Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 14:02
Static task
static1
Behavioral task
behavioral1
Sample
cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe
Resource
win7-20240729-en
General
-
Target
cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe
-
Size
119KB
-
MD5
353f9c3a0b70ecabd365442b70213e10
-
SHA1
594c1301a40519e5e50a8212b2abb75cfb825e96
-
SHA256
cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4b
-
SHA512
35a17eca735b306be3b8764ac863ad6b4a2bd62489051e51f26cddb79d3da5149b0bced67542c50714ab151831a02887e0f53f30ca10b5ecc9d4464c47018b12
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX8XFE:n3C9BRW0j/uVEZF9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2500-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/792-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/476-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-92-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1124-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1400-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ppjpj.exe9fllrxf.exeppdjp.exejpdvj.exellrrrxx.exellrflrr.exejppdd.exelrxlflr.exevvdjv.exe9vpvp.exerrxlfxl.exe7bnbhn.exejjddj.exerrxfflx.exehhbhtn.exetntbbb.exerllllfl.exetntbnb.exe7bnnbh.exedjvjv.exefllfxrr.exetbnbth.exeppvvd.exerrxflrx.exe1bntht.exetthtbh.exepppdj.exefflxrxf.exetthhht.exe3thbhh.exeddpdd.exe7flxflr.exetntntt.exennthth.exe9pjdp.exevdjjd.exe1rffxlx.exehnbntb.exenbbhtb.exe9jpdv.exe5pjpj.exeflrxlrx.exefrxfrxf.exehtnbbn.exe9pjdv.exelrrxffl.exe7rxllrf.exetttbbn.exebhntht.exeddvvd.exejdjpd.exefffflrx.exerrrxffl.exe9hhtth.exevvdvj.exepdppj.exexrxxxfl.exeflxxfrx.exe7nbbtb.exebbbnbn.exejpjdj.exe7xlxlfr.exebhbnbt.exennnhtb.exepid Process 2436 ppjpj.exe 792 9fllrxf.exe 2068 ppdjp.exe 476 jpdvj.exe 2864 llrrrxx.exe 2872 llrflrr.exe 2972 jppdd.exe 2828 lrxlflr.exe 2664 vvdjv.exe 2488 9vpvp.exe 660 rrxlfxl.exe 2928 7bnbhn.exe 2360 jjddj.exe 2032 rrxfflx.exe 2916 hhbhtn.exe 2152 tntbbb.exe 1576 rllllfl.exe 1060 tntbnb.exe 1124 7bnnbh.exe 820 djvjv.exe 1236 fllfxrr.exe 2064 tbnbth.exe 1708 ppvvd.exe 1400 rrxflrx.exe 2260 1bntht.exe 1492 tthtbh.exe 2392 pppdj.exe 744 fflxrxf.exe 2240 tthhht.exe 2596 3thbhh.exe 2428 ddpdd.exe 1592 7flxflr.exe 2712 tntntt.exe 2236 nnthth.exe 264 9pjdp.exe 2852 vdjjd.exe 2848 1rffxlx.exe 2764 hnbntb.exe 1716 nbbhtb.exe 2972 9jpdv.exe 2884 5pjpj.exe 2648 flrxlrx.exe 808 frxfrxf.exe 2148 htnbbn.exe 1092 9pjdv.exe 660 lrrxffl.exe 2372 7rxllrf.exe 2824 tttbbn.exe 536 bhntht.exe 2032 ddvvd.exe 748 jdjpd.exe 1856 fffflrx.exe 1636 rrrxffl.exe 1640 9hhtth.exe 1072 vvdvj.exe 548 pdppj.exe 1728 xrxxxfl.exe 936 flxxfrx.exe 3040 7nbbtb.exe 2064 bbbnbn.exe 1708 jpjdj.exe 2612 7xlxlfr.exe 2348 bhbnbt.exe 740 nnnhtb.exe -
Processes:
