Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 10:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9646029abe38f001bed7ace1d5083621b7d5328d0cb8736fdc9075d12d00cf0N.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b9646029abe38f001bed7ace1d5083621b7d5328d0cb8736fdc9075d12d00cf0N.exe
-
Size
454KB
-
MD5
8396849b39aef5bc862af7d508fa0f70
-
SHA1
38ad689db5b7305549832e9bbf278c2a1c4c05ce
-
SHA256
b9646029abe38f001bed7ace1d5083621b7d5328d0cb8736fdc9075d12d00cf0
-
SHA512
c31797c9e64bc4a1806e19f38a02c76707fe5c183666db314487b8b2b2e035faeb0697e677104bd48e312cc4c96954b2582b1e418a302dde9bfac2317f4f83a9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/1760-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-75-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2696-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-87-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2280-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/608-177-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/608-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-501-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1608-508-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1608-529-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2276-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3052 ntbnth.exe 2152 jpvjd.exe 2932 5hhtbh.exe 2820 bbhtbn.exe 3064 hhthnn.exe 2724 tnbnth.exe 2696 5jpdd.exe 2772 1nhnbh.exe 2280 jpjjp.exe 1896 hbnthh.exe 1968 1pdjv.exe 2528 vdpdp.exe 3036 rxllllr.exe 1868 vvvvj.exe 2440 ffrxfxx.exe 1564 5ppvd.exe 608 7rfffff.exe 1620 3jvpv.exe 1940 llrxffl.exe 2300 lrxxffr.exe 2140 nnbtbb.exe 1088 3hnbbn.exe 1528 ddjjv.exe 2072 tbnbht.exe 1424 5vjpv.exe 2672 bnbtnb.exe 2168 1dppd.exe 264 tttbhn.exe 2392 vdjpd.exe 1448 hhttbh.exe 2524 9pvvd.exe 3004 hntbnt.exe 2936 jdjjv.exe 2132 rxflflr.exe 2932 9ntbnb.exe 2856 pvjpv.exe 2888 frfxlrx.exe 2868 hhthth.exe 2740 vjppv.exe 2760 rxllxff.exe 2260 bttbhh.exe 2768 5vjpp.exe 2296 9frlrxx.exe 1392 ntntht.exe 2676 nnbhth.exe 1948 5vjpd.exe 2796 flxxffl.exe 2996 hhttbh.exe 3036 hhnthh.exe 2872 vdvpv.exe 2784 llrxxxf.exe 2440 nnnntt.exe 1096 vvdjj.exe 1728 1rxrxxx.exe 2220 9nntnt.exe 1620 7dvdv.exe 2428 7rfflrx.exe 1908 tbhhnt.exe 2380 bnhhnt.exe 1608 ppjvd.exe 1812 lflrxxf.exe 2488 hhbnbb.exe 1928 pvvpd.exe 1680 xflllrr.exe -
