Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 02:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d3eaa85f7250ecd299e03d4c48a6e703550ab96480f610b0baede0ff908c46e9.exe
Resource
win7-20240729-en
6 signatures
150 seconds
General
-
Target
d3eaa85f7250ecd299e03d4c48a6e703550ab96480f610b0baede0ff908c46e9.exe
-
Size
69KB
-
MD5
403b38f01975cfdf435bb3fd78401e0f
-
SHA1
f19e634522705e9af1cbfc8ca917be32436607cf
-
SHA256
d3eaa85f7250ecd299e03d4c48a6e703550ab96480f610b0baede0ff908c46e9
-
SHA512
842198cbc6bc377f56be6688ea7e55b1436e60f88107df80318684429853ba30caf79c19d08fb7661948d936653c76c0432c61657b586e6d38a7fa79712904dd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjI:ymb3NkkiQ3mdBjFI4VY
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1508-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2996 nntttb.exe 212 jdvpj.exe 1544 jvvpj.exe 3040 lrrxffx.exe 2096 bthbhh.exe 4364 5vdjd.exe 4284 fflrllf.exe 988 thnhbb.exe 4408 dvpjd.exe 4520 pddvp.exe 752 tnhbhh.exe 4020 pjpjd.exe 1752 xflfxrx.exe 3192 tnnhbb.exe 4776 bnbhnh.exe 756 jvjdv.exe 3000 rlffxxf.exe 384 nhhhhh.exe 4956 9jppp.exe 2376 ppdpp.exe 3752 3xxrlrl.exe 1744 hhbbhn.exe 3984 7jvpp.exe 4308 jdjdv.exe 3624 rlflflf.exe 2116 thbbtb.exe 3776 5pddd.exe 3692 jdppv.exe 3944 xrrlfff.exe 1392 bbhhhh.exe 1184 dvppj.exe 3836 vdvpj.exe 2256 xlfffll.exe 4788 rfrrlrl.exe 2092 9hnnnn.exe 4400 bthbnn.exe 4160 7vvvp.exe 4884 5djjd.exe 1436 vvvpj.exe 2760 rrrxrfl.exe 2596 rfllflf.exe 2980 hhttnn.exe 1228 tntnhh.exe 4756 jjjdp.exe 1852 vjvpj.exe 5092 xrxrrrl.exe 1792 fflllxx.exe 4476 nthhnn.exe 3840 bbbbbh.exe 3996 vvvdj.exe 3932 1pjjv.exe 3268 xrxlffx.exe 3360 ffxxrrf.exe 4520 bthhbb.exe 460 bthbtt.exe 4644 jvpjd.exe 4620 5pdvj.exe 4020 pdjpj.exe 4940 fxxrllf.exe 3192 frxlrrr.exe 2004 tbnhhh.exe 4008 pjvvv.exe 4064 dvddd.exe 2216 ppppd.exe -
resource yara_rule behavioral2/memory/1508-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3040-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2996 1508 d3eaa85f7250ecd299e03d4c48a6e703550ab96480f610b0baede0ff908c46e9.exe 83 PID 1508 wrote to memory of 2996 1508 d3eaa85f7250ecd299e03d4c48a6e703550ab96480f610b0baede0ff908c46e9.exe 83 PID 1508 wrote to memory of 2996 1508 d3eaa85f7250ecd299e03d4c48a6e703550ab96480f610b0baede0ff908c46e9.exe 83 PID 2996 wrote to memory of 212 2996 nntttb.exe 84 PID 2996 wrote to memory of 212 2996 nntttb.exe 84 PID 2996 wrote to memory of 212 2996 nntttb.exe 84 PID 212 wrote to memory of 1544 212 jdvpj.exe 85 PID 212 wrote to memory of 1544 212 jdvpj.exe 85 PID 212 wrote to memory of 1544 212 jdvpj.exe 85 PID 1544 wrote to memory of 3040 1544 jvvpj.exe 86 PID 1544 wrote to memory of 3040 1544 jvvpj.exe 86 PID 1544 wrote to memory of 3040 1544 jvvpj.exe 86 PID 3040 wrote to memory of 2096 3040 lrrxffx.exe 87 PID 3040 wrote to memory of 2096 3040 lrrxffx.exe 87 PID 3040 wrote to memory of 2096 3040 lrrxffx.exe 87 PID 2096 wrote to memory of 4364 2096 bthbhh.exe 88 PID 2096 wrote to memory of 4364 2096 bthbhh.exe 88 PID 2096 wrote to memory of 4364 2096 bthbhh.exe 88 PID 4364 wrote to memory of 4284 4364 5vdjd.exe 89 PID 4364 wrote to memory of 4284 4364 5vdjd.exe 89 PID 4364 wrote to memory of 4284 4364 