Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2024 02:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720N.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720N.exe
-
Size
67KB
-
MD5
8f5fb2f2a612d6da00c99116d1233d20
-
SHA1
1466354ad79d4c1920cc770b5c36b5353e512b27
-
SHA256
2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720
-
SHA512
98793ebe279c89cc1ad9630fe896dcf457f8b21eb625b5e57be8362d4581030e20523f00041278ac89c48b433e46517e4080c8f2697cc77bc5694ee0f14f903d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Bqfs:ymb3NkkiQ3mdBjFI9cqfs
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4100-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-33-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1320-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1184 5jpjv.exe 1116 rxfxlfx.exe 2276 hbbthh.exe 2292 bttbtn.exe 3436 vjvpp.exe 4248 fllxrfx.exe 3584 bthhbh.exe 3444 tttttb.exe 3872 jdjjj.exe 2128 bntnnh.exe 2908 tbbntn.exe 2388 pjjjj.exe 4300 fxxffrx.exe 4544 nhnhnn.exe 4436 7nnhbh.exe 4520 dpppp.exe 4220 ppppj.exe 1320 7lfxrll.exe 4968 9ntnhh.exe 232 pjppj.exe 808 vdjjp.exe 1744 lllfxff.exe 1944 nntbbb.exe 4472 3tbthh.exe 1524 lffxrrr.exe 1560 nhtbhh.exe 4860 7dppd.exe 5116 lxxrlfx.exe 3684 nnhbtt.exe 1416 vpvpj.exe 4252 rrlllrr.exe 1920 thnhth.exe 3616 rlrrrrl.exe 2928 jvvpj.exe 4396 rlllrfx.exe 3052 xlffxxx.exe 3940 bbbtbb.exe 4940 jpjjd.exe 1728 nbhhhn.exe 532 vvvvj.exe 5076 xxlrrlr.exe 1424 hnntnn.exe 2060 jvdvp.exe 804 vvdpj.exe 2660 bnbbtn.exe 5004 dppjj.exe 4348 jvppd.exe 5024 rfllrrr.exe 1064 tbhnnt.exe 3884 7dpvp.exe 3640 jjjjj.exe 3536 xrffllx.exe 3216 fxlrxff.exe 4372 ppdvv.exe 4456 5vpvj.exe 3708 xlrlllr.exe 3992 ffxlxrf.exe 3120 hhntbh.exe 1404 btbbbh.exe 2636 1dvdv.exe 4176 xrxfxrx.exe 3936 xffrrlf.exe 2472 btbnbt.exe 3740 9rffxff.exe -
resource yara_rule behavioral2/memory/4100-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/808-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4100 wrote to memory of 1184 4100 2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720N.exe 82 PID 4100 wrote to memory of 1184 4100 2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720N.exe 82 PID 4100 wrote to memory of 1184 4100 2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720N.exe 82 PID 1184 wrote to memory of 1116 1184 5jpjv.exe 83 PID 1184 wrote to memory of 1116 1184 5jpjv.exe 83 PID 1184 wrote to memory of 1116 1184 5jpjv.exe 83 PID 1116 wrote to memory of 2276 1116 rxfxlfx.exe 84 PID 1116 wrote to memory of 2276 1116 rxfxlfx.exe 84 PID 1116 wrote to memory of 2276 1116 rxfxlfx.exe 84 PID 2276 wrote to memory of 2292 2276 hbbthh.exe 85 PID 2276 wrote to memory of 2292 2276 hbbthh.exe 85 PID 2276 wrote to memory of 2292 2276 hbbthh.exe 85 PID 2292 wrote to memory of 3436 2292 bttbtn.exe 86 PID 2292 wrote to memory of 3436 2292 bttbtn.exe 86 PID 2292 wrote to memory of 3436 2292 bttbtn.exe 86 PID 3436 wrote to memory of 4248 3436 vjvpp.exe 87 PID 3436 wrote to memory of 4248 3436 vjvpp.exe 87 PID 3436 wrote to memory of 4248 3436 vjvpp.exe 87 PID 4248 wrote to memory of 3584 4248 fllxrfx.exe 88 PID 4248 wrote to memory of 3584 4248 fllxrfx.exe 88 PID 4248 wrote to memory of 3584 