Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 14:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4eced1cab94f0fe4e430eedc93d42e80N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
4eced1cab94f0fe4e430eedc93d42e80N.exe
-
Size
90KB
-
MD5
4eced1cab94f0fe4e430eedc93d42e80
-
SHA1
68273cf409d7dd70148b217a7e810179e0284436
-
SHA256
1febd05af56d54a73ec7b8353ca1e0c39c2c6c72efb8022e435aaa3022126d48
-
SHA512
c746a1ee2cb765070efdc7f6b562a5c471d210c313ed82bf73dbdb49f5ac5558c9cc79cbd0d13b4c85a1ed0f7fc9ee429a744efa5fbb4761bb709b29fa2070f1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+mzv7oEzN/8wNXj:ymb3NkkiQ3mdBjF+3TYzvTFD1
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3600-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3352-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3828 nnbbhh.exe 4156 pjpjj.exe 3600 fxlffll.exe 2808 5xfffll.exe 4400 bbhhhh.exe 2592 djjjd.exe 2852 jpdpp.exe 4308 xrrrfxx.exe 3316 hhttbb.exe 3064 nhttnt.exe 1432 vvjvp.exe 224 ddjdd.exe 3948 xxlrxfl.exe 4424 hhnnbb.exe 3352 nnttbh.exe 2980 3ddvp.exe 3568 rlllxxr.exe 4996 5rxxxff.exe 3120 bbnnhh.exe 3964 djjvp.exe 2000 ddjjv.exe 4696 7rfrrrf.exe 2684 lfxlfrl.exe 944 hbnhnn.exe 4560 jpppj.exe 4084 9jjjd.exe 2052 llfflll.exe 448 flrllrr.exe 3676 hbnhhh.exe 3416 bnttnn.exe 1232 pdjjv.exe 2920 5lllfff.exe 4152 fxrrrrr.exe 1804 7tbtnn.exe 2248 1tttnb.exe 2476 dpvjp.exe 4420 ppdvd.exe 2928 vdjjv.exe 1828 xrfrllf.exe 3108 xrlllll.exe 4000 ntntnt.exe 3344 hbnnhh.exe 1084 jdvjp.exe 4620 ffrrrrl.exe 512 flrrllf.exe 4476 fllfxxr.exe 1556 nntnbb.exe 1220 jppjd.exe 4068 vpjdd.exe 4576 xxffxll.exe 4184 frxffll.exe 4524 ffrxlll.exe 4416 tttttb.exe 4272 tbhtnh.exe 2440 dpvdv.exe 2372 7pdjp.exe 2148 1lrlffx.exe 1956 rfxflrf.exe 1436 tntttb.exe 4904 hnbhnh.exe 4860 vvvvv.exe 2980 pjvvv.exe 2088 lllfflf.exe 2108 lxxxrxr.exe -
resource yara_rule behavioral2/memory/316-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3352-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-8-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxflxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhnb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 316 wrote to memory of 3828 316 4eced1cab94f0fe4e430eedc93d42e80N.exe 83 PID 316 wrote to memory of 3828 316 4eced1cab94f0fe4e430eedc93d42e80N.exe 83 PID 316 wrote to memory of 3828 316 4eced1cab94f0fe4e430eedc93d42e80N.exe 83 PID 3828 wrote to memory of 4156 3828 nnbbhh.exe 84 PID 3828 wrote to memory of 4156 3828 nnbbhh.exe 84 PID 3828 wrote to memory of 4156 3828 nnbbhh.exe 84 PID 4156 wrote to memory of 3600 4156 pjpjj.exe 86 PID 4156 wrote to memory of 3600 4156 pjpjj.exe 86 PID 4156 wrote to memory of 3600 4156 pjpjj.exe 86 PID 3600 wrote to memory of 2808 3600 fxlffll.exe 87 PID 3600 wrote to memory of 2808 3600 fxlffll.exe 87 PID 3600 wrote to memory of 2808 3600 fxlffll.exe 87 PID 2808 wrote to memory of 4400 2808 5xfffll.exe 89 PID 2808 wrote to memory of 4400 2808 5xfffll.exe 89 PID 2808 wrote to memory of 4400 2808 5xfffll.exe 89 PID 4400 wrote to memory of 2592 4400 bbhhhh.exe 90 PID 4400 wrote to memory of 2592 4400 bbhhhh.exe 90 PID 4400 wrote to memory of 2592 4400 bbhhhh.exe 90 PID 2592 wrote to memory of 2852 2592 djjjd.exe 91 PID 2592 wrote to memory of 2852 