Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 11:22
Static task
static1
Behavioral task
behavioral1
Sample
ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe
Resource
win7-20240903-en
General
-
Target
ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe
-
Size
75KB
-
MD5
f0985b9122826e1f02a9b5c048e6eee4
-
SHA1
78296346200467974c34120e7d6ea37842c079c1
-
SHA256
ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7
-
SHA512
148b7583855d3c68365ecbd98499f2c6c4fe4959eace5111bb07a2894d81b8e57d2dfade487418bb0abc2fd96a6125556bd2a86273fef7eab01a82a4c76bd51c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmsL:ymb3NkkiQ3mdBjFIvl358nLA89OMFVH1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/2408-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
s0602.exeo222004.exe5xrrffl.exebntttb.exe4024642.exeo248282.exejjpjd.exe5hthtn.exejddpj.exe6260448.exe7rrlfxr.exe480826.exehbhbtt.exexxlffxr.exetbhbtt.exentbbbb.exe680080.exe0004624.exeflrxllf.exe7nhbnn.exe822268.exe460088.exettnntb.exe024008.exerrxrlfx.exe22440.exexxxlfff.exethnhnh.exe6644828.exes4606.exe2804888.exe2202600.exe5lfffxl.exe04642.exethhbtn.exerrrrrfr.exeq62604.exe848024.exeddjvp.exe606284.exennnnhh.exe5hnhbb.exetnbttt.exerfrxlrx.exefflxrlx.exe28060.exexxxrfff.exenhnbhh.exettnhhh.exe64660.exentbbbh.exe8248880.exe9nnnnn.exem6028.exe1xxrrrr.exevvpjd.exew86822.exedvjvp.exejddvp.exe488660.exe8626820.exe6244002.exejpppj.exe4820606.exepid process 2260 s0602.exe 4032 o222004.exe 3980 5xrrffl.exe 2844 bntttb.exe 3976 4024642.exe 4132 o248282.exe 5052 jjpjd.exe 1248 5hthtn.exe 2016 jddpj.exe 3164 6260448.exe 4892 7rrlfxr.exe 540 480826.exe 3660 hbhbtt.exe 4652 xxlffxr.exe 3380 tbhbtt.exe 2800 ntbbbb.exe 3712 680080.exe 1440 0004624.exe 4496 flrxllf.exe 2296 7nhbnn.exe 4612 822268.exe 4448 460088.exe 2444 ttnntb.exe 1040 024008.exe 1408 rrxrlfx.exe 2316 22440.exe 2540 xxxlfff.exe 4092 thnhnh.exe 512 6644828.exe 4004 s4606.exe 4712 2804888.exe 2796 2202600.exe 660 5lfffxl.exe 1104 04642.exe 4832 thhbtn.exe 2876 rrrrrfr.exe 1660 q62604.exe 3904 848024.exe 2404 ddjvp.exe 4444 606284.exe 1484 nnnnhh.exe 5116 5hnhbb.exe 4984 tnbttt.exe 4192 rfrxlrx.exe 4032 fflxrlx.exe 1308 28060.exe 3152 xxxrfff.exe 4528 nhnbhh.exe 1396 ttnhhh.exe 5112 64660.exe 4388 ntbbbh.exe 4952 8248880.exe 3048 9nnnnn.exe 4408 m6028.exe 1760 1xxrrrr.exe 1920 vvpjd.exe 2032 w86822.exe 116 dvjvp.exe 1176 jddvp.exe 3940 488660.exe 4076 8626820.exe 1064 6244002.exe 1480 jpppj.exe 4312 4820606.exe -
Processes:
resource yara_rule behavioral2/memory/2408-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2800-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
