Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 23:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02N.exe
Resource
win7-20241010-en
6 signatures
120 seconds
General
-
Target
642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02N.exe
-
Size
50KB
-
MD5
ca6728b8172836ece668a3316619d520
-
SHA1
96327c6d3592c46536c7503377438c936011e512
-
SHA256
642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02
-
SHA512
4c8d2ca4682425c723a070e04a691212a71e25991be7f982612ceced390ca38a0237bd806b4e2cb5d4c795a2e26df07163ad08624567e6028180c58e1a375e4f
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlO:0cdpeeBSHHMHLf9RyIx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/728-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/672-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1076-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/968-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/892-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/788-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1076-334-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-348-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-359-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-363-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-403-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-423-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-481-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-497-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-519-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-529-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-545-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-549-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2652-568-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-581-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-619-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-641-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-723-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-757-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-1215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-1504-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 316 nhbnbt.exe 2172 nbthtn.exe 1708 jddvv.exe 4332 dvjvj.exe 2000 xrlxlfr.exe 1356 nbbnbb.exe 3864 vjdpv.exe 3984 5ddpj.exe 540 rfflrxf.exe 392 7bthtt.exe 3628 jppvv.exe 2664 frxlxlx.exe 672 lfxxrlf.exe 2364 7bbbnb.exe 3548 jvvpj.exe 1076 lfflxxr.exe 5000 1fxrlfx.exe 4936 5tnnbt.exe 3440 llfxfxr.exe 3300 bntnhh.exe 2216 nnnbnb.exe 436 vvpdp.exe 2188 xffxlxf.exe 4896 3bthbn.exe 3032 vpvpp.exe 4520 pjjvd.exe 968 9llfrlf.exe 4416 7bttnn.exe 3744 tttntn.exe 396 vvpvd.exe 3788 rllfflf.exe 768 9tbhbh.exe 3172 bhbbnn.exe 5092 ppjpj.exe 548 rfxxfxx.exe 892 hthhbn.exe 5040 bttnhb.exe 4316 9vpdp.exe 3412 fllxffl.exe 4392 nhbnhb.exe 4912 3nhbhb.exe 840 3jpjv.exe 3488 rrlxlff.exe 1704 lxrfrlf.exe 2212 bbbtnt.exe 756 tbnbnb.exe 1192 ppdpj.exe 404 dpdpd.exe 4864 1lflxlr.exe 2256 1nhbtn.exe 228 hhhhht.exe 4744 9pjdj.exe 4404 ddppj.exe 628 5rrfxxx.exe 4872 llfxrrr.exe 5028 3nbnbt.exe 532 btnbtb.exe 2028 1dvdv.exe 4312 rlfxxrr.exe 3624 flfrfxl.exe 2932 hbnbtn.exe 1008 thnbtn.exe 2388 ddjdv.exe 4204 jvdpv.