Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 07:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7dbafb393425a186561d04d49519e2dbac64af743875a78acdeee99d87fd5ab0N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
7dbafb393425a186561d04d49519e2dbac64af743875a78acdeee99d87fd5ab0N.exe
-
Size
65KB
-
MD5
cae1104739b55f2df4929732745e0d20
-
SHA1
f32b67c6da40c9f9792342a9b61f7ee08772adeb
-
SHA256
7dbafb393425a186561d04d49519e2dbac64af743875a78acdeee99d87fd5ab0
-
SHA512
4fbb7755f4e4ec83deb61f81ebac052a3d202697060634038d24df6c0e42fa76fed94dc1f89aa75e6c7691a6db6e0d803e78cd850a571a406ab9ba539b9d472b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Bq8Du:ymb3NkkiQ3mdBjFI9cqF
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2992-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2472-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2760 pdjdj.exe 4276 rllfxll.exe 940 thnbnh.exe 1084 dpdpp.exe 2544 xlfrfrf.exe 1152 bhnhhn.exe 4672 btnnbb.exe 1148 ppdpj.exe 4256 tbbbbb.exe 3604 tnbhnh.exe 404 ddjvp.exe 264 xxfxrrl.exe 2268 1rxlfff.exe 1772 tnttnt.exe 1584 jjvdd.exe 1520 dppjd.exe 2396 flffffx.exe 4656 xrrllxl.exe 4324 bttntt.exe 2472 vppdv.exe 3676 9rrlxxr.exe 752 hntnhh.exe 3508 hbnnnn.exe 4592 vvvvp.exe 4396 lffxrll.exe 1600 hhhhbb.exe 4048 pjpjj.exe 1800 fxllxrx.exe 3228 bnhhbb.exe 4272 ddddv.exe 3660 vppjd.exe 2152 pdvjd.exe 4708 ntnnhb.exe 2892 tbhhht.exe 3488 vjvvp.exe 4812 1rxfrlf.exe 4932 xlxlxrl.exe 3388 httbtb.exe 4420 nbtnbb.exe 4900 9dvdp.exe 2432 vpvvp.exe 3580 vddpj.exe 2596 fxlfffr.exe 2088 rlxlffx.exe 4820 hntnbt.exe 4448 bnnhhb.exe 2108 rflxxrr.exe 2144 5rlxxrl.exe 2028 nhhbbb.exe 2104 vvdvd.exe 4916 pjvdv.exe 1796 9xxlfff.exe 3124 bhhbnn.exe 4740 dppjj.exe 1184 llflxll.exe 952 9rllfxr.exe 5100 thtnhn.exe 3628 tbhhhh.exe 732 pppjd.exe 4480 dvdvj.exe 4672 fxxlffx.exe 2792 hntttt.exe 3056 hnhhhh.exe 3120 pdjdd.exe -
resource yara_rule behavioral2/memory/2992-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2472-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2992 wrote to memory of 2760 2992 7dbafb393425a186561d04d49519e2dbac64af743875a78acdeee99d87fd5ab0N.exe 82 PID 2992 wrote to memory of 2760 2992 7dbafb393425a186561d04d49519e2dbac64af743875a78acdeee99d87fd5ab0N.exe 82 PID 2992 wrote to memory of 2760 2992 7dbafb393425a186561d04d49519e2dbac64af743875a78acdeee99d87fd5ab0N.exe 82 PID 2760 wrote to memory of 4276 2760 pdjdj.exe 83 PID 2760 wrote to memory of 4276 2760 pdjdj.exe 83 PID 2760 wrote to memory of 4276 2760 pdjdj.exe 83 PID 4276 wrote to memory of 940 4276 rllfxll.exe 84 PID 4276 wrote to memory of 940 4276 rllfxll.exe 84 PID 4276 wrote to memory of 940 4276 rllfxll.exe 84 PID 940 wrote to memory of 1084 940 thnbnh.exe 85 PID 940 wrote to memory of 1084 940 thnbnh.exe 85 PID 940 wrote to memory of 1084 940 thnbnh.exe 85 PID 1084 wrote to memory of 2544 1084 dpdpp.exe 86 PID 1084 wrote to memory of 2544 1084 dpdpp.exe 86 PID 1084 wrote to memory of 2544 1084 dpdpp.exe 86 PID 2544 wrote to memory of 1152 2544 xlfrfrf.exe 87 PID 2544 wrote to memory of 1152 2544 xlfrfrf.exe 87 PID 2544 wrote to memory of 1152 2544 xlfrfrf.exe 87 PID 1152 wrote to memory of 4672 1152 bhnhhn.exe 88 PID 1152 wrote to