Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2024, 05:04
Static task
static1
Behavioral task
behavioral1
Sample
e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe
Resource
win7-20241010-en
General
-
Target
e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe
-
Size
82KB
-
MD5
e3a9a82f7c138c77e2b1716a5a6164b3
-
SHA1
c78a2245fb1d97d0cbfd5fdd415fe467e623a900
-
SHA256
e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb
-
SHA512
0456800a2a89493e2db62f3d3c6f1f2e13a00af64190f2d12cf17e6cad0d7ff9daf44a507e3aea221cef0dab6fbac6e9d6b70beba9ce8407e6fd1d7a830a6fae
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmB5Gt9:ymb3NkkiQ3mdBjFo73thgQ/wEkc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3708-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1364-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1616 jpjdv.exe 1512 420004.exe 2588 024828.exe 2356 806006.exe 1872 djpjd.exe 3212 lfffflr.exe 3448 lxlrrrx.exe 2820 ttnbtb.exe 4000 k26024.exe 4804 0222882.exe 5008 44624.exe 2212 02048.exe 4740 48882.exe 1364 6688608.exe 4736 dpvpp.exe 2876 htntbt.exe 4120 24860.exe 1656 dvjdd.exe 3184 e06004.exe 760 86664.exe 2288 lrxrllf.exe 3896 llfffrr.exe 3656 20622.exe 3992 o860062.exe 3488 bbhhnb.exe 4720 26028.exe 804 040662.exe 3324 4686044.exe 3252 jdjpp.exe 1948 rrlflrf.exe 3528 4026662.exe 2128 3jppd.exe 4924 hbhbbt.exe 1676 60828.exe 1048 nbhhhh.exe 2436 xlrlffl.exe 1960 bnnnnb.exe 3936 002244.exe 3928 1nbbtn.exe 3012 040822.exe 3456 04620.exe 4060 6200444.exe 2200 frrlfff.exe 4592 88664.exe 224 0880444.exe 2460 k88444.exe 4936 xrrrxxl.exe 1616 446622.exe 2132 62266.exe 3980 8206600.exe 2920 886088.exe 1756 lxxrllf.exe 2916 ppjvj.exe 232 6404006.exe 3212 684448.exe 1804 lfxrxxr.exe 1556 2642826.exe 2820 08864.exe 1384 600460.exe 2184 066482.exe 2276 4886224.exe 980 66266.exe 5016 088408.exe 5012 hbbtnn.exe -
resource yara_rule behavioral2/memory/3708-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1364-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/804-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m2484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s4048.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 600044.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48464.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3708 wrote to memory of 1616 3708 e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe 83 PID 3708 wrote to memory of 1616 3708 e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe 83 PID 3708 wrote to memory of 1616 3708 e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe 83 PID 1616 wrote to memory of 1512 1616 jpjdv.exe 84 PID 1616 wrote to memory of 1512 1616 jpjdv.exe 84 PID 1616 wrote to memory of 1512 1616 jpjdv.exe 84 PID 1512 wrote to memory of 2588 1512 420004.exe 85 PID 1512 wrote to memory of 2588 1512 420004.exe 85 PID 1512 wrote to memory of 2588 1512 420004.exe 85 PID 2588 wrote to memory of 2356 2588 024828.exe 86 PID 2588 wrote to memory of 2356 2588 024828.exe 86 PID 2588 wrote to memory of 2356 2588 024828.exe 86 PID 2356 wrote to memory of 1872 2356 806006.exe 87 PID 2356 wrote to memory of 1872 2356 806006.exe 87 PID 2356 wrote to memory of 1872 2356 806006.exe 87 PID 1872 wrote to memory of 3212 1872 djpjd.exe 88 PID 