resource yara_rule behavioral1/memory/2500-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/476-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/476-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/476-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1400-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
xlflxlx.exerrxflrx.exentntbn.exevvjjv.exexfxfxxr.exedjjjd.exedpjdj.exevvjdp.exe3vdjd.exejjpdp.exepdppj.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exeppjpj.exe9fllrxf.exeppdjp.exejpdvj.exellrrrxx.exellrflrr.exejppdd.exelrxlflr.exevvdjv.exe9vpvp.exerrxlfxl.exe7bnbhn.exejjddj.exerrxfflx.exehhbhtn.exedescription pid Process procid_target PID 2500 wrote to memory of 2436 2500 cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe 30 PID 2500 wrote to memory of 2436 2500 cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe 30 PID 2500 wrote to memory of 2436 2500 cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe 30 PID 2500 wrote to memory of 2436 2500 cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe 30 PID 2436 wrote to memory of 792 2436 ppjpj.exe 31 PID 2436 wrote to memory of 792 2436 ppjpj.exe 31 PID 2436 wrote to memory of 792 2436 ppjpj.exe 31 PID 2436 wrote to memory of 792 2436 ppjpj.exe 31 PID 792 wrote to memory of 2068 792 9fllrxf.exe 32 PID 792 wrote to memory of 2068 792 9fllrxf.exe 32 PID 792 wrote to memory of 2068 792 9fllrxf.exe 32 PID 792 wrote to memory of 2068 792 9fllrxf.exe 32 PID 2068 wrote to memory of 476 2068 ppdjp.exe 33 PID 2068 wrote to memory of 476 2068 ppdjp.exe 33 PID 2068 wrote to memory of 476 2068 ppdjp.exe 33 PID 2068 wrote to memory of 476 2068 ppdjp.exe 33 PID 476 wrote to memory of 2864 476 jpdvj.exe 34 PID 476 wrote to memory of 2864 476 jpdvj.exe 34 PID 476 wrote to memory of 2864 476 jpdvj.exe 34 PID 476 wrote to memory of 2864 476 jpdvj.exe 34 PID 2864 wrote to memory of 2872 2864 llrrrxx.exe 35 PID 2864 wrote to memory of 2872 2864 llrrrxx.exe 35 PID 2864 wrote to memory of 2872 2864 llrrrxx.exe 35 PID 2864 wrote to memory of 2872 2864 llrrrxx.exe 35 PID 2872 wrote to memory of 2972 2872 llrflrr.exe 36 PID 2872 wrote to memory of 2972 2872 llrflrr.exe 36 PID 2872 wrote to memory of 2972 2872 llrflrr.exe 36 PID 2872 wrote to memory of 2972 2872 llrflrr.exe 36 PID 2972 wrote to memory of 2828 2972 jppdd.exe 37 PID 2972 wrote to memory of 2828 2972 jppdd.exe 37 PID 2972 wrote to memory of 2828 2972 jppdd.exe 37 PID 2972 wrote to memory of 2828 2972 jppdd.exe 37 PID 2828 wrote to memory of 2664 2828 lrxlflr.exe 38 PID 2828 wrote to memory of 2664 2828 lrxlflr.exe 38 PID 2828 wrote to memory of 2664 2828 lrxlflr.exe 38 PID 2828 wrote to memory of 2664 2828 lrxlflr.exe 38 PID 2664 wrote to memory of 2488 2664 vvdjv.exe 39 PID 2664 wrote to memory of 2488 2664 vvdjv.exe 39 PID 2664 wrote to memory of 2488 2664 vvdjv.exe 39 PID 2664 wrote to memory of 2488 2664 vvdjv.exe 39 PID 2488 wrote to memory