memory of 4672 1152 bhnhhn.exe 88 PID 1152 wrote to memory of 4672 1152 bhnhhn.exe 88 PID 4672 wrote to memory of 1148 4672 btnnbb.exe 89 PID 4672 wrote to memory of 1148 4672 btnnbb.exe 89 PID 4672 wrote to memory of 1148 4672 btnnbb.exe 89 PID 1148 wrote to memory of 4256 1148 ppdpj.exe 90 PID 1148 wrote to memory of 4256 1148 ppdpj.exe 90 PID 1148 wrote to memory of 4256 1148 ppdpj.exe 90 PID 4256 wrote to memory of 3604 4256 tbbbbb.exe 91 PID 4256 wrote to memory of 3604 4256 tbbbbb.exe 91 PID 4256 wrote to memory of 3604 4256 tbbbbb.exe 91 PID 3604 wrote to memory of 404 3604 tnbhnh.exe 92 PID 3604 wrote to memory of 404 3604 tnbhnh.exe 92 PID 3604 wrote to memory of 404 3604 tnbhnh.exe 92 PID 404 wrote to memory of 264 404 ddjvp.exe 93 PID 404 wrote to memory of 264 404 ddjvp.exe 93 PID 404 wrote to memory of 264 404 ddjvp.exe 93 PID 264 wrote to memory of 2268 264 xxfxrrl.exe 94 PID 264 wrote to memory of 2268 264 xxfxrrl.exe 94 PID 264 wrote to memory of 2268 264 xxfxrrl.exe 94 PID 2268 wrote to memory of 1772 2268 1rxlfff.exe 95 PID 2268 wrote to memory of 1772 2268 1rxlfff.exe 95 PID 2268 wrote to memory of 1772 2268 1rxlfff.exe 95 PID 1772 wrote to memory of 1584 1772 tnttnt.exe 96 PID 1772 wrote to memory of 1584 1772 tnttnt.exe 96 PID 1772 wrote to memory of 1584 1772 tnttnt.exe 96 PID 1584 wrote to memory of 1520 1584 jjvdd.exe 97 PID 1584 wrote to memory of 1520 1584 jjvdd.exe 97 PID 1584 wrote to memory of 1520 1584 jjvdd.exe 97 PID 1520 wrote to memory of 2396 1520 dppjd.exe 98 PID 1520 wrote to memory of 2396 1520 dppjd.exe 98 PID 1520 wrote to memory of 2396 1520 dppjd.exe 98 PID 2396 wrote to memory of 4656 2396 flffffx.exe 99 PID 2396 wrote to memory of 4656 2396 flffffx.exe 99 PID 2396 wrote to memory of 4656 2396 flffffx.exe 99 PID 4656 wrote to memory of 4324 4656 xrrllxl.exe 100 PID 4656 wrote to memory of 4324 4656 xrrllxl.exe 100 PID 4656 wrote to memory of 4324 4656 xrrllxl.exe 100 PID 4324 wrote to memory of 2472 4324 bttntt.exe 101 PID 4324 wrote to memory of 2472 4324 bttntt.exe 101 PID 4324 wrote to memory of 2472 4324 bttntt.exe 101 PID 2472 wrote to memory of 3676 2472 vppdv.exe 102 PID 2472 wrote to memory of 3676 2472 vppdv.exe 102 PID 2472 wrote to memory of 3676 2472 vppdv.exe 102 PID 3676 wrote to memory of 752 3676 9rrlxxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\7dbafb393425a186561d04d49519e2dbac64af743875a78acdeee99d87fd5ab0N.exe"C:\Users\Admin\AppData\Local\Temp\7dbafb393425a186561d04d49519e2dbac64af743875a78acdeee99d87fd5ab0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\pdjdj.exec:\pdjdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\rllfxll.exec:\rllfxll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\thnbnh.exec:\thnbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\dpdpp.exec:\dpdpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\xlfrfrf.exec:\xlfrfrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\bhnhhn.exec:\bhnhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\btnnbb.exec:\btnnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\ppdpj.exec:\ppdpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\tbbbbb.exec:\tbbbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