2592 djjjd.exe 91 PID 2592 wrote to memory of 2852 2592 djjjd.exe 91 PID 2852 wrote to memory of 4308 2852 jpdpp.exe 92 PID 2852 wrote to memory of 4308 2852 jpdpp.exe 92 PID 2852 wrote to memory of 4308 2852 jpdpp.exe 92 PID 4308 wrote to memory of 3316 4308 xrrrfxx.exe 93 PID 4308 wrote to memory of 3316 4308 xrrrfxx.exe 93 PID 4308 wrote to memory of 3316 4308 xrrrfxx.exe 93 PID 3316 wrote to memory of 3064 3316 hhttbb.exe 94 PID 3316 wrote to memory of 3064 3316 hhttbb.exe 94 PID 3316 wrote to memory of 3064 3316 hhttbb.exe 94 PID 3064 wrote to memory of 1432 3064 nhttnt.exe 95 PID 3064 wrote to memory of 1432 3064 nhttnt.exe 95 PID 3064 wrote to memory of 1432 3064 nhttnt.exe 95 PID 1432 wrote to memory of 224 1432 vvjvp.exe 96 PID 1432 wrote to memory of 224 1432 vvjvp.exe 96 PID 1432 wrote to memory of 224 1432 vvjvp.exe 96 PID 224 wrote to memory of 3948 224 ddjdd.exe 98 PID 224 wrote to memory of 3948 224 ddjdd.exe 98 PID 224 wrote to memory of 3948 224 ddjdd.exe 98 PID 3948 wrote to memory of 4424 3948 xxlrxfl.exe 99 PID 3948 wrote to memory of 4424 3948 xxlrxfl.exe 99 PID 3948 wrote to memory of 4424 3948 xxlrxfl.exe 99 PID 4424 wrote to memory of 3352 4424 hhnnbb.exe 100 PID 4424 wrote to memory of 3352 4424 hhnnbb.exe 100 PID 4424 wrote to memory of 3352 4424 hhnnbb.exe 100 PID 3352 wrote to memory of 2980 3352 nnttbh.exe 101 PID 3352 wrote to memory of 2980 3352 nnttbh.exe 101 PID 3352 wrote to memory of 2980 3352 nnttbh.exe 101 PID 2980 wrote to memory of 3568 2980 3ddvp.exe 102 PID 2980 wrote to memory of 3568 2980 3ddvp.exe 102 PID 2980 wrote to memory of 3568 2980 3ddvp.exe 102 PID 3568 wrote to memory of 4996 3568 rlllxxr.exe 103 PID 3568 wrote to memory of 4996 3568 rlllxxr.exe 103 PID 3568 wrote to memory of 4996 3568 rlllxxr.exe 103 PID 4996 wrote to memory of 3120 4996 5rxxxff.exe 104 PID 4996 wrote to memory of 3120 4996 5rxxxff.exe 104 PID 4996 wrote to memory of 3120 4996 5rxxxff.exe 104 PID 3120 wrote to memory of 3964 3120 bbnnhh.exe 105 PID 3120 wrote to memory of 3964 3120 bbnnhh.exe 105 PID 3120 wrote to memory of 3964 3120 bbnnhh.exe 105 PID 3964 wrote to memory of 2000 3964 djjvp.exe 106 PID 3964 wrote to memory of 2000 3964 djjvp.exe 106 PID 3964 wrote to memory of 2000 3964 djjvp.exe 106 PID 2000 wrote to memory of 4696 2000 ddjjv.exe 107
Processes
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\4eced1cab94f0fe4e430eedc93d42e80N.exe"C:\Users\Admin\AppData\Local\Temp\4eced1cab94f0fe4e430eedc93d42e80N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\nnbbhh.exec:\nnbbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\pjpjj.exec:\pjpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\fxlffll.exec:\fxlffll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\5xfffll.exec:\5xfffll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\bbhhhh.exec:\bbhhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\djjjd.exec:\djjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\jpdpp.exec:\jpdpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\xrrrfxx.exec:\xrrrfxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\hhttbb.exec:\hhttbb.