Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 12:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbf3e8ea65f7dbadb62f735e10d89950N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
dbf3e8ea65f7dbadb62f735e10d89950N.exe
-
Size
73KB
-
MD5
dbf3e8ea65f7dbadb62f735e10d89950
-
SHA1
7bca40a5280ca2e77abca45bd78688dde067268d
-
SHA256
0fbbaba09b5c6a35b4b4e51f515b09b174188c7ea4d1592d7a52af730c1d39f5
-
SHA512
4aa06b3b61030404a6af73cebbd4f4ec5ca796583ea39a98b9cd1bfc88d2da4b05e29128572c153fadfbb4b902e8f57eae842c6106111854c35739c9294c591c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIYgC/KSLJT:ymb3NkkiQ3mdBjFI3eFh
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/5000-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1124-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-31-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1320-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1808-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-455-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1124 pjdvd.exe 220 1xlfxfx.exe 2264 dvjjj.exe 2448 dpvpv.exe 3712 bnhhbb.exe 2148 1dddp.exe 1332 xflfrlx.exe 4032 9ntnhh.exe 5036 tnhbtn.exe 1320 vpddv.exe 5088 3vdvp.exe 4224 xrfxfxr.exe 3272 vjddv.exe 2928 xxfxxxr.exe 4700 rrrrllx.exe 4988 nbhnbb.exe 824 9btnhh.exe 2128 vjvjv.exe 868 rxffrxx.exe 5116 xlfllfx.exe 528 bbhntt.exe 1808 pjvvj.exe 1964 5jddp.exe 3676 xxrlfrl.exe 4708 bbnnbb.exe 4320 vjppd.exe 4880 1xrrlxr.exe 3724 bnthbt.exe 1540 7jvpj.exe 4852 xlllxxx.exe 1080 hhnhnh.exe 3616 dvvpd.exe 1376 rxfrxxx.exe 4016 xrrrllf.exe 4888 htbbtt.exe 4552 jjjdd.exe 4008 lrlrlfx.exe 4356 flllrrr.exe 4980 bhhbbh.exe 212 vjjjd.exe 4532 vjdvj.exe 3752 xrrxxxf.exe 2108 lflfflf.exe 2848 nnbhhn.exe 1572 1hnnnt.exe 3712 dvjjd.exe 1404 3djdp.exe 2104 xrrlffx.exe 4032 ttttbb.exe 4688 btbtbb.exe 5016 djdpj.exe 5036 rxffxxx.exe 1320 xllfxxr.exe 224 tnnhbb.exe 4936 tnhhbb.exe 1640 vdvvj.exe 1676 lrrrlll.exe 2544 hnnnbb.exe 4020 ddpvv.exe 2928 jddvj.exe 3040 lrxrrrr.exe 3264 rffxxxr.exe 4988 bbnthn.exe 3920 djjpd.exe -
resource yara_rule behavioral2/memory/5000-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1124-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1808-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-455-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfflffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5000 wrote to memory of 1124 5000 dbf3e8ea65f7dbadb62f735e10d89950N.exe 83 PID 5000 wrote to memory of 1124 5000 dbf3e8ea65f7dbadb62f735e10d89950N.exe 83 PID 5000 wrote to memory of 1124 5000 dbf3e8ea65f7dbadb62f735e10d89950N.exe 83 PID 1124 wrote to memory of 220 1124 pjdvd.exe 84 PID 1124 wrote to memory of 220 1124 pjdvd.exe 84 PID 1124 wrote to memory of 220 1124 pjdvd.exe 84 PID 220 wrote to memory of 2264 220 1xlfxfx.exe 85 PID 220 wrote to memory of 2264 220 1xlfxfx.exe 85 PID 220 wrote to memory of 2264 220 1xlfxfx.exe 85 PID 2264 wrote to memory of 2448 2264 dvjjj.exe 86 PID 2264 wrote to memory of 2448 2264 dvjjj.exe 86 PID 2264 wrote to memory of 2448 2264 dvjjj.exe 86 PID 2448 wrote to memory of 3712 2448 dpvpv.exe 87 PID 2448 wrote to memory of 3712 2448 dpvpv.exe 87 PID 2448 wrote to memory of 3712 2448 dpvpv.exe 87 PID 3712 wrote to memory of 2148 3712 bnhhbb.exe 88 PID 