Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 13:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49.exe
-
Size
53KB
-
MD5
f137b6ff5ad0a3b66840201784875e9c
-
SHA1
5c17e8afcc7e0667646cb2d354bc725ced7db6a7
-
SHA256
73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49
-
SHA512
58d9ec00b033f24bf2245907e3328c94f4f46c12ec6533dbdb2373f081ae811a85de079722833123239896b24fc51499351c3eecfd2ef0ce6562f113919479f4
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvl5:0cdpeeBSHHMHLf9RyIa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2784-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/952-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-343-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-353-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-363-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-384-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-391-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-413-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-429-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-439-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-465-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-493-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-519-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-551-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-905-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-924-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-949-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-1129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3552 1jppv.exe 2364 fxxxxxf.exe 3592 xrllfff.exe 4008 7vjpj.exe 3796 3vvpv.exe 3788 xxrrlrr.exe 696 nttttn.exe 3244 9thhbb.exe 1092 vpvpd.exe 3260 7djvj.exe 384 rlrrrfx.exe 3460 bhbttt.exe 3888 hhnntt.exe 8 ddppv.exe 952 1fxrffx.exe 1516 hhnnhh.exe 2340 ttnttt.exe 4416 dvvvj.exe 3124 rrrrrrl.exe 684 llxrxfl.exe 4372 ttnnhn.exe 4924 1rxxxxx.exe 1388 5lrlllr.exe 2008 ttbbtb.exe 3884 bhhnnn.exe 4932 pvppp.exe 4148 fxlfffl.exe 4104 ttttnn.exe 1584 7vdjv.exe 2460 7rrrrrl.exe 1348 fffrlfx.exe 736 tnthnb.exe 1188 hbnhtt.exe 3472 jpvpj.exe 4812 3fxlfxr.exe 1756 3llfxrf.exe 2344 fflllll.exe 1628 hbbnhh.exe 3752 3dvvp.exe 3036 flrlllx.exe 4408 tnnnhh.exe 4364 bthnnt.exe 1896 vvjpd.exe 4348 9ppdp.exe 1200 rrxxxxx.exe 4216 xrffxxx.exe 3688 tttntt.exe 2536 btbbhh.exe 4568 nntttt.exe 3128 vdpjd.exe 4456 1jjdv.exe 2312 rffxxrr.exe 1492 nhbtnh.exe 3392 btbhtt.exe 3192 dppjj.exe 2360 rllfrrl.exe 2296 3ntnnn.exe 4740 bnnhnb.exe 532 pjjdv.exe 4776 jjjjp.exe 2452 7rflxrl.exe 3108 nhhbhb.exe 3736 nhhhtt.exe 4516 dvjvp.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2784 wrote to memory of 3552 2784 73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49.exe 83 PID 2784 wrote to memory of 3552 2784 73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49.exe 83 PID 2784 wrote to memory of 3552 2784 73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49.exe 83 PID 3552 wrote to memory of 2364 3552 1jppv.exe 84 PID 3552 wrote to memory of 2364 3552 1jppv.exe 84 PID 3552 wrote to memory of 2364 3552 1jppv.exe 84 PID 2364 wrote to memory of 3592 2364 fxxxxxf.exe 85 PID 2364 wrote to memory of 3592 2364 fxxxxxf.exe 85 PID 2364 wrote to memory of 3592 2364 fxxxxxf.exe 85 PID 3592 wrote to memory of 4008 3592 