Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 00:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8.exe
-
Size
71KB
-
MD5
f6f566f622dda5972b3864d8606fe126
-
SHA1
3163e2f4edf8459faa50494c6804ba3062cf147f
-
SHA256
68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8
-
SHA512
56ba0e453b16a78da75b6321717d2969a3be79b28aa69099e65d15ce6a011415da3d3f3d91e1a989d216f3117861dcafd6a49b4eed7f4ddfcad63b15bc1c2c57
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3A8N:ymb3NkkiQ3mdBjFI46TQ8N
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4076-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3524 ddvvp.exe 1836 1pdpd.exe 384 thhbtn.exe 2764 bbhbtn.exe 5064 3jjvp.exe 1968 dpvpp.exe 1296 xrxrffr.exe 2900 nbhbtn.exe 3456 vjjdv.exe 4688 vjjjd.exe 3288 fllfxxr.exe 4680 htnbth.exe 3716 jvdvj.exe 1920 rlxrffx.exe 5116 hnhbbb.exe 3736 thhhtn.exe 4264 jvppp.exe 4948 fxlrxlx.exe 3016 1btnhh.exe 3316 7dddp.exe 432 rxxxrlr.exe 3740 rxrlffx.exe 4016 nnhhbb.exe 3092 dvvpj.exe 2528 rlrllff.exe 376 7jjdv.exe 4332 dpvjd.exe 3888 xrrlffx.exe 4296 hhnnhh.exe 1420 nbthbt.exe 4780 pppjv.exe 2592 1fllfxx.exe 3064 nhbthb.exe 2252 vdppv.exe 2964 ddvdv.exe 2772 7rflfxr.exe 5008 xrrxfff.exe 1684 hhbhhb.exe 4460 jdjpp.exe 1052 5vpdd.exe 936 rrfffll.exe 4844 nnnttt.exe 412 nbnhtt.exe 2008 dpjjd.exe 396 rrrrrrr.exe 4380 xrxrrxr.exe 4748 flxfrfx.exe 4076 nhnhbb.exe 2492 vpppj.exe 3556 7rrrflf.exe 5072 tnnttb.exe 3460 nntnhh.exe 732 jddjd.exe 5064 rlrrlll.exe 3540 9nbtbh.exe 3564 vddjv.exe 980 dpvpp.exe 1416 frfxxrl.exe 3632 flfllrr.exe 2164 bthbbb.exe 3196 jjpjd.exe 3220 fflllfx.exe 3288 bnbtnn.exe 3156 nhhbtb.exe -
resource yara_rule behavioral2/memory/4076-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4076 wrote to memory of 3524 4076 68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8.exe 83 PID 4076 wrote to memory of 3524 4076 68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8.exe 83 PID 4076 wrote to memory of 3524 4076 68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8.exe 83 PID 3524 wrote to memory of 1836 3524 ddvvp.exe 84 PID 3524 wrote to memory of 1836 3524 ddvvp.exe 84 PID 3524 wrote to memory of 1836 3524 ddvvp.exe 84 PID 1836 wrote to memory of 384 1836 1pdpd.exe 85 PID 1836 wrote to memory of 384 1836 1pdpd.exe 85 PID 1836 wrote to memory of 384 1836 1pdpd.exe 85 PID 384 wrote to memory of 2764 384 thhbtn.exe 86 PID 384 wrote to memory of 2764 384 thhbtn.exe 86 PID 384 wrote to memory of 2764 384 thhbtn.exe 86 PID 2764 wrote to memory of 5064 2764 bbhbtn.exe 87 PID 2764 wrote to memory of 5064 2764 bbhbtn.exe 87 PID 2764 wrote to memory of 5064 2764 bbhbtn.exe 87 PID 5064 wrote to memory of 1968 5064 3jjvp.exe 88 PID 5064 wrote to memory of 1968 5064 3jjvp.exe 88 PID 5064 wrote to memory of 1968 5064 3jjvp.exe 88 PID 1968 wrote to memory of 1296 1968 dpvpp.exe 89 PID 1968 wrote to memory of 1296 1968 dpvpp.exe 89 PID 1968 wrote to memory of 1296 1968 dpvpp.exe 89 PID 1296 wrote to memory of 2900 1296 xrxrffr.exe 90 PID 1296 wrote to memory of 2900 1296 xrxrffr.exe 90 PID 1296 wrote to memory of 2900 1296 xrxrffr.exe 90 PID 2900 wrote to memory of 3456 