4248 fllxrfx.exe 88 PID 3584 wrote to memory of 3444 3584 bthhbh.exe 89 PID 3584 wrote to memory of 3444 3584 bthhbh.exe 89 PID 3584 wrote to memory of 3444 3584 bthhbh.exe 89 PID 3444 wrote to memory of 3872 3444 tttttb.exe 90 PID 3444 wrote to memory of 3872 3444 tttttb.exe 90 PID 3444 wrote to memory of 3872 3444 tttttb.exe 90 PID 3872 wrote to memory of 2128 3872 jdjjj.exe 91 PID 3872 wrote to memory of 2128 3872 jdjjj.exe 91 PID 3872 wrote to memory of 2128 3872 jdjjj.exe 91 PID 2128 wrote to memory of 2908 2128 bntnnh.exe 92 PID 2128 wrote to memory of 2908 2128 bntnnh.exe 92 PID 2128 wrote to memory of 2908 2128 bntnnh.exe 92 PID 2908 wrote to memory of 2388 2908 tbbntn.exe 93 PID 2908 wrote to memory of 2388 2908 tbbntn.exe 93 PID 2908 wrote to memory of 2388 2908 tbbntn.exe 93 PID 2388 wrote to memory of 4300 2388 pjjjj.exe 94 PID 2388 wrote to memory of 4300 2388 pjjjj.exe 94 PID 2388 wrote to memory of 4300 2388 pjjjj.exe 94 PID 4300 wrote to memory of 4544 4300 fxxffrx.exe 95 PID 4300 wrote to memory of 4544 4300 fxxffrx.exe 95 PID 4300 wrote to memory of 4544 4300 fxxffrx.exe 95 PID 4544 wrote to memory of 4436 4544 nhnhnn.exe 96 PID 4544 wrote to memory of 4436 4544 nhnhnn.exe 96 PID 4544 wrote to memory of 4436 4544 nhnhnn.exe 96 PID 4436 wrote to memory of 4520 4436 7nnhbh.exe 97 PID 4436 wrote to memory of 4520 4436 7nnhbh.exe 97 PID 4436 wrote to memory of 4520 4436 7nnhbh.exe 97 PID 4520 wrote to memory of 4220 4520 dpppp.exe 98 PID 4520 wrote to memory of 4220 4520 dpppp.exe 98 PID 4520 wrote to memory of 4220 4520 dpppp.exe 98 PID 4220 wrote to memory of 1320 4220 ppppj.exe 99 PID 4220 wrote to memory of 1320 4220 ppppj.exe 99 PID 4220 wrote to memory of 1320 4220 ppppj.exe 99 PID 1320 wrote to memory of 4968 1320 7lfxrll.exe 100 PID 1320 wrote to memory of 4968 1320 7lfxrll.exe 100 PID 1320 wrote to memory of 4968 1320 7lfxrll.exe 100 PID 4968 wrote to memory of 232 4968 9ntnhh.exe 101 PID 4968 wrote to memory of 232 4968 9ntnhh.exe 101 PID 4968 wrote to memory of 232 4968 9ntnhh.exe 101 PID 232 wrote to memory of 808 232 pjppj.exe 102 PID 232 wrote to memory of 808 232 pjppj.exe 102 PID 232 wrote to memory of 808 232 pjppj.exe 102 PID 808 wrote to memory of 1744 808 vdjjp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720N.exe"C:\Users\Admin\AppData\Local\Temp\2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\5jpjv.exec:\5jpjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\rxfxlfx.exec:\rxfxlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\hbbthh.exec:\hbbthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\bttbtn.exec:\bttbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\vjvpp.exec:\vjvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\fllxrfx.exec:\fllxrfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\bthhbh.exec:\bthhbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\tttttb.exec:\tttttb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\jdjjj.exec:\jdjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\bntnnh.exec:\bntnnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\tbbntn.exec:\tbbntn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\pjjjj.exec:\pjjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\fxxffrx.exec:\fxxffrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\nhnhnn.exec:\nhnhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\7nnhbh.exec:\7nnhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\dpppp.exec:\dpppp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\ppppj.exec:\ppppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\7lfxrll.exec:\7lfxrll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\9ntnhh.exec:\9ntnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\pjppj.exec:\pjppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\vdjjp.exec:\vdjjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\lllfxff.exec:\lllfxff.exe23⤵
- Executes dropped EXE
PID:1744 -
\??\c:\nntbbb.exec:\nntbbb.exe24⤵
- Executes dropped EXE
PID:1944 -
\??\c:\3tbthh.exec:\3tbthh.exe25⤵
- Executes dropped EXE
PID:4472 -
\??\c:\lffxrrr.exec:\lffxrrr.exe26⤵
- Executes dropped EXE
PID:1524 -
\??\c:\nhtbhh.exec:\nhtbhh.exe27⤵
- Executes dropped EXE
PID:1560 -
\??\c:\7dppd.exec:\7dppd.exe28⤵
- Executes dropped EXE
PID:4860 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe29⤵
- Executes dropped EXE
PID:5116 -
\??\c:\nnhbtt.exec:\nnhbtt.exe30⤵
- Executes dropped EXE
PID:3684 -
\??\c:\vpvpj.exec:\vpvpj.exe31⤵
- Executes dropped EXE
PID:1416 -
\??\c:\rrlllrr.exec:\rrlllrr.exe32⤵
- Executes dropped EXE
PID:4252 -
\??\c:\thnhth.exec:\thnhth.exe33⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rlrrrrl.exec:\rlrrrrl.exe34⤵
- Executes dropped EXE
PID:3616 -
\??\c:\jvvpj.exec:\jvvpj.exe35⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rlllrfx.exec:\rlllrfx.exe36⤵
- Executes dropped EXE
PID:4396 -
\??\c:\xlffxxx.exec:\xlffxxx.exe37⤵
- Executes dropped EXE
PID:3052 -
\??\c:\bbbtbb.exec:\bbbtbb.exe38⤵
- Executes dropped EXE
PID:3940 -
\??\c:\jpjjd.exec:\jpjjd.exe39⤵
- Executes dropped EXE
PID:4940 -
\??\c:\nbhhhn.exec:\nbhhhn.exe40⤵
- Executes dropped EXE
PID:1728 -
\??\c:\vvvvj.exec:\vvvvj.exe41⤵
- Executes dropped EXE
PID:532 -
\??\c:\xxlrrlr.exec:\xxlrrlr.exe42⤵
- Executes dropped EXE
PID:5076 -
\??\c:\hnntnn.exec:\hnntnn.exe43⤵
- Executes dropped EXE
PID:1424 -
\??\c:\jvdvp.exec:\jvdvp.exe44⤵
- Executes dropped EXE
PID:2060 -
\??\c:\vvdpj.exec:\vvdpj.exe45⤵
- Executes dropped EXE
PID:804 -
\??\c:\bnbbtn.exec:\bnbbtn.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\dppjj.exec:\dppjj.exe47⤵
- Executes dropped EXE
PID:5004 -
\??\c:\jvppd.exec:\jvppd.exe48⤵
- Executes dropped EXE
PID:4348 -
\??\c:\rfllrrr.exec:\rfllrrr.exe49⤵
- Executes dropped EXE
PID:5024 -
\??\c:\tbhnnt.exec:\tbhnnt.exe50⤵
- Executes dropped EXE
PID:1064 -
\??\c:\7dpvp.exec:\7dpvp.exe51⤵
- Executes dropped EXE
PID:3884 -
\??\c:\jjjjj.exec:\jjjjj.exe52⤵
- Executes dropped EXE
PID:3640 -
\??\c:\xrffllx.exec:\xrffllx.exe53⤵
- Executes dropped EXE
PID:3536 -
\??\c:\fxlrxff.exec:\fxlrxff.exe54⤵
- Executes dropped EXE
PID:3216 -
\??\c:\ppdvv.exec:\ppdvv.exe55⤵
- Executes dropped EXE
PID:4372 -
\??\c:\5vpvj.exec:\5vpvj.exe56⤵
- Executes dropped EXE
PID:4456 -
\??\c:\xlrlllr.exec:\xlrlllr.exe57⤵
- Executes dropped EXE
PID:3708 -
\??\c:\ffxlxrf.exec:\ffxlxrf.exe58⤵
- Executes dropped EXE
PID:3992 -