of 660 2488 9vpvp.exe 40 PID 2488 wrote to memory of 660 2488 9vpvp.exe 40 PID 2488 wrote to memory of 660 2488 9vpvp.exe 40 PID 2488 wrote to memory of 660 2488 9vpvp.exe 40 PID 660 wrote to memory of 2928 660 rrxlfxl.exe 41 PID 660 wrote to memory of 2928 660 rrxlfxl.exe 41 PID 660 wrote to memory of 2928 660 rrxlfxl.exe 41 PID 660 wrote to memory of 2928 660 rrxlfxl.exe 41 PID 2928 wrote to memory of 2360 2928 7bnbhn.exe 42 PID 2928 wrote to memory of 2360 2928 7bnbhn.exe 42 PID 2928 wrote to memory of 2360 2928 7bnbhn.exe 42 PID 2928 wrote to memory of 2360 2928 7bnbhn.exe 42 PID 2360 wrote to memory of 2032 2360 jjddj.exe 43 PID 2360 wrote to memory of 2032 2360 jjddj.exe 43 PID 2360 wrote to memory of 2032 2360 jjddj.exe 43 PID 2360 wrote to memory of 2032 2360 jjddj.exe 43 PID 2032 wrote to memory of 2916 2032 rrxfflx.exe 44 PID 2032 wrote to memory of 2916 2032 rrxfflx.exe 44 PID 2032 wrote to memory of 2916 2032 rrxfflx.exe 44 PID 2032 wrote to memory of 2916 2032 rrxfflx.exe 44 PID 2916 wrote to memory of 2152 2916 hhbhtn.exe 45 PID 2916 wrote to memory of 2152 2916 hhbhtn.exe 45 PID 2916 wrote to memory of 2152 2916 hhbhtn.exe 45 PID 2916 wrote to memory of 2152 2916 hhbhtn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe"C:\Users\Admin\AppData\Local\Temp\cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\ppjpj.exec:\ppjpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\9fllrxf.exec:\9fllrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\ppdjp.exec:\ppdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\jpdvj.exec:\jpdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
\??\c:\llrrrxx.exec:\llrrrxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\llrflrr.exec:\llrflrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\jppdd.exec:\jppdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\lrxlflr.exec:\lrxlflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\vvdjv.exec:\vvdjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\9vpvp.exec:\9vpvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rrxlfxl.exec:\rrxlfxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\7bnbhn.exec:\7bnbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\jjddj.exec:\jjddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\rrxfflx.exec:\rrxfflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\hhbhtn.exec:\hhbhtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\tntbbb.exec:\tntbbb.exe17⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rllllfl.exec:\rllllfl.exe18⤵
- Executes dropped EXE
PID:1576 -
\??\c:\tntbnb.exec:\tntbnb.exe19⤵
- Executes dropped EXE
PID:1060 -
\??\c:\7bnnbh.exec:\7bnnbh.exe20⤵
- Executes dropped EXE
PID:1124 -
\??\c:\djvjv.exec:\djvjv.exe21⤵
- Executes dropped EXE
PID:820 -
\??\c:\fllfxrr.exec:\fllfxrr.exe22⤵
- Executes dropped EXE