2900 nbhbtn.exe 91 PID 2900 wrote to memory of 3456 2900 nbhbtn.exe 91 PID 2900 wrote to memory of 3456 2900 nbhbtn.exe 91 PID 3456 wrote to memory of 4688 3456 vjjdv.exe 92 PID 3456 wrote to memory of 4688 3456 vjjdv.exe 92 PID 3456 wrote to memory of 4688 3456 vjjdv.exe 92 PID 4688 wrote to memory of 3288 4688 vjjjd.exe 93 PID 4688 wrote to memory of 3288 4688 vjjjd.exe 93 PID 4688 wrote to memory of 3288 4688 vjjjd.exe 93 PID 3288 wrote to memory of 4680 3288 fllfxxr.exe 94 PID 3288 wrote to memory of 4680 3288 fllfxxr.exe 94 PID 3288 wrote to memory of 4680 3288 fllfxxr.exe 94 PID 4680 wrote to memory of 3716 4680 htnbth.exe 95 PID 4680 wrote to memory of 3716 4680 htnbth.exe 95 PID 4680 wrote to memory of 3716 4680 htnbth.exe 95 PID 3716 wrote to memory of 1920 3716 jvdvj.exe 96 PID 3716 wrote to memory of 1920 3716 jvdvj.exe 96 PID 3716 wrote to memory of 1920 3716 jvdvj.exe 96 PID 1920 wrote to memory of 5116 1920 rlxrffx.exe 97 PID 1920 wrote to memory of 5116 1920 rlxrffx.exe 97 PID 1920 wrote to memory of 5116 1920 rlxrffx.exe 97 PID 5116 wrote to memory of 3736 5116 hnhbbb.exe 98 PID 5116 wrote to memory of 3736 5116 hnhbbb.exe 98 PID 5116 wrote to memory of 3736 5116 hnhbbb.exe 98 PID 3736 wrote to memory of 4264 3736 thhhtn.exe 99 PID 3736 wrote to memory of 4264 3736 thhhtn.exe 99 PID 3736 wrote to memory of 4264 3736 thhhtn.exe 99 PID 4264 wrote to memory of 4948 4264 jvppp.exe 100 PID 4264 wrote to memory of 4948 4264 jvppp.exe 100 PID 4264 wrote to memory of 4948 4264 jvppp.exe 100 PID 4948 wrote to memory of 3016 4948 fxlrxlx.exe 101 PID 4948 wrote to memory of 3016 4948 fxlrxlx.exe 101 PID 4948 wrote to memory of 3016 4948 fxlrxlx.exe 101 PID 3016 wrote to memory of 3316 3016 1btnhh.exe 102 PID 3016 wrote to memory of 3316 3016 1btnhh.exe 102 PID 3016 wrote to memory of 3316 3016 1btnhh.exe 102 PID 3316 wrote to memory of 432 3316 7dddp.exe 103 PID 3316 wrote to memory of 432 3316 7dddp.exe 103 PID 3316 wrote to memory of 432 3316 7dddp.exe 103 PID 432 wrote to memory of 3740 432 rxxxrlr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8.exe"C:\Users\Admin\AppData\Local\Temp\68a954c1260e890a6273a024662bbbfaa37844925d1bfd3bbc2eff1c39abbde8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\ddvvp.exec:\ddvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\1pdpd.exec:\1pdpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\thhbtn.exec:\thhbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\bbhbtn.exec:\bbhbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\3jjvp.exec:\3jjvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\dpvpp.exec:\dpvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\xrxrffr.exec:\xrxrffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\nbhbtn.exec:\nbhbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\vjjdv.exec:\vjjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\vjjjd.exec:\vjjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\fllfxxr.exec:\fllfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\htnbth.exec:\htnbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\jvdvj.exec:\jvdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\rlxrffx.exec:\rlxrffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\hnhbbb.exec:\hnhbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\thhhtn.exec:\thhhtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\jvppp.exec:\jvppp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\fxlrxlx.exec:\fxlrxlx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\1btnhh.exec:\1btnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\7dddp.exec:\7dddp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\rxxxrlr.exec:\rxxxrlr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\rxrlffx.exec:\rxrlffx.exe23⤵
- Executes dropped EXE
PID:3740 -
\??\c:\nnhhbb.exec:\nnhhbb.exe24⤵
- Executes dropped EXE
PID:4016 -
\??\c:\dvvpj.exec:\dvvpj.exe25⤵
- Executes dropped EXE
PID:3092 -
\??\c:\rlrllff.exec:\rlrllff.exe26⤵
- Executes dropped EXE
PID:2528 -
\??\c:\7jjdv.exec:\7jjdv.exe27⤵
- Executes dropped EXE
PID:376 -
\??\c:\dpvjd.exec:\dpvjd.exe28⤵
- Executes dropped EXE
PID:4332 -
\??\c:\xrrlffx.exec:\xrrlffx.exe29⤵
- Executes dropped EXE
PID:3888 -
\??\c:\hhnnhh.exec:\hhnnhh.exe30⤵
- Executes dropped EXE
PID:4296 -
\??\c:\nbthbt.exec:\nbthbt.exe31⤵
- Executes dropped EXE
PID:1420 -
\??\c:\pppjv.exec:\pppjv.exe32⤵
- Executes dropped EXE
PID:4780 -
\??\c:\1fllfxx.exec:\1fllfxx.exe33⤵
- Executes dropped EXE
PID:2592 -
\??\c:\nhbthb.exec:\nhbthb.exe34⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vdppv.exec:\vdppv.exe35⤵
- Executes dropped EXE
PID:2252 -
\??\c:\ddvdv.exec:\ddvdv.exe36⤵
- Executes dropped EXE
PID:2964 -
\??\c:\7rflfxr.exec:\7rflfxr.exe37⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xrrxfff.exec:\xrrxfff.exe38⤵
- Executes dropped EXE
PID:5008 -
\??\c:\hhbhhb.exec:\hhbhhb.exe39⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jdjpp.exec:\jdjpp.exe40⤵
- Executes dropped EXE
PID:4460 -
\??\c:\5vpdd.exec:\5vpdd.exe41⤵
- Executes dropped EXE
PID:1052 -
\??\c:\rrfffll.exec:\rrfffll.exe42⤵
- Executes dropped EXE
PID:936 -
\??\c:\nnnttt.exec:\nnnttt.exe43⤵
- Executes dropped EXE
PID:4844 -
\??\c:\nbnhtt.exec:\nbnhtt.exe44⤵
- Executes dropped EXE
PID:412 -
\??\c:\dpjjd.exec:\dpjjd.exe45⤵
- Executes dropped EXE
PID:2008 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe46⤵
- Executes dropped EXE
PID:396 -
\??\c:\xrxrrxr.exec:\xrxrrxr.exe47⤵
- Executes dropped EXE
PID:4380 -
\??\c:\flxfrfx.exec:\flxfrfx.exe48⤵
- Executes dropped EXE
PID:4748 -
\??\c:\nhnhbb.exec:\nhnhbb.exe49⤵
- Executes dropped EXE
PID:4076 -
\??\c:\vpppj.exec:\vpppj.exe50⤵
- Executes dropped EXE
PID:2492 -
\??\c:\7rrrflf.exec:\7rrrflf.exe51⤵
- Executes dropped EXE
PID:3556 -
\??\c:\tnnttb.exec:\tnnttb.exe52⤵
- Executes dropped EXE
PID:5072 -
\??\c:\nntnhh.exec:\nntnhh.exe53⤵
- Executes dropped EXE
PID:3460 -
\??\c:\jddjd.exec:\jddjd.exe54⤵
- Executes dropped EXE
PID:732 -
\??\c:\rlrrlll.exec:\rlrrlll.exe55⤵
- Executes dropped EXE
PID:5064 -
\??\c:\9nbtbh.exec:\9nbtbh.exe56⤵
- Executes dropped EXE
PID:3540 -
\??\c:\vddjv.exec:\vddjv.exe57⤵
- Executes dropped EXE
PID:3564 -
\??\c:\dpvpp.exec:\dpvpp.exe58⤵
- Executes dropped EXE
PID:980 -
\??\c:\frfxxrl.exec:\frfxxrl.exe59⤵
