Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 05:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exe
Resource
win7-20240729-en
7 signatures
120 seconds
General
-
Target
df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exe
-
Size
71KB
-
MD5
1e4ab4d42921fb71305c3bc0e966f7bf
-
SHA1
8759e87fbd6a17ed2c4ced288e48842d28213b38
-
SHA256
df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4
-
SHA512
d55b46061f9fbc56ee4c5e17c4998ff222dc4ce1e1f60568c11b97bbab44ac1ca877580c7a90b402feb51f713dfe8ea72668c8232daf81d8ae2db11b3202312a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+q8l45CmK:ymb3NkkiQ3mdBjFIj+q8lL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3964-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/652-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4072 pjjjd.exe 3416 9fflffx.exe 1084 jpvjd.exe 3088 dvppd.exe 3936 xrxlffx.exe 652 7nnttt.exe 2892 jpddv.exe 4808 1ffxxlf.exe 3384 rlrrxrx.exe 2272 tbhhbb.exe 4556 7vdjj.exe 4268 7djdd.exe 2900 rxffrrl.exe 1332 nnbttt.exe 4016 9djjd.exe 1016 lfxrrrr.exe 3260 9htntt.exe 1652 btbnbt.exe 448 jjppj.exe 4316 7ffxffr.exe 4460 9hhnnn.exe 2316 3dvpd.exe 1720 fxrllll.exe 1420 3xfffll.exe 4064 3htbbb.exe 3988 7vpjj.exe 3944 lrxffll.exe 3684 fxxrrrl.exe 4936 nbhnnb.exe 1924 5pvjj.exe 1432 7pvjp.exe 3064 7lrlxrl.exe 1468 bbbbbh.exe 1728 pddjj.exe 4652 xlffxxr.exe 5116 xxxffff.exe 2704 hbnnnn.exe 1932 9bttnt.exe 4964 vpjdd.exe 716 xxlflrr.exe 3464 ffllffl.exe 2756 tntttt.exe 1956 jpdpv.exe 5080 xrxfflf.exe 2128 5hnhnt.exe 5064 vppdv.exe 2060 xfrfrlf.exe 624 9nbhhh.exe 2216 1vddv.exe 2760 5rxrrrx.exe 3000 flllfff.exe 1396 1tnnhh.exe 1872 hbntbt.exe 4536 dvdvp.exe 2788 flxfxrl.exe 1196 3hnhbh.exe 636 hthbbb.exe 1612 vdvdp.exe 4408 rfrxlfx.exe 428 frffffl.exe 3956 thnnhh.exe 2908 jjpjd.exe 4556 xllrfrf.exe 3848 xlfllll.exe -
resource yara_rule behavioral2/memory/3964-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/652-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3964 wrote to memory of 4072 3964 df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exe 83 PID 3964 wrote to memory of 4072 3964 df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exe 83 PID 3964 wrote to memory of 4072 3964 df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exe 83 PID 4072 wrote to memory of 3416 4072 pjjjd.exe 84 PID 4072 wrote to memory of 3416 4072 pjjjd.exe 84 PID 4072 wrote to memory of 3416 4072 pjjjd.exe 84 PID 3416 wrote to memory of 1084 3416 9fflffx.exe 85 PID 3416 wrote to memory of 1084 3416 9fflffx.exe 85 PID 3416 wrote to memory of 1084 3416 9fflffx.exe 85 PID 1084 wrote to memory of 3088 1084 jpvjd.exe 86 PID 1084 wrote to memory of 3088 1084 jpvjd.exe 86 PID 1084 wrote to memory of 3088 1084 jpvjd.exe 86 PID 3088 wrote to memory of 3936 3088 dvppd.exe 87 PID 3088 wrote to memory of 3936 3088 dvppd.exe 87 PID 3088 wrote to memory of 3936 3088 dvppd.exe 87 PID 3936 wrote to memory of 652 3936 xrxlffx.exe 88 PID 3936 wrote to memory of 652 3936 xrxlffx.exe 88 PID 3936 wrote to memory of 652 3936 xrxlffx.exe 88 PID 652 wrote to memory of 2892 652 7nnttt.exe 89 PID 652 wrote to memory of 2892 652 7nnttt.exe 89 PID 652 wrote to memory of 2892 652 7nnttt.exe 