xrllfff.exe 86 PID 3592 wrote to memory of 4008 3592 xrllfff.exe 86 PID 3592 wrote to memory of 4008 3592 xrllfff.exe 86 PID 4008 wrote to memory of 3796 4008 7vjpj.exe 87 PID 4008 wrote to memory of 3796 4008 7vjpj.exe 87 PID 4008 wrote to memory of 3796 4008 7vjpj.exe 87 PID 3796 wrote to memory of 3788 3796 3vvpv.exe 88 PID 3796 wrote to memory of 3788 3796 3vvpv.exe 88 PID 3796 wrote to memory of 3788 3796 3vvpv.exe 88 PID 3788 wrote to memory of 696 3788 xxrrlrr.exe 89 PID 3788 wrote to memory of 696 3788 xxrrlrr.exe 89 PID 3788 wrote to memory of 696 3788 xxrrlrr.exe 89 PID 696 wrote to memory of 3244 696 nttttn.exe 90 PID 696 wrote to memory of 3244 696 nttttn.exe 90 PID 696 wrote to memory of 3244 696 nttttn.exe 90 PID 3244 wrote to memory of 1092 3244 9thhbb.exe 91 PID 3244 wrote to memory of 1092 3244 9thhbb.exe 91 PID 3244 wrote to memory of 1092 3244 9thhbb.exe 91 PID 1092 wrote to memory of 3260 1092 vpvpd.exe 92 PID 1092 wrote to memory of 3260 1092 vpvpd.exe 92 PID 1092 wrote to memory of 3260 1092 vpvpd.exe 92 PID 3260 wrote to memory of 384 3260 7djvj.exe 93 PID 3260 wrote to memory of 384 3260 7djvj.exe 93 PID 3260 wrote to memory of 384 3260 7djvj.exe 93 PID 384 wrote to memory of 3460 384 rlrrrfx.exe 94 PID 384 wrote to memory of 3460 384 rlrrrfx.exe 94 PID 384 wrote to memory of 3460 384 rlrrrfx.exe 94 PID 3460 wrote to memory of 3888 3460 bhbttt.exe 95 PID 3460 wrote to memory of 3888 3460 bhbttt.exe 95 PID 3460 wrote to memory of 3888 3460 bhbttt.exe 95 PID 3888 wrote to memory of 8 3888 hhnntt.exe 96 PID 3888 wrote to memory of 8 3888 hhnntt.exe 96 PID 3888 wrote to memory of 8 3888 hhnntt.exe 96 PID 8 wrote to memory of 952 8 ddppv.exe 97 PID 8 wrote to memory of 952 8 ddppv.exe 97 PID 8 wrote to memory of 952 8 ddppv.exe 97 PID 952 wrote to memory of 1516 952 1fxrffx.exe 98 PID 952 wrote to memory of 1516 952 1fxrffx.exe 98 PID 952 wrote to memory of 1516 952 1fxrffx.exe 98 PID 1516 wrote to memory of 2340 1516 hhnnhh.exe 99 PID 1516 wrote to memory of 2340 1516 hhnnhh.exe 99 PID 1516 wrote to memory of 2340 1516 hhnnhh.exe 99 PID 2340 wrote to memory of 4416 2340 ttnttt.exe 100 PID 2340 wrote to memory of 4416 2340 ttnttt.exe 100 PID 2340 wrote to memory of 4416 2340 ttnttt.exe 100 PID 4416 wrote to memory of 3124 4416 dvvvj.exe 101 PID 4416 wrote to memory of 3124 4416 dvvvj.exe 101 PID 4416 wrote to memory of 3124 4416 dvvvj.exe 101 PID 3124 wrote to memory of 684 3124 rrrrrrl.exe 102 PID 3124 wrote to memory of 684 3124 rrrrrrl.exe 102 PID 3124 wrote to memory of 684 3124 rrrrrrl.exe 102 PID 684 wrote to memory of 4372 684 llxrxfl.exe 103 PID 684 wrote to memory of 4372 684 llxrxfl.exe 103 PID 684 wrote to memory of 4372 684 llxrxfl.exe 103 PID 4372 wrote to memory of 4924 4372 ttnnhn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49.exe"C:\Users\Admin\AppData\Local\Temp\73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\1jppv.exec:\1jppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\xrllfff.exec:\xrllfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\7vjpj.exec:\7vjpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\3vvpv.exec:\3vvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\xxrrlrr.exec:\xxrrlrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\nttttn.exec:\nttttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