Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 03:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869.exe
-
Size
65KB
-
MD5
7bb7e715ea25c8a1a922af47cfac55e9
-
SHA1
36e7d34a40e4ec9a683a16b1ac00b79f6661a932
-
SHA256
ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869
-
SHA512
83fdb769e79e4b20ae49d4d459ce847e5e3565b4c6ad26267a1997142238dba7526c877052f00b06b0e08e7eae7d2cfeb41cb438ad4b00e68e46bb6102a7ee2a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Bqfl9:ymb3NkkiQ3mdBjFI9cqf7
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2948-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3788-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4232 9pvjd.exe 116 1llxrll.exe 964 bbtbnn.exe 3428 tntnhh.exe 3896 dpvvd.exe 3184 nbhhht.exe 1692 djpjd.exe 1900 7jpdv.exe 1104 fxxxlxx.exe 4828 nhhhhh.exe 2632 dvjjd.exe 1628 xrxxlll.exe 3788 rfrrffl.exe 1548 btthbn.exe 1172 pvvvp.exe 1904 rfllxxl.exe 2044 tnhbbb.exe 4276 3pjvp.exe 4736 jddvj.exe 4084 xrflrlr.exe 3008 bnnnnh.exe 1688 fxxxxll.exe 2020 frfxxrl.exe 2352 nbhhbb.exe 4384 dvpjv.exe 3476 rrrlxff.exe 2112 hthhbb.exe 1220 3thbbt.exe 4324 djpdv.exe 1928 jvdvj.exe 4772 3tthbb.exe 3868 pddvp.exe 1112 lfxrfff.exe 5048 fxllrrx.exe 4224 5tbbbb.exe 4508 1bttnn.exe 864 pjdvv.exe 3952 lflfrlx.exe 3932 rflfxxr.exe 4996 bthtnn.exe 4300 vjjdv.exe 744 frxrlll.exe 2836 bhnhbt.exe 3976 vjdvj.exe 4048 fxrrrrf.exe 2848 bbbbtt.exe 1756 nhnnnh.exe 1636 dpppd.exe 5024 7fxrlxx.exe 3316 lxrlffx.exe 3472 3nhnnh.exe 4184 jjddp.exe 5036 fxlrlll.exe 2040 lrllxrl.exe 2080 hhttnn.exe 1900 thnhbb.exe 4748 vdjdv.exe 4784 fllfxxr.exe 3548 bnhbtt.exe 1108 bbnhtt.exe 2108 vvvpj.exe 2216 ffxrxxr.exe 3456 ntnhnn.exe 1828 dvjjj.exe -
resource yara_rule behavioral2/memory/2948-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3788-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2948 wrote to memory of 4232 2948 ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869.exe 82 PID 2948 wrote to memory of 4232 2948 ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869.exe 82 PID 2948 wrote to memory of 4232 2948 ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869.exe 82 PID 4232 wrote to memory of 116 4232 9pvjd.exe 83 PID 4232 wrote to memory of 116 4232 9pvjd.exe 83 PID 4232 wrote to memory of 116 4232 9pvjd.exe 83 PID 116 wrote to memory of 964 116 1llxrll.exe 84 PID 116 wrote to memory of 964 116 1llxrll.exe 84 PID 116 wrote to memory of 964 116 1llxrll.exe 84 PID 964 wrote to memory of 3428 964 bbtbnn.exe 85 PID 964 wrote to memory of 3428 964 bbtbnn.exe 85 PID 964 wrote to memory of 3428 964 bbtbnn.exe 85 PID 3428 wrote to memory of 3896 3428 tntnhh.exe 86 PID 3428 wrote to memory of 3896 3428 tntnhh.exe 86 PID 3428 wrote to memory of 3896 3428 tntnhh.exe 86 PID 3896 wrote to memory of 3184 3896 dpvvd.exe 87 PID 3896 wrote to memory of 3184 3896 dpvvd.exe 87 PID 3896 wrote to memory of 3184 3896 dpvvd.exe 87 PID 3184 wrote to memory of 1692 3184 nbhhht.exe 88 PID 3184 wrote to memory of 1692 3184 nbhhht.exe 88 PID 3184 wrote to memory of 1692 3184 nbhhht.exe 88 PID 1692 wrote to memory of 1900 1692 djpjd.exe 89 PID 1692 wrote to memory of 1900 1692 