Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 22:50
Static task
static1
Behavioral task
behavioral1
Sample
fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394.exe
Resource
win7-20241010-en
General
-
Target
fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394.exe
-
Size
72KB
-
MD5
9b505f1dcf02dab70d5bfbcd3ddba70e
-
SHA1
437694a0e4a803b48e19716b00713a22f097970c
-
SHA256
fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394
-
SHA512
72a81776859465374cc6c6ed1b2ccc7a375dac80beb03f17447b615c5e985fc14680860cf97dd116ba69367824b6c9c22cb7e16ae7e9b9f3cf87e54b6e72aa76
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfUcicP/fG:ymb3NkkiQ3mdBjFI4V4ci2/fG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4952-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/892-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 824 lllrlrl.exe 3016 htnhbt.exe 3488 pdjdd.exe 2920 ffrlffx.exe 1460 htbnhh.exe 380 pjjjv.exe 4916 xlfxllx.exe 3872 tnhbtt.exe 3468 nnnnnn.exe 2448 vdjjd.exe 3228 3rxrllf.exe 4972 tnnbtb.exe 3688 bbbthh.exe 2088 dvjdv.exe 4124 xrrlxxl.exe 228 lflfxlf.exe 892 pvpjd.exe 3740 rxffrxr.exe 2336 xffxrrl.exe 3944 hbhbtn.exe 3196 pjdvj.exe 1280 rflfrrf.exe 964 tnnnhh.exe 4184 5rrlxxr.exe 3648 xllfxrl.exe 3880 nbnnhh.exe 912 3jjpd.exe 4168 vpjdd.exe 2700 rxfxrrr.exe 3452 lflfxff.exe 3996 nbbhtt.exe 4764 pdvpd.exe 3788 xxxlfxr.exe 2892 1hnhhh.exe 4876 bnntnn.exe 2008 3vvpd.exe 3108 xlfxrrl.exe 3984 tbnnhb.exe 4200 frxrlll.exe 4824 xxflrlf.exe 1360 bbnbnh.exe 3404 jpdvp.exe 4956 vpvvv.exe 5020 lxrlxrx.exe 4560 ttnhbn.exe 4384 jppjv.exe 2392 hhbnht.exe 4752 vpvvv.exe 3640 xllxfxr.exe 3568 bnthth.exe 1096 nttbhb.exe 4652 3ddvj.exe 3620 rxrxrfr.exe 3060 xxrlrrx.exe 2240 1hhhbt.exe 5084 htnhhb.exe 5092 vddvp.exe 3644 ppvjp.exe 4000 lfrlrrf.exe 3872 lxfxrrl.exe 2760 tnbnbt.exe 4892 3jjdp.exe 1696 ffflxrf.exe 3720 rflfxxl.exe -
resource yara_rule behavioral2/memory/4952-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/892-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4952 wrote to memory of 824 4952 fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394.exe 82 PID 4952 wrote to memory of 824 4952 fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394.exe 82 PID 4952 wrote to memory of 824 4952 fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394.exe 82 PID 824 wrote to memory of 3016 824 lllrlrl.exe 83 PID 824 wrote to memory of 3016 824 lllrlrl.exe 83 PID 824 wrote to memory of 3016 824 lllrlrl.exe 83 PID 3016 wrote to memory of 3488 3016 htnhbt.exe 84 PID 3016 wrote to memory of 3488 3016 htnhbt.exe 84 PID 3016 wrote to memory of 3488 3016 htnhbt.exe 84 PID 3488 wrote to memory of 2920 3488 pdjdd.exe 85 PID 3488 wrote to memory of 2920 3488 pdjdd.exe 85 PID 3488 wrote to memory of 2920 3488 pdjdd.exe 85 PID 2920 wrote to memory of 1460 2920 ffrlffx.exe 86 PID 2920 wrote to memory of 1460 2920 ffrlffx.exe 86 PID 2920 wrote to memory of 1460 2920 ffrlffx.exe 86 PID 1460 wrote to memory of 380 1460 htbnhh.exe 87 PID 1460 wrote to memory of 380 1460 htbnhh.exe 87 PID 1460 wrote to memory of 380 1460 htbnhh.exe 87 PID 380 wrote to memory of 4916 380 pjjjv.exe 88 PID 380 wrote to memory of 4916 380 pjjjv.exe 88 