Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 01:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe
-
Size
454KB
-
MD5
c15fcd440d061fc6fec6fc05d291b1bd
-
SHA1
63059d94c0aac27ca1b772e990feac14df86c717
-
SHA256
9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9
-
SHA512
258de746f0c3b94ca873aa7ae80c7ac9a816eb3210231286d0a277301e884f7f41aa1eb67e6d27f1a5c2c6c8ee78e949875ca14e578174fc5cf53bf0a89b8c74
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbem:q7Tc2NYHUrAwfMp3CDm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2540-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-155-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2904-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-199-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1580-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-207-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2228-211-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/992-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-226-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2952-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-261-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2156-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-488-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1540-546-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1744-557-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2580-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-597-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2836-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2464 rrrfxrr.exe 2744 jjvvd.exe 2288 5hnttb.exe 2948 vvjpj.exe 2860 bthbbb.exe 1680 jdvvp.exe 2604 thnntt.exe 2768 ddpjj.exe 2224 1djvv.exe 2260 5rfxffl.exe 2452 5jvpp.exe 1676 rllffff.exe 1044 jdvjj.exe 2900 fflllff.exe 2496 ppddd.exe 2904 tntnnn.exe 1524 xrrrrrr.exe 444 5bhhbh.exe 544 7lrxffl.exe 1580 rrxxfll.exe 2228 jjpjd.exe 992 llxlrll.exe 2408 fflrxfr.exe 2952 nhnnnn.exe 236 7llxlxf.exe 1004 ddjdv.exe 1788 9xxxxff.exe 3060 9tntbb.exe 2156 xxrrxxl.exe 276 hbhhnh.exe 2988 xxflrxf.exe 1592 nhtntn.exe 1016 ffrlxxl.exe 2464 ttnhbt.exe 2816 5vpvd.exe 2756 xlrrrrf.exe 2808 nntnnb.exe 2748 pvddj.exe 1628 frflrrx.exe 2716 lrfrrxf.exe 2668 5ttttb.exe 2608 pjpvd.exe 3044 rrfflll.exe 1976 1nhhhh.exe 2272 vvjjj.exe 2308 jjpjp.exe 1624 llxrxfl.exe 2672 ttbtbh.exe 2592 djpvd.exe 2924 9xrxllr.exe 2908 bhttbb.exe 1100 hhnhnn.exe 2236 ddppp.exe 2968 rllxxrl.exe 1272 hbnntb.exe 2168 vpjdd.exe 2092 lrxffll.exe 1804 rlfxrrr.exe 2428 bbnnnt.exe 2152 pjvpp.exe 936 xfrrxfr.exe 2404 ffxxxxx.exe 488 nthhnt.exe 1400 jvdvv.exe -
resource yara_rule behavioral1/memory/2540-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-597-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2836-626-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2464 2540 9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe 29 PID 2540 wrote to memory of 2464 2540 9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe 29 PID 2540 wrote to memory of 2464 2540 9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe 29 PID 2540 wrote to memory of 2464 2540 9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe 29 PID 2464 wrote to memory of 2744 2464 rrrfxrr.exe 30 PID 2464 wrote to memory of 2744 2464 rrrfxrr.exe 30 PID 2464 wrote to memory of 2744 2464 rrrfxrr.exe 30 PID 2464 wrote to memory of 2744 2464 rrrfxrr.exe 30 PID 2744 