djpjd.exe 89 PID 1692 wrote to memory of 1900 1692 djpjd.exe 89 PID 1900 wrote to memory of 1104 1900 7jpdv.exe 90 PID 1900 wrote to memory of 1104 1900 7jpdv.exe 90 PID 1900 wrote to memory of 1104 1900 7jpdv.exe 90 PID 1104 wrote to memory of 4828 1104 fxxxlxx.exe 91 PID 1104 wrote to memory of 4828 1104 fxxxlxx.exe 91 PID 1104 wrote to memory of 4828 1104 fxxxlxx.exe 91 PID 4828 wrote to memory of 2632 4828 nhhhhh.exe 92 PID 4828 wrote to memory of 2632 4828 nhhhhh.exe 92 PID 4828 wrote to memory of 2632 4828 nhhhhh.exe 92 PID 2632 wrote to memory of 1628 2632 dvjjd.exe 93 PID 2632 wrote to memory of 1628 2632 dvjjd.exe 93 PID 2632 wrote to memory of 1628 2632 dvjjd.exe 93 PID 1628 wrote to memory of 3788 1628 xrxxlll.exe 94 PID 1628 wrote to memory of 3788 1628 xrxxlll.exe 94 PID 1628 wrote to memory of 3788 1628 xrxxlll.exe 94 PID 3788 wrote to memory of 1548 3788 rfrrffl.exe 95 PID 3788 wrote to memory of 1548 3788 rfrrffl.exe 95 PID 3788 wrote to memory of 1548 3788 rfrrffl.exe 95 PID 1548 wrote to memory of 1172 1548 btthbn.exe 96 PID 1548 wrote to memory of 1172 1548 btthbn.exe 96 PID 1548 wrote to memory of 1172 1548 btthbn.exe 96 PID 1172 wrote to memory of 1904 1172 pvvvp.exe 97 PID 1172 wrote to memory of 1904 1172 pvvvp.exe 97 PID 1172 wrote to memory of 1904 1172 pvvvp.exe 97 PID 1904 wrote to memory of 2044 1904 rfllxxl.exe 98 PID 1904 wrote to memory of 2044 1904 rfllxxl.exe 98 PID 1904 wrote to memory of 2044 1904 rfllxxl.exe 98 PID 2044 wrote to memory of 4276 2044 tnhbbb.exe 99 PID 2044 wrote to memory of 4276 2044 tnhbbb.exe 99 PID 2044 wrote to memory of 4276 2044 tnhbbb.exe 99 PID 4276 wrote to memory of 4736 4276 3pjvp.exe 100 PID 4276 wrote to memory of 4736 4276 3pjvp.exe 100 PID 4276 wrote to memory of 4736 4276 3pjvp.exe 100 PID 4736 wrote to memory of 4084 4736 jddvj.exe 101 PID 4736 wrote to memory of 4084 4736 jddvj.exe 101 PID 4736 wrote to memory of 4084 4736 jddvj.exe 101 PID 4084 wrote to memory of 3008 4084 xrflrlr.exe 102 PID 4084 wrote to memory of 3008 4084 xrflrlr.exe 102 PID 4084 wrote to memory of 3008 4084 xrflrlr.exe 102 PID 3008 wrote to memory of 1688 3008 bnnnnh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869.exe"C:\Users\Admin\AppData\Local\Temp\ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\9pvjd.exec:\9pvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\1llxrll.exec:\1llxrll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\bbtbnn.exec:\bbtbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\tntnhh.exec:\tntnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\dpvvd.exec:\dpvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\nbhhht.exec:\nbhhht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\djpjd.exec:\djpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\7jpdv.exec:\7jpdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\fxxxlxx.exec:\fxxxlxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\nhhhhh.exec:\nhhhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\dvjjd.exec:\dvjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xrxxlll.exec:\xrxxlll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\rfrrffl.exec:\rfrrffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\btthbn.exec:\btthbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\pvvvp.exec:\pvvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\rfllxxl.exec:\rfllxxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\tnhbbb.exec:\tnhbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\3pjvp.exec:\3pjvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\jddvj.exec:\jddvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\xrflrlr.exec:\xrflrlr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\bnnnnh.exec:\bnnnnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\fxxxxll.exec:\fxxxxll.exe23⤵
- Executes dropped EXE
PID:1688 -
\??\c:\frfxxrl.exec:\frfxxrl.exe24⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nbhhbb.exec:\nbhhbb.exe25⤵
- Executes dropped EXE
PID:2352 -
\??\c:\dvpjv.exec:\dvpjv.exe26⤵
- Executes dropped EXE
PID:4384 -
\??\c:\rrrlxff.exec:\rrrlxff.exe27⤵
- Executes dropped EXE
PID:3476 -
\??\c:\hthhbb.exec:\hthhbb.exe28⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3thbbt.exec:\3thbbt.exe29⤵
- Executes dropped EXE
PID:1220 -
\??\c:\djpdv.exec:\djpdv.exe30⤵
- Executes dropped EXE
PID:4324 -
\??\c:\jvdvj.exec:\jvdvj.exe31⤵
- Executes dropped EXE
PID:1928 -
\??\c:\3tthbb.exec:\3tthbb.exe32⤵
- Executes dropped EXE
PID:4772 -
\??\c:\pddvp.exec:\pddvp.exe33⤵
- Executes dropped EXE
PID:3868 -
\??\c:\lfxrfff.exec:\lfxrfff.exe34⤵
- Executes dropped EXE
PID:1112 -
\??\c:\fxllrrx.exec:\fxllrrx.exe35⤵
- Executes dropped EXE
PID:5048 -
\??\c:\5tbbbb.exec:\5tbbbb.exe36⤵
- Executes dropped EXE
PID:4224 -
\??\c:\1bttnn.exec:\1bttnn.exe37⤵
- Executes dropped EXE
PID:4508 -
\??\c:\pjdvv.exec:\pjdvv.exe38⤵
- Executes dropped EXE
PID:864 -
\??\c:\lflfrlx.exec:\lflfrlx.exe39⤵
- Executes dropped EXE
PID:3952 -
\??\c:\rflfxxr.exec:\rflfxxr.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3932 -
\??\c:\bthtnn.exec:\bthtnn.exe41⤵
- Executes dropped EXE
PID:4996 -
\??\c:\vjjdv.exec:\vjjdv.exe42⤵
- Executes dropped EXE
PID:4300 -
\??\c:\frxrlll.exec:\frxrlll.exe43⤵
- Executes dropped EXE
PID:744 -
\??\c:\bhnhbt.exec:\bhnhbt.exe44⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vjdvj.exec:\vjdvj.exe45⤵
- Executes dropped EXE
PID:3976 -
\??\c:\fxrrrrf.exec:\fxrrrrf.exe46⤵
- Executes dropped EXE
PID:4048 -
\??\c:\bbbbtt.exec:\bbbbtt.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\nhnnnh.exec:\nhnnnh.exe48⤵
- Executes dropped EXE
PID:1756 -
\??\c:\dpppd.exec:\dpppd.exe49⤵
- Executes dropped EXE
PID:1636 -
\??\c:\7fxrlxx.exec:\7fxrlxx.exe50⤵
- Executes dropped EXE
PID:5024 -
\??\c:\lxrlffx.exec:\lxrlffx.exe51⤵
- Executes dropped EXE
PID:3316 -
\??\c:\3nhnnh.exec:\3nhnnh.exe52⤵
- Executes dropped EXE
PID:3472 -
\??\c:\jjddp.exec:\jjddp.exe53⤵
- Executes dropped EXE
PID:4184 -
\??\c:\fxlrlll.exec:\fxlrlll.exe54⤵
- Executes dropped EXE
PID:5036 -
\??\c:\lrllxrl.exec:\lrllxrl.exe55⤵
- Executes dropped EXE
PID:2040 -
\??\c:\hhttnn.exec:\hhttnn.exe56⤵
- Executes dropped EXE
PID:2080 -
\??\c:\thnhbb.exec:\thnhbb.exe57⤵
- Executes dropped EXE
PID:1900 -
\??\c:\vdjdv.exec:\vdjdv.exe58⤵
- Executes dropped EXE
PID:4748 -
