Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30-09-2024 21:32
Static task
static1
Behavioral task
behavioral1
Sample
4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432N.exe
Resource
win7-20240708-en
General
-
Target
4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432N.exe
-
Size
82KB
-
MD5
cad9e2ef30454c6c517c644bc66b4890
-
SHA1
3ab06317d32cf3b122548bc0c4cf5f1486c7417c
-
SHA256
4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432
-
SHA512
744b68fcd5ee17512e9f2fc6dacdc766c058dda6657b63f023dfdcd493b82eedd168943033166a9fcf8909b90bf4f35d134f9d7d95f4b4c85cb958c2cc3a1de3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QIj:ymb3NkkiQ3mdBjFIIp9L9QrrA8rj
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/3968-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/724-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/312-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/336-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3724 pdjdd.exe 3968 1jpjd.exe 404 fxlllrx.exe 4984 xrrrrrr.exe 5084 5tbbbb.exe 3232 9frlffl.exe 4260 lrlxlfr.exe 1340 ntnhtn.exe 216 jppdj.exe 2040 rxxrlxr.exe 3004 pdppp.exe 312 1jjvd.exe 768 xrrllfx.exe 2168 hthnbh.exe 3224 bnhtnb.exe 4044 7jjdj.exe 1960 djdvj.exe 2632 rxxrfxf.exe 1456 frrllfx.exe 336 3pjdp.exe 2576 rflfrrl.exe 812 9tnhth.exe 1828 1vvjp.exe 368 rfxrrlf.exe 2380 lffxxrx.exe 736 bththh.exe 4000 5pvjv.exe 2244 vjpjv.exe 3544 7rrfxrx.exe 232 nbtttt.exe 3620 9nnhtt.exe 676 tnbthh.exe 2712 vjpjd.exe 4220 lrxlrlf.exe 4348 ttbtnh.exe 728 1nnhbt.exe 4648 pjvpd.exe 5044 lfxlxlx.exe 2384 htntnh.exe 4476 dpdpd.exe 4368 lxrlfxr.exe 2480 ttttnn.exe 3708 btbntn.exe 2056 pjppd.exe 2660 ffxrxxr.exe 3972 7xfflxr.exe 4760 hnnhtn.exe 1156 7vddp.exe 4860 jdpdj.exe 2400 3frfrfr.exe 3772 frrllff.exe 4652 bttttn.exe 4728 jdjvj.exe 1060 djpjd.exe 4692 xlxfxff.exe 2428 fxlfrlf.exe 700 bhbtht.exe 2040 htnhnh.exe 1036 jvdvj.exe 1136 7lrlllx.exe 2184 lrrfxrf.exe 4400 nhtnth.exe 2168 ntthnb.exe 1424 dpdvv.exe -
resource yara_rule behavioral2/memory/724-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/724-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/336-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 724 wrote to memory of 3724 724 4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432N.exe 82 PID 724 wrote to memory of 3724 724 4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432N.exe 82 PID 724 wrote to memory of 3724 724 4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432N.exe 82 PID 3724 wrote to memory of 3968 3724 pdjdd.exe 83 PID 3724 wrote to memory of 3968 3724 pdjdd.exe 83 PID 3724 wrote to memory of 3968 3724 pdjdd.exe 83 PID 3968 wrote to memory of 404 3968 1jpjd.exe 84 PID 3968 wrote to memory of 404 3968 1jpjd.exe 84 PID 3968 wrote to memory of 404 3968 1jpjd.exe 84 PID 404 wrote to memory of 4984 404 fxlllrx.exe 85 PID 404 wrote to memory of 4984 404 fxlllrx.exe 85 PID 404 wrote to memory of 4984 404 fxlllrx.exe 85 PID 4984 wrote to memory of 5084 4984 xrrrrrr.exe 86 PID 4984 wrote to memory of 5084 4984 xrrrrrr.exe 86 PID 4984 wrote to memory of 5084 4984 xrrrrrr.exe 86 PID 5084 wrote to memory of 3232 5084 5tbbbb.exe 87 PID 5084 wrote to memory of 3232 5084 5tbbbb.exe 