wrote to memory of 2288 2744 jjvvd.exe 31 PID 2744 wrote to memory of 2288 2744 jjvvd.exe 31 PID 2744 wrote to memory of 2288 2744 jjvvd.exe 31 PID 2744 wrote to memory of 2288 2744 jjvvd.exe 31 PID 2288 wrote to memory of 2948 2288 5hnttb.exe 32 PID 2288 wrote to memory of 2948 2288 5hnttb.exe 32 PID 2288 wrote to memory of 2948 2288 5hnttb.exe 32 PID 2288 wrote to memory of 2948 2288 5hnttb.exe 32 PID 2948 wrote to memory of 2860 2948 vvjpj.exe 33 PID 2948 wrote to memory of 2860 2948 vvjpj.exe 33 PID 2948 wrote to memory of 2860 2948 vvjpj.exe 33 PID 2948 wrote to memory of 2860 2948 vvjpj.exe 33 PID 2860 wrote to memory of 1680 2860 bthbbb.exe 34 PID 2860 wrote to memory of 1680 2860 bthbbb.exe 34 PID 2860 wrote to memory of 1680 2860 bthbbb.exe 34 PID 2860 wrote to memory of 1680 2860 bthbbb.exe 34 PID 1680 wrote to memory of 2604 1680 jdvvp.exe 35 PID 1680 wrote to memory of 2604 1680 jdvvp.exe 35 PID 1680 wrote to memory of 2604 1680 jdvvp.exe 35 PID 1680 wrote to memory of 2604 1680 jdvvp.exe 35 PID 2604 wrote to memory of 2768 2604 thnntt.exe 36 PID 2604 wrote to memory of 2768 2604 thnntt.exe 36 PID 2604 wrote to memory of 2768 2604 thnntt.exe 36 PID 2604 wrote to memory of 2768 2604 thnntt.exe 36 PID 2768 wrote to memory of 2224 2768 ddpjj.exe 37 PID 2768 wrote to memory of 2224 2768 ddpjj.exe 37 PID 2768 wrote to memory of 2224 2768 ddpjj.exe 37 PID 2768 wrote to memory of 2224 2768 ddpjj.exe 37 PID 2224 wrote to memory of 2260 2224 1djvv.exe 38 PID 2224 wrote to memory of 2260 2224 1djvv.exe 38 PID 2224 wrote to memory of 2260 2224 1djvv.exe 38 PID 2224 wrote to memory of 2260 2224 1djvv.exe 38 PID 2260 wrote to memory of 2452 2260 5rfxffl.exe 39 PID 2260 wrote to memory of 2452 2260 5rfxffl.exe 39 PID 2260 wrote to memory of 2452 2260 5rfxffl.exe 39 PID 2260 wrote to memory of 2452 2260 5rfxffl.exe 39 PID 2452 wrote to memory of 1676 2452 5jvpp.exe 40 PID 2452 wrote to memory of 1676 2452 5jvpp.exe 40 PID 2452 wrote to memory of 1676 2452 5jvpp.exe 40 PID 2452 wrote to memory of 1676 2452 5jvpp.exe 40 PID 1676 wrote to memory of 1044 1676 rllffff.exe 41 PID 1676 wrote to memory of 1044 1676 rllffff.exe 41 PID 1676 wrote to memory of 1044 1676 rllffff.exe 41 PID 1676 wrote to memory of 1044 1676 rllffff.exe 41 PID 1044 wrote to memory of 2900 1044 jdvjj.exe 42 PID 1044 wrote to memory of 2900 1044 jdvjj.exe 42 PID 1044 wrote to memory of 2900 1044 jdvjj.exe 42 PID 1044 wrote to memory of 2900 1044 jdvjj.exe 42 PID 2900 wrote to memory of 2496 2900 fflllff.exe 43 PID 2900 wrote to memory of 2496 2900 fflllff.exe 43 PID 2900 wrote to memory of 2496 2900 fflllff.exe 43 PID 2900 wrote to memory of 2496 2900 fflllff.exe 43 PID 2496 wrote to memory of 2904 2496 ppddd.exe 44 PID 2496 wrote to memory of 2904 2496 ppddd.exe 44 PID 2496 wrote to memory of 2904 2496 ppddd.exe 44 PID 2496 wrote to memory of 2904 2496 ppddd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe"C:\Users\Admin\AppData\Local\Temp\9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\rrrfxrr.exec:\rrrfxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\jjvvd.exec:\jjvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\5hnttb.exec:\5hnttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\vvjpj.exec:\vvjpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\bthbbb.exec:\bthbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\jdvvp.exec:\jdvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