3712 wrote to memory of 2148 3712 bnhhbb.exe 88 PID 3712 wrote to memory of 2148 3712 bnhhbb.exe 88 PID 2148 wrote to memory of 1332 2148 1dddp.exe 89 PID 2148 wrote to memory of 1332 2148 1dddp.exe 89 PID 2148 wrote to memory of 1332 2148 1dddp.exe 89 PID 1332 wrote to memory of 4032 1332 xflfrlx.exe 90 PID 1332 wrote to memory of 4032 1332 xflfrlx.exe 90 PID 1332 wrote to memory of 4032 1332 xflfrlx.exe 90 PID 4032 wrote to memory of 5036 4032 9ntnhh.exe 91 PID 4032 wrote to memory of 5036 4032 9ntnhh.exe 91 PID 4032 wrote to memory of 5036 4032 9ntnhh.exe 91 PID 5036 wrote to memory of 1320 5036 tnhbtn.exe 93 PID 5036 wrote to memory of 1320 5036 tnhbtn.exe 93 PID 5036 wrote to memory of 1320 5036 tnhbtn.exe 93 PID 1320 wrote to memory of 5088 1320 vpddv.exe 94 PID 1320 wrote to memory of 5088 1320 vpddv.exe 94 PID 1320 wrote to memory of 5088 1320 vpddv.exe 94 PID 5088 wrote to memory of 4224 5088 3vdvp.exe 95 PID 5088 wrote to memory of 4224 5088 3vdvp.exe 95 PID 5088 wrote to memory of 4224 5088 3vdvp.exe 95 PID 4224 wrote to memory of 3272 4224 xrfxfxr.exe 96 PID 4224 wrote to memory of 3272 4224 xrfxfxr.exe 96 PID 4224 wrote to memory of 3272 4224 xrfxfxr.exe 96 PID 3272 wrote to memory of 2928 3272 vjddv.exe 97 PID 3272 wrote to memory of 2928 3272 vjddv.exe 97 PID 3272 wrote to memory of 2928 3272 vjddv.exe 97 PID 2928 wrote to memory of 4700 2928 xxfxxxr.exe 98 PID 2928 wrote to memory of 4700 2928 xxfxxxr.exe 98 PID 2928 wrote to memory of 4700 2928 xxfxxxr.exe 98 PID 4700 wrote to memory of 4988 4700 rrrrllx.exe 99 PID 4700 wrote to memory of 4988 4700 rrrrllx.exe 99 PID 4700 wrote to memory of 4988 4700 rrrrllx.exe 99 PID 4988 wrote to memory of 824 4988 nbhnbb.exe 100 PID 4988 wrote to memory of 824 4988 nbhnbb.exe 100 PID 4988 wrote to memory of 824 4988 nbhnbb.exe 100 PID 824 wrote to memory of 2128 824 9btnhh.exe 101 PID 824 wrote to memory of 2128 824 9btnhh.exe 101 PID 824 wrote to memory of 2128 824 9btnhh.exe 101 PID 2128 wrote to memory of 868 2128 vjvjv.exe 102 PID 2128 wrote to memory of 868 2128 vjvjv.exe 102 PID 2128 wrote to memory of 868 2128 vjvjv.exe 102 PID 868 wrote to memory of 5116 868 rxffrxx.exe 103 PID 868 wrote to memory of 5116 868 rxffrxx.exe 103 PID 868 wrote to memory of 5116 868 rxffrxx.exe 103 PID 5116 wrote to memory of 528 5116 xlfllfx.exe 104 PID 5116 wrote to memory of 528 5116 xlfllfx.exe 104 PID 5116 wrote to memory of 528 5116 xlfllfx.exe 104 PID 528 wrote to memory of 1808 528 bbhntt.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbf3e8ea65f7dbadb62f735e10d89950N.exe"C:\Users\Admin\AppData\Local\Temp\dbf3e8ea65f7dbadb62f735e10d89950N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\pjdvd.exec:\pjdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\1xlfxfx.exec:\1xlfxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\dvjjj.exec:\dvjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\dpvpv.exec:\dpvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\bnhhbb.exec:\bnhhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\1dddp.exec:\1dddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\xflfrlx.exec:\xflfrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\9ntnhh.exec:\9ntnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\tnhbtn.exec:\tnhbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\vpddv.exec:\vpddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\3vdvp.exec:\3vdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\xrfxfxr.exec:\xrfxfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\vjddv.exec:\vjddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\xxfxxxr.exec:\xxfxxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\rrrrllx.exec:\rrrrllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\nbhnbb.exec:\nbhnbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\9btnhh.exec:\9btnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\vjvjv.exec:\vjvjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\rxffrxx.exec:\rxffrxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\xlfllfx.exec:\xlfllfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\bbhntt.exec:\bbhntt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\pjvvj.exec:\pjvvj.exe23⤵
- Executes dropped EXE
PID:1808 -
\??\c:\5jddp.exec:\5jddp.exe24⤵
- Executes dropped EXE
PID:1964 -
\??\c:\xxrlfrl.exec:\xxrlfrl.exe25⤵
- Executes dropped EXE
PID:3676 -
\??\c:\bbnnbb.exec:\bbnnbb.exe26⤵
- Executes dropped EXE
PID:4708 -
\??\c:\vjppd.exec:\vjppd.exe27⤵
- Executes dropped EXE
PID:4320 -
\??\c:\1xrrlxr.exec:\1xrrlxr.exe28⤵
- Executes dropped EXE
PID:4880 -
\??\c:\bnthbt.exec:\bnthbt.exe29⤵
- Executes dropped EXE
PID:3724 -
\??\c:\7jvpj.exec:\7jvpj.exe30⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xlllxxx.exec:\xlllxxx.exe31⤵
- Executes dropped EXE
PID:4852 -
\??\c:\hhnhnh.exec:\hhnhnh.exe32⤵
- Executes dropped EXE
PID:1080 -
\??\c:\dvvpd.exec:\dvvpd.exe33⤵
- Executes dropped EXE
PID:3616 -
\??\c:\rxfrxxx.exec:\rxfrxxx.exe34⤵
- Executes dropped EXE
PID:1376 -
\??\c:\xrrrllf.exec:\xrrrllf.exe35⤵
- Executes dropped EXE
PID:4016 -
\??\c:\htbbtt.exec:\htbbtt.exe36⤵
- Executes dropped EXE
PID:4888 -
\??\c:\jjjdd.exec:\jjjdd.exe37⤵
- Executes dropped EXE
PID:4552 -
\??\c:\lrlrlfx.exec:\lrlrlfx.exe38⤵
- Executes dropped EXE
PID:4008 -
\??\c:\flllrrr.exec:\flllrrr.exe39⤵
- Executes dropped EXE
PID:4356 -
\??\c:\bhhbbh.exec:\bhhbbh.exe40⤵
- Executes dropped EXE
PID:4980 -
\??\c:\vjjjd.exec:\vjjjd.exe41⤵
- Executes dropped EXE
PID:212 -
\??\c:\vjdvj.exec:\vjdvj.exe42⤵
- Executes dropped EXE
PID:4532 -
\??\c:\xrrxxxf.exec:\xrrxxxf.exe43⤵
- Executes dropped EXE
PID:3752 -
\??\c:\lflfflf.exec:\lflfflf.exe44⤵
- Executes dropped EXE
PID:2108 -
\??\c:\nnbhhn.exec:\nnbhhn.exe45⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1hnnnt.exec:\1hnnnt.exe46⤵
- Executes dropped EXE
PID:1572 -
\??\c:\dvjjd.exec:\dvjjd.exe47⤵
- Executes dropped EXE
PID:3712 -
\??\c:\3djdp.exec:\3djdp.exe48⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xrrlffx.exec:\xrrlffx.exe49⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ttttbb.exec:\ttttbb.exe50⤵
- Executes dropped EXE
PID:4032 -
\??\c:\btbtbb.exec:\btbtbb.exe51⤵
- Executes dropped EXE
PID:4688 -
\??\c:\djdpj.exec:\djdpj.exe52⤵
- Executes dropped EXE
PID:5016 -
\??\c:\rxffxxx.exec:\rxffxxx.exe53⤵
- Executes dropped EXE
PID:5036 -
\??\c:\xllfxxr.exec:\xllfxxr.exe54⤵
- Executes dropped EXE
PID:1320 -
\??\c:\tnnhbb.exec:\tnnhbb.exe55⤵
- Executes dropped EXE
PID:224 -
\??\c:\tnhhbb.exec:\tnhhbb.exe56⤵
- Executes dropped EXE
PID:4936 -
