Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 01:37
Static task
static1
Behavioral task
behavioral1
Sample
9eb5cea4d87deffe920c70c2e20717185aaf17a9e7ac539103163a4fc8dabee1.exe
Resource
win7-20241010-en
General
-
Target
9eb5cea4d87deffe920c70c2e20717185aaf17a9e7ac539103163a4fc8dabee1.exe
-
Size
75KB
-
MD5
6a80c71d4bf36bba3919b38458520207
-
SHA1
26ef483b9d94886f83d3e932a1133748acca31d7
-
SHA256
9eb5cea4d87deffe920c70c2e20717185aaf17a9e7ac539103163a4fc8dabee1
-
SHA512
06745695ee55a1ed775a892841fdc547398d025872b4397e05d23d6082e459845f3295465418b2e9340edc60ca1c5d59990fd5c8bb75654e2d56966c19278654
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmsh:ymb3NkkiQ3mdBjFIvl358nLA89OMFVH/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/3212-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2460 frxllfr.exe 1924 nhbtnn.exe 3808 7tnhhh.exe 4896 pdjvp.exe 4536 xrrlxxr.exe 1476 fxxrllf.exe 4856 hhhtbn.exe 4188 dvdvv.exe 2796 3xrfxrr.exe 2960 rlllflf.exe 2252 tbnnhh.exe 2216 vjjvv.exe 2408 frxlrfl.exe 2512 hthnth.exe 2004 rrlxrrf.exe 3220 rlxxffl.exe 380 nhbhbb.exe 1248 5pdvj.exe 2892 lrffrfr.exe 5072 thnnhh.exe 3028 pvdpj.exe 4248 hntbbn.exe 808 pjjpd.exe 1928 rrxxxrl.exe 448 7hbbbb.exe 4812 pjvdj.exe 1348 xrfrrrr.exe 1116 btbbbb.exe 2200 7djjv.exe 2396 1fllxrl.exe 2896 bnbbnb.exe 3992 thnnbn.exe 3472 pdpvp.exe 2988 lfrxxff.exe 4740 ntthbn.exe 2956 vjjdv.exe 3340 jjvpj.exe 4596 3xffxfl.exe 4652 bnnnhh.exe 2128 ttbttn.exe 2292 jdjdd.exe 3840 frfrfrf.exe 4332 ththtt.exe 3724 pdpvp.exe 4832 3lxxxxf.exe 4256 hnttnn.exe 3508 jdjdd.exe 4708 3vjjd.exe 2244 xxffflr.exe 2772 pdjjj.exe 3032 rllfxxr.exe 3056 thhntt.exe 1372 3hhhhh.exe 2800 5pddp.exe 4548 lrrrrxx.exe 3932 hnntbt.exe 4288 pdjdv.exe 896 7rxrflf.exe 1212 bthnnn.exe 744 bhnnnb.exe 3836 djjjv.exe 1576 lllfrfl.exe 804 rlrrrfr.exe 4404 ttnhnn.exe -
resource yara_rule behavioral2/memory/3212-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4188-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/808-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3212 wrote to memory of 2460 3212 9eb5cea4d87deffe920c70c2e20717185aaf17a9e7ac539103163a4fc8dabee1.exe 82 PID 3212 wrote to memory of 2460 3212 9eb5cea4d87deffe920c70c2e20717185aaf17a9e7ac539103163a4fc8dabee1.exe 82 PID 3212 wrote to memory of 2460 3212 9eb5cea4d87deffe920c70c2e20717185aaf17a9e7ac539103163a4fc8dabee1.exe 82 PID 2460 wrote to memory of 1924 2460 frxllfr.exe 83 PID 2460 wrote to memory of 1924 2460 frxllfr.exe 83 PID 2460 wrote to memory of 1924 2460 frxllfr.exe 83 PID 1924 wrote to memory of 3808 1924 