\thnntt.exec:\thnntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\ddpjj.exec:\ddpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\1djvv.exec:\1djvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\5rfxffl.exec:\5rfxffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\5jvpp.exec:\5jvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\rllffff.exec:\rllffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\jdvjj.exec:\jdvjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\fflllff.exec:\fflllff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\ppddd.exec:\ppddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\tntnnn.exec:\tntnnn.exe17⤵
- Executes dropped EXE
PID:2904 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe18⤵
- Executes dropped EXE
PID:1524 -
\??\c:\5bhhbh.exec:\5bhhbh.exe19⤵
- Executes dropped EXE
PID:444 -
\??\c:\7lrxffl.exec:\7lrxffl.exe20⤵
- Executes dropped EXE
PID:544 -
\??\c:\rrxxfll.exec:\rrxxfll.exe21⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jjpjd.exec:\jjpjd.exe22⤵
- Executes dropped EXE
PID:2228 -
\??\c:\llxlrll.exec:\llxlrll.exe23⤵
- Executes dropped EXE
PID:992 -
\??\c:\fflrxfr.exec:\fflrxfr.exe24⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nhnnnn.exec:\nhnnnn.exe25⤵
- Executes dropped EXE
PID:2952 -
\??\c:\7llxlxf.exec:\7llxlxf.exe26⤵
- Executes dropped EXE
PID:236 -
\??\c:\ddjdv.exec:\ddjdv.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1004 -
\??\c:\9xxxxff.exec:\9xxxxff.exe28⤵
- Executes dropped EXE
PID:1788 -
\??\c:\9tntbb.exec:\9tntbb.exe29⤵
- Executes dropped EXE
PID:3060 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe30⤵
- Executes dropped EXE
PID:2156 -
\??\c:\hbhhnh.exec:\hbhhnh.exe31⤵
- Executes dropped EXE
PID:276 -
\??\c:\xxflrxf.exec:\xxflrxf.exe32⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nhtntn.exec:\nhtntn.exe33⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ffrlxxl.exec:\ffrlxxl.exe34⤵
- Executes dropped EXE
PID:1016 -
\??\c:\ttnhbt.exec:\ttnhbt.exe35⤵
- Executes dropped EXE
PID:2464 -
\??\c:\5vpvd.exec:\5vpvd.exe36⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xlrrrrf.exec:\xlrrrrf.exe37⤵
- Executes dropped EXE
PID:2756 -
\??\c:\nntnnb.exec:\nntnnb.exe38⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pvddj.exec:\pvddj.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\frflrrx.exec:\frflrrx.exe40⤵
- Executes dropped EXE
PID:1628 -
\??\c:\lrfrrxf.exec:\lrfrrxf.exe41⤵
- Executes dropped EXE
PID:2716 -
\??\c:\5ttttb.exec:\5ttttb.exe42⤵
- Executes dropped EXE
PID:2668 -
\??\c:\pjpvd.exec:\pjpvd.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rrfflll.exec:\rrfflll.exe44⤵
- Executes dropped EXE
PID:3044 -
\??\c:\1nhhhh.exec:\1nhhhh.exe45⤵
- Executes dropped EXE
PID:1976 -
\??\c:\vvjjj.exec:\vvjjj.exe46⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jjpjp.exec:\jjpjp.exe47⤵
- Executes dropped EXE
PID:2308 -
\??\c:\llxrxfl.exec:\llxrxfl.exe48⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ttbtbh.exec:\ttbtbh.exe49⤵
- Executes dropped EXE
PID:2672 -
\??\c:\djpvd.exec:\djpvd.exe50⤵
- Executes dropped EXE
PID:2592 -
\??\c:\9xrxllr.exec:\9xrxllr.exe51⤵
- Executes dropped EXE
PID:2924 -
\??\c:\bhttbb.exec:\bhttbb.exe52⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hhnhnn.exec:\hhnhnn.exe53⤵
- Executes dropped EXE
PID:1100 -
\??\c:\ddppp.exec:\ddppp.exe54⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rllxxrl.exec:\rllxxrl.exe55⤵
