Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 21:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20d06190ad6341c7985f90b2f20133b5b35da45b23e87c5b1ad00b81b64818f8N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
20d06190ad6341c7985f90b2f20133b5b35da45b23e87c5b1ad00b81b64818f8N.exe
-
Size
70KB
-
MD5
aa53cf5abf69aefb48931c27a1c3a590
-
SHA1
f23f573d2545edee8d6e8b2034e83f049da29617
-
SHA256
20d06190ad6341c7985f90b2f20133b5b35da45b23e87c5b1ad00b81b64818f8
-
SHA512
4ec21bb4cb0f69f2d7ccbe811eae8420c9795d06053fc641627e817021e6e62c2cb1ba55e9b40b477d864e4124e49587775405a340f831fc5362a9a41e262c67
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAcx:ymb3NkkiQ3mdBjFIsIVcx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4768-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1996 jvjvj.exe 3544 lrxflxr.exe 4468 3bnhnn.exe 4744 1pjpj.exe 2572 xrrxrlf.exe 3320 nbtnhh.exe 2788 hhhbbb.exe 2424 jvvjv.exe 2360 xrfrrxr.exe 3480 hhbbhb.exe 1240 lrxxrff.exe 2956 hnnhhb.exe 436 pddvp.exe 2704 frlfxrf.exe 3048 nhhtnh.exe 1772 jvppj.exe 2604 9rfxxll.exe 3024 hnnhtt.exe 1620 jpjdv.exe 372 jjpjd.exe 1004 hhbnbb.exe 4708 thnhbt.exe 1776 vvpdp.exe 2328 xrlrrll.exe 1480 bhbhtt.exe 1460 9ppdp.exe 4392 rllfxxx.exe 4204 bnnbnn.exe 4236 thnhbb.exe 4436 3jjjd.exe 5084 1rffxxr.exe 4948 bntnnn.exe 1840 hbbbtt.exe 1900 jppjd.exe 1544 flffxxr.exe 1088 9xfxffx.exe 4676 tbnhbb.exe 1116 nbbthh.exe 2104 jdjjj.exe 3168 xrxrlff.exe 5028 lxfrlrr.exe 2312 7tbbtt.exe 5036 jvjpd.exe 184 jvjpd.exe 4340 9lfxllf.exe 4032 bhbtnt.exe 432 vjpjv.exe 4664 vjjjv.exe 3960 xlxrllx.exe 2996 nhnntb.exe 4752 hhhthb.exe 1608 ppdpj.exe 4564 jpjdp.exe 400 5lfxrrl.exe 2192 nhtnhn.exe 2788 htnhnn.exe 3020 pddvj.exe 1432 rxrlxrl.exe 2360 lflfxxr.exe 2616 5hhnnt.exe 3900 htthbb.exe 1992 djdvp.exe 1860 rfrrfrf.exe 8 hbthtb.exe -
resource yara_rule behavioral2/memory/4768-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhhh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4768 wrote to memory of 1996 4768 20d06190ad6341c7985f90b2f20133b5b35da45b23e87c5b1ad00b81b64818f8N.exe 84 PID 4768 wrote to memory of 1996 4768 20d06190ad6341c7985f90b2f20133b5b35da45b23e87c5b1ad00b81b64818f8N.exe 84 PID 4768 wrote to memory of 1996 4768 20d06190ad6341c7985f90b2f20133b5b35da45b23e87c5b1ad00b81b64818f8N.exe 84 PID 1996 wrote to memory of 3544 1996 jvjvj.exe 85 PID 1996 wrote to memory of 3544 1996 jvjvj.exe 85 PID 1996 wrote to memory of 3544 1996 jvjvj.exe 85 PID 3544 wrote to memory of 4468 3544 lrxflxr.exe 86 PID 3544 wrote to memory of 4468 3544 lrxflxr.exe 86 PID 3544 wrote