nhbtnn.exe 84 PID 1924 wrote to memory of 3808 1924 nhbtnn.exe 84 PID 1924 wrote to memory of 3808 1924 nhbtnn.exe 84 PID 3808 wrote to memory of 4896 3808 7tnhhh.exe 85 PID 3808 wrote to memory of 4896 3808 7tnhhh.exe 85 PID 3808 wrote to memory of 4896 3808 7tnhhh.exe 85 PID 4896 wrote to memory of 4536 4896 pdjvp.exe 86 PID 4896 wrote to memory of 4536 4896 pdjvp.exe 86 PID 4896 wrote to memory of 4536 4896 pdjvp.exe 86 PID 4536 wrote to memory of 1476 4536 xrrlxxr.exe 87 PID 4536 wrote to memory of 1476 4536 xrrlxxr.exe 87 PID 4536 wrote to memory of 1476 4536 xrrlxxr.exe 87 PID 1476 wrote to memory of 4856 1476 fxxrllf.exe 88 PID 1476 wrote to memory of 4856 1476 fxxrllf.exe 88 PID 1476 wrote to memory of 4856 1476 fxxrllf.exe 88 PID 4856 wrote to memory of 4188 4856 hhhtbn.exe 89 PID 4856 wrote to memory of 4188 4856 hhhtbn.exe 89 PID 4856 wrote to memory of 4188 4856 hhhtbn.exe 89 PID 4188 wrote to memory of 2796 4188 dvdvv.exe 90 PID 4188 wrote to memory of 2796 4188 dvdvv.exe 90 PID 4188 wrote to memory of 2796 4188 dvdvv.exe 90 PID 2796 wrote to memory of 2960 2796 3xrfxrr.exe 91 PID 2796 wrote to memory of 2960 2796 3xrfxrr.exe 91 PID 2796 wrote to memory of 2960 2796 3xrfxrr.exe 91 PID 2960 wrote to memory of 2252 2960 rlllflf.exe 92 PID 2960 wrote to memory of 2252 2960 rlllflf.exe 92 PID 2960 wrote to memory of 2252 2960 rlllflf.exe 92 PID 2252 wrote to memory of 2216 2252 tbnnhh.exe 93 PID 2252 wrote to memory of 2216 2252 tbnnhh.exe 93 PID 2252 wrote to memory of 2216 2252 tbnnhh.exe 93 PID 2216 wrote to memory of 2408 2216 vjjvv.exe 94 PID 2216 wrote to memory of 2408 2216 vjjvv.exe 94 PID 2216 wrote to memory of 2408 2216 vjjvv.exe 94 PID 2408 wrote to memory of 2512 2408 frxlrfl.exe 95 PID 2408 wrote to memory of 2512 2408 frxlrfl.exe 95 PID 2408 wrote to memory of 2512 2408 frxlrfl.exe 95 PID 2512 wrote to memory of 2004 2512 hthnth.exe 96 PID 2512 wrote to memory of 2004 2512 hthnth.exe 96 PID 2512 wrote to memory of 2004 2512 hthnth.exe 96 PID 2004 wrote to memory of 3220 2004 rrlxrrf.exe 97 PID 2004 wrote to memory of 3220 2004 rrlxrrf.exe 97 PID 2004 wrote to memory of 3220 2004 rrlxrrf.exe 97 PID 3220 wrote to memory of 380 3220 rlxxffl.exe 98 PID 3220 wrote to memory of 380 3220 rlxxffl.exe 98 PID 3220 wrote to memory of 380 3220 rlxxffl.exe 98 PID 380 wrote to memory of 1248 380 nhbhbb.exe 99 PID 380 wrote to memory of 1248 380 nhbhbb.exe 99 PID 380 wrote to memory of 1248 380 nhbhbb.exe 99 PID 1248 wrote to memory of 2892 1248 5pdvj.exe 100 PID 1248 wrote to memory of 2892 1248 5pdvj.exe 