Analysis
-
max time kernel
120s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 08:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
674012981fad2bc064d375f742249df0N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
674012981fad2bc064d375f742249df0N.exe
-
Size
95KB
-
MD5
674012981fad2bc064d375f742249df0
-
SHA1
cc0f4761bc0584ea1e8e361bce3090b7906117f8
-
SHA256
c9b0ad4228430de42ee2519188e2619204131120e5e379f1310ad96259cfa4dc
-
SHA512
36dd2b05f5b4b8e8f88e21afd3d3cc1e2443a808e3f5f9a701363a4103f9db9cf9104b319c92e2d378f0ba5631a8562790624e0a49987c3bb4d38086320ce1f7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzac0Hobv0byLufTJfJvWWpx:ymb3NkkiQ3mdBjFodt27HobvcyLufNf7
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4436-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2036 rrxxfff.exe 1440 5flfxxx.exe 1268 htbtnn.exe 1724 7ppjd.exe 1104 5lllffx.exe 4092 lxfxxrr.exe 2084 bhbbth.exe 2944 ddjdv.exe 1616 xxlfxfx.exe 1400 9xrrlrl.exe 5016 nnnhbb.exe 5008 dvjdp.exe 3808 jvvjd.exe 2592 xrrrllr.exe 4452 bnnnhh.exe 628 vjppj.exe 4176 pdppj.exe 4448 lrxrlxx.exe 3268 tntnnh.exe 4544 3jvpp.exe 3508 ffxrxxf.exe 4892 7rxrllf.exe 2704 pppjj.exe 2476 1rxlxxx.exe 3368 3bbbbb.exe 4468 djjdv.exe 3516 dvjdj.exe 5116 flfxffl.exe 4040 bnntbh.exe 2164 3dvvd.exe 1100 pvpvj.exe 388 rxfffff.exe 3800 xrrlfxl.exe 4004 7ntnhn.exe 1896 hhnhbh.exe 4816 7vjdv.exe 4172 fllrffr.exe 4728 htbtnn.exe 4120 pvvvd.exe 2036 ddjjd.exe 5036 lfffrrl.exe 1008 hhnntn.exe 4248 ttnnhh.exe 1724 pvppd.exe 856 jdjdv.exe 948 fxlfxrr.exe 4552 5ntnhb.exe 344 3tbnhh.exe 3980 pjjdv.exe 4104 vdjdd.exe 4060 rrrlxxx.exe 772 lflllfl.exe 4268 tbtnhh.exe 2440 nhthbt.exe 4832 7jpdp.exe 4932 7jddv.exe 2028 lfxrlxr.exe 3684 rrfxlll.exe 4588 rlrfxff.exe 3124 hthbhh.exe 1812 hhhbnn.exe 4996 djpvj.exe 3188 pjpjj.exe 1628 1xffllr.exe -
resource yara_rule behavioral2/memory/4436-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4436 wrote to memory of 2036 4436 674012981fad2bc064d375f742249df0N.exe 83 PID 4436 wrote to memory of 2036 4436 674012981fad2bc064d375f742249df0N.exe 83 PID 4436 wrote to memory of 2036 4436 674012981fad2bc064d375f742249df0N.exe 83 PID 2036 wrote to memory of 1440 2036 rrxxfff.exe 84 PID 2036 wrote to memory of 1440 2036 rrxxfff.exe 84 PID 2036 wrote to memory of 1440 2036 rrxxfff.exe 84 PID 1440 wrote to memory of 1268 1440 5flfxxx.exe 85 PID 1440 wrote to memory of 1268 1440 5flfxxx.exe 85 PID 1440 wrote to memory of 1268 1440 5flfxxx.exe 85 PID 1268 wrote to memory of 1724 1268 htbtnn.exe 86 PID 1268 wrote to memory of 1724 1268 htbtnn.exe 86 PID 1268 wrote to memory of 1724 1268 htbtnn.exe 86 PID 1724 wrote to memory of 1104 1724 7ppjd.exe 87 PID 1724 wrote to memory of 1104 1724 7ppjd.exe 87 PID 1724 wrote to memory of 1104 1724 7ppjd.exe 87 PID 1104 wrote to memory of 4092 1104 5lllffx.exe 88 PID 1104 wrote to memory of 4092 1104 5lllffx.exe 88 PID 1104 wrote to memory of 4092 1104 5lllffx.exe 88 PID 4092 wrote to memory of 2084 4092 lxfxxrr.exe 89 PID 4092 wrote to memory of 2084 4092 lxfxxrr.exe 89 PID 4092 wrote to memory of 2084 4092 lxfxxrr.exe 89 PID 2084 wrote to memory of 2944 2084 bhbbth.exe 90 PID 