Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 21:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe
-
Size
49KB
-
MD5
64ab0cd8df9d6d027937e65c52b2e498
-
SHA1
52f075d3aed88341b4f4d941eb7e1becdef42f7f
-
SHA256
2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da
-
SHA512
093123d714d2987b28d79cee810c810988c5e2291182707e18cfae48ed69503d75b17b340b900c1be431c307746d4e1871cb7dcba8c301dbac054d2a40046a74
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlU:0cdpeeBSHHMHLf9RyIT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/2380-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-132-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1996-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-113-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2592-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-95-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2616-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-225-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1416-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/480-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/480-206-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3008-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-40-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2368-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-265-0x00000000001C0000-0x00000000001E9000-memory.dmp family_blackmoon behavioral1/memory/2064-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-338-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2000-407-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1844-415-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-418-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/328-430-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-428-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-449-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2252-487-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-501-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-516-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2500-619-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-716-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-743-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-792-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-795-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/324-829-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2920-845-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2428-858-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1000-867-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2760-881-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-888-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2756-920-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2172-927-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1544-984-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1704-1004-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/836-1022-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/916-1073-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-1093-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/916-1100-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/704-1126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-1152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-1165-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2368-1184-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2368 680066.exe 2540 e84406.exe 2288 hbbbhh.exe 3008 btbhnn.exe 2720 480404.exe 2772 m6840.exe 2588 rllfrrf.exe 2616 e24406.exe 2716 42840.exe 2592 806666.exe 2748 5tbttb.exe 3012 20222.exe 2016 0406822.exe 2360 0062488.exe 1996 s6028.exe 1852 u242266.exe 2028 0080284.exe 2872 3djdj.exe 296 w28222.exe 3000 hhtttb.exe 1588 rfllrrr.exe 480 xlrlxxf.exe 1416 fxxxrrr.exe 2884 08002.exe 1092 04888.exe 