100 PID 1248 wrote to memory of 2892 1248 5pdvj.exe 100 PID 2892 wrote to memory of 5072 2892 lrffrfr.exe 101 PID 2892 wrote to memory of 5072 2892 lrffrfr.exe 101 PID 2892 wrote to memory of 5072 2892 lrffrfr.exe 101 PID 5072 wrote to memory of 3028 5072 thnnhh.exe 102 PID 5072 wrote to memory of 3028 5072 thnnhh.exe 102 PID 5072 wrote to memory of 3028 5072 thnnhh.exe 102 PID 3028 wrote to memory of 4248 3028 pvdpj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9eb5cea4d87deffe920c70c2e20717185aaf17a9e7ac539103163a4fc8dabee1.exe"C:\Users\Admin\AppData\Local\Temp\9eb5cea4d87deffe920c70c2e20717185aaf17a9e7ac539103163a4fc8dabee1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\frxllfr.exec:\frxllfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\nhbtnn.exec:\nhbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\7tnhhh.exec:\7tnhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\pdjvp.exec:\pdjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\fxxrllf.exec:\fxxrllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\hhhtbn.exec:\hhhtbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\dvdvv.exec:\dvdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\3xrfxrr.exec:\3xrfxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\rlllflf.exec:\rlllflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\tbnnhh.exec:\tbnnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\vjjvv.exec:\vjjvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\frxlrfl.exec:\frxlrfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\hthnth.exec:\hthnth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\rrlxrrf.exec:\rrlxrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\rlxxffl.exec:\rlxxffl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\nhbhbb.exec:\nhbhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\5pdvj.exec:\5pdvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\lrffrfr.exec:\lrffrfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\thnnhh.exec:\thnnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\pvdpj.exec:\pvdpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\hntbbn.exec:\hntbbn.exe23⤵
- Executes dropped EXE
PID:4248 -
\??\c:\pjjpd.exec:\pjjpd.exe24⤵
- Executes dropped EXE
PID:808 -
\??\c:\rrxxxrl.exec:\rrxxxrl.exe25⤵
- Executes dropped EXE
PID:1928 -
\??\c:\7hbbbb.exec:\7hbbbb.exe26⤵
- Executes dropped EXE
PID:448 -
\??\c:\pjvdj.exec:\pjvdj.exe27⤵
- Executes dropped EXE
PID:4812 -
\??\c:\xrfrrrr.exec:\xrfrrrr.exe28⤵
- Executes dropped EXE
PID:1348 -
\??\c:\btbbbb.exec:\btbbbb.exe29⤵
