Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 21:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe
-
Size
105KB
-
MD5
d8b1eb5847774742429d5578ed0e8b57
-
SHA1
8dd1723c339a881b22899a3c9a6f0e7ea743e2f4
-
SHA256
34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7
-
SHA512
2b0eab56c7677175e38e424baa4c23356e52b170dd47ee18d225aa44d078a930b83c6e0df4146d4118a4e8a85e56cc9f8212b762265074e566d98baba506179c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHq82PCK:n3C9BRo7tvnJ99T/KZE89K
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4680-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1596-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2712 pdjdd.exe 3572 xrxrrfx.exe 3580 nhhtbt.exe 3132 djvpd.exe 508 djvpv.exe 4140 xrrxlfl.exe 1736 nnbbhn.exe 4208 jppjj.exe 2736 lrfffxx.exe 4868 1frlllf.exe 4836 jvjpd.exe 4760 vpvpj.exe 4728 5fxrfff.exe 4672 1hnhbh.exe 2708 9hnbnn.exe 400 pjjdd.exe 2208 jpvpj.exe 1212 lrfxffl.exe 3976 tbhthh.exe 1636 dvddj.exe 1240 jdvpv.exe 1596 htthbt.exe 3548 tntttb.exe 1480 hbhhnn.exe 1628 7pvvj.exe 1040 rfllflf.exe 3728 nbnnnn.exe 3716 jdvpj.exe 3724 vvjvv.exe 1892 7lrlxxx.exe 2644 tbbbhb.exe 5020 hbbhbb.exe 1068 dpjvp.exe 1016 rlrrllr.exe 3008 3rrlfff.exe 4108 nbnttt.exe 1200 djppv.exe 2836 rlxrffr.exe 4464 bbttbb.exe 4764 nbhbtt.exe 4804 pvjpp.exe 4884 pjddv.exe 4676 jddjd.exe 4320 hhnttt.exe 1828 thtnhb.exe 1252 vpdjd.exe 1092 5ddpd.exe 5064 3jvvv.exe 3572 rfflxxl.exe 3468 9hhttn.exe 4460 hntthh.exe 2064 pddvj.exe 3832 lfrllrr.exe 2824 lfllfff.exe 3168 tnnnhh.exe 4776 btbbtn.exe 3444 7jpjd.exe 4736 dpvvj.exe 2088 lxxlrrf.exe 5092 3nhhbb.exe 2916 hbbbtt.exe 3984 ppdjv.exe 3320 pjjdp.exe 2136 1frxrrr.exe -
resource yara_rule behavioral2/memory/4680-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2708-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1596-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4680 wrote to memory of 2712 4680 34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe 82 PID 4680 wrote to memory of 2712 4680 34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe 82 PID 4680 wrote to memory of 2712 4680 34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe 82 PID 2712 wrote to memory of 3572 2712 pdjdd.exe 83 PID 2712 wrote to memory of 3572 2712 pdjdd.exe 83 PID 2712 wrote to memory of 3572 2712 pdjdd.exe 83 PID 3572 wrote to memory of 3580 3572 xrxrrfx.exe 84 PID 3572 wrote to memory of 3580 3572 xrxrrfx.exe 84 PID 3572 wrote to memory of 3580 3572 xrxrrfx.exe 84 PID 3580 wrote to memory of 3132 3580 nhhtbt.exe 85 PID 3580 wrote to memory of 3132 3580 nhhtbt.exe 85 PID 3580 wrote to memory of 3132 3580 nhhtbt.exe 85 PID 3132 wrote to memory of 508 3132 djvpd.exe 86 PID 3132 wrote to memory of 508 3132 djvpd.exe 86 PID 3132 wrote to memory of 508 3132 djvpd.exe 86 PID 508 wrote to memory of 4140 508 djvpv.exe 87 PID 508 wrote to memory of 4140 508 djvpv.exe 87 PID 508 wrote to memory of 4140 508 djvpv.exe 87 PID 4140 wrote to memory of 1736 4140 xrrxlfl.exe 88 PID 4140 wrote to memory of 1736 4140 xrrxlfl.exe 88 PID 4140 wrote to memory of 1736 4140 xrrxlfl.exe 88 PID 1736 wrote to memory of 4208 1736 nnbbhn.exe 89 PID 1736 