resource yara_rule behavioral1/memory/1760-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-138-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1868-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-609-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1760 wrote to memory of 3052 1760 b9646029abe38f001bed7ace1d5083621b7d5328d0cb8736fdc9075d12d00cf0N.exe 30 PID 1760 wrote to memory of 3052 1760 b9646029abe38f001bed7ace1d5083621b7d5328d0cb8736fdc9075d12d00cf0N.exe 30 PID 1760 wrote to memory of 3052 1760 b9646029abe38f001bed7ace1d5083621b7d5328d0cb8736fdc9075d12d00cf0N.exe 30 PID 1760 wrote to memory of 3052 1760 b9646029abe38f001bed7ace1d5083621b7d5328d0cb8736fdc9075d12d00cf0N.exe 30 PID 3052 wrote to memory of 2152 3052 ntbnth.exe 31 PID 3052 wrote to memory of 2152 3052 ntbnth.exe 31 PID 3052 wrote to memory of 2152 3052 ntbnth.exe 31 PID 3052 wrote to memory of 2152 3052 ntbnth.exe 31 PID 2152 wrote to memory of 2932 2152 jpvjd.exe 32 PID 2152 wrote to memory of 2932 2152 jpvjd.exe 32 PID 2152 wrote to memory of 2932 2152 jpvjd.exe 32 PID 2152 wrote to memory of 2932 2152 jpvjd.exe 32 PID 2932 wrote to memory of 2820 2932 5hhtbh.exe 33 PID 2932 wrote to memory of 2820 2932 5hhtbh.exe 33 PID 2932 wrote to memory of 2820 2932 5hhtbh.exe 33 PID 2932 wrote to memory of 2820 2932 5hhtbh.exe 33 PID 2820 wrote to memory of 3064 2820 bbhtbn.exe 34 PID 2820 wrote to memory of 3064 2820 bbhtbn.exe 34 PID 2820 wrote to memory of 3064 2820 bbhtbn.exe 34 PID 2820 wrote to memory of 3064 2820 bbhtbn.exe 34 PID 3064 wrote to memory of 2724 3064 hhthnn.exe 35 PID 3064 wrote to memory of 2724 3064 hhthnn.exe 35 PID 3064 wrote to memory of 2724 3064 hhthnn.exe 35 PID 3064 wrote to memory of 2724 3064 hhthnn.exe 35 PID 2724 wrote to memory of 2696 2724 tnbnth.exe 36 PID 2724 wrote to memory of 2696 2724 tnbnth.exe 36 PID 2724 wrote to memory of 2696 2724 tnbnth.exe 36 PID 2724 wrote to memory of 2696 2724 tnbnth.exe 36 PID 2696 wrote to memory of 2772 2696 5jpdd.exe 37 PID 2696 wrote to memory of 2772 2696 5jpdd.exe 37 PID 2696 wrote to memory of 2772 2696 5jpdd.exe 37 PID 2696 wrote to memory of 2772 2696 5jpdd.exe 37 PID 2772 wrote to memory of 2280 2772 1nhnbh.exe 38 PID 2772 wrote to memory of 2280 2772 1nhnbh.exe 38 PID 2772 wrote to memory of 2280 2772 1nhnbh.exe 38 PID 2772 wrote to memory of 2280 2772 1nhnbh.exe 38 PID 2280 wrote to memory of 1896 2280 jpjjp.exe 39 PID 2280 wrote to memory of 1896 2280 jpjjp.exe 39 PID 2280 wrote to memory of 1896 2280 jpjjp.exe 39 PID 2280 wrote to memory of 1896 2280 jpjjp.exe 39 PID 1896 wrote to memory of 1968 1896 hbnthh.exe 40 PID 1896 wrote to memory of 1968 1896 hbnthh.exe 40 PID 1896 wrote to memory of 1968 1896 hbnthh.exe 40 PID 1896 wrote to memory of 1968 1896 hbnthh.exe 40 PID 1968 wrote to memory of 2528 1968 1pdjv.exe 41 PID 1968 wrote to memory of 2528 1968 1pdjv.exe 41 PID 1968 wrote to memory of 2528 1968 1pdjv.exe 41 PID 1968 wrote to memory of 2528 1968 1pdjv.exe 41 PID 2528 wrote to memory of 3036 2528 vdpdp.exe 42 PID 2528 wrote to memory of 3036 2528 vdpdp.exe 42 PID 2528 wrote to memory