\??\c:\vdvvj.exec:\vdvvj.exe57⤵
- Executes dropped EXE
PID:1640 -
\??\c:\lrrrlll.exec:\lrrrlll.exe58⤵
- Executes dropped EXE
PID:1676 -
\??\c:\hnnnbb.exec:\hnnnbb.exe59⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ddpvv.exec:\ddpvv.exe60⤵
- Executes dropped EXE
PID:4020 -
\??\c:\jddvj.exec:\jddvj.exe61⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lrxrrrr.exec:\lrxrrrr.exe62⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rffxxxr.exec:\rffxxxr.exe63⤵
- Executes dropped EXE
PID:3264 -
\??\c:\bbnthn.exec:\bbnthn.exe64⤵
- Executes dropped EXE
PID:4988 -
\??\c:\djjpd.exec:\djjpd.exe65⤵
- Executes dropped EXE
PID:3920 -
\??\c:\fllfrrl.exec:\fllfrrl.exe66⤵PID:2512
-
\??\c:\fllfrxr.exec:\fllfrxr.exe67⤵PID:868
-
\??\c:\3nttnn.exec:\3nttnn.exe68⤵PID:1980
-
\??\c:\djjjd.exec:\djjjd.exe69⤵PID:3980
-
\??\c:\djjdd.exec:\djjdd.exe70⤵PID:4116
-
\??\c:\1xxfffx.exec:\1xxfffx.exe71⤵PID:3848
-
\??\c:\flllfrr.exec:\flllfrr.exe72⤵PID:1916
-
\??\c:\bntthb.exec:\bntthb.exe73⤵PID:4520
-
\??\c:\ttbbtt.exec:\ttbbtt.exe74⤵PID:4104
-
\??\c:\ddjjj.exec:\ddjjj.exe75⤵PID:5008
-
\??\c:\flffllr.exec:\flffllr.exe76⤵PID:1716
-
\??\c:\lllxrxr.exec:\lllxrxr.exe77⤵PID:3724
-
\??\c:\bbtthh.exec:\bbtthh.exe78⤵PID:3528
-
\??\c:\nbhhnh.exec:\nbhhnh.exe79⤵PID:4544
-
\??\c:\pjdvj.exec:\pjdvj.exe80⤵PID:3780
-
\??\c:\jjjjd.exec:\jjjjd.exe81⤵PID:3604
-
\??\c:\lrrrlll.exec:\lrrrlll.exe82⤵PID:3548
-
\??\c:\ffxrrrr.exec:\ffxrrrr.exe83⤵PID:3000
-
\??\c:\bbtnbb.exec:\bbtnbb.exe84⤵PID:3252
-
\??\c:\nhbthh.exec:\nhbthh.exe85⤵PID:3748
-
\??\c:\pdjvv.exec:\pdjvv.exe86⤵PID:3932
-
\??\c:\jjddj.exec:\jjddj.exe87⤵PID:4592
-
\??\c:\xflllxx.exec:\xflllxx.exe88⤵PID:944
-
\??\c:\xrxxxfx.exec:\xrxxxfx.exe89⤵PID:4352
-
\??\c:\nbnnht.exec:\nbnnht.exe90⤵PID:4356
-
\??\c:\hnnttn.exec:\hnnttn.exe91⤵PID:4980
-
\??\c:\ppjjp.exec:\ppjjp.exe92⤵PID:4516
-
\??\c:\jddjv.exec:\jddjv.exe93⤵PID:220
-
\??\c:\ffxrxfl.exec:\ffxrxfl.exe94⤵PID:5092
-
\??\c:\xflrrll.exec:\xflrrll.exe95⤵PID:2284
-
\??\c:\bhttbh.exec:\bhttbh.exe96⤵PID:340
-
\??\c:\ttnttb.exec:\ttnttb.exe97⤵
- System Location Discovery: System Language Discovery
PID:2148 -
\??\c:\5ttttt.exec:\5ttttt.exe98⤵PID:2412
-
\??\c:\jjpjd.exec:\jjpjd.exe99⤵PID:4792
-
\??\c:\7pvpj.exec:\7pvpj.exe100⤵PID:828
-
\??\c:\5xflxff.exec:\5xflxff.exe101⤵PID:1828
-
\??\c:\fxxrfll.exec:\fxxrfll.exe102⤵PID:2772
-
\??\c:\bthnnn.exec:\bthnnn.exe103⤵PID:4996
-
\??\c:\9thhhn.exec:\9thhhn.exe104⤵PID:996
-
\??\c:\vjpjd.exec:\vjpjd.exe105⤵PID:1192
-
\??\c:\9vddv.exec:\9vddv.exe106⤵PID:940
-
\??\c:\frffxff.exec:\frffxff.exe107⤵PID:2268
-
\??\c:\llrrrff.exec:\llrrrff.exe108⤵PID:4892
-
\??\c:\hhhhbh.exec:\hhhhbh.exe109⤵PID:3468
-
\??\c:\hntttt.exec:\hntttt.exe110⤵PID:4020
-
\??\c:\vdjvj.exec:\vdjvj.exe111⤵PID:2852
-
\??\c:\xxffxxx.exec:\xxffxxx.exe112⤵PID:2352
-
\??\c:\fxlrrlr.exec:\fxlrrlr.exe113⤵PID:4132
-
\??\c:\nnnntb.exec:\nnnntb.exe114⤵PID:3920
-
\??\c:\3httbh.exec:\3httbh.exe115⤵PID:836
-
\??\c:\1tbbtn.exec:\1tbbtn.exe116⤵PID:4644
-
\??\c:\vddjd.exec:\vddjd.exe117⤵PID:4876
-
\??\c:\vvjjp.exec:\vvjjp.exe118⤵PID:1056
-
\??\c:\xrllfll.exec:\xrllfll.exe119⤵PID:4708
-
\??\c:\rfxrrxx.exec:\rfxrrxx.exe120⤵PID:1604
-
\??\c:\nhtttt.exec:\nhtttt.exe121⤵PID:4860
-
\??\c:\hnnnnt.exec:\hnnnnt.exe122⤵PID:1880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-