2084 wrote to memory of 2944 2084 bhbbth.exe 90 PID 2084 wrote to memory of 2944 2084 bhbbth.exe 90 PID 2944 wrote to memory of 1616 2944 ddjdv.exe 91 PID 2944 wrote to memory of 1616 2944 ddjdv.exe 91 PID 2944 wrote to memory of 1616 2944 ddjdv.exe 91 PID 1616 wrote to memory of 1400 1616 xxlfxfx.exe 92 PID 1616 wrote to memory of 1400 1616 xxlfxfx.exe 92 PID 1616 wrote to memory of 1400 1616 xxlfxfx.exe 92 PID 1400 wrote to memory of 5016 1400 9xrrlrl.exe 93 PID 1400 wrote to memory of 5016 1400 9xrrlrl.exe 93 PID 1400 wrote to memory of 5016 1400 9xrrlrl.exe 93 PID 5016 wrote to memory of 5008 5016 nnnhbb.exe 94 PID 5016 wrote to memory of 5008 5016 nnnhbb.exe 94 PID 5016 wrote to memory of 5008 5016 nnnhbb.exe 94 PID 5008 wrote to memory of 3808 5008 dvjdp.exe 95 PID 5008 wrote to memory of 3808 5008 dvjdp.exe 95 PID 5008 wrote to memory of 3808 5008 dvjdp.exe 95 PID 3808 wrote to memory of 2592 3808 jvvjd.exe 96 PID 3808 wrote to memory of 2592 3808 jvvjd.exe 96 PID 3808 wrote to memory of 2592 3808 jvvjd.exe 96 PID 2592 wrote to memory of 4452 2592 xrrrllr.exe 97 PID 2592 wrote to memory of 4452 2592 xrrrllr.exe 97 PID 2592 wrote to memory of 4452 2592 xrrrllr.exe 97 PID 4452 wrote to memory of 628 4452 bnnnhh.exe 98 PID 4452 wrote to memory of 628 4452 bnnnhh.exe 98 PID 4452 wrote to memory of 628 4452 bnnnhh.exe 98 PID 628 wrote to memory of 4176 628 vjppj.exe 99 PID 628 wrote to memory of 4176 628 vjppj.exe 99 PID 628 wrote to memory of 4176 628 vjppj.exe 99 PID 4176 wrote to memory of 4448 4176 pdppj.exe 101 PID 4176 wrote to memory of 4448 4176 pdppj.exe 101 PID 4176 wrote to memory of 4448 4176 pdppj.exe 101 PID 4448 wrote to memory of 3268 4448 lrxrlxx.exe 102 PID 4448 wrote to memory of 3268 4448 lrxrlxx.exe 102 PID 4448 wrote to memory of 3268 4448 lrxrlxx.exe 102 PID 3268 wrote to memory of 4544 3268 tntnnh.exe 103 PID 3268 wrote to memory of 4544 3268 tntnnh.exe 103 PID 3268 wrote to memory of 4544 3268 tntnnh.exe 103 PID 4544 wrote to memory of 3508 4544 3jvpp.exe 104 PID 4544 wrote to memory of 3508 4544 3jvpp.exe 104 PID 4544 wrote to memory of 3508 4544 3jvpp.exe 104 PID 3508 wrote to memory of 4892 3508 ffxrxxf.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\674012981fad2bc064d375f742249df0N.exe"C:\Users\Admin\AppData\Local\Temp\674012981fad2bc064d375f742249df0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\rrxxfff.exec:\rrxxfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\5flfxxx.exec:\5flfxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\htbtnn.exec:\htbtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\7ppjd.exec:\7ppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\5lllffx.exec:\5lllffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\lxfxxrr.exec:\lxfxxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\bhbbth.exec:\bhbbth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\ddjdv.exec:\ddjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\xxlfxfx.exec:\xxlfxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\9xrrlrl.exec:\9xrrlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\nnnhbb.exec:\nnnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\dvjdp.exec:\dvjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\jvvjd.exec:\jvvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\xrrrllr.exec:\xrrrllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\bnnnhh.exec:\bnnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\vjppj.exec:\vjppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\pdppj.exec:\pdppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\lrxrlxx.exec:\lrxrlxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\tntnnh.exec:\tntnnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\3jvpp.exec:\3jvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\ffxrxxf.exec:\ffxrxxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\7rxrllf.exec:\7rxrllf.exe23⤵
- Executes dropped EXE
PID:4892 -
\??\c:\pppjj.exec:\pppjj.exe24⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1rxlxxx.exec:\1rxlxxx.exe25⤵
- Executes dropped EXE
PID:2476 -
\??\c:\3bbbbb.exec:\3bbbbb.exe26⤵
- Executes dropped EXE
PID:3368 -
\??\c:\djjdv.exec:\djjdv.exe27⤵
- Executes dropped EXE
PID:4468 -
\??\c:\dvjdj.exec:\dvjdj.exe28⤵
- Executes dropped EXE
PID:3516 -
\??\c:\flfxffl.exec:\flfxffl.exe29⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bnntbh.exec:\bnntbh.exe30⤵
- Executes dropped EXE
PID:4040 -
\??\c:\3dvvd.exec:\3dvvd.exe31⤵
- Executes dropped EXE
PID:2164 -
\??\c:\pvpvj.exec:\pvpvj.exe32⤵
- Executes dropped EXE
PID:1100 -
\??\c:\rxfffff.exec:\rxfffff.exe33⤵
- Executes dropped EXE
PID:388 -
\??\c:\xrrlfxl.exec:\xrrlfxl.exe34⤵
- Executes dropped EXE
PID:3800 -
\??\c:\7ntnhn.exec:\7ntnhn.exe35⤵
- Executes dropped EXE
PID:4004 -
\??\c:\hhnhbh.exec:\hhnhbh.exe36⤵
- Executes dropped EXE
PID:1896 -
\??\c:\7vjdv.exec:\7vjdv.exe37⤵
- Executes dropped EXE
PID:4816 -
\??\c:\fllrffr.exec:\fllrffr.exe38⤵
- Executes dropped EXE
PID:4172 -
\??\c:\htbtnn.exec:\htbtnn.exe39⤵
- Executes dropped EXE
PID:4728 -
\??\c:\tnnhbb.exec:\tnnhbb.exe40⤵PID:4256
-
\??\c:\pvvvd.exec:\pvvvd.exe41⤵
- Executes dropped EXE
PID:4120 -
\??\c:\ddjjd.exec:\ddjjd.exe42⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lfffrrl.exec:\lfffrrl.exe43⤵
- Executes dropped EXE
PID:5036 -
\??\c:\hhnntn.exec:\hhnntn.exe44⤵
- Executes dropped EXE
PID:1008 -
\??\c:\ttnnhh.exec:\ttnnhh.exe45⤵
- Executes dropped EXE
PID:4248 -
\??\c:\pvppd.exec:\pvppd.exe46⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jdjdv.exec:\jdjdv.exe47⤵
- Executes dropped EXE
PID:856 -
\??\c:\fxlfxrr.exec:\fxlfxrr.exe48⤵
- Executes dropped EXE
PID:948 -
\??\c:\5ntnhb.exec:\5ntnhb.exe49⤵
- Executes dropped EXE
PID:4552 -
\??\c:\3tbnhh.exec:\3tbnhh.exe50⤵
- Executes dropped EXE
PID:344 -
\??\c:\pjjdv.exec:\pjjdv.exe51⤵
- Executes dropped EXE
PID:3980 -
\??\c:\vdjdd.exec:\vdjdd.exe52⤵
- Executes dropped EXE
PID:4104 -
\??\c:\rrrlxxx.exec:\rrrlxxx.exe53⤵
- Executes dropped EXE
PID:4060 -
\??\c:\lflllfl.exec:\lflllfl.exe54⤵
- Executes dropped EXE
PID:772 -
\??\c:\tbtnhh.exec:\tbtnhh.exe55⤵
- Executes dropped EXE
PID:4268 -
\??\c:\nhthbt.exec:\nhthbt.exe56⤵
- Executes dropped EXE
PID:2440 -
\??\c:\7jpdp.exec:\7jpdp.exe57⤵
- Executes dropped EXE
PID:4832 -
\??\c:\7jddv.exec:\7jddv.exe58⤵