1948 ppvpj.exe 316 dvpvd.exe 564 4264044.exe 1644 jdddp.exe 2952 ppdjd.exe 2064 w02622.exe 880 nhbbhh.exe 2356 bbhhhn.exe 1892 9xxrxxx.exe 2504 60262.exe 1856 208466.exe 2264 thnntn.exe 2788 4866266.exe 2280 9nhnnn.exe 2704 fflllxf.exe 2820 vpvjj.exe 2796 880688.exe 2604 hbhhtt.exe 2740 ddjpj.exe 2592 2688888.exe 2284 jvjdj.exe 2748 6062444.exe 1888 xllffxl.exe 2000 frxllfl.exe 1844 420066.exe 2360 5vdvp.exe 1704 c428000.exe 328 ppdvv.exe 1472 dpvvv.exe 2336 64626.exe 2004 thnnhh.exe 2812 3nhbbt.exe 1700 828048.exe 2896 3tnnbb.exe 1532 7vjdp.exe 2252 e68288.exe 1588 nhhbbh.exe 812 vvppd.exe 2940 9rlfrrx.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a6882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26288.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6066828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2288002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 484206.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2368 2380 2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe 30 PID 2380 wrote to memory of 2368 2380 2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe 30 PID 2380 wrote to memory of 2368 2380 2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe 30 PID 2380 wrote to memory of 2368 2380 2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe 30 PID 2368 wrote to memory of 2540 2368 680066.exe 31 PID 2368 wrote to memory of 2540 2368 680066.exe 31 PID 2368 wrote to memory of 2540 2368 680066.exe 31 PID 2368 wrote to memory of 2540 2368 680066.exe 31 PID 2540 wrote to memory of 2288 2540 e84406.exe 32 PID 2540 wrote to memory of 2288 2540 e84406.exe 32 PID 2540 wrote to memory of 2288 2540 e84406.exe 32 PID 2540 wrote to memory of 2288 2540 e84406.exe 32 PID 2288 wrote to memory of 3008 2288 hbbbhh.exe 33 PID 2288 wrote to memory of 3008 2288 hbbbhh.exe 33 PID 2288 wrote to memory of 3008 2288 hbbbhh.exe 33 PID 2288 wrote to memory of 3008 2288 hbbbhh.exe 33 PID 3008 wrote to memory of 2720 3008 btbhnn.exe 34 PID 3008 wrote to memory of 2720 3008 btbhnn.exe 34 PID 3008 wrote to memory of 2720 3008 btbhnn.exe 34 PID 3008 wrote to memory of 2720 3008 btbhnn.exe 34 PID 2720 wrote to memory of 2772 2720 480404.exe 35 PID 2720 wrote to memory of 2772 2720 480404.exe 35 PID 2720 wrote to memory of 2772 2720 480404.exe 35 PID 2720 wrote to memory of 2772 2720 480404.exe 35 PID 2772 wrote to memory of 2588 2772 m6840.exe 36 PID 2772 wrote to memory of 2588 2772 m6840.exe 36 PID 2772 wrote to memory of 2588 2772 m6840.exe 36 PID 2772 wrote to memory of 2588 2772 m6840.exe 36 PID 2588 wrote to memory of 2616 2588 rllfrrf.exe 37 PID 2588 wrote to memory of 2616 2588 rllfrrf.exe 37 PID 2588 wrote to memory of 2616 2588 rllfrrf.exe 37 PID 2588 wrote to memory of 2616 2588 rllfrrf.exe 37 PID 2616 wrote to memory of 2716 2616 e24406.exe 38 PID 2616 wrote to memory of 2716 2616 e24406.exe 38 PID 2616 wrote to memory of 2716 2616 e24406.exe 38 PID 2616 wrote to memory of 2716 2616 e24406.exe 38 PID 2716 wrote to memory of 2592 2716 42840.exe 39 PID 2716 wrote to memory of 2592 2716 42840.exe 39 PID 2716 wrote to memory of 2592 2716 42840.exe 39 PID 2716 wrote to memory of 2592 2716 42840.exe 39 PID 2592 wrote to memory of 2748 2592 806666.exe 40 PID 2592 wrote to memory of 2748 2592 806666.exe 40 PID 2592 wrote to memory of 2748 2592 806666.exe 40 PID 2592 wrote to memory of 2748 2592 806666.exe 40 PID 2748 wrote to memory of 3012 2748 5tbttb.exe 41 PID 2748 wrote to memory of 3012 2748 5tbttb.exe 41 PID 2748 wrote to memory of 3012 2748 5tbttb.exe 41 PID 2748 wrote to memory of 3012 2748 5tbttb.exe 41 PID 3012 wrote to memory of 2016 3012 20222.exe 42 PID 3012 wrote to memory of 2016 3012 20222.exe 42 PID 3012 wrote to memory of 2016 3012 20222.exe 42 PID 3012 wrote to memory of 2016 3012 20222.exe 42 PID 2016 wrote to memory of 2360 2016 0406822.exe 43 PID 2016 wrote to memory of 2360 2016 0406822.exe 43 PID 2016 wrote to memory of 2360 2016 0406822.exe 43 PID 2016 wrote to memory of 2360 2016 0406822.exe 43 PID 2360 wrote to memory of 1996 2360 0062488.exe 44 PID 2360 wrote to memory of 1996 2360 0062488.exe 44 PID 2360 wrote to memory of 1996 2360 0062488.exe 44 PID 2360 wrote to memory of 1996 2360 0062488.exe 44 PID 1996 wrote to memory of 1852 1996 s6028.exe 45 PID 1996 wrote to memory of 1852 1996 s6028.exe 45 PID 1996 wrote to memory of 1852 1996 s6028.exe 45 PID 1996 wrote to memory of 1852 1996 s6028.