87 PID 5084 wrote to memory of 3232 5084 5tbbbb.exe 87 PID 3232 wrote to memory of 4260 3232 9frlffl.exe 88 PID 3232 wrote to memory of 4260 3232 9frlffl.exe 88 PID 3232 wrote to memory of 4260 3232 9frlffl.exe 88 PID 4260 wrote to memory of 1340 4260 lrlxlfr.exe 89 PID 4260 wrote to memory of 1340 4260 lrlxlfr.exe 89 PID 4260 wrote to memory of 1340 4260 lrlxlfr.exe 89 PID 1340 wrote to memory of 216 1340 ntnhtn.exe 90 PID 1340 wrote to memory of 216 1340 ntnhtn.exe 90 PID 1340 wrote to memory of 216 1340 ntnhtn.exe 90 PID 216 wrote to memory of 2040 216 jppdj.exe 91 PID 216 wrote to memory of 2040 216 jppdj.exe 91 PID 216 wrote to memory of 2040 216 jppdj.exe 91 PID 2040 wrote to memory of 3004 2040 rxxrlxr.exe 92 PID 2040 wrote to memory of 3004 2040 rxxrlxr.exe 92 PID 2040 wrote to memory of 3004 2040 rxxrlxr.exe 92 PID 3004 wrote to memory of 312 3004 pdppp.exe 93 PID 3004 wrote to memory of 312 3004 pdppp.exe 93 PID 3004 wrote to memory of 312 3004 pdppp.exe 93 PID 312 wrote to memory of 768 312 1jjvd.exe 94 PID 312 wrote to memory of 768 312 1jjvd.exe 94 PID 312 wrote to memory of 768 312 1jjvd.exe 94 PID 768 wrote to memory of 2168 768 xrrllfx.exe 95 PID 768 wrote to memory of 2168 768 xrrllfx.exe 95 PID 768 wrote to memory of 2168 768 xrrllfx.exe 95 PID 2168 wrote to memory of 3224 2168 hthnbh.exe 96 PID 2168 wrote to memory of 3224 2168 hthnbh.exe 96 PID 2168 wrote to memory of 3224 2168 hthnbh.exe 96 PID 3224 wrote to memory of 4044 3224 bnhtnb.exe 97 PID 3224 wrote to memory of 4044 3224 bnhtnb.exe 97 PID 3224 wrote to memory of 4044 3224 bnhtnb.exe 97 PID 4044 wrote to memory of 1960 4044 7jjdj.exe 98 PID 4044 wrote to memory of 1960 4044 7jjdj.exe 98 PID 4044 wrote to memory of 1960 4044 7jjdj.exe 98 PID 1960 wrote to memory of 2632 1960 djdvj.exe 99 PID 1960 wrote to memory of 2632 1960 djdvj.exe 99 PID 1960 wrote to memory of 2632 1960 djdvj.exe 99 PID 2632 wrote to memory of 1456 2632 rxxrfxf.exe 100 PID 2632 wrote to memory of 1456 2632 rxxrfxf.exe 100 PID 2632 wrote to memory of 1456 2632 rxxrfxf.exe 100 PID 1456 wrote to memory of 336 1456 frrllfx.exe 101 PID 1456 wrote to memory of 336 1456 frrllfx.exe 101 PID 1456 wrote to memory of 336 1456 frrllfx.exe 101 PID 336 wrote to memory of 2576 336 3pjdp.exe 102 PID 336 wrote to memory of 2576 336 3pjdp.exe 102 PID 336 wrote to memory of 2576 336 3pjdp.exe 102 PID 2576 wrote to memory of 812 2576 rflfrrl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432N.exe"C:\Users\Admin\AppData\Local\Temp\4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:724 -
\??\c:\pdjdd.exec:\pdjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\1jpjd.exec:\1jpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\fxlllrx.exec:\fxlllrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\5tbbbb.exec:\5tbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\9frlffl.exec:\9frlffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\lrlxlfr.exec:\lrlxlfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\ntnhtn.exec:\ntnhtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\jppdj.exec:\jppdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\rxxrlxr.exec:\rxxrlxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