of 3036 2528 vdpdp.exe 42 PID 2528 wrote to memory of 3036 2528 vdpdp.exe 42 PID 3036 wrote to memory of 1868 3036 rxllllr.exe 43 PID 3036 wrote to memory of 1868 3036 rxllllr.exe 43 PID 3036 wrote to memory of 1868 3036 rxllllr.exe 43 PID 3036 wrote to memory of 1868 3036 rxllllr.exe 43 PID 1868 wrote to memory of 2440 1868 vvvvj.exe 44 PID 1868 wrote to memory of 2440 1868 vvvvj.exe 44 PID 1868 wrote to memory of 2440 1868 vvvvj.exe 44 PID 1868 wrote to memory of 2440 1868 vvvvj.exe 44 PID 2440 wrote to memory of 1564 2440 ffrxfxx.exe 45 PID 2440 wrote to memory of 1564 2440 ffrxfxx.exe 45 PID 2440 wrote to memory of 1564 2440 ffrxfxx.exe 45 PID 2440 wrote to memory of 1564 2440 ffrxfxx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9646029abe38f001bed7ace1d5083621b7d5328d0cb8736fdc9075d12d00cf0N.exe"C:\Users\Admin\AppData\Local\Temp\b9646029abe38f001bed7ace1d5083621b7d5328d0cb8736fdc9075d12d00cf0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\ntbnth.exec:\ntbnth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\jpvjd.exec:\jpvjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\5hhtbh.exec:\5hhtbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\bbhtbn.exec:\bbhtbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\hhthnn.exec:\hhthnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\tnbnth.exec:\tnbnth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\5jpdd.exec:\5jpdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\1nhnbh.exec:\1nhnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\jpjjp.exec:\jpjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\hbnthh.exec:\hbnthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\1pdjv.exec:\1pdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\vdpdp.exec:\vdpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\rxllllr.exec:\rxllllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\vvvvj.exec:\vvvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\ffrxfxx.exec:\ffrxfxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\5ppvd.exec:\5ppvd.exe17⤵
- Executes dropped EXE
PID:1564 -
\??\c:\7rfffff.exec:\7rfffff.exe18⤵
- Executes dropped EXE
PID:608 -
\??\c:\3jvpv.exec:\3jvpv.exe19⤵
- Executes dropped EXE
PID:1620 -
\??\c:\llrxffl.exec:\llrxffl.exe20⤵
- Executes dropped EXE
PID:1940 -
\??\c:\lrxxffr.exec:\lrxxffr.exe21⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nnbtbb.exec:\nnbtbb.exe22⤵
- Executes dropped EXE
PID:2140 -
\??\c:\3hnbbn.exec:\3hnbbn.exe23⤵
- Executes dropped EXE
PID:1088 -
\??\c:\ddjjv.exec:\ddjjv.exe24⤵
- Executes dropped EXE
PID:1528 -
\??\c:\tbnbht.exec:\tbnbht.exe25⤵
- Executes dropped EXE
PID:2072 -
\??\c:\5vjpv.exec:\5vjpv.exe26⤵
- Executes dropped EXE
PID:1424 -