- Executes dropped EXE
PID:4932 -
\??\c:\lfxrlxr.exec:\lfxrlxr.exe59⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rrfxlll.exec:\rrfxlll.exe60⤵
- Executes dropped EXE
PID:3684 -
\??\c:\rlrfxff.exec:\rlrfxff.exe61⤵
- Executes dropped EXE
PID:4588 -
\??\c:\hthbhh.exec:\hthbhh.exe62⤵
- Executes dropped EXE
PID:3124 -
\??\c:\hhhbnn.exec:\hhhbnn.exe63⤵
- Executes dropped EXE
PID:1812 -
\??\c:\djpvj.exec:\djpvj.exe64⤵
- Executes dropped EXE
PID:4996 -
\??\c:\pjpjj.exec:\pjpjj.exe65⤵
- Executes dropped EXE
PID:3188 -
\??\c:\1xffllr.exec:\1xffllr.exe66⤵
- Executes dropped EXE
PID:1628 -
\??\c:\9xffxrl.exec:\9xffxrl.exe67⤵PID:5076
-
\??\c:\5tbnnn.exec:\5tbnnn.exe68⤵PID:2000
-
\??\c:\jppvp.exec:\jppvp.exe69⤵PID:3168
-
\??\c:\jdvjp.exec:\jdvjp.exe70⤵PID:3636
-
\??\c:\lfffrlf.exec:\lfffrlf.exe71⤵PID:404
-
\??\c:\frrlllf.exec:\frrlllf.exe72⤵PID:4700
-
\??\c:\lrrlxff.exec:\lrrlxff.exe73⤵PID:1856
-
\??\c:\bbhbtn.exec:\bbhbtn.exe74⤵PID:2216
-
\??\c:\3ntnnn.exec:\3ntnnn.exe75⤵PID:2380
-
\??\c:\jdjjd.exec:\jdjjd.exe76⤵PID:2056
-
\??\c:\xllrrrl.exec:\xllrrrl.exe77⤵PID:748
-
\??\c:\5ntnbb.exec:\5ntnbb.exe78⤵PID:1916
-
\??\c:\bthbtn.exec:\bthbtn.exe79⤵PID:4568
-
\??\c:\3jdvj.exec:\3jdvj.exe80⤵PID:1828
-
\??\c:\fxrrxrx.exec:\fxrrxrx.exe81⤵PID:2016
-
\??\c:\hbtntt.exec:\hbtntt.exe82⤵PID:3616
-
\??\c:\djppp.exec:\djppp.exe83⤵PID:3944
-
\??\c:\3xxlfff.exec:\3xxlfff.exe84⤵PID:3712
-
\??\c:\bhnhbb.exec:\bhnhbb.exe85⤵PID:3020
-
\??\c:\bnthnn.exec:\bnthnn.exe86⤵PID:4352
-
\??\c:\pvpdv.exec:\pvpdv.exe87⤵PID:1520
-
\??\c:\vjpjd.exec:\vjpjd.exe88⤵PID:1220
-
\??\c:\xxffffx.exec:\xxffffx.exe89⤵PID:1440
-
\??\c:\lxfffxx.exec:\lxfffxx.exe90⤵PID:4180
-
\??\c:\hhhhnn.exec:\hhhhnn.exe91⤵PID:4512
-
\??\c:\dvjdj.exec:\dvjdj.exe92⤵PID:4504
-
\??\c:\9pjjd.exec:\9pjjd.exe93⤵PID:3452
-
\??\c:\7jjjd.exec:\7jjjd.exe94⤵PID:3008
-
\??\c:\lxlfrrl.exec:\lxlfrrl.exe95⤵PID:3776
-
\??\c:\7rffxrl.exec:\7rffxrl.exe96⤵PID:5020
-
\??\c:\hnbtnn.exec:\hnbtnn.exe97⤵PID:3648
-
\??\c:\bbnhbb.exec:\bbnhbb.exe98⤵PID:212
-
\??\c:\pdpjp.exec:\pdpjp.exe99⤵PID:4100
-
\??\c:\vdvdp.exec:\vdvdp.exe100⤵PID:3752
-
\??\c:\rxrfflx.exec:\rxrfflx.exe101⤵PID:2784
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe102⤵PID:772
-
\??\c:\bhbbtt.exec:\bhbbtt.exe103⤵PID:3852
-
\??\c:\5nbttt.exec:\5nbttt.exe104⤵PID:1764
-
\??\c:\djpdv.exec:\djpdv.exe105⤵PID:4684
-
\??\c:\vdjdd.exec:\vdjdd.exe106⤵PID:4632
-
\??\c:\7rrrlxr.exec:\7rrrlxr.exe107⤵PID:3040
-
\??\c:\ttbnnn.exec:\ttbnnn.exe108⤵PID:2260
-
\??\c:\bbbhnn.exec:\bbbhnn.exe109⤵PID:4020
-
\??\c:\nnntbh.exec:\nnntbh.exe110⤵PID:1644
-
\??\c:\vpjjd.exec:\vpjjd.exe111⤵PID:464
-
\??\c:\3xllfff.exec:\3xllfff.exe112⤵PID:1480
-
\??\c:\xrxrrxr.exec:\xrxrrxr.exe113⤵PID:3512
-
\??\c:\btntbn.exec:\btntbn.exe114⤵PID:3508
-
\??\c:\tnbbhn.exec:\tnbbhn.exe115⤵PID:3264
-
\??\c:\jvjjp.exec:\jvjjp.exe116⤵PID:2000
-
\??\c:\jvdvv.exec:\jvdvv.exe117⤵PID:4376
-
\??\c:\lrrrlfl.exec:\lrrrlfl.exe118⤵PID:3636
-
\??\c:\tttttn.exec:\tttttn.exe119⤵PID:2476
-
\??\c:\1tnbtn.exec:\1tnbtn.exe120⤵PID:552
-
\??\c:\ddpjj.exec:\ddpjj.exe121⤵PID:2472
-
\??\c:\dvppp.exec:\dvppp.exe122⤵PID:1240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-