PID:1236 -
\??\c:\tbnbth.exec:\tbnbth.exe23⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ppvvd.exec:\ppvvd.exe24⤵
- Executes dropped EXE
PID:1708 -
\??\c:\rrxflrx.exec:\rrxflrx.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1400 -
\??\c:\1bntht.exec:\1bntht.exe26⤵
- Executes dropped EXE
PID:2260 -
\??\c:\tthtbh.exec:\tthtbh.exe27⤵
- Executes dropped EXE
PID:1492 -
\??\c:\pppdj.exec:\pppdj.exe28⤵
- Executes dropped EXE
PID:2392 -
\??\c:\fflxrxf.exec:\fflxrxf.exe29⤵
- Executes dropped EXE
PID:744 -
\??\c:\tthhht.exec:\tthhht.exe30⤵
- Executes dropped EXE
PID:2240 -
\??\c:\3thbhh.exec:\3thbhh.exe31⤵
- Executes dropped EXE
PID:2596 -
\??\c:\ddpdd.exec:\ddpdd.exe32⤵
- Executes dropped EXE
PID:2428 -
\??\c:\7flxflr.exec:\7flxflr.exe33⤵
- Executes dropped EXE
PID:1592 -
\??\c:\tntntt.exec:\tntntt.exe34⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nnthth.exec:\nnthth.exe35⤵
- Executes dropped EXE
PID:2236 -
\??\c:\9pjdp.exec:\9pjdp.exe36⤵
- Executes dropped EXE
PID:264 -
\??\c:\vdjjd.exec:\vdjjd.exe37⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1rffxlx.exec:\1rffxlx.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\hnbntb.exec:\hnbntb.exe39⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nbbhtb.exec:\nbbhtb.exe40⤵
- Executes dropped EXE
PID:1716 -
\??\c:\9jpdv.exec:\9jpdv.exe41⤵
- Executes dropped EXE
PID:2972 -
\??\c:\5pjpj.exec:\5pjpj.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\flrxlrx.exec:\flrxlrx.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\frxfrxf.exec:\frxfrxf.exe44⤵
- Executes dropped EXE
PID:808 -
\??\c:\htnbbn.exec:\htnbbn.exe45⤵
- Executes dropped EXE
PID:2148 -
\??\c:\9pjdv.exec:\9pjdv.exe46⤵
- Executes dropped EXE
PID:1092 -
\??\c:\lrrxffl.exec:\lrrxffl.exe47⤵
- Executes dropped EXE
PID:660 -
\??\c:\7rxllrf.exec:\7rxllrf.exe48⤵
- Executes dropped EXE
PID:2372 -
\??\c:\tttbbn.exec:\tttbbn.exe49⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bhntht.exec:\bhntht.exe50⤵
- Executes dropped EXE
PID:536 -
\??\c:\ddvvd.exec:\ddvvd.exe51⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jdjpd.exec:\jdjpd.exe52⤵
- Executes dropped EXE
PID:748 -
\??\c:\fffflrx.exec:\fffflrx.exe53⤵
- Executes dropped EXE
PID:1856 -
\??\c:\rrrxffl.exec:\rrrxffl.exe54⤵
- Executes dropped EXE
PID:1636 -
\??\c:\9hhtth.exec:\9hhtth.exe55⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vvdvj.exec:\vvdvj.exe56⤵
- Executes dropped EXE
PID:1072 -
\??\c:\pdppj.exec:\pdppj.exe57⤵
- Executes dropped EXE
PID:548 -
\??\c:\xrxxxfl.exec:\xrxxxfl.exe58⤵
- Executes dropped EXE
PID:1728 -
\??\c:\flxxfrx.exec:\flxxfrx.exe59⤵
- Executes dropped EXE
PID:936 -
\??\c:\7nbbtb.exec:\7nbbtb.exe60⤵
- Executes dropped EXE
PID:3040 -
\??\c:\bbbnbn.exec:\bbbnbn.exe61⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jpjdj.exec:\jpjdj.exe62⤵