wrote to memory of 4208 1736 nnbbhn.exe 89 PID 1736 wrote to memory of 4208 1736 nnbbhn.exe 89 PID 4208 wrote to memory of 2736 4208 jppjj.exe 90 PID 4208 wrote to memory of 2736 4208 jppjj.exe 90 PID 4208 wrote to memory of 2736 4208 jppjj.exe 90 PID 2736 wrote to memory of 4868 2736 lrfffxx.exe 91 PID 2736 wrote to memory of 4868 2736 lrfffxx.exe 91 PID 2736 wrote to memory of 4868 2736 lrfffxx.exe 91 PID 4868 wrote to memory of 4836 4868 1frlllf.exe 92 PID 4868 wrote to memory of 4836 4868 1frlllf.exe 92 PID 4868 wrote to memory of 4836 4868 1frlllf.exe 92 PID 4836 wrote to memory of 4760 4836 jvjpd.exe 93 PID 4836 wrote to memory of 4760 4836 jvjpd.exe 93 PID 4836 wrote to memory of 4760 4836 jvjpd.exe 93 PID 4760 wrote to memory of 4728 4760 vpvpj.exe 94 PID 4760 wrote to memory of 4728 4760 vpvpj.exe 94 PID 4760 wrote to memory of 4728 4760 vpvpj.exe 94 PID 4728 wrote to memory of 4672 4728 5fxrfff.exe 95 PID 4728 wrote to memory of 4672 4728 5fxrfff.exe 95 PID 4728 wrote to memory of 4672 4728 5fxrfff.exe 95 PID 4672 wrote to memory of 2708 4672 1hnhbh.exe 96 PID 4672 wrote to memory of 2708 4672 1hnhbh.exe 96 PID 4672 wrote to memory of 2708 4672 1hnhbh.exe 96 PID 2708 wrote to memory of 400 2708 9hnbnn.exe 97 PID 2708 wrote to memory of 400 2708 9hnbnn.exe 97 PID 2708 wrote to memory of 400 2708 9hnbnn.exe 97 PID 400 wrote to memory of 2208 400 pjjdd.exe 98 PID 400 wrote to memory of 2208 400 pjjdd.exe 98 PID 400 wrote to memory of 2208 400 pjjdd.exe 98 PID 2208 wrote to memory of 1212 2208 jpvpj.exe 99 PID 2208 wrote to memory of 1212 2208 jpvpj.exe 99 PID 2208 wrote to memory of 1212 2208 jpvpj.exe 99 PID 1212 wrote to memory of 3976 1212 lrfxffl.exe 100 PID 1212 wrote to memory of 3976 1212 lrfxffl.exe 100 PID 1212 wrote to memory of 3976 1212 lrfxffl.exe 100 PID 3976 wrote to memory of 1636 3976 tbhthh.exe 101 PID 3976 wrote to memory of 1636 3976 tbhthh.exe 101 PID 3976 wrote to memory of 1636 3976 tbhthh.exe 101 PID 1636 wrote to memory of 1240 1636 dvddj.exe 102 PID 1636 wrote to memory of 1240 1636 dvddj.exe 102 PID 1636 wrote to memory of 1240 1636 dvddj.exe 102 PID 1240 wrote to memory of 1596 1240 jdvpv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe"C:\Users\Admin\AppData\Local\Temp\34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\pdjdd.exec:\pdjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\xrxrrfx.exec:\xrxrrfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\nhhtbt.exec:\nhhtbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\djvpd.exec:\djvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\djvpv.exec:\djvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\xrrxlfl.exec:\xrrxlfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\nnbbhn.exec:\nnbbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\jppjj.exec:\jppjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\lrfffxx.exec:\lrfffxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\1frlllf.exec:\1frlllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\jvjpd.exec:\jvjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\vpvpj.exec:\vpvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\5fxrfff