\??\c:\fllfxxr.exec:\fllfxxr.exe59⤵
- Executes dropped EXE
PID:4784 -
\??\c:\bnhbtt.exec:\bnhbtt.exe60⤵
- Executes dropped EXE
PID:3548 -
\??\c:\bbnhtt.exec:\bbnhtt.exe61⤵
- Executes dropped EXE
PID:1108 -
\??\c:\vvvpj.exec:\vvvpj.exe62⤵
- Executes dropped EXE
PID:2108 -
\??\c:\ffxrxxr.exec:\ffxrxxr.exe63⤵
- Executes dropped EXE
PID:2216 -
\??\c:\ntnhnn.exec:\ntnhnn.exe64⤵
- Executes dropped EXE
PID:3456 -
\??\c:\dvjjj.exec:\dvjjj.exe65⤵
- Executes dropped EXE
PID:1828 -
\??\c:\9frlrrr.exec:\9frlrrr.exe66⤵PID:996
-
\??\c:\hthhbb.exec:\hthhbb.exe67⤵PID:2752
-
\??\c:\9tttnb.exec:\9tttnb.exe68⤵PID:2044
-
\??\c:\jpvpv.exec:\jpvpv.exe69⤵PID:5112
-
\??\c:\lxlfrrf.exec:\lxlfrrf.exe70⤵PID:2872
-
\??\c:\rlrrlrx.exec:\rlrrlrx.exe71⤵PID:316
-
\??\c:\nhtbbn.exec:\nhtbbn.exe72⤵PID:2136
-
\??\c:\pjvpp.exec:\pjvpp.exe73⤵PID:2716
-
\??\c:\dpppj.exec:\dpppj.exe74⤵PID:1096
-
\??\c:\lllxlrl.exec:\lllxlrl.exe75⤵PID:2852
-
\??\c:\fffrlll.exec:\fffrlll.exe76⤵PID:3268
-
\??\c:\tnbbbb.exec:\tnbbbb.exe77⤵PID:2352
-
\??\c:\nnnhhb.exec:\nnnhhb.exe78⤵PID:4384
-
\??\c:\djpjv.exec:\djpjv.exe79⤵PID:1656
-
\??\c:\5rlxlrl.exec:\5rlxlrl.exe80⤵PID:5088
-
\??\c:\xlxxfff.exec:\xlxxfff.exe81⤵PID:1760
-
\??\c:\ntnttn.exec:\ntnttn.exe82⤵PID:2700
-
\??\c:\bbhbtt.exec:\bbhbtt.exe83⤵PID:2144
-
\??\c:\jdppp.exec:\jdppp.exe84⤵PID:1500
-
\??\c:\rrxrrrx.exec:\rrxrrrx.exe85⤵PID:1608
-
\??\c:\ntbbtn.exec:\ntbbtn.exe86⤵PID:1964
-
\??\c:\tnhbnn.exec:\tnhbnn.exe87⤵PID:3344
-
\??\c:\pjvdv.exec:\pjvdv.exe88⤵PID:4320
-
\??\c:\jdddv.exec:\jdddv.exe89⤵PID:392
-
\??\c:\9ffxrrf.exec:\9ffxrrf.exe90⤵PID:4224
-
\??\c:\tttbhh.exec:\tttbhh.exe91⤵PID:3844
-
\??\c:\jvdvd.exec:\jvdvd.exe92⤵PID:4344
-
\??\c:\dvdvp.exec:\dvdvp.exe93⤵PID:1564
-
\??\c:\rlllxxf.exec:\rlllxxf.exe94⤵PID:3200
-
\??\c:\rlrxxfr.exec:\rlrxxfr.exe95⤵PID:4304
-
\??\c:\bbbhbb.exec:\bbbhbb.exe96⤵PID:3304
-
\??\c:\7pjdv.exec:\7pjdv.exe97⤵PID:320
-
\??\c:\jvvvj.exec:\jvvvj.exe98⤵PID:4864
-
\??\c:\xxllllf.exec:\xxllllf.exe99⤵PID:3020
-
\??\c:\3nbbbb.exec:\3nbbbb.exe100⤵PID:4740
-
\??\c:\tbnhtt.exec:\tbnhtt.exe101⤵PID:4144
-
\??\c:\3dppj.exec:\3dppj.exe102⤵PID:3956
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe103⤵PID:3536
-
\??\c:\hnhhbb.exec:\hnhhbb.exe104⤵PID:3896
-
\??\c:\bbnnhn.exec:\bbnnhn.exe105⤵PID:556
-
\??\c:\ppdvp.exec:\ppdvp.exe106⤵PID:4492
-
\??\c:\xlfrrlr.exec:\xlfrrlr.exe107⤵PID:4012
-
\??\c:\lxffffx.exec:\lxffffx.exe108⤵PID:1856
-
\??\c:\5dvdv.exec:\5dvdv.exe109⤵
- System Location Discovery: System Language Discovery
PID:4184 -
\??\c:\1vpjd.exec:\1vpjd.exe110⤵PID:3692
-
\??\c:\xlrlxfx.exec:\xlrlxfx.exe111⤵PID:4544
-
\??\c:\rlllffx.exec:\rlllffx.exe112⤵PID:1568
-
\??\c:\bbhbnt.exec:\bbhbnt.exe113⤵PID:1556
-
\??\c:\vpdvd.exec:\vpdvd.exe114⤵PID:3992
-
\??\c:\rllfxlf.exec:\rllfxlf.exe115⤵PID:3676
-
\??\c:\rrllxxf.exec:\rrllxxf.exe116⤵PID:2628
-
\??\c:\bnnnhh.exec:\bnnnhh.exe117⤵PID:1392
-
\??\c:\pppvp.exec:\pppvp.exe118⤵PID:3424
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe119⤵PID:2108
-
\??\c:\llffxxx.exec:\llffxxx.exe120⤵PID:372
-
\??\c:\bhhhbb.exec:\bhhhbb.exe121⤵PID:4024
-
\??\c:\htnhbh.exec:\htnhbh.exe122⤵PID:1164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-