PID 380 wrote to memory of 4916 380 pjjjv.exe 88 PID 4916 wrote to memory of 3872 4916 xlfxllx.exe 89 PID 4916 wrote to memory of 3872 4916 xlfxllx.exe 89 PID 4916 wrote to memory of 3872 4916 xlfxllx.exe 89 PID 3872 wrote to memory of 3468 3872 tnhbtt.exe 90 PID 3872 wrote to memory of 3468 3872 tnhbtt.exe 90 PID 3872 wrote to memory of 3468 3872 tnhbtt.exe 90 PID 3468 wrote to memory of 2448 3468 nnnnnn.exe 91 PID 3468 wrote to memory of 2448 3468 nnnnnn.exe 91 PID 3468 wrote to memory of 2448 3468 nnnnnn.exe 91 PID 2448 wrote to memory of 3228 2448 vdjjd.exe 92 PID 2448 wrote to memory of 3228 2448 vdjjd.exe 92 PID 2448 wrote to memory of 3228 2448 vdjjd.exe 92 PID 3228 wrote to memory of 4972 3228 3rxrllf.exe 93 PID 3228 wrote to memory of 4972 3228 3rxrllf.exe 93 PID 3228 wrote to memory of 4972 3228 3rxrllf.exe 93 PID 4972 wrote to memory of 3688 4972 tnnbtb.exe 94 PID 4972 wrote to memory of 3688 4972 tnnbtb.exe 94 PID 4972 wrote to memory of 3688 4972 tnnbtb.exe 94 PID 3688 wrote to memory of 2088 3688 bbbthh.exe 95 PID 3688 wrote to memory of 2088 3688 bbbthh.exe 95 PID 3688 wrote to memory of 2088 3688 bbbthh.exe 95 PID 2088 wrote to memory of 4124 2088 dvjdv.exe 96 PID 2088 wrote to memory of 4124 2088 dvjdv.exe 96 PID 2088 wrote to memory of 4124 2088 dvjdv.exe 96 PID 4124 wrote to memory of 228 4124 xrrlxxl.exe 97 PID 4124 wrote to memory of 228 4124 xrrlxxl.exe 97 PID 4124 wrote to memory of 228 4124 xrrlxxl.exe 97 PID 228 wrote to memory of 892 228 lflfxlf.exe 98 PID 228 wrote to memory of 892 228 lflfxlf.exe 98 PID 228 wrote to memory of 892 228 lflfxlf.exe 98 PID 892 wrote to memory of 3740 892 pvpjd.exe 99 PID 892 wrote to memory of 3740 892 pvpjd.exe 99 PID 892 wrote to memory of 3740 892 pvpjd.exe 99 PID 3740 wrote to memory of 2336 3740 rxffrxr.exe 100 PID 3740 wrote to memory of 2336 3740 rxffrxr.exe 100 PID 3740 wrote to memory of 2336 3740 rxffrxr.exe 100 PID 2336 wrote to memory of 3944 2336 xffxrrl.exe 101 PID 2336 wrote to memory of 3944 2336 xffxrrl.exe 101 PID 2336 wrote to memory of 3944 2336 xffxrrl.exe 101 PID 3944 wrote to memory of 3196 3944 hbhbtn.exe 102 PID 3944 wrote to memory of 3196 3944 hbhbtn.exe 102 PID 3944 wrote to memory of 3196 3944 hbhbtn.exe 102 PID 3196 wrote to memory of 1280 3196 pjdvj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394.exe"C:\Users\Admin\AppData\Local\Temp\fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\lllrlrl.exec:\lllrlrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\htnhbt.exec:\htnhbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\pdjdd.exec:\pdjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\ffrlffx.exec:\ffrlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\htbnhh.exec:\htbnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\pjjjv.exec:\pjjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\xlfxllx.exec:\xlfxllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\tnhbtt.exec:\tnhbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\nnnnnn.exec:\nnnnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\vdjjd.exec:\vdjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\3rxrllf.exec:\3rxrllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