- Executes dropped EXE
PID:1416 -
\??\c:\flfllrr.exec:\flfllrr.exe60⤵
- Executes dropped EXE
PID:3632 -
\??\c:\bthbbb.exec:\bthbbb.exe61⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jjpjd.exec:\jjpjd.exe62⤵
- Executes dropped EXE
PID:3196 -
\??\c:\fflllfx.exec:\fflllfx.exe63⤵
- Executes dropped EXE
PID:3220 -
\??\c:\bnbtnn.exec:\bnbtnn.exe64⤵
- Executes dropped EXE
PID:3288 -
\??\c:\nhhbtb.exec:\nhhbtb.exe65⤵
- Executes dropped EXE
PID:3156 -
\??\c:\vpjjp.exec:\vpjjp.exe66⤵PID:3272
-
\??\c:\lfxlrrx.exec:\lfxlrrx.exe67⤵PID:3296
-
\??\c:\hnnnth.exec:\hnnnth.exe68⤵PID:4700
-
\??\c:\nnnnhh.exec:\nnnnhh.exe69⤵PID:4816
-
\??\c:\bnnhhh.exec:\bnnhhh.exe70⤵PID:3736
-
\??\c:\ppppj.exec:\ppppj.exe71⤵PID:2268
-
\??\c:\lxfrllf.exec:\lxfrllf.exe72⤵PID:752
-
\??\c:\3lfxrlf.exec:\3lfxrlf.exe73⤵
- System Location Discovery: System Language Discovery
PID:4716 -
\??\c:\btnttn.exec:\btnttn.exe74⤵PID:4116
-
\??\c:\djpjj.exec:\djpjj.exe75⤵PID:456
-
\??\c:\jddjv.exec:\jddjv.exe76⤵PID:2708
-
\??\c:\llxxxlf.exec:\llxxxlf.exe77⤵PID:3496
-
\??\c:\3htnnh.exec:\3htnnh.exe78⤵PID:3276
-
\??\c:\9ttntt.exec:\9ttntt.exe79⤵PID:1780
-
\??\c:\djdvp.exec:\djdvp.exe80⤵PID:4108
-
\??\c:\lxffrlf.exec:\lxffrlf.exe81⤵PID:1072
-
\??\c:\fllfffr.exec:\fllfffr.exe82⤵PID:4552
-
\??\c:\7hbttn.exec:\7hbttn.exe83⤵PID:2280
-
\??\c:\httnhb.exec:\httnhb.exe84⤵PID:376
-
\??\c:\jjpjd.exec:\jjpjd.exe85⤵PID:1156
-
\??\c:\llrrfff.exec:\llrrfff.exe86⤵PID:4324
-
\??\c:\flllffx.exec:\flllffx.exe87⤵PID:1204
-
\??\c:\tnhnnh.exec:\tnhnnh.exe88⤵PID:1616
-
\??\c:\3bbthb.exec:\3bbthb.exe89⤵PID:1488
-
\??\c:\dvvpd.exec:\dvvpd.exe90⤵PID:4448
-
\??\c:\lfllllx.exec:\lfllllx.exe91⤵PID:2592
-
\??\c:\rrllffx.exec:\rrllffx.exe92⤵PID:1352
-
\??\c:\nhbttt.exec:\nhbttt.exe93⤵PID:2252
-
\??\c:\9pvjj.exec:\9pvjj.exe94⤵PID:1848
-
\??\c:\xrxrfrl.exec:\xrxrfrl.exe95⤵PID:2020
-
\??\c:\tnnbtt.exec:\tnnbtt.exe96⤵PID:4540
-
\??\c:\vdvjd.exec:\vdvjd.exe97⤵PID:1720
-
\??\c:\jdvpj.exec:\jdvpj.exe98⤵PID:1732
-
\??\c:\xflfrxr.exec:\xflfrxr.exe99⤵PID:2572
-
\??\c:\tntnhb.exec:\tntnhb.exe100⤵PID:2168
-
\??\c:\1bthtt.exec:\1bthtt.exe101⤵PID:3292
-
\??\c:\vpppd.exec:\vpppd.exe102⤵PID:1644
-
\??\c:\xxfxxxf.exec:\xxfxxxf.exe103⤵PID:2508
-
\??\c:\frxrlfx.exec:\frxrlfx.exe104⤵PID:4336
-
\??\c:\nhhtnn.exec:\nhhtnn.exe105⤵PID:540
-
\??\c:\vjjjd.exec:\vjjjd.exe106⤵PID:4128
-
\??\c:\pddvj.exec:\pddvj.exe107⤵PID:1636
-
\??\c:\vjjdv.exec:\vjjdv.exe108⤵PID:4932
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe109⤵PID:2324
-
\??\c:\thhhbb.exec:\thhhbb.exe110⤵PID:384
-
\??\c:\dpdvj.exec:\dpdvj.exe111⤵PID:3804
-
\??\c:\djvjd.exec:\djvjd.exe112⤵PID:5096
-
\??\c:\xrrlxrr.exec:\xrrlxrr.exe113⤵PID:5004
-
\??\c:\tnnttn.exec:\tnnttn.exe114⤵PID:5092
-
\??\c:\nntbnn.exec:\nntbnn.exe115⤵PID:3320
-
\??\c:\ddddp.exec:\ddddp.exe116⤵PID:3352
-
\??\c:\7llxrlf.exec:\7llxrlf.exe117⤵PID:4120
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe118⤵PID:1048
-
\??\c:\hhhbnn.exec:\hhhbnn.exe119⤵PID:3756
-
\??\c:\1hbthh.exec:\1hbthh.exe120⤵PID:3624
-
\??\c:\vpjdp.exec:\vpjdp.exe121⤵PID:3864
-
\??\c:\lflxrrx.exec:\lflxrrx.exe122⤵PID:4976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-