22884.exe64042.exexxxrfff.exejpppj.exerfffrrr.exedvddd.exettnhbb.exe4242082.exepjppv.exe9jddp.exehthbtt.exes4600.exethhhbn.exe2066448.exelllrfll.exelxfxrxr.exeu682004.exe2604600.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22884.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4242082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s4600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2066448.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u682004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2604600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exes0602.exeo222004.exe5xrrffl.exebntttb.exe4024642.exeo248282.exejjpjd.exe5hthtn.exejddpj.exe6260448.exe7rrlfxr.exe480826.exehbhbtt.exexxlffxr.exetbhbtt.exentbbbb.exe680080.exe0004624.exeflrxllf.exe7nhbnn.exe822268.exedescription pid process target process PID 2408 wrote to memory of 2260 2408 ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe s0602.exe PID 2408 wrote to memory of 2260 2408 ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe s0602.exe PID 2408 wrote to memory of 2260 2408 ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe s0602.exe PID 2260 wrote to memory of 4032 2260 s0602.exe o222004.exe PID 2260 wrote to memory of 4032 2260 s0602.exe o222004.exe PID 2260 wrote to memory of 4032 2260 s0602.exe o222004.exe PID 4032 wrote to memory of 3980 4032 o222004.exe 5xrrffl.exe PID 4032 wrote to memory of 3980 4032 o222004.exe 5xrrffl.exe PID 4032 wrote to memory of 3980 4032 o222004.exe 5xrrffl.exe PID 3980 wrote to memory of 2844 3980 5xrrffl.exe bntttb.exe PID 3980 wrote to memory of 2844 3980 5xrrffl.exe bntttb.exe PID 3980 wrote to memory of 2844 3980 5xrrffl.exe bntttb.exe PID 2844 wrote to memory of 3976 2844 bntttb.exe 4024642.exe PID 2844 wrote to memory of 3976 2844 bntttb.exe 4024642.exe PID 2844 wrote to memory of 3976 2844 bntttb.exe 4024642.exe PID 3976 wrote to memory of 4132 3976 4024642.exe o248282.exe PID 3976 wrote to memory of 4132 3976 4024642.exe o248282.exe PID 3976 wrote to memory of 4132 3976 4024642.exe o248282.exe PID 4132 wrote to memory of 5052 4132 o248282.exe jjpjd.exe PID 4132 wrote to memory of 5052 4132 o248282.exe jjpjd.exe PID 4132 wrote to memory of 5052 4132 o248282.exe jjpjd.exe PID 5052 wrote to memory of 1248 5052 jjpjd.exe 5hthtn.exe PID 5052 wrote to memory of 1248 5052 jjpjd.exe 5hthtn.exe PID 5052 wrote to memory of 1248 5052 jjpjd.exe 5hthtn.exe PID 1248 wrote to memory of 2016 1248 5hthtn.exe jddpj.exe PID 1248 wrote to memory of 2016 1248 5hthtn.exe jddpj.exe PID 1248 wrote to memory of 2016 1248 5hthtn.exe jddpj.exe PID 2016 wrote to memory of 3164 2016 jddpj.exe 6260448.exe PID 2016 wrote to memory of 3164 2016 jddpj.exe 6260448.exe PID 2016 wrote to memory of 3164 2016 jddpj.exe 6260448.exe PID 3164 wrote to memory of 4892 3164 6260448.exe 7rrlfxr.exe PID 3164 wrote to memory of 4892 3164 6260448.exe 7rrlfxr.exe PID 3164 wrote to memory of 4892 3164 6260448.exe 7rrlfxr.exe PID 4892 wrote to memory of 540 4892 7rrlfxr.exe 480826.exe PID 4892 wrote to memory of 540 4892 7rrlfxr.exe 480826.exe PID 4892 wrote to memory of 540 4892 7rrlfxr.exe 480826.exe PID 540 wrote to memory of 3660 540 480826.exe hbhbtt.exe PID 540 wrote to memory of 3660 540 480826.exe