\9thhbb.exec:\9thhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\vpvpd.exec:\vpvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\7djvj.exec:\7djvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\rlrrrfx.exec:\rlrrrfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\bhbttt.exec:\bhbttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\hhnntt.exec:\hhnntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\ddppv.exec:\ddppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\1fxrffx.exec:\1fxrffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\hhnnhh.exec:\hhnnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\ttnttt.exec:\ttnttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\dvvvj.exec:\dvvvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\rrrrrrl.exec:\rrrrrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\llxrxfl.exec:\llxrxfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\ttnnhn.exec:\ttnnhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\1rxxxxx.exec:\1rxxxxx.exe23⤵
- Executes dropped EXE
PID:4924 -
\??\c:\5lrlllr.exec:\5lrlllr.exe24⤵
- Executes dropped EXE
PID:1388 -
\??\c:\ttbbtb.exec:\ttbbtb.exe25⤵
- Executes dropped EXE
PID:2008 -
\??\c:\bhhnnn.exec:\bhhnnn.exe26⤵
- Executes dropped EXE
PID:3884 -
\??\c:\pvppp.exec:\pvppp.exe27⤵
- Executes dropped EXE
PID:4932 -
\??\c:\fxlfffl.exec:\fxlfffl.exe28⤵
- Executes dropped EXE
PID:4148 -
\??\c:\ttttnn.exec:\ttttnn.exe29⤵
- Executes dropped EXE
PID:4104 -
\??\c:\7vdjv.exec:\7vdjv.exe30⤵
- Executes dropped EXE
PID:1584 -
\??\c:\7rrrrrl.exec:\7rrrrrl.exe31⤵
- Executes dropped EXE
PID:2460 -
\??\c:\fffrlfx.exec:\fffrlfx.exe32⤵
- Executes dropped EXE
PID:1348 -
\??\c:\tnthnb.exec:\tnthnb.exe33⤵
- Executes dropped EXE
PID:736 -
\??\c:\hbnhtt.exec:\hbnhtt.exe34⤵
- Executes dropped EXE
PID:1188 -
\??\c:\jpvpj.exec:\jpvpj.exe35⤵
- Executes dropped EXE
PID:3472 -
\??\c:\3fxlfxr.exec:\3fxlfxr.exe36⤵
- Executes dropped EXE
PID:4812 -
\??\c:\3llfxrf.exec:\3llfxrf.exe37⤵
- Executes dropped EXE
PID:1756 -
\??\c:\fflllll.exec:\fflllll.exe38⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hbbnhh.exec:\hbbnhh.exe39⤵
- Executes dropped EXE
PID:1628 -
\??\c:\3dvvp.exec:\3dvvp.exe40⤵
- Executes dropped EXE
PID:3752 -
\??\c:\flrlllx.exec:\flrlllx.exe41⤵
- Executes dropped EXE
PID:3036 -
\??\c:\tnnnhh.exec:\tnnnhh.exe42⤵
- Executes dropped EXE
PID:4408 -
\??\c:\bthnnt.exec:\bthnnt.exe43⤵
- Executes dropped EXE
PID:4364 -
\??\c:\vvjpd.exec:\vvjpd.exe44⤵
- Executes dropped EXE
PID:1896 -
\??\c:\9ppdp.exec:\9ppdp.exe45⤵
- Executes dropped EXE
PID:4348 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe46⤵
- Executes dropped EXE
PID:1200 -
\??\c:\xrffxxx.exec:\xrffxxx.exe47⤵
- Executes dropped EXE
PID:4216 -
\??\c:\tttntt.exec:\tttntt.exe48⤵
- Executes dropped EXE
PID:3688 -
\??\c:\btbbhh.exec:\btbbhh.exe49⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nntttt.exec:\nntttt.exe50⤵
- Executes dropped EXE
PID:4568 -
\??\c:\vdpjd.exec:\vdpjd.exe51⤵
- Executes dropped EXE
PID:3128 -
\??\c:\1jjdv.exec:\1jjdv.exe52⤵
- Executes dropped EXE
PID:4456 -
\??\c:\rffxxrr.exec:\rffxxrr.exe53⤵
- Executes dropped EXE
PID:2312 -
\??\c:\nhbtnh.exec:\nhbtnh.exe54⤵
- Executes dropped EXE
PID:1492 -
\??\c:\btbhtt.exec:\btbhtt.exe55⤵
- Executes dropped EXE
PID:3392 -
