Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 02:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f39d1361a8c174cca2588bfca30bc1b0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
f39d1361a8c174cca2588bfca30bc1b0N.exe
-
Size
65KB
-
MD5
f39d1361a8c174cca2588bfca30bc1b0
-
SHA1
4ae6ed66173c156c44fe7378b4646fa0411f49da
-
SHA256
12ce31e2bb90d843f9f4a9d4c545238d89b4e1e6ae3eea95573e9230f1c85726
-
SHA512
86ed1725505dd75d3033bdfc0348058e3c74465a431abb93a9a12d8809cba73015af1d5a78a9bd08471d8f4c7f3a9fc3e2ab920563a013529543e108beb2520c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Bqfj:ymb3NkkiQ3mdBjFI9cqfj
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1932-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2900 xlxllfl.exe 208 9tthnh.exe 3652 3jdvj.exe 5052 xrrlfrl.exe 4280 hbthtn.exe 1476 dddvd.exe 2012 xxrfrrl.exe 1128 ddvpd.exe 3808 dvdpj.exe 3404 flxfrlx.exe 4176 nbnhbn.exe 376 dvvjj.exe 2712 pjdvd.exe 1452 lffrlrx.exe 5072 hhnnnh.exe 3672 bhnnbb.exe 4168 pjjpv.exe 3860 xffrflr.exe 2616 7rxxrrr.exe 4008 3nnnnn.exe 4752 hhtnnn.exe 3008 dpvvj.exe 3264 9pvpp.exe 3176 rxrlxfx.exe 976 btttnn.exe 4544 nntnhh.exe 3276 jdpvv.exe 3212 fllfxxr.exe 2200 flrrlll.exe 4996 bnnnnt.exe 1232 nbhttn.exe 4144 dpdpj.exe 1056 fxxxrrl.exe 4716 9xxffrl.exe 2588 btnbnb.exe 1208 9tbtbt.exe 4700 1jddp.exe 1620 jddvp.exe 3816 fxxrlff.exe 1904 xxrllxr.exe 4540 9bbbtt.exe 1932 tbhhtt.exe 4276 vjppp.exe 4380 pjpvp.exe 1652 pjdvj.exe 1136 xrlrrlx.exe 3788 rxlfxlf.exe 2380 hnhbbt.exe 4528 btnbbb.exe 1548 pjvjv.exe 2084 jvdvj.exe 4896 rrxfxxx.exe 464 lxxxrfx.exe 2248 9tnnnn.exe 4196 thnhnn.exe 2760 vdjjj.exe 2444 dvdvj.exe 4020 3xffxxx.exe 2440 fxffxxr.exe 1516 thnhhh.exe 3572 1bhbtt.exe 3504 jjppj.exe 1452 pjjvj.exe 2972 xrxrllf.exe -
resource yara_rule behavioral2/memory/1932-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1128-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-216-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxxr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2900 1932 f39d1361a8c174cca2588bfca30bc1b0N.exe 83 PID 1932 wrote to memory of 2900 1932 f39d1361a8c174cca2588bfca30bc1b0N.exe 83 PID 1932 wrote to memory of 2900 1932 f39d1361a8c174cca2588bfca30bc1b0N.exe 83 PID 2900 wrote to memory of 208 2900 xlxllfl.exe 84 PID 2900 wrote to memory of 208 2900 xlxllfl.exe 84 PID 2900 wrote to memory of 208 2900 xlxllfl.exe 84 PID 208 wrote to memory of 3652 208 9tthnh.exe 85 PID 208 wrote to memory of 3652 208 9tthnh.exe 85 PID 208 wrote to memory of 3652 208 9tthnh.exe 85 PID 3652 wrote to memory of 5052 3652 3jdvj.exe 86 PID 3652 wrote to memory of 5052 3652 3jdvj.exe 86 PID 3652 wrote to memory of 5052 3652 3jdvj.exe 86 PID 5052 wrote to memory of 4280 5052 xrrlfrl.exe 88 PID 5052 wrote to memory of 4280 5052 xrrlfrl.exe 88 PID 5052 wrote to memory of 4280 5052 xrrlfrl.exe 88 PID 4280 wrote to memory of 1476 4280 hbthtn.exe 89 PID 4280 wrote to memory of 1476 4280 hbthtn.exe 89 PID 4280 wrote to memory of 1476 4280 hbthtn.exe 89 PID 1476 wrote to memory of 2012 1476 dddvd.exe 91 PID 1476 wrote to memory of 2012 1476 dddvd.exe 91 PID 1476 wrote to memory of 2012 1476 dddvd.exe 91 PID 2012 wrote to memory of 1128 2012 xxrfrrl.exe 92 PID 2012 wrote to memory of 1128 