to memory of 4468 3544 lrxflxr.exe 86 PID 4468 wrote to memory of 4744 4468 3bnhnn.exe 87 PID 4468 wrote to memory of 4744 4468 3bnhnn.exe 87 PID 4468 wrote to memory of 4744 4468 3bnhnn.exe 87 PID 4744 wrote to memory of 2572 4744 1pjpj.exe 88 PID 4744 wrote to memory of 2572 4744 1pjpj.exe 88 PID 4744 wrote to memory of 2572 4744 1pjpj.exe 88 PID 2572 wrote to memory of 3320 2572 xrrxrlf.exe 89 PID 2572 wrote to memory of 3320 2572 xrrxrlf.exe 89 PID 2572 wrote to memory of 3320 2572 xrrxrlf.exe 89 PID 3320 wrote to memory of 2788 3320 nbtnhh.exe 90 PID 3320 wrote to memory of 2788 3320 nbtnhh.exe 90 PID 3320 wrote to memory of 2788 3320 nbtnhh.exe 90 PID 2788 wrote to memory of 2424 2788 hhhbbb.exe 91 PID 2788 wrote to memory of 2424 2788 hhhbbb.exe 91 PID 2788 wrote to memory of 2424 2788 hhhbbb.exe 91 PID 2424 wrote to memory of 2360 2424 jvvjv.exe 92 PID 2424 wrote to memory of 2360 2424 jvvjv.exe 92 PID 2424 wrote to memory of 2360 2424 jvvjv.exe 92 PID 2360 wrote to memory of 3480 2360 xrfrrxr.exe 93 PID 2360 wrote to memory of 3480 2360 xrfrrxr.exe 93 PID 2360 wrote to memory of 3480 2360 xrfrrxr.exe 93 PID 3480 wrote to memory of 1240 3480 hhbbhb.exe 94 PID 3480 wrote to memory of 1240 3480 hhbbhb.exe 94 PID 3480 wrote to memory of 1240 3480 hhbbhb.exe 94 PID 1240 wrote to memory of 2956 1240 lrxxrff.exe 95 PID 1240 wrote to memory of 2956 1240 lrxxrff.exe 95 PID 1240 wrote to memory of 2956 1240 lrxxrff.exe 95 PID 2956 wrote to memory of 436 2956 hnnhhb.exe 96 PID 2956 wrote to memory of 436 2956 hnnhhb.exe 96 PID 2956 wrote to memory of 436 2956 hnnhhb.exe 96 PID 436 wrote to memory of 2704 436 pddvp.exe 97 PID 436 wrote to memory of 2704 436 pddvp.exe 97 PID 436 wrote to memory of 2704 436 pddvp.exe 97 PID 2704 wrote to memory of 3048 2704 frlfxrf.exe 98 PID 2704 wrote to memory of 3048 2704 frlfxrf.exe 98 PID 2704 wrote to memory of 3048 2704 frlfxrf.exe 98 PID 3048 wrote to memory of 1772 3048 nhhtnh.exe 99 PID 3048 wrote to memory of 1772 3048 nhhtnh.exe 99 PID 3048 wrote to memory of 1772 3048 nhhtnh.exe 99 PID 1772 wrote to memory of 2604 1772 jvppj.exe 100 PID 1772 wrote to memory of 2604 1772 jvppj.exe 100 PID 1772 wrote to memory of 2604 1772 jvppj.exe 100 PID 2604 wrote to memory of 3024 2604 9rfxxll.exe 101 PID 2604 wrote to memory of 3024 2604 9rfxxll.exe 101 PID 2604 wrote to memory of 3024 2604 9rfxxll.exe 101 PID 3024 wrote to memory of 1620 3024 hnnhtt.exe 102 PID 3024 wrote to memory of 1620 3024 hnnhtt.exe 102 PID 3024 wrote to memory of 1620 3024 hnnhtt.exe 102 PID 1620 wrote to memory of 372 1620 