.exec:\5fxrfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\1hnhbh.exec:\1hnhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\9hnbnn.exec:\9hnbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\pjjdd.exec:\pjjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\jpvpj.exec:\jpvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\lrfxffl.exec:\lrfxffl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\tbhthh.exec:\tbhthh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\dvddj.exec:\dvddj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\jdvpv.exec:\jdvpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\htthbt.exec:\htthbt.exe23⤵
- Executes dropped EXE
PID:1596 -
\??\c:\tntttb.exec:\tntttb.exe24⤵
- Executes dropped EXE
PID:3548 -
\??\c:\hbhhnn.exec:\hbhhnn.exe25⤵
- Executes dropped EXE
PID:1480 -
\??\c:\7pvvj.exec:\7pvvj.exe26⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rfllflf.exec:\rfllflf.exe27⤵
- Executes dropped EXE
PID:1040 -
\??\c:\nbnnnn.exec:\nbnnnn.exe28⤵
- Executes dropped EXE
PID:3728 -
\??\c:\jdvpj.exec:\jdvpj.exe29⤵
- Executes dropped EXE
PID:3716 -
\??\c:\vvjvv.exec:\vvjvv.exe30⤵
- Executes dropped EXE
PID:3724 -
\??\c:\7lrlxxx.exec:\7lrlxxx.exe31⤵
- Executes dropped EXE
PID:1892 -
\??\c:\tbbbhb.exec:\tbbbhb.exe32⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hbbhbb.exec:\hbbhbb.exe33⤵
- Executes dropped EXE
PID:5020 -
\??\c:\dpjvp.exec:\dpjvp.exe34⤵
- Executes dropped EXE
PID:1068 -
\??\c:\rlrrllr.exec:\rlrrllr.exe35⤵
- Executes dropped EXE
PID:1016 -
\??\c:\3rrlfff.exec:\3rrlfff.exe36⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nbnttt.exec:\nbnttt.exe37⤵
- Executes dropped EXE
PID:4108 -
\??\c:\djppv.exec:\djppv.exe38⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rlxrffr.exec:\rlxrffr.exe39⤵
- Executes dropped EXE
PID:2836 -
\??\c:\bbttbb.exec:\bbttbb.exe40⤵
- Executes dropped EXE
PID:4464 -
\??\c:\nbhbtt.exec:\nbhbtt.exe41⤵
- Executes dropped EXE
PID:4764 -
\??\c:\pvjpp.exec:\pvjpp.exe42⤵
- Executes dropped EXE
PID:4804 -
\??\c:\pjddv.exec:\pjddv.exe43⤵
- Executes dropped EXE
PID:4884 -
\??\c:\jddjd.exec:\jddjd.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4676 -
\??\c:\hhnttt.exec:\hhnttt.exe45⤵
- Executes dropped EXE
PID:4320 -
\??\c:\thtnhb.exec:\thtnhb.exe46⤵
- Executes dropped EXE
PID:1828 -
\??\c:\vpdjd.exec:\vpdjd.exe47⤵
- Executes dropped EXE
PID:1252 -
\??\c:\5ddpd.exec:\5ddpd.exe48⤵
- Executes dropped EXE
PID:1092 -
\??\c:\3jvvv.exec:\3jvvv.exe49⤵
- Executes dropped EXE
PID:5064 -
\??\c:\rfflxxl.exec:\rfflxxl.exe50⤵
- Executes dropped EXE
PID:3572 -
\??\c:\9hhttn.exec:\9hhttn.exe51⤵
- Executes dropped EXE
PID:3468 -
\??\c:\hntthh.exec:\hntthh.exe52⤵
- Executes dropped EXE
PID:4460 -
\??\c:\pddvj.exec:\pddvj.exe53⤵
- Executes dropped EXE
PID:2064 -
\??\c:\lfrllrr.exec:\lfrllrr.exe54⤵
- Executes dropped EXE
PID:3832 -
\??\c:\lfllfff.exec:\lfllfff.exe55⤵
- Executes dropped EXE
PID:2824 -
\??\c:\tnnnhh.exec:\tnnnhh.exe56⤵
- Executes dropped EXE
PID:3168 -
\??\c:\btbbtn.exec:\btbbtn.exe57⤵
- Executes dropped EXE
PID:4776 -
\??\c:\7jpjd.exec:\7jpjd.exe58⤵
- Executes dropped EXE
PID:3444 -
\??\c:\dpvvj.exec:\dpvvj.exe59⤵