5vdjd.exe 89 PID 4284 wrote to memory of 988 4284 fflrllf.exe 90 PID 4284 wrote to memory of 988 4284 fflrllf.exe 90 PID 4284 wrote to memory of 988 4284 fflrllf.exe 90 PID 988 wrote to memory of 4408 988 thnhbb.exe 92 PID 988 wrote to memory of 4408 988 thnhbb.exe 92 PID 988 wrote to memory of 4408 988 thnhbb.exe 92 PID 4408 wrote to memory of 4520 4408 dvpjd.exe 93 PID 4408 wrote to memory of 4520 4408 dvpjd.exe 93 PID 4408 wrote to memory of 4520 4408 dvpjd.exe 93 PID 4520 wrote to memory of 752 4520 pddvp.exe 94 PID 4520 wrote to memory of 752 4520 pddvp.exe 94 PID 4520 wrote to memory of 752 4520 pddvp.exe 94 PID 752 wrote to memory of 4020 752 tnhbhh.exe 95 PID 752 wrote to memory of 4020 752 tnhbhh.exe 95 PID 752 wrote to memory of 4020 752 tnhbhh.exe 95 PID 4020 wrote to memory of 1752 4020 pjpjd.exe 96 PID 4020 wrote to memory of 1752 4020 pjpjd.exe 96 PID 4020 wrote to memory of 1752 4020 pjpjd.exe 96 PID 1752 wrote to memory of 3192 1752 xflfxrx.exe 97 PID 1752 wrote to memory of 3192 1752 xflfxrx.exe 97 PID 1752 wrote to memory of 3192 1752 xflfxrx.exe 97 PID 3192 wrote to memory of 4776 3192 tnnhbb.exe 98 PID 3192 wrote to memory of 4776 3192 tnnhbb.exe 98 PID 3192 wrote to memory of 4776 3192 tnnhbb.exe 98 PID 4776 wrote to memory of 756 4776 bnbhnh.exe 99 PID 4776 wrote to memory of 756 4776 bnbhnh.exe 99 PID 4776 wrote to memory of 756 4776 bnbhnh.exe 99 PID 756 wrote to memory of 3000 756 jvjdv.exe 100 PID 756 wrote to memory of 3000 756 jvjdv.exe 100 PID 756 wrote to memory of 3000 756 jvjdv.exe 100 PID 3000 wrote to memory of 384 3000 rlffxxf.exe 102 PID 3000 wrote to memory of 384 3000 rlffxxf.exe 102 PID 3000 wrote to memory of 384 3000 rlffxxf.exe 102 PID 384 wrote to memory of 4956 384 nhhhhh.exe 103 PID 384 wrote to memory of 4956 384 nhhhhh.exe 103 PID 384 wrote to memory of 4956 384 nhhhhh.exe 103 PID 4956 wrote to memory of 2376 4956 9jppp.exe 104 PID 4956 wrote to memory of 2376 4956 9jppp.exe 104 PID 4956 wrote to memory of 2376 4956 9jppp.exe 104 PID 2376 wrote to memory of 3752 2376 ppdpp.exe 106 PID 2376 wrote to memory of 3752 2376 ppdpp.exe 106 PID 2376 wrote to memory of 3752 2376 ppdpp.exe 106 PID 3752 wrote to memory of 1744 3752 3xxrlrl.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3eaa85f7250ecd299e03d4c48a6e703550ab96480f610b0baede0ff908c46e9.exe"C:\Users\Admin\AppData\Local\Temp\d3eaa85f7250ecd299e03d4c48a6e703550ab96480f610b0baede0ff908c46e9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\nntttb.exec:\nntttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\jdvpj.exec:\jdvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\jvvpj.exec:\jvvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\lrrxffx.exec:\lrrxffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\bthbhh.exec:\bthbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\5vdjd.exec:\5vdjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\fflrllf.exec:\fflrllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\thnhbb.exec:\thnhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\dvpjd.exec:\dvpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\pddvp.exec:\pddvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