hbhbtt.exe PID 540 wrote to memory of 3660 540 480826.exe hbhbtt.exe PID 3660 wrote to memory of 4652 3660 hbhbtt.exe xxlffxr.exe PID 3660 wrote to memory of 4652 3660 hbhbtt.exe xxlffxr.exe PID 3660 wrote to memory of 4652 3660 hbhbtt.exe xxlffxr.exe PID 4652 wrote to memory of 3380 4652 xxlffxr.exe tbhbtt.exe PID 4652 wrote to memory of 3380 4652 xxlffxr.exe tbhbtt.exe PID 4652 wrote to memory of 3380 4652 xxlffxr.exe tbhbtt.exe PID 3380 wrote to memory of 2800 3380 tbhbtt.exe ntbbbb.exe PID 3380 wrote to memory of 2800 3380 tbhbtt.exe ntbbbb.exe PID 3380 wrote to memory of 2800 3380 tbhbtt.exe ntbbbb.exe PID 2800 wrote to memory of 3712 2800 ntbbbb.exe 680080.exe PID 2800 wrote to memory of 3712 2800 ntbbbb.exe 680080.exe PID 2800 wrote to memory of 3712 2800 ntbbbb.exe 680080.exe PID 3712 wrote to memory of 1440 3712 680080.exe 0004624.exe PID 3712 wrote to memory of 1440 3712 680080.exe 0004624.exe PID 3712 wrote to memory of 1440 3712 680080.exe 0004624.exe PID 1440 wrote to memory of 4496 1440 0004624.exe flrxllf.exe PID 1440 wrote to memory of 4496 1440 0004624.exe flrxllf.exe PID 1440 wrote to memory of 4496 1440 0004624.exe flrxllf.exe PID 4496 wrote to memory of 2296 4496 flrxllf.exe 7nhbnn.exe PID 4496 wrote to memory of 2296 4496 flrxllf.exe 7nhbnn.exe PID 4496 wrote to memory of 2296 4496 flrxllf.exe 7nhbnn.exe PID 2296 wrote to memory of 4612 2296 7nhbnn.exe 822268.exe PID 2296 wrote to memory of 4612 2296 7nhbnn.exe 822268.exe PID 2296 wrote to memory of 4612 2296 7nhbnn.exe 822268.exe PID 4612 wrote to memory of 4448 4612 822268.exe 460088.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe"C:\Users\Admin\AppData\Local\Temp\ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\s0602.exec:\s0602.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\o222004.exec:\o222004.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\5xrrffl.exec:\5xrrffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\bntttb.exec:\bntttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\4024642.exec:\4024642.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\o248282.exec:\o248282.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\jjpjd.exec:\jjpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\5hthtn.exec:\5hthtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\jddpj.exec:\jddpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\6260448.exec:\6260448.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\7rrlfxr.exec:\7rrlfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\480826.exec:\480826.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\hbhbtt.exec:\hbhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\xxlffxr.exec:\xxlffxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\tbhbtt.exec:\tbhbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\ntbbbb.exec:\ntbbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\680080.exec:\680080.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\0004624.exec:\0004624.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\flrxllf.exec:\flrxllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\7nhbnn.exec:\7nhbnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\822268.exec:\822268.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\460088.exec:\460088.exe23⤵