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 728 wrote to memory of 316 728 642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02N.exe 83 PID 728 wrote to memory of 316 728 642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02N.exe 83 PID 728 wrote to memory of 316 728 642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02N.exe 83 PID 316 wrote to memory of 2172 316 nhbnbt.exe 84 PID 316 wrote to memory of 2172 316 nhbnbt.exe 84 PID 316 wrote to memory of 2172 316 nhbnbt.exe 84 PID 2172 wrote to memory of 1708 2172 nbthtn.exe 85 PID 2172 wrote to memory of 1708 2172 nbthtn.exe 85 PID 2172 wrote to memory of 1708 2172 nbthtn.exe 85 PID 1708 wrote to memory of 4332 1708 jddvv.exe 86 PID 1708 wrote to memory of 4332 1708 jddvv.exe 86 PID 1708 wrote to memory of 4332 1708 jddvv.exe 86 PID 4332 wrote to memory of 2000 4332 dvjvj.exe 87 PID 4332 wrote to memory of 2000 4332 dvjvj.exe 87 PID 4332 wrote to memory of 2000 4332 dvjvj.exe 87 PID 2000 wrote to memory of 1356 2000 xrlxlfr.exe 88 PID 2000 wrote to memory of 1356 2000 xrlxlfr.exe 88 PID 2000 wrote to memory of 1356 2000 xrlxlfr.exe 88 PID 1356 wrote to memory of 3864 1356 nbbnbb.exe 89 PID 1356 wrote to memory of 3864 1356 nbbnbb.exe 89 PID 1356 wrote to memory of 3864 1356 nbbnbb.exe 89 PID 3864 wrote to memory of 3984 3864 vjdpv.exe 90 PID 3864 wrote to memory of 3984 3864 vjdpv.exe 90 PID 3864 wrote to memory of 3984 3864 vjdpv.exe 90 PID 3984 wrote to memory of 540 3984 5ddpj.exe 91 PID 3984 wrote to memory of 540 3984 5ddpj.exe 91 PID 3984 wrote to memory of 540 3984 5ddpj.exe 91 PID 540 wrote to memory of 392 540 rfflrxf.exe 92 PID 540 wrote to memory of 392 540 rfflrxf.exe 92 PID 540 wrote to memory of 392 540 rfflrxf.exe 92 PID 392 wrote to memory of 3628 392 7bthtt.exe 93 PID 392 wrote to memory of 3628 392 7bthtt.exe 93 PID 392 wrote to memory of 3628 392 7bthtt.exe 93 PID 3628 wrote to memory of 2664 3628 jppvv.exe 94 PID 3628 wrote to memory of 2664 3628 jppvv.exe 94 PID 3628 wrote to memory of 2664 3628 jppvv.exe 94 PID 2664 wrote to memory of 672 2664 frxlxlx.exe 95 PID 2664 wrote to memory of 672 2664 frxlxlx.exe 95 PID 2664 wrote to memory of 672 2664 frxlxlx.exe 95 PID 672 wrote to memory of 2364 672 lfxxrlf.exe 96 PID 672 wrote to memory of 2364 672 lfxxrlf.exe 96 PID 672 wrote to memory of 2364 672 lfxxrlf.exe 96 PID 2364 wrote to memory of 3548 2364 7bbbnb.exe 97 PID 2364 wrote to memory of 3548 2364 7bbbnb.exe 97 PID 2364 wrote to memory of 3548 2364 7bbbnb.exe 97 PID 3548 wrote to memory of 1076 3548 jvvpj.exe 98 PID 3548 wrote to memory of 1076 3548 jvvpj.exe 98 PID 3548 wrote to memory of 1076 3548 jvvpj.exe 98 PID 1076 wrote to memory of 5000 1076 lfflxxr.exe 99 PID 1076 wrote to memory of 5000 1076 lfflxxr.exe 99 PID 1076 wrote to memory of 5000 1076 lfflxxr.exe 99 PID 5000 wrote to memory of 4936 5000 1fxrlfx.exe 100 PID 5000 wrote to memory of 4936 5000 1fxrlfx.exe 100 PID 5000 wrote to memory of 4936 5000 1fxrlfx.exe 100 PID 4936 wrote to memory of 3440 4936 5tnnbt.exe 101 PID 4936 wrote to memory of 3440 4936 5tnnbt.exe 101 PID 4936 wrote to memory of 3440 4936 5tnnbt.exe 101 PID 3440 wrote to memory of 3300 3440 llfxfxr.exe 102 PID 3440 wrote to memory of 3300 3440 llfxfxr.exe 102 PID 3440 wrote to memory of 3300 3440 llfxfxr.exe 102 PID 3300 wrote to memory of 2216 3300 bntnhh.exe 103 PID 3300 wrote to memory of 2216 3300 bntnhh.exe 103 PID 3300 wrote to memory of 2216 3300 bntnhh.exe 103 PID 2216 wrote to memory of 436 2216 