89 PID 2892 wrote to memory of 4808 2892 jpddv.exe 90 PID 2892 wrote to memory of 4808 2892 jpddv.exe 90 PID 2892 wrote to memory of 4808 2892 jpddv.exe 90 PID 4808 wrote to memory of 3384 4808 1ffxxlf.exe 91 PID 4808 wrote to memory of 3384 4808 1ffxxlf.exe 91 PID 4808 wrote to memory of 3384 4808 1ffxxlf.exe 91 PID 3384 wrote to memory of 2272 3384 rlrrxrx.exe 92 PID 3384 wrote to memory of 2272 3384 rlrrxrx.exe 92 PID 3384 wrote to memory of 2272 3384 rlrrxrx.exe 92 PID 2272 wrote to memory of 4556 2272 tbhhbb.exe 93 PID 2272 wrote to memory of 4556 2272 tbhhbb.exe 93 PID 2272 wrote to memory of 4556 2272 tbhhbb.exe 93 PID 4556 wrote to memory of 4268 4556 7vdjj.exe 94 PID 4556 wrote to memory of 4268 4556 7vdjj.exe 94 PID 4556 wrote to memory of 4268 4556 7vdjj.exe 94 PID 4268 wrote to memory of 2900 4268 7djdd.exe 95 PID 4268 wrote to memory of 2900 4268 7djdd.exe 95 PID 4268 wrote to memory of 2900 4268 7djdd.exe 95 PID 2900 wrote to memory of 1332 2900 rxffrrl.exe 96 PID 2900 wrote to memory of 1332 2900 rxffrrl.exe 96 PID 2900 wrote to memory of 1332 2900 rxffrrl.exe 96 PID 1332 wrote to memory of 4016 1332 nnbttt.exe 97 PID 1332 wrote to memory of 4016 1332 nnbttt.exe 97 PID 1332 wrote to memory of 4016 1332 nnbttt.exe 97 PID 4016 wrote to memory of 1016 4016 9djjd.exe 98 PID 4016 wrote to memory of 1016 4016 9djjd.exe 98 PID 4016 wrote to memory of 1016 4016 9djjd.exe 98 PID 1016 wrote to memory of 3260 1016 lfxrrrr.exe 99 PID 1016 wrote to memory of 3260 1016 lfxrrrr.exe 99 PID 1016 wrote to memory of 3260 1016 lfxrrrr.exe 99 PID 3260 wrote to memory of 1652 3260 9htntt.exe 100 PID 3260 wrote to memory of 1652 3260 9htntt.exe 100 PID 3260 wrote to memory of 1652 3260 9htntt.exe 100 PID 1652 wrote to memory of 448 1652 btbnbt.exe 101 PID 1652 wrote to memory of 448 1652 btbnbt.exe 101 PID 1652 wrote to memory of 448 1652 btbnbt.exe 101 PID 448 wrote to memory of 4316 448 jjppj.exe 102 PID 448 wrote to memory of 4316 448 jjppj.exe 102 PID 448 wrote to memory of 4316 448 jjppj.exe 102 PID 4316 wrote to memory of 4460 4316 7ffxffr.exe 103 PID 4316 wrote to memory of 4460 4316 7ffxffr.exe 103 PID 4316 wrote to memory of 4460 4316 7ffxffr.exe 103 PID 4460 wrote to memory of 2316 4460 9hhnnn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exe"C:\Users\Admin\AppData\Local\Temp\df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\pjjjd.exec:\pjjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\9fflffx.exec:\9fflffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\jpvjd.exec:\jpvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\dvppd.exec:\dvppd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\xrxlffx.exec:\xrxlffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\7nnttt.exec:\7nnttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\jpddv.exec:\jpddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\1ffxxlf.exec:\1ffxxlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\rlrrxrx.exec:\rlrrxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\tbhhbb.exec:\tbhhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\7vdjj.exec:\7vdjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\7djdd.exec:\7djdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\rxffrrl.exec:\rxffrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\nnbttt.exec:\nnbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\9djjd.exec:\9djjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\lfxrrrr.exec:\lfxrrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\9htntt.exec:\9htntt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\btbnbt.exec:\btbnbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\jjppj.exec:\jjppj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\7ffxffr.exec:\7ffxffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\9hhnnn.exec:\9hhnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\3dvpd.exec:\3dvpd.exe23⤵
- Executes dropped EXE
PID:2316 -
\??\c:\fxrllll.exec:\fxrllll.exe24⤵
- Executes dropped EXE
PID:1720 -
\??\c:\3xfffll.exec:\3xfffll.exe25⤵
- Executes dropped EXE
PID:1420 -
\??\c:\3htbbb.exec:\3htbbb.exe26⤵
- Executes dropped EXE
PID:4064 -
\??\c:\7vpjj.exec:\7vpjj.exe27⤵
- Executes dropped EXE
PID:3988 -
\??\c:\lrxffll.exec:\lrxffll.exe28⤵
- Executes dropped EXE
PID:3944 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe29⤵
- Executes dropped EXE
PID:3684 -
\??\c:\nbhnnb.exec:\nbhnnb.exe30⤵
- Executes dropped EXE
PID:4936 -
\??\c:\5pvjj.exec:\5pvjj.exe31⤵
- Executes dropped EXE
PID:1924 -
\??\c:\7pvjp.exec:\7pvjp.exe32⤵
- Executes dropped EXE
PID:1432 -
\??\c:\7lrlxrl.exec:\7lrlxrl.exe33⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bbbbbh.exec:\bbbbbh.exe34⤵
- Executes dropped EXE
PID:1468 -
\??\c:\pddjj.exec:\pddjj.exe35⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xlffxxr.exec:\xlffxxr.exe36⤵
- Executes dropped EXE
PID:4652 -
\??\c:\xxxffff.exec:\xxxffff.exe37⤵
- Executes dropped EXE
PID:5116 -
\??\c:\hbnnnn.exec:\hbnnnn.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9bttnt.exec:\9bttnt.exe39⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vpjdd.exec:\vpjdd.exe40⤵
- Executes dropped EXE
PID:4964 -
\??\c:\xxlflrr.exec:\xxlflrr.exe41⤵
- Executes dropped EXE
PID:716 -
\??\c:\ffllffl.exec:\ffllffl.exe42⤵
- Executes dropped EXE
PID:3464 -
\??\c:\tntttt.exec:\tntttt.exe43⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jpdpv.exec:\jpdpv.exe44⤵
- Executes dropped EXE
PID:1956 -
\??\c:\fxfllll.exec:\fxfllll.exe45⤵PID:4276
-
\??\c:\xrxfflf.exec:\xrxfflf.exe46⤵
- Executes dropped EXE
PID:5080 -
\??\c:\5hnhnt.exec:\5hnhnt.exe47⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vppdv.exec:\vppdv.exe48⤵
- Executes dropped EXE
PID:5064 -
\??\c:\xfrfrlf.exec:\xfrfrlf.exe49⤵
- Executes dropped EXE
PID:2060 -
\??\c:\9nbhhh.exec:\9nbhhh.exe50⤵
- Executes dropped EXE
PID:624 -
\??\c:\1vddv.exec:\1vddv.exe51⤵
- Executes dropped EXE
PID:2216 -
\??\c:\5rxrrrx.exec:\5rxrrrx.exe52⤵
- Executes dropped EXE
PID:2760 -
\??\c:\flllfff.exec:\flllfff.exe53⤵
- Executes dropped EXE
PID:3000 -
\??\c:\1tnnhh.exec:\1tnnhh.exe54⤵
- Executes dropped EXE
PID:1396 -
\??\c:\hbntbt.exec:\hbntbt.exe55⤵
- Executes dropped EXE
PID:1872 -
\??\c:\dvdvp.exec:\dvdvp.exe56⤵
- Executes dropped EXE
PID:4536 -
\??\c:\flxfxrl.exec:\flxfxrl.exe57⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3hnhbh.exec:\3hnhbh.exe58⤵