- Executes dropped EXE
PID:4448 -
\??\c:\ttnntb.exec:\ttnntb.exe24⤵
- Executes dropped EXE
PID:2444 -
\??\c:\024008.exec:\024008.exe25⤵
- Executes dropped EXE
PID:1040 -
\??\c:\rrxrlfx.exec:\rrxrlfx.exe26⤵
- Executes dropped EXE
PID:1408 -
\??\c:\22440.exec:\22440.exe27⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xxxlfff.exec:\xxxlfff.exe28⤵
- Executes dropped EXE
PID:2540 -
\??\c:\thnhnh.exec:\thnhnh.exe29⤵
- Executes dropped EXE
PID:4092 -
\??\c:\6644828.exec:\6644828.exe30⤵
- Executes dropped EXE
PID:512 -
\??\c:\s4606.exec:\s4606.exe31⤵
- Executes dropped EXE
PID:4004 -
\??\c:\2804888.exec:\2804888.exe32⤵
- Executes dropped EXE
PID:4712 -
\??\c:\2202600.exec:\2202600.exe33⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5lfffxl.exec:\5lfffxl.exe34⤵
- Executes dropped EXE
PID:660 -
\??\c:\04642.exec:\04642.exe35⤵
- Executes dropped EXE
PID:1104 -
\??\c:\thhbtn.exec:\thhbtn.exe36⤵
- Executes dropped EXE
PID:4832 -
\??\c:\rrrrrfr.exec:\rrrrrfr.exe37⤵
- Executes dropped EXE
PID:2876 -
\??\c:\q62604.exec:\q62604.exe38⤵
- Executes dropped EXE
PID:1660 -
\??\c:\848024.exec:\848024.exe39⤵
- Executes dropped EXE
PID:3904 -
\??\c:\ddjvp.exec:\ddjvp.exe40⤵
- Executes dropped EXE
PID:2404 -
\??\c:\606284.exec:\606284.exe41⤵
- Executes dropped EXE
PID:4444 -
\??\c:\nnnnhh.exec:\nnnnhh.exe42⤵
- Executes dropped EXE
PID:1484 -
\??\c:\5hnhbb.exec:\5hnhbb.exe43⤵
- Executes dropped EXE
PID:5116 -
\??\c:\tnbttt.exec:\tnbttt.exe44⤵
- Executes dropped EXE
PID:4984 -
\??\c:\rfrxlrx.exec:\rfrxlrx.exe45⤵
- Executes dropped EXE
PID:4192 -
\??\c:\fflxrlx.exec:\fflxrlx.exe46⤵
- Executes dropped EXE
PID:4032 -
\??\c:\28060.exec:\28060.exe47⤵
- Executes dropped EXE
PID:1308 -
\??\c:\xxxrfff.exec:\xxxrfff.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3152 -
\??\c:\nhnbhh.exec:\nhnbhh.exe49⤵
- Executes dropped EXE
PID:4528 -
\??\c:\ttnhhh.exec:\ttnhhh.exe50⤵
- Executes dropped EXE
PID:1396 -
\??\c:\64660.exec:\64660.exe51⤵
- Executes dropped EXE
PID:5112 -
\??\c:\ntbbbh.exec:\ntbbbh.exe52⤵
- Executes dropped EXE
PID:4388 -
\??\c:\8248880.exec:\8248880.exe53⤵
- Executes dropped EXE
PID:4952 -
\??\c:\9nnnnn.exec:\9nnnnn.exe54⤵
- Executes dropped EXE
PID:3048 -
\??\c:\m6028.exec:\m6028.exe55⤵
- Executes dropped EXE
PID:4408 -
\??\c:\1xxrrrr.exec:\1xxrrrr.exe56⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vvpjd.exec:\vvpjd.exe57⤵
- Executes dropped EXE
PID:1920 -
\??\c:\w86822.exec:\w86822.exe58⤵
- Executes dropped EXE
PID:2032 -
\??\c:\dvjvp.exec:\dvjvp.exe59⤵
- Executes dropped EXE
PID:116 -
\??\c:\jddvp.exec:\jddvp.exe60⤵
- Executes dropped EXE
PID:1176 -