1872 wrote to memory of 3212 1872 djpjd.exe 88 PID 1872 wrote to memory of 3212 1872 djpjd.exe 88 PID 3212 wrote to memory of 3448 3212 lfffflr.exe 89 PID 3212 wrote to memory of 3448 3212 lfffflr.exe 89 PID 3212 wrote to memory of 3448 3212 lfffflr.exe 89 PID 3448 wrote to memory of 2820 3448 lxlrrrx.exe 90 PID 3448 wrote to memory of 2820 3448 lxlrrrx.exe 90 PID 3448 wrote to memory of 2820 3448 lxlrrrx.exe 90 PID 2820 wrote to memory of 4000 2820 ttnbtb.exe 91 PID 2820 wrote to memory of 4000 2820 ttnbtb.exe 91 PID 2820 wrote to memory of 4000 2820 ttnbtb.exe 91 PID 4000 wrote to memory of 4804 4000 k26024.exe 92 PID 4000 wrote to memory of 4804 4000 k26024.exe 92 PID 4000 wrote to memory of 4804 4000 k26024.exe 92 PID 4804 wrote to memory of 5008 4804 0222882.exe 93 PID 4804 wrote to memory of 5008 4804 0222882.exe 93 PID 4804 wrote to memory of 5008 4804 0222882.exe 93 PID 5008 wrote to memory of 2212 5008 44624.exe 94 PID 5008 wrote to memory of 2212 5008 44624.exe 94 PID 5008 wrote to memory of 2212 5008 44624.exe 94 PID 2212 wrote to memory of 4740 2212 02048.exe 95 PID 2212 wrote to memory of 4740 2212 02048.exe 95 PID 2212 wrote to memory of 4740 2212 02048.exe 95 PID 4740 wrote to memory of 1364 4740 48882.exe 96 PID 4740 wrote to memory of 1364 4740 48882.exe 96 PID 4740 wrote to memory of 1364 4740 48882.exe 96 PID 1364 wrote to memory of 4736 1364 6688608.exe 97 PID 1364 wrote to memory of 4736 1364 6688608.exe 97 PID 1364 wrote to memory of 4736 1364 6688608.exe 97 PID 4736 wrote to memory of 2876 4736 dpvpp.exe 98 PID 4736 wrote to memory of 2876 4736 dpvpp.exe 98 PID 4736 wrote to memory of 2876 4736 dpvpp.exe 98 PID 2876 wrote to memory of 4120 2876 htntbt.exe 99 PID 2876 wrote to memory of 4120 2876 htntbt.exe 99 PID 2876 wrote to memory of 4120 2876 htntbt.exe 99 PID 4120 wrote to memory of 1656 4120 24860.exe 100 PID 4120 wrote to memory of 1656 4120 24860.exe 100 PID 4120 wrote to memory of 1656 4120 24860.exe 100 PID 1656 wrote to memory of 3184 1656 dvjdd.exe 101 PID 1656 wrote to memory of 3184 1656 dvjdd.exe 101 PID 1656 wrote to memory of 3184 1656 dvjdd.exe 101 PID 3184 wrote to memory of 760 3184 e06004.exe 102 PID 3184 wrote to memory of 760 3184 e06004.exe 102 PID 3184 wrote to memory of 760 3184 e06004.exe 102 PID 760 wrote to memory of 2288 760 86664.exe 103 PID 760 wrote to memory of 2288 760 86664.exe 103 PID 760 wrote to memory of 2288 760 86664.exe 103 PID 2288 wrote to memory of 3896 2288 lrxrllf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe"C:\Users\Admin\AppData\Local\Temp\e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\jpjdv.exec:\jpjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\420004.exec:\420004.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\024828.exec:\024828.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\806006.exec:\806006.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\djpjd.exec:\djpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\lfffflr.exec:\lfffflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\lxlrrrx.exec:\lxlrrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\ttnbtb.exec:\ttnbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\k26024.exec:\k26024.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\0222882.exec:\0222882.