- Executes dropped EXE
PID:1196 -
\??\c:\hthbbb.exec:\hthbbb.exe59⤵
- Executes dropped EXE
PID:636 -
\??\c:\vdvdp.exec:\vdvdp.exe60⤵
- Executes dropped EXE
PID:1612 -
\??\c:\rfrxlfx.exec:\rfrxlfx.exe61⤵
- Executes dropped EXE
PID:4408 -
\??\c:\frffffl.exec:\frffffl.exe62⤵
- Executes dropped EXE
PID:428 -
\??\c:\thnnhh.exec:\thnnhh.exe63⤵
- Executes dropped EXE
PID:3956 -
\??\c:\jjpjd.exec:\jjpjd.exe64⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xllrfrf.exec:\xllrfrf.exe65⤵
- Executes dropped EXE
PID:4556 -
\??\c:\xlfllll.exec:\xlfllll.exe66⤵
- Executes dropped EXE
PID:3848 -
\??\c:\7hnnnn.exec:\7hnnnn.exe67⤵PID:1776
-
\??\c:\nntnnb.exec:\nntnnb.exe68⤵PID:2900
-
\??\c:\hnnbbb.exec:\hnnbbb.exe69⤵PID:2032
-
\??\c:\dpddd.exec:\dpddd.exe70⤵PID:5012
-
\??\c:\fxllflx.exec:\fxllflx.exe71⤵PID:4760
-
\??\c:\rrllrxl.exec:\rrllrxl.exe72⤵PID:4216
-
\??\c:\hnbtnn.exec:\hnbtnn.exe73⤵PID:5072
-
\??\c:\vddvp.exec:\vddvp.exe74⤵PID:5036
-
\??\c:\xxlxrfl.exec:\xxlxrfl.exe75⤵PID:4364
-
\??\c:\rrflrrx.exec:\rrflrrx.exe76⤵PID:4992
-
\??\c:\hnhhtt.exec:\hnhhtt.exe77⤵PID:764
-
\??\c:\jjvpj.exec:\jjvpj.exe78⤵PID:4212
-
\??\c:\rrxllfx.exec:\rrxllfx.exe79⤵PID:4292
-
\??\c:\rlxxflr.exec:\rlxxflr.exe80⤵PID:1960
-
\??\c:\hnnnnt.exec:\hnnnnt.exe81⤵PID:5028
-
\??\c:\bbttnt.exec:\bbttnt.exe82⤵PID:4516
-
\??\c:\jjvdj.exec:\jjvdj.exe83⤵PID:1012
-
\??\c:\fxrllrl.exec:\fxrllrl.exe84⤵PID:4568
-
\??\c:\tbhnhn.exec:\tbhnhn.exe85⤵PID:532
-
\??\c:\bhthtn.exec:\bhthtn.exe86⤵PID:928
-
\??\c:\vpvvv.exec:\vpvvv.exe87⤵PID:892
-
\??\c:\rxllrrx.exec:\rxllrrx.exe88⤵PID:4052
-
\??\c:\3lfflrf.exec:\3lfflrf.exe89⤵PID:1556
-
\??\c:\nntbnn.exec:\nntbnn.exe90⤵PID:3064
-
\??\c:\jjddv.exec:\jjddv.exe91⤵PID:3232
-
\??\c:\vpvvp.exec:\vpvvp.exe92⤵PID:5004
-
\??\c:\llxlxlx.exec:\llxlxlx.exe93⤵PID:4184
-
\??\c:\hnhbbt.exec:\hnhbbt.exe94⤵PID:1520
-
\??\c:\vdjjv.exec:\vdjjv.exe95⤵PID:4260
-
\??\c:\rrrlxfx.exec:\rrrlxfx.exe96⤵PID:3724
-
\??\c:\nhtttn.exec:\nhtttn.exe97⤵PID:3924
-
\??\c:\tbbbtn.exec:\tbbbtn.exe98⤵PID:2796
-
\??\c:\pddpv.exec:\pddpv.exe99⤵PID:1272
-
\??\c:\5lxxfrr.exec:\5lxxfrr.exe100⤵PID:2756
-
\??\c:\1lrfflr.exec:\1lrfflr.exe101⤵PID:2264
-
\??\c:\tttthh.exec:\tttthh.exe102⤵PID:228
-
\??\c:\ppppj.exec:\ppppj.exe103⤵PID:1004
-
\??\c:\rxlllff.exec:\rxlllff.exe104⤵PID:2128
-
\??\c:\9rxrrrx.exec:\9rxrrrx.exe105⤵PID:5064
-
\??\c:\tbttbh.exec:\tbttbh.exe106⤵PID:1920
-
\??\c:\vpvpp.exec:\vpvpp.exe107⤵
- System Location Discovery: System Language Discovery
PID:4352 -
\??\c:\xfrfxrr.exec:\xfrfxrr.exe108⤵PID:2236
-
\??\c:\rflxrrr.exec:\rflxrrr.exe109⤵PID:2428
-
\??\c:\btttnn.exec:\btttnn.exe110⤵PID:5100
-
\??\c:\jpppd.exec:\jpppd.exe111⤵PID:2844
-
\??\c:\3lllfll.exec:\3lllfll.exe112⤵PID:4256
-
\??\c:\rxlllll.exec:\rxlllll.exe113⤵PID:848
-
\??\c:\htbthh.exec:\htbthh.exe114⤵PID:4648
-
\??\c:\htbnbb.exec:\htbnbb.exe115⤵PID:2892
-
\??\c:\vdpvp.exec:\vdpvp.exe116⤵PID:536
-
\??\c:\llxfffl.exec:\llxfffl.exe117⤵PID:3028
-
\??\c:\rlxxrxr.exec:\rlxxrxr.exe118⤵PID:4408
-
\??\c:\tnhnnh.exec:\tnhnnh.exe119⤵PID:1976
-
\??\c:\ddvpd.exec:\ddvpd.exe120⤵PID:4028
-
\??\c:\dvvpj.exec:\dvvpj.exe121⤵PID:3848
-
\??\c:\lxlxlfr.exec:\lxlxlfr.exe122⤵PID:1104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-