\tnnbtb.exec:\tnnbtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\bbbthh.exec:\bbbthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\dvjdv.exec:\dvjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\xrrlxxl.exec:\xrrlxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\lflfxlf.exec:\lflfxlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\pvpjd.exec:\pvpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\rxffrxr.exec:\rxffrxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\xffxrrl.exec:\xffxrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\hbhbtn.exec:\hbhbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\pjdvj.exec:\pjdvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\rflfrrf.exec:\rflfrrf.exe23⤵
- Executes dropped EXE
PID:1280 -
\??\c:\tnnnhh.exec:\tnnnhh.exe24⤵
- Executes dropped EXE
PID:964 -
\??\c:\5rrlxxr.exec:\5rrlxxr.exe25⤵
- Executes dropped EXE
PID:4184 -
\??\c:\xllfxrl.exec:\xllfxrl.exe26⤵
- Executes dropped EXE
PID:3648 -
\??\c:\nbnnhh.exec:\nbnnhh.exe27⤵
- Executes dropped EXE
PID:3880 -
\??\c:\3jjpd.exec:\3jjpd.exe28⤵
- Executes dropped EXE
PID:912 -
\??\c:\vpjdd.exec:\vpjdd.exe29⤵
- Executes dropped EXE
PID:4168 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe30⤵
- Executes dropped EXE
PID:2700 -
\??\c:\lflfxff.exec:\lflfxff.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3452 -
\??\c:\nbbhtt.exec:\nbbhtt.exe32⤵
- Executes dropped EXE
PID:3996 -
\??\c:\pdvpd.exec:\pdvpd.exe33⤵
- Executes dropped EXE
PID:4764 -
\??\c:\xxxlfxr.exec:\xxxlfxr.exe34⤵
- Executes dropped EXE
PID:3788 -
\??\c:\1hnhhh.exec:\1hnhhh.exe35⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bnntnn.exec:\bnntnn.exe36⤵
- Executes dropped EXE
PID:4876 -
\??\c:\3vvpd.exec:\3vvpd.exe37⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe38⤵
- Executes dropped EXE
PID:3108 -
\??\c:\tbnnhb.exec:\tbnnhb.exe39⤵
- Executes dropped EXE
PID:3984 -
\??\c:\frxrlll.exec:\frxrlll.exe40⤵
- Executes dropped EXE
PID:4200 -
\??\c:\xxflrlf.exec:\xxflrlf.exe41⤵
- Executes dropped EXE
PID:4824 -
\??\c:\bbnbnh.exec:\bbnbnh.exe42⤵
- Executes dropped EXE
PID:1360 -
\??\c:\jpdvp.exec:\jpdvp.exe43⤵
- Executes dropped EXE
PID:3404 -
\??\c:\vpvvv.exec:\vpvvv.exe44⤵
- Executes dropped EXE
PID:4956 -
\??\c:\lxrlxrx.exec:\lxrlxrx.exe45⤵
- Executes dropped EXE
PID:5020 -
\??\c:\ttnhbn.exec:\ttnhbn.exe46⤵
- Executes dropped EXE
PID:4560 -
\??\c:\jppjv.exec:\jppjv.exe47⤵
- Executes dropped EXE
PID:4384 -
\??\c:\hhbnht.exec:\hhbnht.exe48⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vpvvv.exec:\vpvvv.exe49⤵
- Executes dropped EXE
PID:4752 -
\??\c:\xllxfxr.exec:\xllxfxr.exe50⤵
- Executes dropped EXE
PID:3640 -
\??\c:\bnthth.exec:\bnthth.exe51⤵
- Executes dropped EXE
PID:3568 -
\??\c:\nttbhb.exec:\nttbhb.exe52⤵
- Executes dropped EXE
PID:1096 -
\??\c:\3ddvj.exec:\3ddvj.exe53⤵
- Executes dropped EXE
PID:4652 -
\??\c:\rxrxrfr.exec:\rxrxrfr.exe54⤵
- Executes dropped EXE
PID:3620 -
\??\c:\xxrlrrx.exec:\xxrlrrx.exe55⤵
- Executes dropped EXE
PID:3060 -
\??\c:\1hhhbt.exec:\1hhhbt.exe56⤵
- Executes dropped EXE
PID:2240 -
\??\c:\htnhhb.exec:\htnhhb.exe57⤵
- Executes dropped EXE
PID:5084 -
\??\c:\vddvp.exec:\vddvp.exe58⤵
- Executes dropped EXE