\tnhbhh.exec:\tnhbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\pjpjd.exec:\pjpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\xflfxrx.exec:\xflfxrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\tnnhbb.exec:\tnnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\bnbhnh.exec:\bnbhnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\jvjdv.exec:\jvjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\rlffxxf.exec:\rlffxxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\nhhhhh.exec:\nhhhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\9jppp.exec:\9jppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\ppdpp.exec:\ppdpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\3xxrlrl.exec:\3xxrlrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\hhbbhn.exec:\hhbbhn.exe23⤵
- Executes dropped EXE
PID:1744 -
\??\c:\7jvpp.exec:\7jvpp.exe24⤵
- Executes dropped EXE
PID:3984 -
\??\c:\jdjdv.exec:\jdjdv.exe25⤵
- Executes dropped EXE
PID:4308 -
\??\c:\rlflflf.exec:\rlflflf.exe26⤵
- Executes dropped EXE
PID:3624 -
\??\c:\thbbtb.exec:\thbbtb.exe27⤵
- Executes dropped EXE
PID:2116 -
\??\c:\5pddd.exec:\5pddd.exe28⤵
- Executes dropped EXE
PID:3776 -
\??\c:\jdppv.exec:\jdppv.exe29⤵
- Executes dropped EXE
PID:3692 -
\??\c:\xrrlfff.exec:\xrrlfff.exe30⤵
- Executes dropped EXE
PID:3944 -
\??\c:\bbhhhh.exec:\bbhhhh.exe31⤵
- Executes dropped EXE
PID:1392 -
\??\c:\dvppj.exec:\dvppj.exe32⤵
- Executes dropped EXE
PID:1184 -
\??\c:\vdvpj.exec:\vdvpj.exe33⤵
- Executes dropped EXE
PID:3836 -
\??\c:\xlfffll.exec:\xlfffll.exe34⤵
- Executes dropped EXE
PID:2256 -
\??\c:\rfrrlrl.exec:\rfrrlrl.exe35⤵
- Executes dropped EXE
PID:4788 -
\??\c:\9hnnnn.exec:\9hnnnn.exe36⤵
- Executes dropped EXE
PID:2092 -
\??\c:\bthbnn.exec:\bthbnn.exe37⤵
- Executes dropped EXE
PID:4400 -
\??\c:\7vvvp.exec:\7vvvp.exe38⤵
- Executes dropped EXE
PID:4160 -
\??\c:\5djjd.exec:\5djjd.exe39⤵
- Executes dropped EXE
PID:4884 -
\??\c:\vvvpj.exec:\vvvpj.exe40⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rrrxrfl.exec:\rrrxrfl.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rfllflf.exec:\rfllflf.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hhttnn.exec:\hhttnn.exe43⤵
- Executes dropped EXE
PID:2980 -
\??\c:\tntnhh.exec:\tntnhh.exe44⤵
- Executes dropped EXE
PID:1228 -
\??\c:\jjjdp.exec:\jjjdp.exe45⤵
- Executes dropped EXE
PID:4756 -
\??\c:\vjvpj.exec:\vjvpj.exe46⤵
- Executes dropped EXE
PID:1852 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe47⤵
- Executes dropped EXE
PID:5092 -
\??\c:\fflllxx.exec:\fflllxx.exe48⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nthhnn.exec:\nthhnn.exe49⤵
- Executes dropped EXE
PID:4476 -
\??\c:\bbbbbh.exec:\bbbbbh.exe50⤵
- Executes dropped EXE
PID:3840 -
\??\c:\vvvdj.exec:\vvvdj.exe51⤵
- Executes dropped EXE
PID:3996 -
\??\c:\1pjjv.exec:\1pjjv.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3932 -
\??\c:\xrxlffx.exec:\xrxlffx.exe53⤵
- Executes dropped EXE
PID:3268 -
\??\c:\ffxxrrf.exec:\ffxxrrf.exe54⤵
- Executes dropped EXE
PID:3360 -
\??\c:\bthhbb.exec:\bthhbb.exe55⤵
- Executes dropped EXE
PID:4520 -
\??\c:\bthbtt.exec:\bthbtt.exe56⤵
- Executes dropped EXE
PID:460 -
\??\c:\jvpjd.exec:\jvpjd.exe57⤵