jpjdv.exe 103 PID 1620 wrote to memory of 372 1620 jpjdv.exe 103 PID 1620 wrote to memory of 372 1620 jpjdv.exe 103 PID 372 wrote to memory of 1004 372 jjpjd.exe 104 PID 372 wrote to memory of 1004 372 jjpjd.exe 104 PID 372 wrote to memory of 1004 372 jjpjd.exe 104 PID 1004 wrote to memory of 4708 1004 hhbnbb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\20d06190ad6341c7985f90b2f20133b5b35da45b23e87c5b1ad00b81b64818f8N.exe"C:\Users\Admin\AppData\Local\Temp\20d06190ad6341c7985f90b2f20133b5b35da45b23e87c5b1ad00b81b64818f8N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\jvjvj.exec:\jvjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\lrxflxr.exec:\lrxflxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\3bnhnn.exec:\3bnhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\1pjpj.exec:\1pjpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\xrrxrlf.exec:\xrrxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\nbtnhh.exec:\nbtnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\hhhbbb.exec:\hhhbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\jvvjv.exec:\jvvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\xrfrrxr.exec:\xrfrrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\hhbbhb.exec:\hhbbhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\lrxxrff.exec:\lrxxrff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\hnnhhb.exec:\hnnhhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\pddvp.exec:\pddvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\frlfxrf.exec:\frlfxrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\nhhtnh.exec:\nhhtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\jvppj.exec:\jvppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\9rfxxll.exec:\9rfxxll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\hnnhtt.exec:\hnnhtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jpjdv.exec:\jpjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\jjpjd.exec:\jjpjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\hhbnbb.exec:\hhbnbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\thnhbt.exec:\thnhbt.exe23⤵
- Executes dropped EXE
PID:4708 -
\??\c:\vvpdp.exec:\vvpdp.exe24⤵
- Executes dropped EXE
PID:1776 -
\??\c:\xrlrrll.exec:\xrlrrll.exe25⤵
- Executes dropped EXE
PID:2328 -
\??\c:\bhbhtt.exec:\bhbhtt.exe26⤵
- Executes dropped EXE
PID:1480 -
\??\c:\9ppdp.exec:\9ppdp.exe27⤵
- Executes dropped EXE
PID:1460 -
\??\c:\rllfxxx.exec:\rllfxxx.exe28⤵
- Executes dropped EXE
PID:4392 -
\??\c:\bnnbnn.exec:\bnnbnn.exe29⤵
- Executes dropped EXE
PID:4204 -