nnnbnb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02N.exe"C:\Users\Admin\AppData\Local\Temp\642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\nhbnbt.exec:\nhbnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\nbthtn.exec:\nbthtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\jddvv.exec:\jddvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\dvjvj.exec:\dvjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\xrlxlfr.exec:\xrlxlfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\nbbnbb.exec:\nbbnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\vjdpv.exec:\vjdpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\5ddpj.exec:\5ddpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\rfflrxf.exec:\rfflrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\7bthtt.exec:\7bthtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\jppvv.exec:\jppvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\frxlxlx.exec:\frxlxlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\lfxxrlf.exec:\lfxxrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\7bbbnb.exec:\7bbbnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\jvvpj.exec:\jvvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\lfflxxr.exec:\lfflxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\1fxrlfx.exec:\1fxrlfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\5tnnbt.exec:\5tnnbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\llfxfxr.exec:\llfxfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\bntnhh.exec:\bntnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\nnnbnb.exec:\nnnbnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\vvpdp.exec:\vvpdp.exe23⤵
- Executes dropped EXE
PID:436 -
\??\c:\xffxlxf.exec:\xffxlxf.exe24⤵
- Executes dropped EXE
PID:2188 -
\??\c:\3bthbn.exec:\3bthbn.exe25⤵
- Executes dropped EXE
PID:4896 -
\??\c:\vpvpp.exec:\vpvpp.exe26⤵
- Executes dropped EXE
PID:3032 -
\??\c:\pjjvd.exec:\pjjvd.exe27⤵
- Executes dropped EXE
PID:4520 -
\??\c:\9llfrlf.exec:\9llfrlf.exe28⤵
- Executes dropped EXE
PID:968 -
\??\c:\7bttnn.exec:\7bttnn.exe29⤵
- Executes dropped EXE
PID:4416 -
\??\c:\tttntn.exec:\tttntn.exe30⤵
- Executes dropped EXE
PID:3744 -
\??\c:\vvpvd.exec:\vvpvd.exe31⤵
- Executes dropped EXE
PID:396 -
\??\c:\rllfflf.exec:\rllfflf.exe32⤵
- Executes dropped EXE
PID:3788 -
\??\c:\9tbhbh.exec:\9tbhbh.exe33⤵
- Executes dropped EXE
PID:768 -
\??\c:\bhbbnn.exec:\bhbbnn.exe34⤵
- Executes dropped EXE
PID:3172 -
\??\c:\ppjpj.exec:\ppjpj.exe35⤵
- Executes dropped EXE
PID:5092 -
\??\c:\rfxxfxx.exec:\rfxxfxx.exe36⤵
- Executes dropped EXE
PID:548 -
\??\c:\hthhbn.exec:\hthhbn.exe37⤵
- Executes dropped EXE
PID:892 -
\??\c:\bttnhb.exec:\bttnhb.exe38⤵
- Executes dropped EXE
PID:5040 -
\??\c:\9vpdp.exec:\9vpdp.exe39⤵
- Executes dropped EXE
PID:4316 -
\??\c:\fllxffl.exec:\fllxffl.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3412 -
\??\c:\nhbnhb.exec:\nhbnhb.exe41⤵
- Executes dropped EXE
PID:4392 -
\??\c:\3nhbhb.exec:\3nhbhb.exe42⤵
- Executes dropped EXE
PID:4912 -
\??\c:\3jpjv.exec:\3jpjv.exe43⤵
- Executes dropped EXE
PID:840 -
\??\c:\rrlxlff.exec:\rrlxlff.exe44⤵
- Executes dropped EXE
PID:3488 -
\??\c:\lxrfrlf.exec:\lxrfrlf.exe45⤵
- Executes dropped EXE
PID:1704 -
\??\c:\bbbtnt.exec:\bbbtnt.exe46⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tbnbnb.exec:\tbnbnb.exe47⤵
- Executes dropped EXE
PID:756 -
\??\c:\ppdpj.exec:\ppdpj.exe48⤵
- Executes dropped EXE
PID:1192 -
\??\c:\dpdpd.exec:\dpdpd.exe49⤵
- Executes dropped EXE
PID:404 -
\??\c:\1lflxlr.exec:\1lflxlr.exe50⤵
- Executes dropped EXE
PID:4864 -
\??\c:\1nhbtn.exec:\1nhbtn.exe51⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hhhhht.exec:\hhhhht.exe52⤵
- Executes dropped EXE
PID:228 -
\??\c:\9pjdj.exec:\9pjdj.exe53⤵
- Executes dropped EXE