\pdppp.exec:\pdppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\1jjvd.exec:\1jjvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\xrrllfx.exec:\xrrllfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\hthnbh.exec:\hthnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\bnhtnb.exec:\bnhtnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\7jjdj.exec:\7jjdj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\djdvj.exec:\djdvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\rxxrfxf.exec:\rxxrfxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\frrllfx.exec:\frrllfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\3pjdp.exec:\3pjdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\rflfrrl.exec:\rflfrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\9tnhth.exec:\9tnhth.exe23⤵
- Executes dropped EXE
PID:812 -
\??\c:\1vvjp.exec:\1vvjp.exe24⤵
- Executes dropped EXE
PID:1828 -
\??\c:\rfxrrlf.exec:\rfxrrlf.exe25⤵
- Executes dropped EXE
PID:368 -
\??\c:\lffxxrx.exec:\lffxxrx.exe26⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bththh.exec:\bththh.exe27⤵
- Executes dropped EXE
PID:736 -
\??\c:\5pvjv.exec:\5pvjv.exe28⤵
- Executes dropped EXE
PID:4000 -
\??\c:\vjpjv.exec:\vjpjv.exe29⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7rrfxrx.exec:\7rrfxrx.exe30⤵
- Executes dropped EXE
PID:3544 -
\??\c:\nbtttt.exec:\nbtttt.exe31⤵
- Executes dropped EXE
PID:232 -
\??\c:\9nnhtt.exec:\9nnhtt.exe32⤵
- Executes dropped EXE
PID:3620 -
\??\c:\tnbthh.exec:\tnbthh.exe33⤵
- Executes dropped EXE
PID:676 -
\??\c:\vjpjd.exec:\vjpjd.exe34⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lrxlrlf.exec:\lrxlrlf.exe35⤵
- Executes dropped EXE
PID:4220 -
\??\c:\ttbtnh.exec:\ttbtnh.exe36⤵
- Executes dropped EXE
PID:4348 -
\??\c:\1nnhbt.exec:\1nnhbt.exe37⤵
- Executes dropped EXE
PID:728 -
\??\c:\pjvpd.exec:\pjvpd.exe38⤵
- Executes dropped EXE
PID:4648 -
\??\c:\lfxlxlx.exec:\lfxlxlx.exe39⤵
- Executes dropped EXE
PID:5044 -
\??\c:\htntnh.exec:\htntnh.exe40⤵
- Executes dropped EXE
PID:2384 -
\??\c:\dpdpd.exec:\dpdpd.exe41⤵
- Executes dropped EXE
PID:4476 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe42⤵
- Executes dropped EXE
PID:4368 -
\??\c:\ttttnn.exec:\ttttnn.exe43⤵
- Executes dropped EXE
PID:2480 -
\??\c:\btbntn.exec:\btbntn.exe44⤵
- Executes dropped EXE
PID:3708 -
\??\c:\pjppd.exec:\pjppd.exe45⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ffxrxxr.exec:\ffxrxxr.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2660 -
\??\c:\7xfflxr.exec:\7xfflxr.exe47⤵
- Executes dropped EXE
PID:3972 -
\??\c:\hnnhtn.exec:\hnnhtn.exe48⤵
- Executes dropped EXE
PID:4760 -
\??\c:\7vddp.exec:\7vddp.exe49⤵
- Executes dropped EXE
PID:1156 -
\??\c:\jdpdj.exec:\jdpdj.exe50⤵
- Executes dropped EXE
PID:4860 -
\??\c:\3frfrfr.exec:\3frfrfr.exe51⤵
- Executes dropped EXE
PID:2400 -
\??\c:\frrllff.exec:\frrllff.exe52⤵
- Executes dropped EXE
PID:3772 -
\??\c:\bttttn.exec:\bttttn.exe53⤵
- Executes dropped EXE
PID:4652 -
\??\c:\jdjvj.exec:\jdjvj.exe54⤵
- Executes dropped EXE
PID:4728 -
\??\c:\djpjd.exec:\djpjd.exe55⤵
- Executes dropped EXE
PID:1060 -
\??\c:\xlxfxff.exec:\xlxfxff.exe56⤵
- Executes dropped EXE
PID:4692 -