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe"C:\Users\Admin\AppData\Local\Temp\2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\680066.exec:\680066.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\e84406.exec:\e84406.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\hbbbhh.exec:\hbbbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\btbhnn.exec:\btbhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\480404.exec:\480404.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\m6840.exec:\m6840.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rllfrrf.exec:\rllfrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\e24406.exec:\e24406.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\42840.exec:\42840.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\806666.exec:\806666.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\5tbttb.exec:\5tbttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\20222.exec:\20222.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\0406822.exec:\0406822.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\0062488.exec:\0062488.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\s6028.exec:\s6028.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\u242266.exec:\u242266.exe17⤵
- Executes dropped EXE
PID:1852 -
\??\c:\0080284.exec:\0080284.exe18⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3djdj.exec:\3djdj.exe19⤵
- Executes dropped EXE
PID:2872 -
\??\c:\w28222.exec:\w28222.exe20⤵
- Executes dropped EXE
PID:296 -
\??\c:\hhtttb.exec:\hhtttb.exe21⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rfllrrr.exec:\rfllrrr.exe22⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xlrlxxf.exec:\xlrlxxf.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:480 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe24⤵
- Executes dropped EXE
PID:1416 -
\??\c:\08002.exec:\08002.exe25⤵
- Executes dropped EXE
PID:2884 -
\??\c:\04888.exec:\04888.exe26⤵
- Executes dropped EXE
PID:1092 -
\??\c:\ppvpj.exec:\ppvpj.exe27⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dvpvd.exec:\dvpvd.exe28⤵
- Executes dropped EXE
PID:316 -
\??\c:\4264044.exec:\4264044.exe29⤵
- Executes dropped EXE
PID:564 -
\??\c:\jdddp.exec:\jdddp.exe30⤵
- Executes dropped EXE
PID:1644 -
\??\c:\ppdjd.exec:\ppdjd.exe31⤵
- Executes dropped EXE
PID:2952 -
\??\c:\w02622.exec:\w02622.exe32⤵
- Executes dropped EXE
PID:2064 -
\??\c:\nhbbhh.exec:\nhbbhh.exe33⤵
- Executes dropped EXE
PID:880 -
\??\c:\bbhhhn.exec:\bbhhhn.exe34⤵
- Executes dropped EXE
PID:2356 -
\??\c:\9xxrxxx.exec:\9xxrxxx.exe35⤵
- Executes dropped EXE
PID:1892 -
\??\c:\60262.exec:\60262.exe36⤵
- Executes dropped EXE
PID:2504 -
\??\c:\208466.exec:\208466.exe37⤵
- Executes dropped EXE
PID:1856 -
\??\c:\thnntn.exec:\thnntn.exe38⤵
- Executes dropped EXE
PID:2264 -
\??\c:\4866266.exec:\4866266.exe39⤵
- Executes dropped EXE
PID:2788 -
\??\c:\9nhnnn.exec:\9nhnnn.exe40⤵
- Executes dropped EXE
PID:2280 -
\??\c:\fflllxf.exec:\fflllxf.exe41⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vpvjj.exec:\vpvjj.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\880688.exec:\880688.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hbhhtt.exec:\hbhhtt.exe44⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ddjpj.exec:\ddjpj.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\2688888.exec:\2688888.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jvjdj.exec:\jvjdj.exe47⤵