- Executes dropped EXE
PID:1116 -
\??\c:\7djjv.exec:\7djjv.exe30⤵
- Executes dropped EXE
PID:2200 -
\??\c:\1fllxrl.exec:\1fllxrl.exe31⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bnbbnb.exec:\bnbbnb.exe32⤵
- Executes dropped EXE
PID:2896 -
\??\c:\thnnbn.exec:\thnnbn.exe33⤵
- Executes dropped EXE
PID:3992 -
\??\c:\pdpvp.exec:\pdpvp.exe34⤵
- Executes dropped EXE
PID:3472 -
\??\c:\lfrxxff.exec:\lfrxxff.exe35⤵
- Executes dropped EXE
PID:2988 -
\??\c:\ntthbn.exec:\ntthbn.exe36⤵
- Executes dropped EXE
PID:4740 -
\??\c:\vjjdv.exec:\vjjdv.exe37⤵
- Executes dropped EXE
PID:2956 -
\??\c:\jjvpj.exec:\jjvpj.exe38⤵
- Executes dropped EXE
PID:3340 -
\??\c:\3xffxfl.exec:\3xffxfl.exe39⤵
- Executes dropped EXE
PID:4596 -
\??\c:\bnnnhh.exec:\bnnnhh.exe40⤵
- Executes dropped EXE
PID:4652 -
\??\c:\ttbttn.exec:\ttbttn.exe41⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jdjdd.exec:\jdjdd.exe42⤵
- Executes dropped EXE
PID:2292 -
\??\c:\frfrfrf.exec:\frfrfrf.exe43⤵
- Executes dropped EXE
PID:3840 -
\??\c:\ththtt.exec:\ththtt.exe44⤵
- Executes dropped EXE
PID:4332 -
\??\c:\pdpvp.exec:\pdpvp.exe45⤵
- Executes dropped EXE
PID:3724 -
\??\c:\3lxxxxf.exec:\3lxxxxf.exe46⤵
- Executes dropped EXE
PID:4832 -
\??\c:\hnttnn.exec:\hnttnn.exe47⤵
- Executes dropped EXE
PID:4256 -
\??\c:\jdjdd.exec:\jdjdd.exe48⤵
- Executes dropped EXE
PID:3508 -
\??\c:\3vjjd.exec:\3vjjd.exe49⤵
- Executes dropped EXE
PID:4708 -
\??\c:\xxffflr.exec:\xxffflr.exe50⤵
- Executes dropped EXE
PID:2244 -
\??\c:\pdjjj.exec:\pdjjj.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2772 -
\??\c:\rllfxxr.exec:\rllfxxr.exe52⤵
- Executes dropped EXE
PID:3032 -
\??\c:\thhntt.exec:\thhntt.exe53⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3hhhhh.exec:\3hhhhh.exe54⤵
- Executes dropped EXE
PID:1372 -
\??\c:\5pddp.exec:\5pddp.exe55⤵
- Executes dropped EXE
PID:2800 -
\??\c:\lrrrrxx.exec:\lrrrrxx.exe56⤵
- Executes dropped EXE
PID:4548 -
\??\c:\hnntbt.exec:\hnntbt.exe57⤵
- Executes dropped EXE
PID:3932 -
\??\c:\pdjdv.exec:\pdjdv.exe58⤵
- Executes dropped EXE
PID:4288 -
\??\c:\7rxrflf.exec:\7rxrflf.exe59⤵
- Executes dropped EXE
PID:896 -
\??\c:\bthnnn.exec:\bthnnn.exe60⤵
- Executes dropped EXE
PID:1212 -
\??\c:\bhnnnb.exec:\bhnnnb.exe61⤵
- Executes dropped EXE
PID:744 -
\??\c:\djjjv.exec:\djjjv.exe62⤵
- Executes dropped EXE
PID:3836 -
\??\c:\lllfrfl.exec:\lllfrfl.exe63⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rlrrrfr.exec:\rlrrrfr.exe64⤵
- Executes dropped EXE
PID:804 -
\??\c:\ttnhnn.exec:\ttnhnn.exe65⤵
- Executes dropped EXE
PID:4404 -
\??\c:\ddvdj.exec:\ddvdj.exe66⤵PID:5008