- Executes dropped EXE
PID:2968 -
\??\c:\hbnntb.exec:\hbnntb.exe56⤵
- Executes dropped EXE
PID:1272 -
\??\c:\vpjdd.exec:\vpjdd.exe57⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lrxffll.exec:\lrxffll.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2092 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe59⤵
- Executes dropped EXE
PID:1804 -
\??\c:\bbnnnt.exec:\bbnnnt.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pjvpp.exec:\pjvpp.exe61⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xfrrxfr.exec:\xfrrxfr.exe62⤵
- Executes dropped EXE
PID:936 -
\??\c:\ffxxxxx.exec:\ffxxxxx.exe63⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nthhnt.exec:\nthhnt.exe64⤵
- Executes dropped EXE
PID:488 -
\??\c:\jvdvv.exec:\jvdvv.exe65⤵
- Executes dropped EXE
PID:1400 -
\??\c:\xffllfr.exec:\xffllfr.exe66⤵PID:1744
-
\??\c:\tnnhnh.exec:\tnnhnh.exe67⤵PID:1968
-
\??\c:\dvpdp.exec:\dvpdp.exe68⤵PID:1540
-
\??\c:\rrxrrll.exec:\rrxrrll.exe69⤵PID:928
-
\??\c:\1hthhh.exec:\1hthhh.exe70⤵PID:3056
-
\??\c:\nhhnnt.exec:\nhhnnt.exe71⤵PID:1700
-
\??\c:\vvdvd.exec:\vvdvd.exe72⤵PID:892
-
\??\c:\ffllrxl.exec:\ffllrxl.exe73⤵PID:1604
-
\??\c:\hnbbbb.exec:\hnbbbb.exe74⤵PID:2580
-
\??\c:\9dppv.exec:\9dppv.exe75⤵PID:1592
-
\??\c:\xrrrxxx.exec:\xrrrxxx.exe76⤵PID:1388
-
\??\c:\xflrxlr.exec:\xflrxlr.exe77⤵PID:2824
-
\??\c:\htbttn.exec:\htbttn.exe78⤵PID:2760
-
\??\c:\1vpjp.exec:\1vpjp.exe79⤵PID:2764
-
\??\c:\3rfxrxx.exec:\3rfxrxx.exe80⤵PID:2836
-
\??\c:\tbnnbh.exec:\tbnnbh.exe81⤵PID:2912
-
\??\c:\btbbhh.exec:\btbbhh.exe82⤵PID:1628
-
\??\c:\9vvdj.exec:\9vvdj.exe83⤵PID:2716
-
\??\c:\lflrlrr.exec:\lflrlrr.exe84⤵PID:3024
-
\??\c:\tnbhhh.exec:\tnbhhh.exe85⤵PID:2620
-
\??\c:\pjpjj.exec:\pjpjj.exe86⤵PID:2872
-
\??\c:\3dppv.exec:\3dppv.exe87⤵PID:1976
-
\??\c:\xlfxfrr.exec:\xlfxfrr.exe88⤵PID:2272
-
\??\c:\nthnht.exec:\nthnht.exe89⤵PID:2308
-
\??\c:\pppdd.exec:\pppdd.exe90⤵PID:1504
-
\??\c:\rxffllr.exec:\rxffllr.exe91⤵PID:2584
-
\??\c:\rxlrfrf.exec:\rxlrfrf.exe92⤵PID:2028
-
\??\c:\thttnb.exec:\thttnb.exe93⤵PID:2312
-
\??\c:\jddvd.exec:\jddvd.exe94⤵PID:1612
-
\??\c:\ffrrffl.exec:\ffrrffl.exe95⤵PID:1364
-
\??\c:\1rrlrll.exec:\1rrlrll.exe96⤵PID:2904
-
\??\c:\ntbhht.exec:\ntbhht.exe97⤵PID:1160
-
\??\c:\dvppv.exec:\dvppv.exe98⤵PID:876
-
\??\c:\7pvdj.exec:\7pvdj.exe99⤵PID:2556
-
\??\c:\xlffllx.exec:\xlffllx.exe100⤵PID:2164
-
\??\c:\3ttbnb.exec:\3ttbnb.exe101⤵PID:2240
-
\??\c:\3nttnh.exec:\3nttnh.exe102⤵PID:764
-
\??\c:\jjjvv.exec:\jjjvv.exe103⤵PID:568
-
\??\c:\xxfxxxf.exec:\xxfxxxf.exe104⤵PID:1940
-
\??\c:\3lflrxl.exec:\3lflrxl.exe105⤵PID:2432
-
\??\c:\vpvpp.exec:\vpvpp.exe106⤵PID:1344
-
\??\c:\5vpvd.exec:\5vpvd.exe107⤵PID:2084
-
\??\c:\ffrlrlx.exec:\ffrlrlx.exe108⤵PID:708
-
\??\c:\bnnhnn.exec:\bnnhnn.exe109⤵PID:768
-
\??\c:\9nbtbt.exec:\9nbtbt.exe110⤵PID:2076
-
\??\c:\vdppv.exec:\vdppv.exe111⤵PID:796
-
\??\c:\5fxrxrx.exec:\5fxrxrx.exe112⤵PID:396
-
\??\c:\fxxlffr.exec:\fxxlffr.exe113⤵PID:896
-
\??\c:\hhtttt.exec:\hhtttt.exe114⤵PID:2336
-
\??\c:\vdpdv.exec:\vdpdv.exe115⤵PID:2988
-
\??\c:\1pdvv.exec:\1pdvv.exe116⤵PID:1832
-
\??\c:\xxllflr.exec:\xxllflr.exe117⤵PID:2300
-
\??\c:\1frrrxx.exec:\1frrrxx.exe118⤵PID:2820
-
\??\c:\nhnhnb.exec:\nhnhnb.exe119⤵PID:2960
-
\??\c:\jdvvj.exec:\jdvvj.exe120⤵PID:2868
-
\??\c:\vdddj.exec:\vdddj.exe121⤵PID:2760
-
\??\c:\lfrlrff.exec:\lfrlrff.exe122⤵PID:2884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-