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\nhttnt.exec:\nhttnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\vvjvp.exec:\vvjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\ddjdd.exec:\ddjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\xxlrxfl.exec:\xxlrxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\hhnnbb.exec:\hhnnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\nnttbh.exec:\nnttbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\3ddvp.exec:\3ddvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\rlllxxr.exec:\rlllxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\5rxxxff.exec:\5rxxxff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\bbnnhh.exec:\bbnnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\djjvp.exec:\djjvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\ddjjv.exec:\ddjjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\7rfrrrf.exec:\7rfrrrf.exe23⤵
- Executes dropped EXE
PID:4696 -
\??\c:\lfxlfrl.exec:\lfxlfrl.exe24⤵
- Executes dropped EXE
PID:2684 -
\??\c:\hbnhnn.exec:\hbnhnn.exe25⤵
- Executes dropped EXE
PID:944 -
\??\c:\jpppj.exec:\jpppj.exe26⤵
- Executes dropped EXE
PID:4560 -
\??\c:\9jjjd.exec:\9jjjd.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4084 -
\??\c:\llfflll.exec:\llfflll.exe28⤵
- Executes dropped EXE
PID:2052 -
\??\c:\flrllrr.exec:\flrllrr.exe29⤵
- Executes dropped EXE
PID:448 -
\??\c:\hbnhhh.exec:\hbnhhh.exe30⤵
- Executes dropped EXE
PID:3676 -
\??\c:\bnttnn.exec:\bnttnn.exe31⤵
- Executes dropped EXE
PID:3416 -
\??\c:\pdjjv.exec:\pdjjv.exe32⤵
- Executes dropped EXE
PID:1232 -
\??\c:\5lllfff.exec:\5lllfff.exe33⤵
- Executes dropped EXE
PID:2920 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe34⤵
- Executes dropped EXE
PID:4152 -
\??\c:\7tbtnn.exec:\7tbtnn.exe35⤵
- Executes dropped EXE
PID:1804 -
\??\c:\1tttnb.exec:\1tttnb.exe36⤵
- Executes dropped EXE
PID:2248 -
\??\c:\dpvjp.exec:\dpvjp.exe37⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ppdvd.exec:\ppdvd.exe38⤵
- Executes dropped EXE
PID:4420 -
\??\c:\vdjjv.exec:\vdjjv.exe39⤵
- Executes dropped EXE
PID:2928 -
\??\c:\xrfrllf.exec:\xrfrllf.exe40⤵
- Executes dropped EXE
PID:1828 -
\??\c:\xrlllll.exec:\xrlllll.exe41⤵
- Executes dropped EXE
PID:3108 -
\??\c:\ntntnt.exec:\ntntnt.exe42⤵
- Executes dropped EXE
PID:4000 -
\??\c:\hbnnhh.exec:\hbnnhh.exe43⤵
- Executes dropped EXE
PID:3344 -
\??\c:\jdvjp.exec:\jdvjp.exe44⤵
- Executes dropped EXE
PID:1084 -
\??\c:\ffrrrrl.exec:\ffrrrrl.exe45⤵
- Executes dropped EXE
PID:4620 -
\??\c:\flrrllf.exec:\flrrllf.exe46⤵
- Executes dropped EXE
PID:512 -
\??\c:\fllfxxr.exec:\fllfxxr.exe47⤵
- Executes dropped EXE
PID:4476 -
\??\c:\nntnbb.exec:\nntnbb.exe48⤵
- Executes dropped EXE
PID:1556 -
\??\c:\jppjd.exec:\jppjd.exe49⤵
- Executes dropped EXE
PID:1220 -
\??\c:\vpjdd.exec:\vpjdd.exe50⤵
- Executes dropped EXE
PID:4068 -
\??\c:\xxffxll.exec:\xxffxll.exe51⤵
- Executes dropped EXE
PID:4576 -
\??\c:\frxffll.exec:\frxffll.exe52⤵
- Executes dropped EXE
PID:4184 -
\??\c:\ffrxlll.exec:\ffrxlll.exe53⤵
- Executes dropped EXE
PID:4524 -
\??\c:\tttttb.exec:\tttttb.exe54⤵
- Executes dropped EXE
PID:4416 -
\??\c:\tbhtnh.exec:\tbhtnh.exe55⤵
- Executes dropped EXE
PID:4272 -
\??\c:\dpvdv.exec:\dpvdv.exe56⤵
- Executes dropped EXE
PID:2440 -