PID:4744 -
\??\c:\ddppj.exec:\ddppj.exe54⤵
- Executes dropped EXE
PID:4404 -
\??\c:\5rrfxxx.exec:\5rrfxxx.exe55⤵
- Executes dropped EXE
PID:628 -
\??\c:\llfxrrr.exec:\llfxrrr.exe56⤵
- Executes dropped EXE
PID:4872 -
\??\c:\3nbnbt.exec:\3nbnbt.exe57⤵
- Executes dropped EXE
PID:5028 -
\??\c:\btnbtb.exec:\btnbtb.exe58⤵
- Executes dropped EXE
PID:532 -
\??\c:\1dvdv.exec:\1dvdv.exe59⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rlfxxrr.exec:\rlfxxrr.exe60⤵
- Executes dropped EXE
PID:4312 -
\??\c:\flfrfxl.exec:\flfrfxl.exe61⤵
- Executes dropped EXE
PID:3624 -
\??\c:\hbnbtn.exec:\hbnbtn.exe62⤵
- Executes dropped EXE
PID:2932 -
\??\c:\thnbtn.exec:\thnbtn.exe63⤵
- Executes dropped EXE
PID:1008 -
\??\c:\ddjdv.exec:\ddjdv.exe64⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jvdpv.exec:\jvdpv.exe65⤵
- Executes dropped EXE
PID:4204 -
\??\c:\lrrrfxr.exec:\lrrrfxr.exe66⤵PID:3960
-
\??\c:\thhthb.exec:\thhthb.exe67⤵PID:1256
-
\??\c:\nbhthh.exec:\nbhthh.exe68⤵PID:2412
-
\??\c:\pdvpd.exec:\pdvpd.exe69⤵PID:1964
-
\??\c:\3lllxlf.exec:\3lllxlf.exe70⤵PID:788
-
\??\c:\lfxrlfr.exec:\lfxrlfr.exe71⤵PID:3628
-
\??\c:\ttbtbb.exec:\ttbtbb.exe72⤵PID:1544
-
\??\c:\7dvpp.exec:\7dvpp.exe73⤵PID:980
-
\??\c:\9dpvj.exec:\9dpvj.exe74⤵PID:464
-
\??\c:\llllfxl.exec:\llllfxl.exe75⤵PID:1468
-
\??\c:\rlrfffl.exec:\rlrfffl.exe76⤵PID:1240
-
\??\c:\tnhthb.exec:\tnhthb.exe77⤵PID:2020
-
\??\c:\thbtnh.exec:\thbtnh.exe78⤵PID:1076
-
\??\c:\7jpjd.exec:\7jpjd.exe79⤵PID:4144
-
\??\c:\pjppj.exec:\pjppj.exe80⤵PID:1968
-
\??\c:\xrllllr.exec:\xrllllr.exe81⤵PID:3368
-
\??\c:\fflrlrl.exec:\fflrlrl.exe82⤵PID:1764
-
\??\c:\nbhhnn.exec:\nbhhnn.exe83⤵PID:3060
-
\??\c:\vddvv.exec:\vddvv.exe84⤵PID:4756
-
\??\c:\vjvvd.exec:\vjvvd.exe85⤵PID:4748
-
\??\c:\xxrxlff.exec:\xxrxlff.exe86⤵PID:1064
-
\??\c:\5rxfxff.exec:\5rxfxff.exe87⤵PID:2456
-
\??\c:\btnnnt.exec:\btnnnt.exe88⤵PID:4432
-
\??\c:\vpvpj.exec:\vpvpj.exe89⤵PID:3356
-
\??\c:\frrrlrr.exec:\frrrlrr.exe90⤵PID:2792
-
\??\c:\rlllfrl.exec:\rlllfrl.exe91⤵PID:4520
-
\??\c:\bthbtn.exec:\bthbtn.exe92⤵
- System Location Discovery: System Language Discovery
PID:1872 -
\??\c:\nhthhb.exec:\nhthhb.exe93⤵PID:3508
-
\??\c:\vvdvd.exec:\vvdvd.exe94⤵PID:1492
-
\??\c:\9vvpd.exec:\9vvpd.exe95⤵PID:3284
-
\??\c:\ffxfffl.exec:\ffxfffl.exe96⤵PID:2872
-
\??\c:\lllllfx.exec:\lllllfx.exe97⤵PID:4708
-
\??\c:\btbtnh.exec:\btbtnh.exe98⤵PID:3828
-
\??\c:\1ththb.exec:\1ththb.exe99⤵PID:5004
-
\??\c:\vddvp.exec:\vddvp.exe100⤵PID:3164
-
\??\c:\lxxrxfr.exec:\lxxrxfr.exe101⤵PID:2628
-
\??\c:\lfrxlff.exec:\lfrxlff.exe102⤵PID:4220
-
\??\c:\9tthtt.exec:\9tthtt.exe103⤵PID:944
-
\??\c:\ttbthb.exec:\ttbthb.exe104⤵PID:4448
-
\??\c:\9vdvp.exec:\9vdvp.exe105⤵PID:2244
-
\??\c:\9xfxfrl.exec:\9xfxfrl.exe106⤵PID:3188
-
\??\c:\5nhbht.exec:\5nhbht.exe107⤵PID:1760
-
\??\c:\nbbhtn.exec:\nbbhtn.exe108⤵PID:3944
-
\??\c:\vjjdp.exec:\vjjdp.exe109⤵PID:4876
-
\??\c:\3vdjj.exec:\3vdjj.exe110⤵PID:4044
-
\??\c:\rxxrfrf.exec:\rxxrfrf.exe111⤵PID:4592
-
\??\c:\3tnbtt.exec:\3tnbtt.exe112⤵PID:4372
-
\??\c:\tbtnbn.exec:\tbtnbn.exe113⤵PID:5100
-
\??\c:\djpjd.exec:\djpjd.exe114⤵PID:3492
-
\??\c:\fxrflxf.exec:\fxrflxf.exe115⤵PID:4764
-
\??\c:\3rlfxrl.exec:\3rlfxrl.exe116⤵PID:2656
-
\??\c:\btnbnh.exec:\btnbnh.exe117⤵PID:4904
-
\??\c:\nnnhnh.exec:\nnnhnh.exe118⤵PID:640
-
\??\c:\jdppv.exec:\jdppv.exe119⤵PID:4424
-
\??\c:\frfxlff.exec:\frfxlff.exe120⤵PID:2016
-
\??\c:\lfxllll.exec:\lfxllll.exe121⤵PID:4620
-
\??\c:\thnhhh.exec:\thnhhh.exe122⤵PID:3136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-