\??\c:\fxlfrlf.exec:\fxlfrlf.exe57⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bhbtht.exec:\bhbtht.exe58⤵
- Executes dropped EXE
PID:700 -
\??\c:\htnhnh.exec:\htnhnh.exe59⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jvdvj.exec:\jvdvj.exe60⤵
- Executes dropped EXE
PID:1036 -
\??\c:\7lrlllx.exec:\7lrlllx.exe61⤵
- Executes dropped EXE
PID:1136 -
\??\c:\lrrfxrf.exec:\lrrfxrf.exe62⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nhtnth.exec:\nhtnth.exe63⤵
- Executes dropped EXE
PID:4400 -
\??\c:\ntthnb.exec:\ntthnb.exe64⤵
- Executes dropped EXE
PID:2168 -
\??\c:\dpdvv.exec:\dpdvv.exe65⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ddpdp.exec:\ddpdp.exe66⤵PID:2180
-
\??\c:\xlfxrll.exec:\xlfxrll.exe67⤵PID:2984
-
\??\c:\vpvvj.exec:\vpvvj.exe68⤵PID:1396
-
\??\c:\lfrlllr.exec:\lfrlllr.exe69⤵PID:4980
-
\??\c:\rrrlxlf.exec:\rrrlxlf.exe70⤵PID:1456
-
\??\c:\nbnbbt.exec:\nbnbbt.exe71⤵PID:5080
-
\??\c:\htttnn.exec:\htttnn.exe72⤵PID:2152
-
\??\c:\jvjvj.exec:\jvjvj.exe73⤵PID:1468
-
\??\c:\1xxfrfr.exec:\1xxfrfr.exe74⤵PID:552
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe75⤵PID:2128
-
\??\c:\thhhnh.exec:\thhhnh.exe76⤵PID:3284
-
\??\c:\tnhtbt.exec:\tnhtbt.exe77⤵PID:3452
-
\??\c:\pdjjv.exec:\pdjjv.exe78⤵PID:1412
-
\??\c:\pjdpd.exec:\pjdpd.exe79⤵PID:3500
-
\??\c:\lfllllr.exec:\lfllllr.exe80⤵PID:440
-
\??\c:\1llfrlx.exec:\1llfrlx.exe81⤵PID:840
-
\??\c:\hbtbth.exec:\hbtbth.exe82⤵PID:1292
-
\??\c:\vvdpd.exec:\vvdpd.exe83⤵PID:232
-
\??\c:\dppjp.exec:\dppjp.exe84⤵PID:3720
-
\??\c:\1xrlrlf.exec:\1xrlrlf.exe85⤵PID:2236
-
\??\c:\rfxxlrl.exec:\rfxxlrl.exe86⤵PID:468
-
\??\c:\ntbbnh.exec:\ntbbnh.exe87⤵PID:960
-
\??\c:\1btthh.exec:\1btthh.exe88⤵PID:2712
-
\??\c:\vjvpv.exec:\vjvpv.exe89⤵PID:4060
-
\??\c:\dppjp.exec:\dppjp.exe90⤵PID:4204
-
\??\c:\lffxllf.exec:\lffxllf.exe91⤵PID:860
-
\??\c:\1xxlxxl.exec:\1xxlxxl.exe92⤵PID:1644
-
\??\c:\tbbthb.exec:\tbbthb.exe93⤵PID:4480
-
\??\c:\nbhhhh.exec:\nbhhhh.exe94⤵PID:5096
-
\??\c:\vpjvp.exec:\vpjvp.exe95⤵PID:4936
-
\??\c:\rfxlxlx.exec:\rfxlxlx.exe96⤵PID:3032
-
\??\c:\fxxrrlr.exec:\fxxrrlr.exe97⤵PID:396
-
\??\c:\htnhtn.exec:\htnhtn.exe98⤵PID:3652
-
\??\c:\bnnhbt.exec:\bnnhbt.exe99⤵PID:3724
-
\??\c:\ddddj.exec:\ddddj.exe100⤵PID:4388
-
\??\c:\1vjvj.exec:\1vjvj.exe101⤵PID:3968
-
\??\c:\7lxrllf.exec:\7lxrllf.exe102⤵PID:2672
-
\??\c:\lffrlfx.exec:\lffrlfx.exe103⤵PID:4040
-
\??\c:\hbbbhh.exec:\hbbbhh.exe104⤵PID:996
-
\??\c:\jpvjd.exec:\jpvjd.exe105⤵PID:3088
-
\??\c:\dpjdp.exec:\dpjdp.exe106⤵PID:1592
-
\??\c:\9rxfxlf.exec:\9rxfxlf.exe107⤵PID:3232
-
\??\c:\lrlxfxl.exec:\lrlxfxl.exe108⤵PID:1416
-
\??\c:\tbbbtt.exec:\tbbbtt.exe109⤵PID:3256
-
\??\c:\nttnbb.exec:\nttnbb.exe110⤵PID:412
-
\??\c:\vdvjp.exec:\vdvjp.exe111⤵PID:5088
-
\??\c:\vjvjv.exec:\vjvjv.exe112⤵PID:1520
-
\??\c:\xlfrfrf.exec:\xlfrfrf.exe113⤵PID:2736
-
\??\c:\9xfxrlf.exec:\9xfxrlf.exe114⤵PID:1720
-
\??\c:\9bbnbb.exec:\9bbnbb.exe115⤵PID:4744
-
\??\c:\htbhbt.exec:\htbhbt.exe116⤵PID:3640
-
\??\c:\pvvpv.exec:\pvvpv.exe117⤵PID:2996
-
\??\c:\dppdj.exec:\dppdj.exe118⤵PID:1636
-
\??\c:\lffxxrx.exec:\lffxxrx.exe119⤵PID:3752
-
\??\c:\tntbtn.exec:\tntbtn.exe120⤵PID:1152
-
\??\c:\xlxfxrf.exec:\xlxfxrf.exe121⤵PID:2276
-
\??\c:\htnhbb.exec:\htnhbb.exe122⤵PID:1724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-