PID:5092 -
\??\c:\ppvjp.exec:\ppvjp.exe59⤵
- Executes dropped EXE
PID:3644 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe60⤵
- Executes dropped EXE
PID:4000 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe61⤵
- Executes dropped EXE
PID:3872 -
\??\c:\tnbnbt.exec:\tnbnbt.exe62⤵
- Executes dropped EXE
PID:2760 -
\??\c:\3jjdp.exec:\3jjdp.exe63⤵
- Executes dropped EXE
PID:4892 -
\??\c:\ffflxrf.exec:\ffflxrf.exe64⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rflfxxl.exec:\rflfxxl.exe65⤵
- Executes dropped EXE
PID:3720 -
\??\c:\tnhtnh.exec:\tnhtnh.exe66⤵PID:5104
-
\??\c:\9lxrxxf.exec:\9lxrxxf.exe67⤵PID:3464
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe68⤵PID:348
-
\??\c:\hbnhbt.exec:\hbnhbt.exe69⤵PID:4124
-
\??\c:\7htnbt.exec:\7htnbt.exe70⤵PID:1040
-
\??\c:\9ththn.exec:\9ththn.exe71⤵PID:2824
-
\??\c:\dvpdp.exec:\dvpdp.exe72⤵PID:2844
-
\??\c:\flfrlfr.exec:\flfrlfr.exe73⤵PID:2044
-
\??\c:\5rfxffx.exec:\5rfxffx.exe74⤵PID:4120
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe75⤵PID:4136
-
\??\c:\nbbttn.exec:\nbbttn.exe76⤵PID:4884
-
\??\c:\3jdpd.exec:\3jdpd.exe77⤵PID:2504
-
\??\c:\djjdp.exec:\djjdp.exe78⤵PID:1280
-
\??\c:\7lrlxrf.exec:\7lrlxrf.exe79⤵PID:2756
-
\??\c:\lfxrllf.exec:\lfxrllf.exe80⤵PID:3080
-
\??\c:\7tbttn.exec:\7tbttn.exe81⤵PID:3472
-
\??\c:\hbbthh.exec:\hbbthh.exe82⤵PID:1964
-
\??\c:\pddvj.exec:\pddvj.exe83⤵PID:4692
-
\??\c:\ffxlffx.exec:\ffxlffx.exe84⤵PID:1684
-
\??\c:\xfxrlfx.exec:\xfxrlfx.exe85⤵PID:724
-
\??\c:\nhhbtn.exec:\nhhbtn.exe86⤵PID:1212
-
\??\c:\hnbbtb.exec:\hnbbtb.exe87⤵PID:1504
-
\??\c:\vpvdp.exec:\vpvdp.exe88⤵PID:2700
-
\??\c:\dppjd.exec:\dppjd.exe89⤵PID:3412
-
\??\c:\fllxlfr.exec:\fllxlfr.exe90⤵PID:3992
-
\??\c:\9rlfrlf.exec:\9rlfrlf.exe91⤵PID:1616
-
\??\c:\htthhh.exec:\htthhh.exe92⤵PID:1648
-
\??\c:\jvdvv.exec:\jvdvv.exe93⤵PID:1640
-
\??\c:\pjdjv.exec:\pjdjv.exe94⤵PID:4272
-
\??\c:\5xxrxrf.exec:\5xxrxrf.exe95⤵PID:5048
-
\??\c:\5llllll.exec:\5llllll.exe96⤵PID:2008
-
\??\c:\tnnnnn.exec:\tnnnnn.exe97⤵PID:3808
-
\??\c:\hbtntt.exec:\hbtntt.exe98⤵PID:1168
-
\??\c:\pdpjj.exec:\pdpjj.exe99⤵PID:3972
-
\??\c:\djjdv.exec:\djjdv.exe100⤵PID:4968
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe101⤵PID:4848
-
\??\c:\xlxrrrl.exec:\xlxrrrl.exe102⤵PID:4956
-
\??\c:\lrrfrlx.exec:\lrrfrlx.exe103⤵PID:4020
-
\??\c:\nhbtnh.exec:\nhbtnh.exe104⤵PID:1552
-
\??\c:\nbhbnb.exec:\nbhbnb.exe105⤵PID:2648
-
\??\c:\vpdpj.exec:\vpdpj.exe106⤵PID:3552
-
\??\c:\jjdvp.exec:\jjdvp.exe107⤵PID:4260
-
\??\c:\rlrlfff.exec:\rlrlfff.exe108⤵PID:1096
-
\??\c:\llffxxl.exec:\llffxxl.exe109⤵PID:4240
-
\??\c:\fllfrlf.exec:\fllfrlf.exe110⤵PID:3508
-
\??\c:\bhnttt.exec:\bhnttt.exe111⤵PID:3768
-
\??\c:\hntthn.exec:\hntthn.exe112⤵PID:4060
-
\??\c:\djvpp.exec:\djvpp.exe113⤵PID:2388
-
\??\c:\dvvpd.exec:\dvvpd.exe114⤵PID:4252
-
\??\c:\7flfxxr.exec:\7flfxxr.exe115⤵PID:2760
-
\??\c:\nbnhbh.exec:\nbnhbh.exe116⤵PID:1560
-
\??\c:\5nthtt.exec:\5nthtt.exe117⤵PID:1816
-
\??\c:\vjdvj.exec:\vjdvj.exe118⤵PID:3688
-
\??\c:\jddvd.exec:\jddvd.exe119⤵PID:3888
-
\??\c:\3rxrlll.exec:\3rxrlll.exe120⤵PID:3664
-
\??\c:\hbbbbt.exec:\hbbbbt.exe121⤵PID:1300
-
\??\c:\dvvpp.exec:\dvvpp.exe122⤵PID:2216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-