\??\c:\bnbtnb.exec:\bnbtnb.exe27⤵
- Executes dropped EXE
PID:2672 -
\??\c:\1dppd.exec:\1dppd.exe28⤵
- Executes dropped EXE
PID:2168 -
\??\c:\tttbhn.exec:\tttbhn.exe29⤵
- Executes dropped EXE
PID:264 -
\??\c:\vdjpd.exec:\vdjpd.exe30⤵
- Executes dropped EXE
PID:2392 -
\??\c:\hhttbh.exec:\hhttbh.exe31⤵
- Executes dropped EXE
PID:1448 -
\??\c:\9pvvd.exec:\9pvvd.exe32⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hntbnt.exec:\hntbnt.exe33⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jdjjv.exec:\jdjjv.exe34⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rxflflr.exec:\rxflflr.exe35⤵
- Executes dropped EXE
PID:2132 -
\??\c:\9ntbnb.exec:\9ntbnb.exe36⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pvjpv.exec:\pvjpv.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\frfxlrx.exec:\frfxlrx.exe38⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hhthth.exec:\hhthth.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\vjppv.exec:\vjppv.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rxllxff.exec:\rxllxff.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bttbhh.exec:\bttbhh.exe42⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5vjpp.exec:\5vjpp.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\9frlrxx.exec:\9frlrxx.exe44⤵
- Executes dropped EXE
PID:2296 -
\??\c:\ntntht.exec:\ntntht.exe45⤵
- Executes dropped EXE
PID:1392 -
\??\c:\nnbhth.exec:\nnbhth.exe46⤵
- Executes dropped EXE
PID:2676 -
\??\c:\5vjpd.exec:\5vjpd.exe47⤵
- Executes dropped EXE
PID:1948 -
\??\c:\flxxffl.exec:\flxxffl.exe48⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hhttbh.exec:\hhttbh.exe49⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hhnthh.exec:\hhnthh.exe50⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vdvpv.exec:\vdvpv.exe51⤵
- Executes dropped EXE
PID:2872 -
\??\c:\llrxxxf.exec:\llrxxxf.exe52⤵
- Executes dropped EXE
PID:2784 -
\??\c:\nnnntt.exec:\nnnntt.exe53⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vvdjj.exec:\vvdjj.exe54⤵
- Executes dropped EXE
PID:1096 -
\??\c:\1rxrxxx.exec:\1rxrxxx.exe55⤵
- Executes dropped EXE
PID:1728 -
\??\c:\9nntnt.exec:\9nntnt.exe56⤵
- Executes dropped EXE
PID:2220 -
\??\c:\7dvdv.exec:\7dvdv.exe57⤵
- Executes dropped EXE
PID:1620 -
\??\c:\7rfflrx.exec:\7rfflrx.exe58⤵
- Executes dropped EXE
PID:2428 -
\??\c:\tbhhnt.exec:\tbhhnt.exe59⤵
- Executes dropped EXE
PID:1908 -
\??\c:\bnhhnt.exec:\bnhhnt.exe60⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ppjvd.exec:\ppjvd.exe61⤵
- Executes dropped EXE
PID:1608 -
\??\c:\lflrxxf.exec:\lflrxxf.exe62⤵
- Executes dropped EXE
PID:1812 -
\??\c:\hhbnbb.exec:\hhbnbb.exe63⤵
- Executes dropped EXE
PID:2488 -
\??\c:\pvvpd.exec:\pvvpd.exe64⤵
- Executes dropped EXE