2012 xxrfrrl.exe 92 PID 2012 wrote to memory of 1128 2012 xxrfrrl.exe 92 PID 1128 wrote to memory of 3808 1128 ddvpd.exe 93 PID 1128 wrote to memory of 3808 1128 ddvpd.exe 93 PID 1128 wrote to memory of 3808 1128 ddvpd.exe 93 PID 3808 wrote to memory of 3404 3808 dvdpj.exe 94 PID 3808 wrote to memory of 3404 3808 dvdpj.exe 94 PID 3808 wrote to memory of 3404 3808 dvdpj.exe 94 PID 3404 wrote to memory of 4176 3404 flxfrlx.exe 95 PID 3404 wrote to memory of 4176 3404 flxfrlx.exe 95 PID 3404 wrote to memory of 4176 3404 flxfrlx.exe 95 PID 4176 wrote to memory of 376 4176 nbnhbn.exe 96 PID 4176 wrote to memory of 376 4176 nbnhbn.exe 96 PID 4176 wrote to memory of 376 4176 nbnhbn.exe 96 PID 376 wrote to memory of 2712 376 dvvjj.exe 97 PID 376 wrote to memory of 2712 376 dvvjj.exe 97 PID 376 wrote to memory of 2712 376 dvvjj.exe 97 PID 2712 wrote to memory of 1452 2712 pjdvd.exe 98 PID 2712 wrote to memory of 1452 2712 pjdvd.exe 98 PID 2712 wrote to memory of 1452 2712 pjdvd.exe 98 PID 1452 wrote to memory of 5072 1452 lffrlrx.exe 99 PID 1452 wrote to memory of 5072 1452 lffrlrx.exe 99 PID 1452 wrote to memory of 5072 1452 lffrlrx.exe 99 PID 5072 wrote to memory of 3672 5072 hhnnnh.exe 100 PID 5072 wrote to memory of 3672 5072 hhnnnh.exe 100 PID 5072 wrote to memory of 3672 5072 hhnnnh.exe 100 PID 3672 wrote to memory of 4168 3672 bhnnbb.exe 102 PID 3672 wrote to memory of 4168 3672 bhnnbb.exe 102 PID 3672 wrote to memory of 4168 3672 bhnnbb.exe 102 PID 4168 wrote to memory of 3860 4168 pjjpv.exe 103 PID 4168 wrote to memory of 3860 4168 pjjpv.exe 103 PID 4168 wrote to memory of 3860 4168 pjjpv.exe 103 PID 3860 wrote to memory of 2616 3860 xffrflr.exe 104 PID 3860 wrote to memory of 2616 3860 xffrflr.exe 104 PID 3860 wrote to memory of 2616 3860 xffrflr.exe 104 PID 2616 wrote to memory of 4008 2616 7rxxrrr.exe 105 PID 2616 wrote to memory of 4008 2616 7rxxrrr.exe 105 PID 2616 wrote to memory of 4008 2616 7rxxrrr.exe 105 PID 4008 wrote to memory of 4752 4008 3nnnnn.exe 106 PID 4008 wrote to memory of 4752 4008 3nnnnn.exe 106 PID 4008 wrote to memory of 4752 4008 3nnnnn.exe 106 PID 4752 wrote to memory of 3008 4752 hhtnnn.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\f39d1361a8c174cca2588bfca30bc1b0N.exe"C:\Users\Admin\AppData\Local\Temp\f39d1361a8c174cca2588bfca30bc1b0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\xlxllfl.exec:\xlxllfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\9tthnh.exec:\9tthnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\3jdvj.exec:\3jdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\xrrlfrl.exec:\xrrlfrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\hbthtn.exec:\hbthtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\dddvd.exec:\dddvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\xxrfrrl.exec:\xxrfrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\ddvpd.exec:\ddvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\dvdpj.exec:\dvdpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\flxfrlx.exec:\flxfrlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\nbnhbn.exec:\nbnhbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\dvvjj.exec:\dvvjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\pjdvd.exec:\pjdvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\lffrlrx.exec:\lffrlrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\hhnnnh.exec:\hhnnnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\bhnnbb.exec:\bhnnbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\pjjpv.exec:\pjjpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\xffrflr.exec:\xffrflr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\7rxxrrr.exec:\7rxxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\3nnnnn.exec:\3nnnnn.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\hhtnnn.exec:\hhtnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\dpvvj.exec:\dpvvj.exe23⤵
- Executes dropped EXE
PID:3008 -
\??\c:\9pvpp.exec:\9pvpp.exe24⤵
- Executes dropped EXE
PID:3264 -
\??\c:\rxrlxfx.exec:\rxrlxfx.exe25⤵
- Executes dropped EXE
PID:3176 -
\??\c:\btttnn.exec:\btttnn.exe26⤵
- Executes dropped EXE
PID:976 -
\??\c:\nntnhh.exec:\nntnhh.exe27⤵
- Executes dropped EXE
PID:4544 -
\??\c:\jdpvv.exec:\jdpvv.exe28⤵
- Executes dropped EXE
PID:3276 -
\??\c:\fllfxxr.exec:\fllfxxr.exe29⤵
- Executes dropped EXE
PID:3212 -
\??\c:\flrrlll.exec:\flrrlll.exe30⤵
- Executes dropped EXE
PID:2200 -
\??\c:\bnnnnt.exec:\bnnnnt.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4996 -
\??\c:\nbhttn.exec:\nbhttn.exe32⤵
- Executes dropped EXE
PID:1232 -
\??\c:\dpdpj.exec:\dpdpj.exe33⤵
- Executes dropped EXE
PID:4144 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe34⤵
- Executes dropped EXE
PID:1056 -
\??\c:\9xxffrl.exec:\9xxffrl.exe35⤵
- Executes dropped EXE
PID:4716 -
\??\c:\btnbnb.exec:\btnbnb.exe36⤵
- Executes dropped EXE
PID:2588 -
\??\c:\9tbtbt.exec:\9tbtbt.exe37⤵
- Executes dropped EXE
PID:1208 -
\??\c:\1jddp.exec:\1jddp.exe38⤵
- Executes dropped EXE
PID:4700 -
\??\c:\jddvp.exec:\jddvp.exe39⤵
- Executes dropped EXE
PID:1620 -
\??\c:\fxxrlff.exec:\fxxrlff.exe40⤵
- Executes dropped EXE
PID:3816 -
\??\c:\xxrllxr.exec:\xxrllxr.exe41⤵
- Executes dropped EXE
PID:1904 -
\??\c:\9bbbtt.exec:\9bbbtt.exe42⤵
- Executes dropped EXE
PID:4540 -
\??\c:\tbhhtt.exec:\tbhhtt.exe43⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vjppp.exec:\vjppp.exe44⤵
- Executes dropped EXE
PID:4276 -
\??\c:\pjpvp.exec:\pjpvp.exe45⤵
- Executes dropped EXE
PID:4380 -
\??\c:\pjdvj.exec:\pjdvj.exe46⤵
- Executes dropped EXE
PID:1652 -
\??\c:\xrlrrlx.exec:\xrlrrlx.exe47⤵
- Executes dropped EXE
PID:1136 -
\??\c:\rxlfxlf.exec:\rxlfxlf.exe48⤵
- Executes dropped EXE
PID:3788 -
\??\c:\hnhbbt.exec:\hnhbbt.exe49⤵
- Executes dropped EXE
PID:2380 -
\??\c:\btnbbb.exec:\btnbbb.exe50⤵
- Executes dropped EXE
PID:4528 -
\??\c:\pjvjv.exec:\pjvjv.exe51⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jvdvj.exec:\jvdvj.exe52⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rrxfxxx.exec:\rrxfxxx.exe53⤵
- Executes dropped EXE
PID:4896 -
\??\c:\lxxxrfx.exec:\lxxxrfx.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:464 -
\??\c:\9tnnnn.exec:\9tnnnn.exe55⤵
- Executes dropped EXE
PID:2248 -
\??\c:\thnhnn.exec:\thnhnn.exe56⤵
- Executes dropped EXE
PID:4196 -
\??\c:\vdjjj.exec:\vdjjj.exe57⤵
- Executes dropped EXE
PID:2760 -
\??\c:\dvdvj.exec:\dvdvj.exe58⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3xffxxx.exec:\3xffxxx.exe59⤵
- Executes dropped EXE
PID:4020 -