\tnbhnh.exec:\tnbhnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\ddjvp.exec:\ddjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\1rxlfff.exec:\1rxlfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\tnttnt.exec:\tnttnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\jjvdd.exec:\jjvdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\dppjd.exec:\dppjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\flffffx.exec:\flffffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\xrrllxl.exec:\xrrllxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\bttntt.exec:\bttntt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\vppdv.exec:\vppdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\9rrlxxr.exec:\9rrlxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\hntnhh.exec:\hntnhh.exe23⤵
- Executes dropped EXE
PID:752 -
\??\c:\hbnnnn.exec:\hbnnnn.exe24⤵
- Executes dropped EXE
PID:3508 -
\??\c:\vvvvp.exec:\vvvvp.exe25⤵
- Executes dropped EXE
PID:4592 -
\??\c:\lffxrll.exec:\lffxrll.exe26⤵
- Executes dropped EXE
PID:4396 -
\??\c:\hhhhbb.exec:\hhhhbb.exe27⤵
- Executes dropped EXE
PID:1600 -
\??\c:\pjpjj.exec:\pjpjj.exe28⤵
- Executes dropped EXE
PID:4048 -
\??\c:\fxllxrx.exec:\fxllxrx.exe29⤵
- Executes dropped EXE
PID:1800 -
\??\c:\bnhhbb.exec:\bnhhbb.exe30⤵
- Executes dropped EXE
PID:3228 -
\??\c:\ddddv.exec:\ddddv.exe31⤵
- Executes dropped EXE
PID:4272 -
\??\c:\vppjd.exec:\vppjd.exe32⤵
- Executes dropped EXE
PID:3660 -
\??\c:\pdvjd.exec:\pdvjd.exe33⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ntnnhb.exec:\ntnnhb.exe34⤵
- Executes dropped EXE
PID:4708 -
\??\c:\tbhhht.exec:\tbhhht.exe35⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vjvvp.exec:\vjvvp.exe36⤵
- Executes dropped EXE
PID:3488 -
\??\c:\1rxfrlf.exec:\1rxfrlf.exe37⤵
- Executes dropped EXE
PID:4812 -
\??\c:\xlxlxrl.exec:\xlxlxrl.exe38⤵
- Executes dropped EXE
PID:4932 -
\??\c:\httbtb.exec:\httbtb.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3388 -
\??\c:\nbtnbb.exec:\nbtnbb.exe40⤵
- Executes dropped EXE
PID:4420 -
\??\c:\9dvdp.exec:\9dvdp.exe41⤵
- Executes dropped EXE
PID:4900 -
\??\c:\vpvvp.exec:\vpvvp.exe42⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vddpj.exec:\vddpj.exe43⤵
- Executes dropped EXE
PID:3580 -
\??\c:\fxlfffr.exec:\fxlfffr.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\rlxlffx.exec:\rlxlffx.exe45⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hntnbt.exec:\hntnbt.exe46⤵
- Executes dropped EXE
PID:4820 -
\??\c:\bnnhhb.exec:\bnnhhb.exe47⤵
- Executes dropped EXE
PID:4448 -
\??\c:\rflxxrr.exec:\rflxxrr.exe48⤵
- Executes dropped EXE
PID:2108 -
\??\c:\5rlxxrl.exec:\5rlxxrl.exe49⤵
- Executes dropped EXE
PID:2144 -
\??\c:\nhhbbb.exec:\nhhbbb.exe50⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vvdvd.exec:\vvdvd.exe51⤵
- Executes dropped EXE
PID:2104 -
\??\c:\pjvdv.exec:\pjvdv.exe52⤵
- Executes dropped EXE
PID:4916 -
\??\c:\9xxlfff.exec:\9xxlfff.exe53⤵
- Executes dropped EXE
PID:1796 -
\??\c:\bhhbnn.exec:\bhhbnn.exe54⤵
- Executes dropped EXE
PID:3124 -
\??\c:\dppjj.exec:\dppjj.exe55⤵
- Executes dropped EXE
PID:4740 -
\??\c:\llflxll.exec:\llflxll.exe56⤵
- Executes dropped EXE
PID:1184 -
\??\c:\9rllfxr.exec:\9rllfxr.exe57⤵