\??\c:\7pdjp.exec:\7pdjp.exe57⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1lrlffx.exec:\1lrlffx.exe58⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rfxflrf.exec:\rfxflrf.exe59⤵
- Executes dropped EXE
PID:1956 -
\??\c:\tntttb.exec:\tntttb.exe60⤵
- Executes dropped EXE
PID:1436 -
\??\c:\hnbhnh.exec:\hnbhnh.exe61⤵
- Executes dropped EXE
PID:4904 -
\??\c:\vvvvv.exec:\vvvvv.exe62⤵
- Executes dropped EXE
PID:4860 -
\??\c:\pjvvv.exec:\pjvvv.exe63⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lllfflf.exec:\lllfflf.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2088 -
\??\c:\lxxxrxr.exec:\lxxxrxr.exe65⤵
- Executes dropped EXE
PID:2108 -
\??\c:\ttttbn.exec:\ttttbn.exe66⤵PID:4048
-
\??\c:\tntnnn.exec:\tntnnn.exe67⤵PID:2788
-
\??\c:\pvdvp.exec:\pvdvp.exe68⤵PID:3756
-
\??\c:\dvjdd.exec:\dvjdd.exe69⤵PID:392
-
\??\c:\lfxllxr.exec:\lfxllxr.exe70⤵PID:4324
-
\??\c:\fxxrfxf.exec:\fxxrfxf.exe71⤵PID:884
-
\??\c:\bbbbbb.exec:\bbbbbb.exe72⤵PID:208
-
\??\c:\7hnnnn.exec:\7hnnnn.exe73⤵PID:944
-
\??\c:\pjjdv.exec:\pjjdv.exe74⤵PID:1020
-
\??\c:\pddvd.exec:\pddvd.exe75⤵PID:2128
-
\??\c:\xllfxxr.exec:\xllfxxr.exe76⤵PID:2680
-
\??\c:\lllllrr.exec:\lllllrr.exe77⤵PID:3452
-
\??\c:\nhnnhh.exec:\nhnnhh.exe78⤵PID:3884
-
\??\c:\9ntttb.exec:\9ntttb.exe79⤵
- System Location Discovery: System Language Discovery
PID:3660 -
\??\c:\9btbnb.exec:\9btbnb.exe80⤵PID:4580
-
\??\c:\dvjjd.exec:\dvjjd.exe81⤵PID:4756
-
\??\c:\vpdvp.exec:\vpdvp.exe82⤵PID:2468
-
\??\c:\llffxxx.exec:\llffxxx.exe83⤵PID:1644
-
\??\c:\rxlrrxx.exec:\rxlrrxx.exe84⤵PID:2800
-
\??\c:\thnnnn.exec:\thnnnn.exe85⤵PID:3496
-
\??\c:\tthbht.exec:\tthbht.exe86⤵PID:4432
-
\??\c:\htbbtt.exec:\htbbtt.exe87⤵PID:3928
-
\??\c:\jddpp.exec:\jddpp.exe88⤵PID:4040
-
\??\c:\vpddj.exec:\vpddj.exe89⤵PID:4368
-
\??\c:\frrxfll.exec:\frrxfll.exe90⤵
- System Location Discovery: System Language Discovery
PID:4988 -
\??\c:\xlxrrll.exec:\xlxrrll.exe91⤵PID:3112
-
\??\c:\tbtnnn.exec:\tbtnnn.exe92⤵PID:4784
-
\??\c:\hhhbbh.exec:\hhhbbh.exe93⤵PID:2544
-
\??\c:\vjvpj.exec:\vjvpj.exe94⤵PID:1140
-
\??\c:\jdpjp.exec:\jdpjp.exe95⤵PID:1264
-
\??\c:\pjdjv.exec:\pjdjv.exe96⤵PID:1660
-
\??\c:\rrxrxxl.exec:\rrxrxxl.exe97⤵PID:4124
-
\??\c:\lrrrlrl.exec:\lrrrlrl.exe98⤵PID:652
-
\??\c:\7lxxffl.exec:\7lxxffl.exe99⤵PID:3852
-
\??\c:\btnnnn.exec:\btnnnn.exe100⤵PID:1556
-
\??\c:\bthntb.exec:\bthntb.exe101⤵PID:2608
-
\??\c:\vvpjp.exec:\vvpjp.exe102⤵PID:2312
-
\??\c:\ppjjd.exec:\ppjjd.exe103⤵PID:4532
-
\??\c:\rrxxrrf.exec:\rrxxrrf.exe104⤵PID:3480
-
\??\c:\vvpjd.exec:\vvpjd.exe105⤵PID:860
-
\??\c:\ddjpj.exec:\ddjpj.exe106⤵PID:4416
-
\??\c:\djpjv.exec:\djpjv.exe107⤵PID:224
-
\??\c:\5lrllrr.exec:\5lrllrr.exe108⤵PID:2440
-
\??\c:\llrrllf.exec:\llrrllf.exe109⤵PID:3056
-
\??\c:\3btnnh.exec:\3btnnh.exe110⤵PID:1764
-
\??\c:\vdppv.exec:\vdppv.exe111⤵PID:4296
-
\??\c:\ppvpp.exec:\ppvpp.exe112⤵PID:3384
-
\??\c:\dvddd.exec:\dvddd.exe113⤵PID:864
-
\??\c:\lfrlrrf.exec:\lfrlrrf.exe114⤵PID:2216
-
\??\c:\hnbbbb.exec:\hnbbbb.exe115⤵PID:3328
-
\??\c:\ttnhnn.exec:\ttnhnn.exe116⤵PID:4680
-
\??\c:\jpdjp.exec:\jpdjp.exe117⤵PID:1912
-
\??\c:\ffffrll.exec:\ffffrll.exe118⤵PID:1164
-
\??\c:\btbbtb.exec:\btbbtb.exe119⤵PID:1616
-
\??\c:\jdvjj.exec:\jdvjj.exe120⤵PID:3672
-
\??\c:\llrllll.exec:\llrllll.exe121⤵PID:2084
-
\??\c:\llrrrrr.exec:\llrrrrr.exe122⤵PID:3220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-