- Executes dropped EXE
PID:2284 -
\??\c:\6062444.exec:\6062444.exe48⤵
- Executes dropped EXE
PID:2748 -
\??\c:\xllffxl.exec:\xllffxl.exe49⤵
- Executes dropped EXE
PID:1888 -
\??\c:\frxllfl.exec:\frxllfl.exe50⤵
- Executes dropped EXE
PID:2000 -
\??\c:\420066.exec:\420066.exe51⤵
- Executes dropped EXE
PID:1844 -
\??\c:\5vdvp.exec:\5vdvp.exe52⤵
- Executes dropped EXE
PID:2360 -
\??\c:\c428000.exec:\c428000.exe53⤵
- Executes dropped EXE
PID:1704 -
\??\c:\ppdvv.exec:\ppdvv.exe54⤵
- Executes dropped EXE
PID:328 -
\??\c:\dpvvv.exec:\dpvvv.exe55⤵
- Executes dropped EXE
PID:1472 -
\??\c:\64626.exec:\64626.exe56⤵
- Executes dropped EXE
PID:2336 -
\??\c:\thnnhh.exec:\thnnhh.exe57⤵
- Executes dropped EXE
PID:2004 -
\??\c:\3nhbbt.exec:\3nhbbt.exe58⤵
- Executes dropped EXE
PID:2812 -
\??\c:\828048.exec:\828048.exe59⤵
- Executes dropped EXE
PID:1700 -
\??\c:\3tnnbb.exec:\3tnnbb.exe60⤵
- Executes dropped EXE
PID:2896 -
\??\c:\7vjdp.exec:\7vjdp.exe61⤵
- Executes dropped EXE
PID:1532 -
\??\c:\e68288.exec:\e68288.exe62⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nhhbbh.exec:\nhhbbh.exe63⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vvppd.exec:\vvppd.exe64⤵
- Executes dropped EXE
PID:812 -
\??\c:\9rlfrrx.exec:\9rlfrrx.exe65⤵
- Executes dropped EXE
PID:2940 -
\??\c:\0826262.exec:\0826262.exe66⤵PID:2168
-
\??\c:\0462040.exec:\0462040.exe67⤵PID:1564
-
\??\c:\22488.exec:\22488.exe68⤵PID:536
-
\??\c:\080060.exec:\080060.exe69⤵PID:3060
-
\??\c:\m8664.exec:\m8664.exe70⤵PID:904
-
\??\c:\flrxflr.exec:\flrxflr.exe71⤵PID:2936
-
\??\c:\420688.exec:\420688.exe72⤵PID:1780
-
\??\c:\0440062.exec:\0440062.exe73⤵PID:2160
-
\??\c:\1jpjp.exec:\1jpjp.exe74⤵PID:2640
-
\??\c:\82866.exec:\82866.exe75⤵PID:2104
-
\??\c:\a2440.exec:\a2440.exe76⤵PID:2064
-
\??\c:\btbtbt.exec:\btbtbt.exe77⤵PID:1000
-
\??\c:\82828.exec:\82828.exe78⤵PID:2368
-
\??\c:\btnntn.exec:\btnntn.exe79⤵PID:1312
-
\??\c:\7hnbbb.exec:\7hnbbb.exe80⤵PID:2084
-
\??\c:\lfffffl.exec:\lfffffl.exe81⤵PID:276
-
\??\c:\7nbhtn.exec:\7nbhtn.exe82⤵PID:1260
-
\??\c:\5pjdd.exec:\5pjdd.exe83⤵PID:2264
-
\??\c:\tnnnhh.exec:\tnnnhh.exe84⤵PID:2500
-
\??\c:\822626.exec:\822626.exe85⤵PID:2684
-
\??\c:\5lxxflf.exec:\5lxxflf.exe86⤵PID:2712
-
\??\c:\s6406.exec:\s6406.exe87⤵PID:3064
-
\??\c:\k64282.exec:\k64282.exe88⤵PID:2616
-
\??\c:\640624.exec:\640624.exe89⤵PID:2604
-
\??\c:\480060.exec:\480060.exe90⤵PID:2596
-
\??\c:\4802440.exec:\4802440.exe91⤵PID:2996
-
\??\c:\pjvpd.exec:\pjvpd.exe92⤵PID:1972
-
\??\c:\ppdvp.exec:\ppdvp.exe93⤵PID:3012
-
\??\c:\824066.exec:\824066.exe94⤵PID:1728
-
\??\c:\486688.exec:\486688.exe95⤵PID:1980
-
\??\c:\824082.exec:\824082.exe96⤵PID:1568
-
\??\c:\0468844.exec:\0468844.exe97⤵PID:1828
-
\??\c:\llrrxrx.exec:\llrrxrx.exe98⤵PID:1624
-
\??\c:\rlxlrrx.exec:\rlxlrrx.exe99⤵PID:1704
-
\??\c:\2200002.exec:\2200002.exe100⤵PID:1068
-
\??\c:\a6466.exec:\a6466.exe101⤵PID:1472
-
\??\c:\dpvpd.exec:\dpvpd.exe102⤵PID:1556
-
\??\c:\64024.exec:\64024.exe103⤵PID:756
-
\??\c:\202660.exec:\202660.exe104⤵PID:1200
-
\??\c:\82484.exec:\82484.exe105⤵PID:1700
-
\??\c:\206628.exec:\206628.exe106⤵PID:2136
-
\??\c:\pjpjd.exec:\pjpjd.exe107⤵PID:1532
-
\??\c:\602244.exec:\602244.exe108⤵PID:2180
-
\??\c:\48440.exec:\48440.exe109⤵PID:1408
-
\??\c:\8840662.exec:\8840662.exe110⤵PID:1540
-
\??\c:\rlllrrf.exec:\rlllrrf.exe111⤵PID:2564
-
\??\c:\e40066.exec:\e40066.exe112⤵PID:2480
-
\??\c:\3lrrxrx.exec:\3lrrxrx.exe113⤵PID:952
-
\??\c:\3pjjj.exec:\3pjjj.exe114⤵PID:344
-
\??\c:\fffllrr.exec:\fffllrr.exe115⤵PID:1652
-
\??\c:\4822262.exec:\4822262.exe116⤵PID:1476
-
\??\c:\q86408.exec:\q86408.exe117⤵PID:324
-
\??\c:\7lrllrr.exec:\7lrllrr.exe118⤵PID:2388
-
\??\c:\k68888.exec:\k68888.exe119⤵PID:2920
-
\??\c:\608282.exec:\608282.exe120⤵PID:1412
-
\??\c:\djppv.exec:\djppv.exe121⤵PID:2104
-
\??\c:\240626.exec:\240626.exe122⤵PID:2428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-