\??\c:\fxffxxr.exec:\fxffxxr.exe60⤵
- Executes dropped EXE
PID:2440 -
\??\c:\thnhhh.exec:\thnhhh.exe61⤵
- Executes dropped EXE
PID:1516 -
\??\c:\1bhbtt.exec:\1bhbtt.exe62⤵
- Executes dropped EXE
PID:3572 -
\??\c:\jjppj.exec:\jjppj.exe63⤵
- Executes dropped EXE
PID:3504 -
\??\c:\pjjvj.exec:\pjjvj.exe64⤵
- Executes dropped EXE
PID:1452 -
\??\c:\xrxrllf.exec:\xrxrllf.exe65⤵
- Executes dropped EXE
PID:2972 -
\??\c:\rflllll.exec:\rflllll.exe66⤵PID:2420
-
\??\c:\7ntttt.exec:\7ntttt.exe67⤵PID:2480
-
\??\c:\bnnhhh.exec:\bnnhhh.exe68⤵PID:1156
-
\??\c:\9jjpd.exec:\9jjpd.exe69⤵PID:3860
-
\??\c:\pppdj.exec:\pppdj.exe70⤵PID:4620
-
\??\c:\flxrlll.exec:\flxrlll.exe71⤵PID:3172
-
\??\c:\tnttnn.exec:\tnttnn.exe72⤵
- System Location Discovery: System Language Discovery
PID:1928 -
\??\c:\jjdvd.exec:\jjdvd.exe73⤵PID:2328
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe74⤵PID:4980
-
\??\c:\rllrlxr.exec:\rllrlxr.exe75⤵PID:1036
-
\??\c:\7hbbbb.exec:\7hbbbb.exe76⤵PID:2784
-
\??\c:\hbhbbb.exec:\hbhbbb.exe77⤵PID:3752
-
\??\c:\jvddv.exec:\jvddv.exe78⤵PID:1664
-
\??\c:\pdddd.exec:\pdddd.exe79⤵PID:4544
-
\??\c:\rllfffr.exec:\rllfffr.exe80⤵PID:1716
-
\??\c:\tntntt.exec:\tntntt.exe81⤵
- System Location Discovery: System Language Discovery
PID:3276 -
\??\c:\ttbbhh.exec:\ttbbhh.exe82⤵PID:2536
-
\??\c:\3bhnhh.exec:\3bhnhh.exe83⤵PID:2668
-
\??\c:\pjvpp.exec:\pjvpp.exe84⤵PID:4316
-
\??\c:\5vjdp.exec:\5vjdp.exe85⤵PID:4100
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe86⤵
- System Location Discovery: System Language Discovery
PID:2388 -
\??\c:\xlllxxr.exec:\xlllxxr.exe87⤵PID:4144
-
\??\c:\hbtttb.exec:\hbtttb.exe88⤵PID:3016
-
\??\c:\jjpjj.exec:\jjpjj.exe89⤵PID:4716
-
\??\c:\djvpd.exec:\djvpd.exe90⤵PID:4740
-
\??\c:\bbtbth.exec:\bbtbth.exe91⤵PID:3944
-
\??\c:\hhnhbt.exec:\hhnhbt.exe92⤵PID:2356
-
\??\c:\vdjdp.exec:\vdjdp.exe93⤵PID:5036
-
\??\c:\pjvpj.exec:\pjvpj.exe94⤵PID:864
-
\??\c:\7xxrllf.exec:\7xxrllf.exe95⤵PID:1200
-
\??\c:\frrlffx.exec:\frrlffx.exe96⤵PID:3564
-
\??\c:\tnnhbt.exec:\tnnhbt.exe97⤵PID:4500
-
\??\c:\btnhbb.exec:\btnhbb.exe98⤵PID:1688
-
\??\c:\dpvpp.exec:\dpvpp.exe99⤵PID:212
-
\??\c:\vdjdp.exec:\vdjdp.exe100⤵PID:4548
-
\??\c:\dpvvj.exec:\dpvvj.exe101⤵PID:4364
-
\??\c:\rrffffx.exec:\rrffffx.exe102⤵PID:3884
-
\??\c:\xfrlffx.exec:\xfrlffx.exe103⤵
- System Location Discovery: System Language Discovery
PID:2036 -
\??\c:\tbhhnn.exec:\tbhhnn.exe104⤵PID:4628
-
\??\c:\bthbbb.exec:\bthbbb.exe105⤵PID:2064
-
\??\c:\pjdvj.exec:\pjdvj.exe106⤵PID:1128
-
\??\c:\vjvvv.exec:\vjvvv.exe107⤵PID:3652
-
\??\c:\1flxrll.exec:\1flxrll.exe108⤵PID:1604
-
\??\c:\xrfrfxr.exec:\xrfrfxr.exe109⤵PID:1732
-
\??\c:\btthth.exec:\btthth.exe110⤵PID:960
-
\??\c:\btnhtt.exec:\btnhtt.exe111⤵PID:4536
-
\??\c:\pvdvp.exec:\pvdvp.exe112⤵PID:548
-
\??\c:\5pdvv.exec:\5pdvv.exe113⤵PID:5100
-
\??\c:\flxxffl.exec:\flxxffl.exe114⤵PID:3552
-
\??\c:\lxlrxxr.exec:\lxlrxxr.exe115⤵PID:3516
-
\??\c:\lrxxrll.exec:\lrxxrll.exe116⤵PID:2852
-
\??\c:\hbbttt.exec:\hbbttt.exe117⤵PID:5072
-
\??\c:\hnnthn.exec:\hnnthn.exe118⤵PID:4420
-
\??\c:\9jppp.exec:\9jppp.exe119⤵PID:992
-
\??\c:\rrxrllf.exec:\rrxrllf.exe120⤵PID:2068
-
\??\c:\rfffxxx.exec:\rfffxxx.exe121⤵PID:880
-
\??\c:\7lxrrll.exec:\7lxrrll.exe122⤵PID:3924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-