\??\c:\thnhbb.exec:\thnhbb.exe30⤵
- Executes dropped EXE
PID:4236 -
\??\c:\3jjjd.exec:\3jjjd.exe31⤵
- Executes dropped EXE
PID:4436 -
\??\c:\1rffxxr.exec:\1rffxxr.exe32⤵
- Executes dropped EXE
PID:5084 -
\??\c:\bntnnn.exec:\bntnnn.exe33⤵
- Executes dropped EXE
PID:4948 -
\??\c:\hbbbtt.exec:\hbbbtt.exe34⤵
- Executes dropped EXE
PID:1840 -
\??\c:\jppjd.exec:\jppjd.exe35⤵
- Executes dropped EXE
PID:1900 -
\??\c:\flffxxr.exec:\flffxxr.exe36⤵
- Executes dropped EXE
PID:1544 -
\??\c:\9xfxffx.exec:\9xfxffx.exe37⤵
- Executes dropped EXE
PID:1088 -
\??\c:\tbnhbb.exec:\tbnhbb.exe38⤵
- Executes dropped EXE
PID:4676 -
\??\c:\nbbthh.exec:\nbbthh.exe39⤵
- Executes dropped EXE
PID:1116 -
\??\c:\jdjjj.exec:\jdjjj.exe40⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xrxrlff.exec:\xrxrlff.exe41⤵
- Executes dropped EXE
PID:3168 -
\??\c:\lxfrlrr.exec:\lxfrlrr.exe42⤵
- Executes dropped EXE
PID:5028 -
\??\c:\7tbbtt.exec:\7tbbtt.exe43⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jvjpd.exec:\jvjpd.exe44⤵
- Executes dropped EXE
PID:5036 -
\??\c:\jvjpd.exec:\jvjpd.exe45⤵
- Executes dropped EXE
PID:184 -
\??\c:\9lfxllf.exec:\9lfxllf.exe46⤵
- Executes dropped EXE
PID:4340 -
\??\c:\bhbtnt.exec:\bhbtnt.exe47⤵
- Executes dropped EXE
PID:4032 -
\??\c:\vjpjv.exec:\vjpjv.exe48⤵
- Executes dropped EXE
PID:432 -
\??\c:\vjjjv.exec:\vjjjv.exe49⤵
- Executes dropped EXE
PID:4664 -
\??\c:\xlxrllx.exec:\xlxrllx.exe50⤵
- Executes dropped EXE
PID:3960 -
\??\c:\nhnntb.exec:\nhnntb.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2996 -
\??\c:\hhhthb.exec:\hhhthb.exe52⤵
- Executes dropped EXE
PID:4752 -
\??\c:\ppdpj.exec:\ppdpj.exe53⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jpjdp.exec:\jpjdp.exe54⤵
- Executes dropped EXE
PID:4564 -
\??\c:\5lfxrrl.exec:\5lfxrrl.exe55⤵
- Executes dropped EXE
PID:400 -
\??\c:\nhtnhn.exec:\nhtnhn.exe56⤵
- Executes dropped EXE
PID:2192 -
\??\c:\htnhnn.exec:\htnhnn.exe57⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pddvj.exec:\pddvj.exe58⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rxrlxrl.exec:\rxrlxrl.exe59⤵
- Executes dropped EXE
PID:1432 -
\??\c:\lflfxxr.exec:\lflfxxr.exe60⤵
- Executes dropped EXE
PID:2360 -
\??\c:\5hhnnt.exec:\5hhnnt.exe61⤵
- Executes dropped EXE
PID:2616 -
\??\c:\htthbb.exec:\htthbb.exe62⤵
- Executes dropped EXE
PID:3900 -
\??\c:\djdvp.exec:\djdvp.exe63⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rfrrfrf.exec:\rfrrfrf.exe64⤵
- Executes dropped EXE
PID:1860 -
\??\c:\hbthtb.exec:\hbthtb.exe65⤵
- Executes dropped EXE
PID:8 -
\??\c:\hhbnbt.exec:\hhbnbt.exe66⤵PID:4688
-