- Executes dropped EXE
PID:4644 -
\??\c:\5pdvj.exec:\5pdvj.exe58⤵
- Executes dropped EXE
PID:4620 -
\??\c:\pdjpj.exec:\pdjpj.exe59⤵
- Executes dropped EXE
PID:4020 -
\??\c:\fxxrllf.exec:\fxxrllf.exe60⤵
- Executes dropped EXE
PID:4940 -
\??\c:\frxlrrr.exec:\frxlrrr.exe61⤵
- Executes dropped EXE
PID:3192 -
\??\c:\tbnhhh.exec:\tbnhhh.exe62⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pjvvv.exec:\pjvvv.exe63⤵
- Executes dropped EXE
PID:4008 -
\??\c:\dvddd.exec:\dvddd.exe64⤵
- Executes dropped EXE
PID:4064 -
\??\c:\ppppd.exec:\ppppd.exe65⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xflrlrr.exec:\xflrlrr.exe66⤵PID:1148
-
\??\c:\bthnnt.exec:\bthnnt.exe67⤵PID:1596
-
\??\c:\hbbtnt.exec:\hbbtnt.exe68⤵PID:4208
-
\??\c:\jpdpv.exec:\jpdpv.exe69⤵PID:4468
-
\??\c:\jvpvv.exec:\jvpvv.exe70⤵PID:4864
-
\??\c:\fxffxff.exec:\fxffxff.exe71⤵PID:3124
-
\??\c:\rrrxxff.exec:\rrrxxff.exe72⤵PID:1972
-
\??\c:\hbtnnn.exec:\hbtnnn.exe73⤵PID:1744
-
\??\c:\bbttbb.exec:\bbttbb.exe74⤵PID:2000
-
\??\c:\ppppp.exec:\ppppp.exe75⤵PID:3176
-
\??\c:\vjppv.exec:\vjppv.exe76⤵PID:3144
-
\??\c:\ffxfxlr.exec:\ffxfxlr.exe77⤵PID:3400
-
\??\c:\nhhhbh.exec:\nhhhbh.exe78⤵PID:4528
-
\??\c:\nnbbbh.exec:\nnbbbh.exe79⤵PID:1252
-
\??\c:\vvvpj.exec:\vvvpj.exe80⤵PID:3620
-
\??\c:\dpjpv.exec:\dpjpv.exe81⤵PID:428
-
\??\c:\rlfffll.exec:\rlfffll.exe82⤵PID:3816
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe83⤵PID:3388
-
\??\c:\nnnnhh.exec:\nnnnhh.exe84⤵PID:3976
-
\??\c:\nntttb.exec:\nntttb.exe85⤵PID:5108
-
\??\c:\jpppp.exec:\jpppp.exe86⤵PID:1532
-
\??\c:\dvjdj.exec:\dvjdj.exe87⤵PID:3140
-
\??\c:\hbbbtt.exec:\hbbbtt.exe88⤵PID:708
-
\??\c:\nbbtnt.exec:\nbbtnt.exe89⤵PID:804
-
\??\c:\ppvvp.exec:\ppvvp.exe90⤵PID:3484
-
\??\c:\vvddd.exec:\vvddd.exe91⤵PID:4572
-
\??\c:\llrxxff.exec:\llrxxff.exe92⤵PID:2872
-
\??\c:\tntnnt.exec:\tntnnt.exe93⤵PID:4160
-
\??\c:\htbhhn.exec:\htbhhn.exe94⤵PID:4724
-
\??\c:\jdppj.exec:\jdppj.exe95⤵PID:1436
-
\??\c:\pvjdd.exec:\pvjdd.exe96⤵PID:4856
-
\??\c:\frrrlrr.exec:\frrrlrr.exe97⤵PID:1220
-
\??\c:\rrrxxff.exec:\rrrxxff.exe98⤵PID:2980
-
\??\c:\nnbbnn.exec:\nnbbnn.exe99⤵PID:2064
-
\??\c:\3ntbhh.exec:\3ntbhh.exe100⤵PID:5016
-
\??\c:\dvdvj.exec:\dvdvj.exe101⤵PID:4364
-
\??\c:\jvpvd.exec:\jvpvd.exe102⤵PID:1260
-
\??\c:\llrlllf.exec:\llrlllf.exe103⤵PID:2204
-
\??\c:\bbbtnt.exec:\bbbtnt.exe104⤵PID:4476
-
\??\c:\btbntt.exec:\btbntt.exe105⤵PID:2628
-
\??\c:\jjpjp.exec:\jjpjp.exe106⤵PID:3996
-
\??\c:\ddvvp.exec:\ddvvp.exe107⤵PID:3092
-
\??\c:\fflflfx.exec:\fflflfx.exe108⤵PID:3268
-
\??\c:\7ffflll.exec:\7ffflll.exe109⤵PID:3988
-
\??\c:\nhnnnn.exec:\nhnnnn.exe110⤵PID:2752
-
\??\c:\jpvpp.exec:\jpvpp.exe111⤵PID:1636
-
\??\c:\ppvvj.exec:\ppvvj.exe112⤵PID:3684
-
\??\c:\lxlfxfx.exec:\lxlfxfx.exe113⤵PID:2072
-
\??\c:\7frfflr.exec:\7frfflr.exe114⤵PID:3216
-
\??\c:\tbnhbb.exec:\tbnhbb.exe115⤵PID:1908
-
\??\c:\nhhbbb.exec:\nhhbbb.exe116⤵PID:4776
-
\??\c:\3pjjp.exec:\3pjjp.exe117⤵PID:3436
-
\??\c:\xxfllrf.exec:\xxfllrf.exe118⤵PID:1864
-
\??\c:\xxxlxlx.exec:\xxxlxlx.exe119⤵PID:2232
-
\??\c:\9hnnbb.exec:\9hnnbb.exe120⤵PID:2844
-
\??\c:\hntthh.exec:\hntthh.exe121⤵PID:4696
-
\??\c:\dpdjd.exec:\dpdjd.exe122⤵PID:2464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-