdv.exe120⤵PID:3152
-
\??\c:\rrxrlrl.exec:\rrxrlrl.exe121⤵
- System Location Discovery: System Language Discovery
PID:2844 -
\??\c:\nnnnhn.exec:\nnnnhn.exe122⤵PID:2368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-