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\44624.exec:\44624.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\02048.exec:\02048.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\48882.exec:\48882.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\6688608.exec:\6688608.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\dpvpp.exec:\dpvpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\htntbt.exec:\htntbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\24860.exec:\24860.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\dvjdd.exec:\dvjdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\e06004.exec:\e06004.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\86664.exec:\86664.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\lrxrllf.exec:\lrxrllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\llfffrr.exec:\llfffrr.exe23⤵
- Executes dropped EXE
PID:3896 -
\??\c:\20622.exec:\20622.exe24⤵
- Executes dropped EXE
PID:3656 -
\??\c:\o860062.exec:\o860062.exe25⤵
- Executes dropped EXE
PID:3992 -
\??\c:\bbhhnb.exec:\bbhhnb.exe26⤵
- Executes dropped EXE
PID:3488 -
\??\c:\26028.exec:\26028.exe27⤵
- Executes dropped EXE
PID:4720 -
\??\c:\040662.exec:\040662.exe28⤵
- Executes dropped EXE
PID:804 -
\??\c:\4686044.exec:\4686044.exe29⤵
- Executes dropped EXE
PID:3324 -
\??\c:\jdjpp.exec:\jdjpp.exe30⤵
- Executes dropped EXE
PID:3252 -
\??\c:\rrlflrf.exec:\rrlflrf.exe31⤵
- Executes dropped EXE
PID:1948 -
\??\c:\4026662.exec:\4026662.exe32⤵
- Executes dropped EXE
PID:3528 -
\??\c:\3jppd.exec:\3jppd.exe33⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hbhbbt.exec:\hbhbbt.exe34⤵
- Executes dropped EXE
PID:4924 -
\??\c:\60828.exec:\60828.exe35⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nbhhhh.exec:\nbhhhh.exe36⤵
- Executes dropped EXE
PID:1048 -
\??\c:\xlrlffl.exec:\xlrlffl.exe37⤵
- Executes dropped EXE
PID:2436 -
\??\c:\bnnnnb.exec:\bnnnnb.exe38⤵
- Executes dropped EXE
PID:1960 -
\??\c:\002244.exec:\002244.exe39⤵
- Executes dropped EXE
PID:3936 -
\??\c:\1nbbtn.exec:\1nbbtn.exe40⤵
- Executes dropped EXE
PID:3928 -
\??\c:\040822.exec:\040822.exe41⤵
- Executes dropped EXE
PID:3012 -
\??\c:\04620.exec:\04620.exe42⤵
- Executes dropped EXE
PID:3456 -
\??\c:\6200444.exec:\6200444.exe43⤵
- Executes dropped EXE
PID:4060 -
\??\c:\frrlfff.exec:\frrlfff.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2200 -
\??\c:\88664.exec:\88664.exe45⤵
- Executes dropped EXE
PID:4592 -
\??\c:\0880444.exec:\0880444.exe46⤵
- Executes dropped EXE
PID:224 -
\??\c:\k88444.exec:\k88444.exe47⤵
- Executes dropped EXE
PID:2460 -
\??\c:\xrrrxxl.exec:\xrrrxxl.exe48⤵
- Executes dropped EXE
PID:4936 -
\??\c:\446622.exec:\446622.exe49⤵
- Executes dropped EXE
PID:1616 -
\??\c:\62266.exec:\62266.exe50⤵
- Executes dropped EXE
PID:2132 -
\??\c:\8206600.exec:\8206600.exe51⤵
- Executes dropped EXE
PID:3980 -
\??\c:\886088.exec:\886088.exe52⤵
- Executes dropped EXE
PID:2920 -
\??\c:\lxxrllf.exec:\lxxrllf.exe53⤵
- Executes dropped EXE
PID:1756 -
\??\c:\ppjvj.exec:\ppjvj.exe54⤵
- Executes dropped EXE
PID:2916 -
\??\c:\6404006.exec:\6404006.exe55⤵
- Executes dropped EXE
PID:232 -
\??\c:\684448.exec:\684448.exe56⤵
- Executes dropped EXE
PID:3212 -
\??\c:\lfxrxxr.exec:\lfxrxxr.exe57⤵