- Executes dropped EXE
PID:952 -
\??\c:\thtnhn.exec:\thtnhn.exe58⤵
- Executes dropped EXE
PID:5100 -
\??\c:\tbhhhh.exec:\tbhhhh.exe59⤵
- Executes dropped EXE
PID:3628 -
\??\c:\pppjd.exec:\pppjd.exe60⤵
- Executes dropped EXE
PID:732 -
\??\c:\dvdvj.exec:\dvdvj.exe61⤵
- Executes dropped EXE
PID:4480 -
\??\c:\fxxlffx.exec:\fxxlffx.exe62⤵
- Executes dropped EXE
PID:4672 -
\??\c:\hntttt.exec:\hntttt.exe63⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hnhhhh.exec:\hnhhhh.exe64⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pdjdd.exec:\pdjdd.exe65⤵
- Executes dropped EXE
PID:3120 -
\??\c:\pdjvj.exec:\pdjvj.exe66⤵PID:1820
-
\??\c:\xlfrfxr.exec:\xlfrfxr.exe67⤵PID:3604
-
\??\c:\1xxxrrr.exec:\1xxxrrr.exe68⤵PID:404
-
\??\c:\bthbtt.exec:\bthbtt.exe69⤵PID:3384
-
\??\c:\5hnnnh.exec:\5hnnnh.exe70⤵PID:1508
-
\??\c:\djjdp.exec:\djjdp.exe71⤵PID:1840
-
\??\c:\rxrfrrl.exec:\rxrfrrl.exe72⤵PID:1544
-
\??\c:\xlllfff.exec:\xlllfff.exe73⤵PID:2608
-
\??\c:\tttnhb.exec:\tttnhb.exe74⤵PID:3656
-
\??\c:\bnbhbb.exec:\bnbhbb.exe75⤵PID:1680
-
\??\c:\pjdpj.exec:\pjdpj.exe76⤵PID:3092
-
\??\c:\lllfrrr.exec:\lllfrrr.exe77⤵PID:4656
-
\??\c:\rxlrxxx.exec:\rxlrxxx.exe78⤵PID:4012
-
\??\c:\lfflrrl.exec:\lfflrrl.exe79⤵PID:2472
-
\??\c:\nbhbtt.exec:\nbhbtt.exe80⤵PID:856
-
\??\c:\nhthtt.exec:\nhthtt.exe81⤵PID:4228
-
\??\c:\vjdvd.exec:\vjdvd.exe82⤵PID:2860
-
\??\c:\tbthnh.exec:\tbthnh.exe83⤵PID:3280
-
\??\c:\vdvjd.exec:\vdvjd.exe84⤵PID:3896
-
\??\c:\ffxlrlx.exec:\ffxlrlx.exe85⤵PID:3732
-
\??\c:\frxllxf.exec:\frxllxf.exe86⤵PID:1612
-
\??\c:\1hthth.exec:\1hthth.exe87⤵PID:1616
-
\??\c:\bntnht.exec:\bntnht.exe88⤵PID:3096
-
\??\c:\jdvjp.exec:\jdvjp.exe89⤵PID:2468
-
\??\c:\3jdvj.exec:\3jdvj.exe90⤵PID:720
-
\??\c:\lrrlrff.exec:\lrrlrff.exe91⤵PID:1824
-
\??\c:\rrlllrr.exec:\rrlllrr.exe92⤵PID:2064
-
\??\c:\hhbbnh.exec:\hhbbnh.exe93⤵PID:1456
-
\??\c:\bbbtnh.exec:\bbbtnh.exe94⤵PID:2980
-
\??\c:\hhnbtn.exec:\hhnbtn.exe95⤵PID:3480
-
\??\c:\pjdvd.exec:\pjdvd.exe96⤵PID:408
-
\??\c:\lxfllrf.exec:\lxfllrf.exe97⤵PID:4652
-
\??\c:\xflllll.exec:\xflllll.exe98⤵PID:4200
-
\??\c:\hnnbhn.exec:\hnnbhn.exe99⤵PID:4540
-
\??\c:\3hnbnh.exec:\3hnbnh.exe100⤵PID:4812
-
\??\c:\1jvvd.exec:\1jvvd.exe101⤵PID:4008
-
\??\c:\pjjvp.exec:\pjjvp.exe102⤵PID:3996
-
\??\c:\3xxlxxl.exec:\3xxlxxl.exe103⤵PID:2296
-
\??\c:\lrlxlff.exec:\lrlxlff.exe104⤵PID:4904
-
\??\c:\nntnnh.exec:\nntnnh.exe105⤵PID:3964
-
\??\c:\7bbthh.exec:\7bbthh.exe106⤵PID:4076
-
\??\c:\jdpjv.exec:\jdpjv.exe107⤵PID:1296
-
\??\c:\lrlxflx.exec:\lrlxflx.exe108⤵PID:4608
-
\??\c:\xxlxfxx.exec:\xxlxfxx.exe109⤵PID:2080
-
\??\c:\5thbnh.exec:\5thbnh.exe110⤵PID:4448
-
\??\c:\nhbnbn.exec:\nhbnbn.exe111⤵PID:4488
-
\??\c:\djddd.exec:\djddd.exe112⤵PID:2144
-
\??\c:\lxxrlll.exec:\lxxrlll.exe113⤵PID:4924
-
\??\c:\lflxrrr.exec:\lflxrrr.exe114⤵PID:1728
-
\??\c:\rxlfllf.exec:\rxlfllf.exe115⤵PID:4916
-
\??\c:\5bttnn.exec:\5bttnn.exe116⤵PID:540
-
\??\c:\1hhbtn.exec:\1hhbtn.exe117⤵PID:3124
-
\??\c:\pjddj.exec:\pjddj.exe118⤵PID:988
-
\??\c:\1pvpd.exec:\1pvpd.exe119⤵PID:1084
-
\??\c:\flrrffx.exec:\flrrffx.exe120⤵PID:952
-
\??\c:\lxxxrrf.exec:\lxxxrrf.exe121⤵PID:5100
-
\??\c:\nthbtt.exec:\nthbtt.exe122⤵PID:1876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-