\??\c:\dvjvj.exec:\dvjvj.exe67⤵PID:3344
-
\??\c:\1llfrrl.exec:\1llfrrl.exe68⤵PID:3276
-
\??\c:\fxlffff.exec:\fxlffff.exe69⤵PID:944
-
\??\c:\rflxlll.exec:\rflxlll.exe70⤵PID:4552
-
\??\c:\nbhbbb.exec:\nbhbbb.exe71⤵PID:3112
-
\??\c:\thtnhb.exec:\thtnhb.exe72⤵PID:2368
-
\??\c:\jppjv.exec:\jppjv.exe73⤵PID:4656
-
\??\c:\rlfflfr.exec:\rlfflfr.exe74⤵PID:3944
-
\??\c:\lfxxrlx.exec:\lfxxrlx.exe75⤵PID:4916
-
\??\c:\hbnbnh.exec:\hbnbnh.exe76⤵PID:4872
-
\??\c:\hhnthb.exec:\hhnthb.exe77⤵PID:2904
-
\??\c:\jvvjp.exec:\jvvjp.exe78⤵PID:1780
-
\??\c:\jjvvj.exec:\jjvvj.exe79⤵PID:1044
-
\??\c:\xrxlxrl.exec:\xrxlxrl.exe80⤵PID:2124
-
\??\c:\tnthbt.exec:\tnthbt.exe81⤵PID:5012
-
\??\c:\pjdvj.exec:\pjdvj.exe82⤵PID:1480
-
\??\c:\pjpvp.exec:\pjpvp.exe83⤵PID:4824
-
\??\c:\xxfxllf.exec:\xxfxllf.exe84⤵PID:3144
-
\??\c:\thnhhb.exec:\thnhhb.exe85⤵
- System Location Discovery: System Language Discovery
PID:3924 -
\??\c:\nbbbnn.exec:\nbbbnn.exe86⤵PID:4936
-
\??\c:\3vpvd.exec:\3vpvd.exe87⤵PID:4312
-
\??\c:\pvvvp.exec:\pvvvp.exe88⤵PID:4436
-
\??\c:\frrlffx.exec:\frrlffx.exe89⤵PID:3592
-
\??\c:\7xxlfll.exec:\7xxlfll.exe90⤵PID:1236
-
\??\c:\nbnhnh.exec:\nbnhnh.exe91⤵PID:1624
-
\??\c:\7pjdp.exec:\7pjdp.exe92⤵PID:3456
-
\??\c:\pdvpj.exec:\pdvpj.exe93⤵PID:1900
-
\??\c:\dvpdd.exec:\dvpdd.exe94⤵PID:3084
-
\??\c:\rrrfrrf.exec:\rrrfrrf.exe95⤵PID:1088
-
\??\c:\7hhbtn.exec:\7hhbtn.exe96⤵PID:872
-
\??\c:\1hbnbt.exec:\1hbnbt.exe97⤵PID:4116
-
\??\c:\5jjdv.exec:\5jjdv.exe98⤵PID:2832
-
\??\c:\rllfrlf.exec:\rllfrlf.exe99⤵PID:4524
-
\??\c:\flxrrll.exec:\flxrrll.exe100⤵PID:2112
-
\??\c:\1jvpj.exec:\1jvpj.exe101⤵PID:4336
-
\??\c:\vjpjd.exec:\vjpjd.exe102⤵PID:1384
-
\??\c:\xlxlllr.exec:\xlxlllr.exe103⤵PID:1164
-
\??\c:\nhhhhh.exec:\nhhhhh.exe104⤵PID:1996
-
\??\c:\3btnbb.exec:\3btnbb.exe105⤵PID:3544
-
\??\c:\ppvpd.exec:\ppvpd.exe106⤵PID:3660
-
\??\c:\vvjvp.exec:\vvjvp.exe107⤵PID:3304
-
\??\c:\rfrlrxf.exec:\rfrlrxf.exe108⤵PID:1212
-
\??\c:\bnntnn.exec:\bnntnn.exe109⤵PID:4372
-
\??\c:\1ntbnn.exec:\1ntbnn.exe110⤵PID:688
-
\??\c:\jdppj.exec:\jdppj.exe111⤵PID:4528
-
\??\c:\9flfxxx.exec:\9flfxxx.exe112⤵PID:4440
-
\??\c:\hntnhb.exec:\hntnhb.exe113⤵PID:1420
-
\??\c:\jvjdj.exec:\jvjdj.exe114⤵PID:4180
-
\??\c:\5vpjv.exec:\5vpjv.exe115⤵PID:3380
-
\??\c:\lxlxrlx.exec:\lxlxrlx.exe116⤵PID:3608
-
\??\c:\7nbbnh.exec:\7nbbnh.exe117⤵PID:2644
-
\??\c:\hntbht.exec:\hntbht.exe118⤵PID:3620
-
\??\c:\pdddp.exec:\pdddp.exe119⤵PID:4728
-
\??\c:\rllxxrl.exec:\rllxxrl.exe120⤵PID:1292
-
\??\c:\5lfffxf.exec:\5lfffxf.exe121⤵PID:4932
-
\??\c:\bhnnnh.exec:\bhnnnh.exe122⤵PID:3052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-