- Executes dropped EXE
PID:1804 -
\??\c:\2642826.exec:\2642826.exe58⤵
- Executes dropped EXE
PID:1556 -
\??\c:\08864.exec:\08864.exe59⤵
- Executes dropped EXE
PID:2820 -
\??\c:\600460.exec:\600460.exe60⤵
- Executes dropped EXE
PID:1384 -
\??\c:\066482.exec:\066482.exe61⤵
- Executes dropped EXE
PID:2184 -
\??\c:\4886224.exec:\4886224.exe62⤵
- Executes dropped EXE
PID:2276 -
\??\c:\66266.exec:\66266.exe63⤵
- Executes dropped EXE
PID:980 -
\??\c:\088408.exec:\088408.exe64⤵
- Executes dropped EXE
PID:5016 -
\??\c:\hbbtnn.exec:\hbbtnn.exe65⤵
- Executes dropped EXE
PID:5012 -
\??\c:\pjvpj.exec:\pjvpj.exe66⤵
- System Location Discovery: System Language Discovery
PID:4276 -
\??\c:\pdppp.exec:\pdppp.exe67⤵PID:4740
-
\??\c:\c828028.exec:\c828028.exe68⤵PID:3680
-
\??\c:\rrrrlrf.exec:\rrrrlrf.exe69⤵PID:1940
-
\??\c:\642200.exec:\642200.exe70⤵PID:1104
-
\??\c:\640860.exec:\640860.exe71⤵PID:1876
-
\??\c:\frrfxrl.exec:\frrfxrl.exe72⤵PID:3388
-
\??\c:\3ntnbb.exec:\3ntnbb.exe73⤵PID:5000
-
\??\c:\tnnbhn.exec:\tnnbhn.exe74⤵PID:4304
-
\??\c:\k20600.exec:\k20600.exe75⤵PID:4176
-
\??\c:\ffxxxll.exec:\ffxxxll.exe76⤵PID:3036
-
\??\c:\jvjvv.exec:\jvjvv.exe77⤵PID:3092
-
\??\c:\820228.exec:\820228.exe78⤵PID:1664
-
\??\c:\jvjpd.exec:\jvjpd.exe79⤵PID:1144
-
\??\c:\4000226.exec:\4000226.exe80⤵PID:4240
-
\??\c:\44608.exec:\44608.exe81⤵PID:4708
-
\??\c:\k66426.exec:\k66426.exe82⤵PID:3612
-
\??\c:\6222644.exec:\6222644.exe83⤵PID:4224
-
\??\c:\lxxxxll.exec:\lxxxxll.exe84⤵PID:4612
-
\??\c:\xrlffff.exec:\xrlffff.exe85⤵PID:3520
-
\??\c:\006600.exec:\006600.exe86⤵PID:1108
-
\??\c:\0266882.exec:\0266882.exe87⤵PID:4508
-
\??\c:\8400860.exec:\8400860.exe88⤵PID:1820
-
\??\c:\httttt.exec:\httttt.exe89⤵PID:3956
-
\??\c:\6802826.exec:\6802826.exe90⤵PID:1292
-
\??\c:\0286622.exec:\0286622.exe91⤵PID:468
-
\??\c:\04680.exec:\04680.exe92⤵PID:3856
-
\??\c:\nhbnht.exec:\nhbnht.exe93⤵PID:2732
-
\??\c:\thhhtn.exec:\thhhtn.exe94⤵PID:4332
-
\??\c:\44424.exec:\44424.exe95⤵PID:3296
-
\??\c:\pppjv.exec:\pppjv.exe96⤵PID:1960
-
\??\c:\46866.exec:\46866.exe97⤵PID:4820
-
\??\c:\2284888.exec:\2284888.exe98⤵PID:3928
-
\??\c:\s4048.exec:\s4048.exe99⤵
- System Location Discovery: System Language Discovery
PID:3828 -
\??\c:\rrrrfff.exec:\rrrrfff.exe100⤵PID:4060
-
\??\c:\4404040.exec:\4404040.exe101⤵PID:32
-
\??\c:\3vdpd.exec:\3vdpd.exe102⤵PID:4484
-
\??\c:\bhhthb.exec:\bhhthb.exe103⤵PID:2340
-
\??\c:\w06426.exec:\w06426.exe104⤵PID:2464
-
\??\c:\5hnhbt.exec:\5hnhbt.exe105⤵PID:1692
-
\??\c:\66606.exec:\66606.exe106⤵PID:1616
-
\??\c:\3pjpd.exec:\3pjpd.exe107⤵PID:1216
-
\??\c:\60222.exec:\60222.exe108⤵PID:5096
-
\??\c:\dppjp.exec:\dppjp.exe109⤵PID:2920
-
\??\c:\8004424.exec:\8004424.exe110⤵PID:2004
-
\??\c:\1ffffff.exec:\1ffffff.exe111⤵PID:2916
-
\??\c:\286260.exec:\286260.exe112⤵PID:2448
-
\??\c:\62482.exec:\62482.exe113⤵PID:3448
-
\??\c:\frllfff.exec:\frllfff.exe114⤵PID:1804
-
\??\c:\1djjp.exec:\1djjp.exe115⤵PID:3540
-
\??\c:\vjjjp.exec:\vjjjp.exe116⤵PID:1000
-
\??\c:\062466.exec:\062466.exe117⤵PID:1708
-
\??\c:\vvvpp.exec:\vvvpp.exe118⤵PID:4972
-
\??\c:\1tttnt.exec:\1tttnt.exe119⤵PID:4428
-
\??\c:\2800004.exec:\2800004.exe120⤵PID:3692
-
\??\c:\fxrrxxx.exec:\fxrrxxx.exe121⤵PID:2212
-
\??\c:\htnnbt.exec:\htnnbt.exe122⤵PID:4040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-