PID:1928 -
\??\c:\xflllrr.exec:\xflllrr.exe65⤵
- Executes dropped EXE
PID:1680 -
\??\c:\5hhntt.exec:\5hhntt.exe66⤵PID:1664
-
\??\c:\vdddd.exec:\vdddd.exe67⤵PID:2196
-
\??\c:\fflrxxf.exec:\fflrxxf.exe68⤵PID:2276
-
\??\c:\1nhnbb.exec:\1nhnbb.exe69⤵PID:1668
-
\??\c:\tbthbn.exec:\tbthbn.exe70⤵PID:868
-
\??\c:\rlrxlrf.exec:\rlrxlrf.exe71⤵PID:1760
-
\??\c:\rxflrrx.exec:\rxflrrx.exe72⤵PID:1544
-
\??\c:\bnbbhh.exec:\bnbbhh.exe73⤵PID:2788
-
\??\c:\7jvjv.exec:\7jvjv.exe74⤵PID:3004
-
\??\c:\5rxxffl.exec:\5rxxffl.exe75⤵PID:2152
-
\??\c:\5nnthh.exec:\5nnthh.exe76⤵PID:2844
-
\??\c:\dvjpd.exec:\dvjpd.exe77⤵PID:2956
-
\??\c:\xrfrrlx.exec:\xrfrrlx.exe78⤵PID:2704
-
\??\c:\1tnntb.exec:\1tnntb.exe79⤵PID:2080
-
\??\c:\3bnbnb.exec:\3bnbnb.exe80⤵PID:2292
-
\??\c:\lflllxf.exec:\lflllxf.exe81⤵PID:2728
-
\??\c:\fflxlrl.exec:\fflxlrl.exe82⤵PID:2696
-
\??\c:\hhnntb.exec:\hhnntb.exe83⤵PID:1104
-
\??\c:\vdjpv.exec:\vdjpv.exe84⤵PID:3044
-
\??\c:\lflrlrf.exec:\lflrlrf.exe85⤵PID:2768
-
\??\c:\ffrfrxx.exec:\ffrfrxx.exe86⤵PID:2296
-
\??\c:\hhhnbn.exec:\hhhnbn.exe87⤵PID:2092
-
\??\c:\1djpd.exec:\1djpd.exe88⤵PID:764
-
\??\c:\pdpdj.exec:\pdpdj.exe89⤵PID:1456
-
\??\c:\xllfxfx.exec:\xllfxfx.exe90⤵PID:3040
-
\??\c:\bhbnbh.exec:\bhbnbh.exe91⤵PID:1048
-
\??\c:\1vpdj.exec:\1vpdj.exe92⤵PID:1224
-
\??\c:\ppvjv.exec:\ppvjv.exe93⤵PID:2340
-
\??\c:\5xrxflx.exec:\5xrxflx.exe94⤵PID:1144
-
\??\c:\hnttbb.exec:\hnttbb.exe95⤵PID:2892
-
\??\c:\1ppjd.exec:\1ppjd.exe96⤵PID:608
-
\??\c:\ffllrrx.exec:\ffllrrx.exe97⤵PID:2052
-
\??\c:\lxflrxl.exec:\lxflrxl.exe98⤵PID:492
-
\??\c:\bbthnn.exec:\bbthnn.exe99⤵PID:2972
-
\??\c:\fxlrfxl.exec:\fxlrfxl.exe100⤵PID:2252
-
\??\c:\7nbbhh.exec:\7nbbhh.exe101⤵PID:2300
-
\??\c:\hbtbnb.exec:\hbtbnb.exe102⤵PID:628
-
\??\c:\ddjjp.exec:\ddjjp.exe103⤵PID:776
-
\??\c:\rxrxllf.exec:\rxrxllf.exe104⤵PID:1536
-
\??\c:\xxlrrrf.exec:\xxlrrrf.exe105⤵PID:1740
-
\??\c:\nthtbh.exec:\nthtbh.exe106⤵PID:1712
-
\??\c:\vvjjp.exec:\vvjjp.exe107⤵
- System Location Discovery: System Language Discovery
PID:1796 -
\??\c:\pdpvj.exec:\pdpvj.exe108⤵PID:2404
-
\??\c:\rflffrl.exec:\rflffrl.exe109⤵PID:1628
-
\??\c:\nbntnn.exec:\nbntnn.exe110⤵PID:2276
-
\??\c:\pjpvp.exec:\pjpvp.exe111⤵PID:2780
-
\??\c:\7pppd.exec:\7pppd.exe112⤵PID:1448
-
\??\c:\rrrlrxl.exec:\rrrlrxl.exe113⤵PID:1944
-
\??\c:\1nhhth.exec:\1nhhth.exe114⤵PID:2212
-
\??\c:\bbtbht.exec:\bbtbht.exe115⤵PID:1964
-
\??\c:\vvjvj.exec:\vvjvj.exe116⤵PID:2800
-
\??\c:\ffrrfff.exec:\ffrrfff.exe117⤵PID:2920
-
\??\c:\5xlrfxl.exec:\5xlrfxl.exe118⤵PID:2732
-
\??\c:\ttbbbb.exec:\ttbbbb.exe119⤵PID:2904
-
\??\c:\jpddp.exec:\jpddp.exe120⤵PID:2888
-
\??\c:\lxrrxff.exec:\lxrrxff.exe121⤵PID:2712
-
\??\c:\lflrflr.exec:\lflrflr.exe122⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-