\??\c:\488660.exec:\488660.exe61⤵
- Executes dropped EXE
PID:3940 -
\??\c:\8626820.exec:\8626820.exe62⤵
- Executes dropped EXE
PID:4076 -
\??\c:\6244002.exec:\6244002.exe63⤵
- Executes dropped EXE
PID:1064 -
\??\c:\jpppj.exec:\jpppj.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1480 -
\??\c:\4820606.exec:\4820606.exe65⤵
- Executes dropped EXE
PID:4312 -
\??\c:\264400.exec:\264400.exe66⤵PID:3380
-
\??\c:\bhhbtt.exec:\bhhbtt.exe67⤵PID:3932
-
\??\c:\9ntnhh.exec:\9ntnhh.exe68⤵PID:4568
-
\??\c:\bntbtt.exec:\bntbtt.exe69⤵PID:2912
-
\??\c:\nbhnbh.exec:\nbhnbh.exe70⤵PID:1980
-
\??\c:\jdjdj.exec:\jdjdj.exe71⤵PID:2976
-
\??\c:\xlxflll.exec:\xlxflll.exe72⤵PID:912
-
\??\c:\vddjj.exec:\vddjj.exe73⤵PID:5028
-
\??\c:\htbhnb.exec:\htbhnb.exe74⤵PID:5036
-
\??\c:\nhtbhb.exec:\nhtbhb.exe75⤵PID:3576
-
\??\c:\lfxlrfr.exec:\lfxlrfr.exe76⤵PID:4880
-
\??\c:\btthtn.exec:\btthtn.exe77⤵PID:2772
-
\??\c:\4868080.exec:\4868080.exe78⤵PID:1040
-
\??\c:\flrrlll.exec:\flrrlll.exe79⤵PID:1568
-
\??\c:\802268.exec:\802268.exe80⤵PID:1088
-
\??\c:\6060444.exec:\6060444.exe81⤵PID:3864
-
\??\c:\5ttbtt.exec:\5ttbtt.exe82⤵PID:3972
-
\??\c:\fxxrllf.exec:\fxxrllf.exe83⤵PID:4812
-
\??\c:\244488.exec:\244488.exe84⤵PID:3312
-
\??\c:\48882.exec:\48882.exe85⤵PID:2752
-
\??\c:\vpvjj.exec:\vpvjj.exe86⤵PID:3700
-
\??\c:\djpjd.exec:\djpjd.exe87⤵PID:2640
-
\??\c:\o620604.exec:\o620604.exe88⤵PID:4396
-
\??\c:\6804882.exec:\6804882.exe89⤵PID:3960
-
\??\c:\nhnhnh.exec:\nhnhnh.exe90⤵PID:3028
-
\??\c:\2666442.exec:\2666442.exe91⤵PID:1256
-
\??\c:\vvvpj.exec:\vvvpj.exe92⤵PID:2760
-
\??\c:\24648.exec:\24648.exe93⤵PID:2984
-
\??\c:\4080808.exec:\4080808.exe94⤵PID:2404
-
\??\c:\86028.exec:\86028.exe95⤵PID:2332
-
\??\c:\04802.exec:\04802.exe96⤵PID:1484
-
\??\c:\800620.exec:\800620.exe97⤵PID:5084
-
\??\c:\g4246.exec:\g4246.exe98⤵PID:4476
-
\??\c:\60044.exec:\60044.exe99⤵PID:4192
-
\??\c:\2248660.exec:\2248660.exe100⤵PID:1968
-
\??\c:\hbnnnn.exec:\hbnnnn.exe101⤵PID:4512
-
\??\c:\84286.exec:\84286.exe102⤵PID:4988
-
\??\c:\lffrxrx.exec:\lffrxrx.exe103⤵PID:2720
-
\??\c:\824484.exec:\824484.exe104⤵PID:2100
-
\??\c:\404046.exec:\404046.exe105⤵PID:4528
-
\??\c:\w68822.exec:\w68822.exe106⤵PID:1620
-
\??\c:\8868028.exec:\8868028.exe107⤵PID:5112
-
\??\c:\htttth.exec:\htttth.exe108⤵PID:4388
-
\??\c:\hnnbnn.exec:\hnnbnn.exe109⤵PID:3620
-
\??\c:\0608084.exec:\0608084.exe110⤵PID:3048
-
\??\c:\rxlxfrf.exec:\rxlxfrf.exe111⤵PID:2012
-
\??\c:\06242.exec:\06242.exe112⤵PID:4932
-
\??\c:\nnbtbh.exec:\nnbtbh.exe113⤵PID:1584
-
\??\c:\2626404.exec:\2626404.exe114⤵PID:112
-
\??\c:\84806.exec:\84806.exe115⤵PID:1872
-
\??\c:\460824.exec:\460824.exe116⤵PID:1924
-
\??\c:\088248.exec:\088248.exe117⤵PID:2792
-
\??\c:\jjdvp.exec:\jjdvp.exe118⤵PID:4416
-
\??\c:\fxfxlrl.exec:\fxfxlrl.exe119⤵PID:3996
-
\??\c:\24806.exec:\24806.exe120⤵PID:1840
-
\??\c:\bhnbnt.exec:\bhnbnt.exe121⤵PID:2860
-
\??\c:\thhbtn.exec:\thhbtn.exe122⤵PID:1016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-