\??\c:\hhntbh.exec:\hhntbh.exe59⤵
- Executes dropped EXE
PID:3120 -
\??\c:\btbbbh.exec:\btbbbh.exe60⤵
- Executes dropped EXE
PID:1404 -
\??\c:\1dvdv.exec:\1dvdv.exe61⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xrxfxrx.exec:\xrxfxrx.exe62⤵
- Executes dropped EXE
PID:4176 -
\??\c:\xffrrlf.exec:\xffrrlf.exe63⤵
- Executes dropped EXE
PID:3936 -
\??\c:\btbnbt.exec:\btbnbt.exe64⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9rffxff.exec:\9rffxff.exe65⤵
- Executes dropped EXE
PID:3740 -
\??\c:\rxxfxrr.exec:\rxxfxrr.exe66⤵PID:1864
-
\??\c:\bhtbbh.exec:\bhtbbh.exe67⤵PID:3364
-
\??\c:\bbhbtt.exec:\bbhbtt.exe68⤵PID:3112
-
\??\c:\djdjd.exec:\djdjd.exe69⤵PID:1656
-
\??\c:\9fflflr.exec:\9fflflr.exe70⤵PID:1916
-
\??\c:\llffflr.exec:\llffflr.exe71⤵
- System Location Discovery: System Language Discovery
PID:3628 -
\??\c:\1ttttt.exec:\1ttttt.exe72⤵PID:508
-
\??\c:\jjvpp.exec:\jjvpp.exe73⤵PID:3760
-
\??\c:\pjddv.exec:\pjddv.exe74⤵PID:5032
-
\??\c:\xrllxxl.exec:\xrllxxl.exe75⤵PID:4112
-
\??\c:\hhtbhn.exec:\hhtbhn.exe76⤵PID:3424
-
\??\c:\ttnnnt.exec:\ttnnnt.exe77⤵PID:1088
-
\??\c:\9dpjd.exec:\9dpjd.exe78⤵PID:4236
-
\??\c:\lxxrffx.exec:\lxxrffx.exe79⤵PID:3408
-
\??\c:\xrffxrl.exec:\xrffxrl.exe80⤵PID:4732
-
\??\c:\nhtttb.exec:\nhtttb.exe81⤵PID:2784
-
\??\c:\dvddd.exec:\dvddd.exe82⤵PID:3388
-
\??\c:\jjddj.exec:\jjddj.exe83⤵PID:4472
-
\??\c:\rffxrrl.exec:\rffxrrl.exe84⤵PID:1524
-
\??\c:\nnnnnt.exec:\nnnnnt.exe85⤵PID:2936
-
\??\c:\5nhbtn.exec:\5nhbtn.exe86⤵PID:4860
-
\??\c:\pjppj.exec:\pjppj.exe87⤵PID:4892
-
\??\c:\ddddv.exec:\ddddv.exe88⤵PID:1880
-
\??\c:\ffrrfll.exec:\ffrrfll.exe89⤵PID:428
-
\??\c:\3htbnn.exec:\3htbnn.exe90⤵PID:916
-
\??\c:\7thhbb.exec:\7thhbb.exe91⤵PID:1468
-
\??\c:\vdvvp.exec:\vdvvp.exe92⤵PID:3020
-
\??\c:\jjvvv.exec:\jjvvv.exe93⤵PID:3472
-
\??\c:\flrrxxf.exec:\flrrxxf.exe94⤵
- System Location Discovery: System Language Discovery
PID:4548 -
\??\c:\thtbbb.exec:\thtbbb.exe95⤵PID:1056
-
\??\c:\ththbh.exec:\ththbh.exe96⤵PID:2240
-
\??\c:\djdjd.exec:\djdjd.exe97⤵PID:4208
-
\??\c:\djddj.exec:\djddj.exe98⤵PID:1196
-
\??\c:\rrflfll.exec:\rrflfll.exe99⤵PID:3940
-
\??\c:\hnbhhn.exec:\hnbhhn.exe100⤵PID:4804
-
\??\c:\bbttnt.exec:\bbttnt.exe101⤵PID:4556
-
\??\c:\jpjjp.exec:\jpjjp.exe102⤵PID:2916
-
\??\c:\jvvvp.exec:\jvvvp.exe103⤵PID:3580
-
\??\c:\rfxxxxf.exec:\rfxxxxf.exe104⤵PID:4428
-
\??\c:\hbhhht.exec:\hbhhht.exe105⤵PID:2060
-
\??\c:\bbnbbb.exec:\bbnbbb.exe106⤵PID:3036
-
\??\c:\pvdpj.exec:\pvdpj.exe107⤵PID:3712
-
\??\c:\jjjdd.exec:\jjjdd.exe108⤵PID:1668
-
\??\c:\rrrrlrl.exec:\rrrrlrl.exe109⤵PID:4348
-
\??\c:\9fffxxl.exec:\9fffxxl.exe110⤵PID:5024
-
\??\c:\thnnbh.exec:\thnnbh.exe111⤵PID:2340
-
\??\c:\pdddp.exec:\pdddp.exe112⤵PID:3884
-
\??\c:\rlrrflf.exec:\rlrrflf.exe113⤵PID:640
-
\??\c:\ttnntt.exec:\ttnntt.exe114⤵PID:3448
-
\??\c:\3thhht.exec:\3thhht.exe115⤵PID:2288
-
\??\c:\jjppj.exec:\jjppj.exe116⤵PID:4372
-
\??\c:\xxflrrl.exec:\xxflrrl.exe117⤵PID:1044
-
\??\c:\flfffll.exec:\flfffll.exe118⤵PID:3584
-
\??\c:\hhnnnt.exec:\hhnnnt.exe119⤵PID:2536
-
\??\c:\bbthbt.exec:\bbthbt.exe120⤵PID:3120
-
\??\c:\vvppd.exec:\vvppd.exe121⤵PID:1216
-
\??\c:\7flrllr.exec:\7flrllr.exe122⤵PID:3676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-