-
\??\c:\vddjv.exec:\vddjv.exe67⤵PID:4784
-
\??\c:\5xffrll.exec:\5xffrll.exe68⤵PID:4816
-
\??\c:\hbtthh.exec:\hbtthh.exe69⤵PID:3884
-
\??\c:\bbbnnb.exec:\bbbnnb.exe70⤵PID:5092
-
\??\c:\pvvpd.exec:\pvvpd.exe71⤵PID:440
-
\??\c:\xfllxlf.exec:\xfllxlf.exe72⤵PID:3768
-
\??\c:\fxxxlfr.exec:\fxxxlfr.exe73⤵PID:3772
-
\??\c:\htbthh.exec:\htbthh.exe74⤵PID:4868
-
\??\c:\bnnhbt.exec:\bnnhbt.exe75⤵PID:2452
-
\??\c:\vdpdv.exec:\vdpdv.exe76⤵PID:4416
-
\??\c:\vvdpj.exec:\vvdpj.exe77⤵PID:1928
-
\??\c:\flfrllf.exec:\flfrllf.exe78⤵PID:2120
-
\??\c:\5nbtbt.exec:\5nbtbt.exe79⤵PID:880
-
\??\c:\bttntt.exec:\bttntt.exe80⤵PID:1648
-
\??\c:\btbthb.exec:\btbthb.exe81⤵PID:4428
-
\??\c:\pdpjj.exec:\pdpjj.exe82⤵PID:1348
-
\??\c:\3xxrffx.exec:\3xxrffx.exe83⤵PID:2808
-
\??\c:\rxflffx.exec:\rxflffx.exe84⤵PID:2240
-
\??\c:\btbbth.exec:\btbbth.exe85⤵PID:1184
-
\??\c:\jpdvd.exec:\jpdvd.exe86⤵PID:3272
-
\??\c:\fxfxflr.exec:\fxfxflr.exe87⤵PID:3560
-
\??\c:\1bhhnn.exec:\1bhhnn.exe88⤵PID:3992
-
\??\c:\btbbhh.exec:\btbbhh.exe89⤵PID:2056
-
\??\c:\jdpdj.exec:\jdpdj.exe90⤵PID:4776
-
\??\c:\rffxfrl.exec:\rffxfrl.exe91⤵PID:1336
-
\??\c:\frlxfll.exec:\frlxfll.exe92⤵PID:4068
-
\??\c:\5ntbhb.exec:\5ntbhb.exe93⤵PID:1500
-
\??\c:\pdpjp.exec:\pdpjp.exe94⤵PID:868
-
\??\c:\pjvpd.exec:\pjvpd.exe95⤵PID:4908
-
\??\c:\5rrfxfx.exec:\5rrfxfx.exe96⤵PID:2464
-
\??\c:\xxxllrr.exec:\xxxllrr.exe97⤵PID:912
-
\??\c:\3htbtn.exec:\3htbtn.exe98⤵PID:4360
-
\??\c:\jjppj.exec:\jjppj.exe99⤵PID:3268
-
\??\c:\jdjdp.exec:\jdjdp.exe100⤵PID:2448
-
\??\c:\1frfrrl.exec:\1frfrrl.exe101⤵PID:1480
-
\??\c:\nbnhtt.exec:\nbnhtt.exe102⤵PID:1172
-
\??\c:\vjppp.exec:\vjppp.exe103⤵PID:3236
-
\??\c:\ppvdd.exec:\ppvdd.exe104⤵PID:3140
-
\??\c:\9frrxlf.exec:\9frrxlf.exe105⤵PID:3808
-
\??\c:\hnnttt.exec:\hnnttt.exe106⤵PID:920
-
\??\c:\1btnht.exec:\1btnht.exe107⤵PID:2132
-
\??\c:\pjjvp.exec:\pjjvp.exe108⤵PID:1476
-
\??\c:\bhhbbn.exec:\bhhbbn.exe109⤵PID:1908
-
\??\c:\ppvpj.exec:\ppvpj.exe110⤵PID:2732
-
\??\c:\pjvjp.exec:\pjvjp.exe111⤵PID:4672
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe112⤵PID:4272
-
\??\c:\tbttbt.exec:\tbttbt.exe113⤵PID:4936
-
\??\c:\bnnbnn.exec:\bnnbnn.exe114⤵PID:896
-
\??\c:\pddvp.exec:\pddvp.exe115⤵PID:4604
-
\??\c:\jjjpj.exec:\jjjpj.exe116⤵PID:1764
-
\??\c:\1flfrll.exec:\1flfrll.exe117⤵PID:2740
-
\??\c:\hthbbb.exec:\hthbbb.exe118⤵PID:4984
-
\??\c:\thnttt.exec:\thnttt.exe119⤵PID:4404
-
\??\c:\7djjd.exec:\7djjd.exe120⤵PID:1368
-
\??\c:\flxxrff.exec:\flxxrff.exe121⤵PID:4680
-
\??\c:\lllrxxx.exec:\lllrxxx.exe122⤵PID:512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-