- Executes dropped EXE
PID:1708 -
\??\c:\7xlxlfr.exec:\7xlxlfr.exe63⤵
- Executes dropped EXE
PID:2612 -
\??\c:\bhbnbt.exec:\bhbnbt.exe64⤵
- Executes dropped EXE
PID:2348 -
\??\c:\nnnhtb.exec:\nnnhtb.exe65⤵
- Executes dropped EXE
PID:740 -
\??\c:\ddddj.exec:\ddddj.exe66⤵PID:1284
-
\??\c:\jjpdj.exec:\jjpdj.exe67⤵PID:2536
-
\??\c:\1rlrxrf.exec:\1rlrxrf.exe68⤵PID:2272
-
\??\c:\9nhnnt.exec:\9nhnnt.exe69⤵PID:2500
-
\??\c:\nbtbht.exec:\nbtbht.exe70⤵PID:3016
-
\??\c:\jppvj.exec:\jppvj.exe71⤵PID:2560
-
\??\c:\vvjvp.exec:\vvjvp.exe72⤵PID:1584
-
\??\c:\5xlrxff.exec:\5xlrxff.exe73⤵PID:792
-
\??\c:\lrxfxfx.exec:\lrxfxfx.exe74⤵PID:2576
-
\??\c:\7nhbbb.exec:\7nhbbb.exe75⤵PID:2504
-
\??\c:\bbnthn.exec:\bbnthn.exe76⤵PID:2060
-
\??\c:\pvjpv.exec:\pvjpv.exe77⤵PID:2736
-
\??\c:\jpddp.exec:\jpddp.exe78⤵PID:2832
-
\??\c:\ffxfxfr.exec:\ffxfxfr.exe79⤵PID:2668
-
\??\c:\llrxrxf.exec:\llrxrxf.exe80⤵PID:2792
-
\??\c:\tbhnbh.exec:\tbhnbh.exe81⤵PID:2332
-
\??\c:\jvjpv.exec:\jvjpv.exe82⤵PID:2776
-
\??\c:\jvdvp.exec:\jvdvp.exe83⤵PID:2696
-
\??\c:\5xlrfxl.exec:\5xlrfxl.exe84⤵PID:2684
-
\??\c:\9xrxflr.exec:\9xrxflr.exe85⤵PID:2488
-
\??\c:\ntbbbt.exec:\ntbbbt.exe86⤵PID:2920
-
\??\c:\vjdjj.exec:\vjdjj.exe87⤵PID:1720
-
\??\c:\flrfxfr.exec:\flrfxfr.exe88⤵PID:2004
-
\??\c:\rxrlxxr.exec:\rxrlxxr.exe89⤵PID:1260
-
\??\c:\7tnthn.exec:\7tnthn.exe90⤵PID:536
-
\??\c:\pjvdv.exec:\pjvdv.exe91⤵PID:1664
-
\??\c:\djjvp.exec:\djjvp.exe92⤵PID:1860
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe93⤵PID:2340
-
\??\c:\tthnnt.exec:\tthnnt.exe94⤵PID:2168
-
\??\c:\btnnnn.exec:\btnnnn.exe95⤵PID:448
-
\??\c:\5ppvp.exec:\5ppvp.exe96⤵PID:1044
-
\??\c:\frfxrrf.exec:\frfxrrf.exe97⤵PID:1808
-
\??\c:\7fxrlfx.exec:\7fxrlfx.exe98⤵PID:984
-
\??\c:\9nbnnb.exec:\9nbnnb.exe99⤵PID:1732
-
\??\c:\7vppd.exec:\7vppd.exe100⤵PID:1056
-
\??\c:\vdvdv.exec:\vdvdv.exe101⤵PID:1004
-
\??\c:\flffxfr.exec:\flffxfr.exe102⤵PID:1524
-
\??\c:\lxfxrlr.exec:\lxfxrlr.exe103⤵PID:1968
-
\??\c:\7bbhbt.exec:\7bbhbt.exe104⤵PID:2400
-
\??\c:\hnhtnt.exec:\hnhtnt.exe105⤵PID:1160
-
\??\c:\vvpdd.exec:\vvpdd.exe106⤵PID:876
-
\??\c:\vjvdv.exec:\vjvdv.exe107⤵PID:1788
-
\??\c:\xxxlrxx.exec:\xxxlrxx.exe108⤵PID:2436
-
\??\c:\thhtnt.exec:\thhtnt.exe109⤵PID:1932
-
\??\c:\3nbnnb.exec:\3nbnnb.exe110⤵PID:1672
-
\??\c:\vpdpp.exec:\vpdpp.exe111⤵PID:2044
-
\??\c:\rrllxfx.exec:\rrllxfx.exe112⤵PID:1964
-
\??\c:\lrlxllx.exec:\lrlxllx.exe113⤵PID:2904
-
\??\c:\5htnth.exec:\5htnth.exe114⤵PID:2236
-
\??\c:\dvjjp.exec:\dvjjp.exe115⤵PID:2856
-
\??\c:\jjpvp.exec:\jjpvp.exe116⤵PID:2852
-
\??\c:\lrlxrxl.exec:\lrlxrxl.exe117⤵PID:3008
-
\??\c:\9hbhnb.exec:\9hbhnb.exe118⤵PID:2764
-
\??\c:\thtthn.exec:\thtthn.exe119⤵PID:2660
-
\??\c:\7ddjp.exec:\7ddjp.exe120⤵PID:1716
-
\??\c:\fxxrrll.exec:\fxxrrll.exe121⤵PID:2676
-
\??\c:\rlxlfrf.exec:\rlxlfrf.exe122⤵PID:2884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-