- Executes dropped EXE
PID:4736 -
\??\c:\lxxlrrf.exec:\lxxlrrf.exe60⤵
- Executes dropped EXE
PID:2088 -
\??\c:\3nhhbb.exec:\3nhhbb.exe61⤵
- Executes dropped EXE
PID:5092 -
\??\c:\hbbbtt.exec:\hbbbtt.exe62⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ppdjv.exec:\ppdjv.exe63⤵
- Executes dropped EXE
PID:3984 -
\??\c:\pjjdp.exec:\pjjdp.exe64⤵
- Executes dropped EXE
PID:3320 -
\??\c:\1frxrrr.exec:\1frxrrr.exe65⤵
- Executes dropped EXE
PID:2136 -
\??\c:\lxffllf.exec:\lxffllf.exe66⤵PID:4984
-
\??\c:\5hhbbt.exec:\5hhbbt.exe67⤵PID:4728
-
\??\c:\jdvvp.exec:\jdvvp.exe68⤵PID:2972
-
\??\c:\vppjj.exec:\vppjj.exe69⤵PID:1488
-
\??\c:\rfrfffl.exec:\rfrfffl.exe70⤵PID:3512
-
\??\c:\lflffxr.exec:\lflffxr.exe71⤵PID:3532
-
\??\c:\1thtbb.exec:\1thtbb.exe72⤵PID:1412
-
\??\c:\pppvj.exec:\pppvj.exe73⤵PID:1888
-
\??\c:\1pppp.exec:\1pppp.exe74⤵PID:4204
-
\??\c:\3xrxrff.exec:\3xrxrff.exe75⤵PID:212
-
\??\c:\rlllflf.exec:\rlllflf.exe76⤵PID:4816
-
\??\c:\1lrrrrl.exec:\1lrrrrl.exe77⤵PID:4732
-
\??\c:\5xfxrrl.exec:\5xfxrrl.exe78⤵PID:2204
-
\??\c:\9thntt.exec:\9thntt.exe79⤵PID:2000
-
\??\c:\hbtnhh.exec:\hbtnhh.exe80⤵PID:3948
-
\??\c:\jdjjd.exec:\jdjjd.exe81⤵PID:888
-
\??\c:\dvpjj.exec:\dvpjj.exe82⤵PID:4148
-
\??\c:\xlrrlff.exec:\xlrrlff.exe83⤵PID:3500
-
\??\c:\nhttnh.exec:\nhttnh.exe84⤵PID:1220
-
\??\c:\nhttnt.exec:\nhttnt.exe85⤵PID:3052
-
\??\c:\7tbttt.exec:\7tbttt.exe86⤵PID:1612
-
\??\c:\ddjdd.exec:\ddjdd.exe87⤵PID:1512
-
\??\c:\rrrxxrr.exec:\rrrxxrr.exe88⤵PID:4844
-
\??\c:\rrrrllr.exec:\rrrrllr.exe89⤵PID:4132
-
\??\c:\tnbhtn.exec:\tnbhtn.exe90⤵PID:4972
-
\??\c:\ppvpp.exec:\ppvpp.exe91⤵PID:1400
-
\??\c:\ddjdd.exec:\ddjdd.exe92⤵PID:3972
-
\??\c:\7pjdd.exec:\7pjdd.exe93⤵PID:1984
-
\??\c:\rrrllll.exec:\rrrllll.exe94⤵PID:760
-
\??\c:\nbtnnt.exec:\nbtnnt.exe95⤵PID:1064
-
\??\c:\jjjjd.exec:\jjjjd.exe96⤵PID:4792
-
\??\c:\vpvpj.exec:\vpvpj.exe97⤵PID:1700
-
\??\c:\vdjvp.exec:\vdjvp.exe98⤵PID:452
-
\??\c:\fxxrxxx.exec:\fxxrxxx.exe99⤵PID:4108
-
\??\c:\thnnbb.exec:\thnnbb.exe100⤵
- System Location Discovery: System Language Discovery
PID:2472 -
\??\c:\nbtntn.exec:\nbtntn.exe101⤵PID:3676
-
\??\c:\jjvpj.exec:\jjvpj.exe102⤵PID:1912
-
\??\c:\5jppj.exec:\5jppj.exe103⤵PID:812
-
\??\c:\xxrllxf.exec:\xxrllxf.exe104⤵PID:4804
-
\??\c:\nbbntn.exec:\nbbntn.exe105⤵
- System Location Discovery: System Language Discovery
PID:4308 -
\??\c:\jjdvj.exec:\jjdvj.exe106⤵PID:4260
-
\??\c:\vjjjd.exec:\vjjjd.exe107⤵PID:2348
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe108⤵PID:2516
-
\??\c:\5xfxxxr.exec:\5xfxxxr.exe109⤵PID:4104
-
\??\c:\1thhhn.exec:\1thhhn.exe110⤵PID:8
-
\??\c:\hnbbbh.exec:\hnbbbh.exe111⤵PID:4468
-
\??\c:\9vvvj.exec:\9vvvj.exe112⤵PID:4232
-
\??\c:\jjvpj.exec:\jjvpj.exe113⤵PID:4460
-
\??\c:\xllxxxx.exec:\xllxxxx.exe114⤵PID:2064
-
\??\c:\nhhbtt.exec:\nhhbtt.exe115⤵PID:692
-
\??\c:\tbnhbh.exec:\tbnhbh.exe116⤵PID:2824
-
\??\c:\vpvpp.exec:\vpvpp.exe117⤵PID:1352
-
\??\c:\9jpjd.exec:\9jpjd.exe118⤵PID:2256
-
\??\c:\fxlfffl.exec:\fxlfffl.exe119⤵PID:3444
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe120⤵PID:732
-
\??\c:\nhhbbb.exec:\nhhbbb.exe121⤵PID:2088
-
\??\c:\bbbbbh.exec:\bbbbbh.exe122⤵PID:2320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-