\??\c:\dppjj.exec:\dppjj.exe56⤵
- Executes dropped EXE
PID:3192 -
\??\c:\rllfrrl.exec:\rllfrrl.exe57⤵
- Executes dropped EXE
PID:2360 -
\??\c:\3ntnnn.exec:\3ntnnn.exe58⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bnnhnb.exec:\bnnhnb.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4740 -
\??\c:\pjjdv.exec:\pjjdv.exe60⤵
- Executes dropped EXE
PID:532 -
\??\c:\jjjjp.exec:\jjjjp.exe61⤵
- Executes dropped EXE
PID:4776 -
\??\c:\7rflxrl.exec:\7rflxrl.exe62⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nhhbhb.exec:\nhhbhb.exe63⤵
- Executes dropped EXE
PID:3108 -
\??\c:\nhhhtt.exec:\nhhhtt.exe64⤵
- Executes dropped EXE
PID:3736 -
\??\c:\dvjvp.exec:\dvjvp.exe65⤵
- Executes dropped EXE
PID:4516 -
\??\c:\1xrlfxr.exec:\1xrlfxr.exe66⤵PID:3260
-
\??\c:\3rfffxx.exec:\3rfffxx.exe67⤵PID:5116
-
\??\c:\7bbtth.exec:\7bbtth.exe68⤵PID:3212
-
\??\c:\jvppj.exec:\jvppj.exe69⤵PID:3628
-
\??\c:\xlfrlfx.exec:\xlfrlfx.exe70⤵PID:3716
-
\??\c:\bhbtnh.exec:\bhbtnh.exe71⤵PID:3380
-
\??\c:\jpppd.exec:\jpppd.exe72⤵PID:4580
-
\??\c:\lfffxfx.exec:\lfffxfx.exe73⤵PID:952
-
\??\c:\lffxfxx.exec:\lffxfxx.exe74⤵PID:1384
-
\??\c:\tttthb.exec:\tttthb.exe75⤵PID:1792
-
\??\c:\5jppd.exec:\5jppd.exe76⤵PID:2004
-
\??\c:\rrxrrrx.exec:\rrxrrrx.exe77⤵PID:4704
-
\??\c:\htthbt.exec:\htthbt.exe78⤵PID:3576
-
\??\c:\jpdpd.exec:\jpdpd.exe79⤵PID:2708
-
\??\c:\rffxrrl.exec:\rffxrrl.exe80⤵PID:3984
-
\??\c:\pjpjj.exec:\pjpjj.exe81⤵PID:3228
-
\??\c:\3llxlfr.exec:\3llxlfr.exe82⤵PID:4372
-
\??\c:\fllfxfr.exec:\fllfxfr.exe83⤵PID:3076
-
\??\c:\bnhbtt.exec:\bnhbtt.exe84⤵PID:4752
-
\??\c:\5vpdp.exec:\5vpdp.exe85⤵PID:1132
-
\??\c:\5vdvj.exec:\5vdvj.exe86⤵PID:4108
-
\??\c:\xflxrlf.exec:\xflxrlf.exe87⤵PID:4804
-
\??\c:\thtnbb.exec:\thtnbb.exe88⤵PID:2504
-
\??\c:\5tbnbb.exec:\5tbnbb.exe89⤵PID:2624
-
\??\c:\jdddv.exec:\jdddv.exe90⤵PID:4488
-
\??\c:\frxrlfx.exec:\frxrlfx.exe91⤵PID:220
-
\??\c:\lffxxrr.exec:\lffxxrr.exe92⤵PID:112
-
\??\c:\1ntnnn.exec:\1ntnnn.exe93⤵PID:440
-
\??\c:\pdjdv.exec:\pdjdv.exe94⤵PID:2568
-
\??\c:\3rrlffr.exec:\3rrlffr.exe95⤵PID:3692
-
\??\c:\lfxrlfl.exec:\lfxrlfl.exe96⤵PID:4184
-
\??\c:\pjpvv.exec:\pjpvv.exe97⤵PID:2368
-
\??\c:\ffrlfff.exec:\ffrlfff.exe98⤵PID:3672
-
\??\c:\frlllfx.exec:\frlllfx.exe99⤵PID:1932
-
\??\c:\3tthtn.exec:\3tthtn.exe100⤵PID:2344
-
\??\c:\pjjdp.exec:\pjjdp.exe101⤵PID:2348
-
\??\c:\xrrlllf.exec:\xrrlllf.exe102⤵PID:60
-
\??\c:\rlfxrxr.exec:\rlfxrxr.exe103⤵PID:4736
-
\??\c:\bhbbnn.exec:\bhbbnn.exe104⤵PID:3064
-
\??\c:\bbhhtb.exec:\bbhhtb.exe105⤵PID:4364
-
\??\c:\vjdjv.exec:\vjdjv.exe106⤵PID:3268
-
\??\c:\dvvjd.exec:\dvvjd.exe107⤵PID:3584
-
\??\c:\xxxxxfx.exec:\xxxxxfx.exe108⤵PID:3940
-
\??\c:\htthtt.exec:\htthtt.exe109⤵PID:2440
-
\??\c:\bnhbtn.exec:\bnhbtn.exe110⤵PID:3336
-
\??\c:\5pvpj.exec:\5pvpj.exe111⤵PID:860
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe112⤵PID:376
-
\??\c:\3rlrlrl.exec:\3rlrlrl.exe113⤵PID:4484
-
\??\c:\nhnnhn.exec:\nhnnhn.exe114⤵PID:4428
-
\??\c:\nhbtnn.exec:\nhbtnn.exe115⤵PID:3092
-
\??\c:\7dpjd.exec:\7dpjd.exe116⤵PID:4964
-
\??\c:\1rxrllf.exec:\1rxrllf.exe117⤵PID:2560
-
\??\c:\7rrlxfl.exec:\7rrlxfl.exe118⤵PID:620
-
\??\c:\hbhbbt.exec:\hbhbbt.exe119⤵PID:2984
-
\??\c:\9jvvj.exec:\9jvvj.exe120⤵PID:4204
-
\??\c:\rxlxfff.exec:\rxlxfff.exe121⤵PID:3596
-
\??\c:\bnbhbh.exec:\bnbhbh.exe122⤵PID:4740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-