Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 23:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe
-
Size
452KB
-
MD5
62c1d9a088678e1601be87e3a7812ad2
-
SHA1
c9b441abd87a50d43067ce8ba674e5ec29f8dd82
-
SHA256
4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1
-
SHA512
f59ca0e23ae40d9736b31df83161245c6684540259ac8a704c4bec46b228e65ebad1fb5572962b94392af7a992c09f49b5ce52402e0ce023145e168985968f8c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2296-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-66-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-91-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/536-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-154-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1232-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-194-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1592-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-370-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2576-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-464-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1740-471-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2448-478-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2556-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-545-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/1416-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-579-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2380-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-767-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2408 3xfrrrr.exe 2436 jvddj.exe 2892 20002.exe 2980 k04062.exe 2920 lfrxflr.exe 2620 pdvpv.exe 2592 6086842.exe 2624 7jdjj.exe 536 jdjjp.exe 1168 nnnbth.exe 1500 xfxrxrr.exe 1876 rlfrfll.exe 2932 a0828.exe 2312 4864220.exe 1940 822406.exe 1232 1thhtb.exe 2800 6020648.exe 2044 rfrrfff.exe 1636 3hbhtb.exe 2180 2602046.exe 2424 82640.exe 1592 7fflxlf.exe 2164 xrlllll.exe 3020 thttbh.exe 1624 c444680.exe 1412 lfffxfr.exe 1884 7frlrxf.exe 1664 dvddj.exe 916 20240.exe 1800 ffrlrxf.exe 2064 pdjvj.exe 3032 w08844.exe 2212 rfffrlr.exe 1596 bthtbb.exe 2140 260640.exe 2408 rlxxffr.exe 2868 dvvvp.exe 2696 1jdjv.exe 2880 hbtbnh.exe 2748 dpdjp.exe 1632 xrlxrxr.exe 2576 640840.exe 2644 frfxxxf.exe 2176 8600006.exe 2888 60286.exe 1092 xxrfflf.exe 1036 8262802.exe 1812 2082224.exe 2660 1vjjp.exe 2940 m2068.exe 1820 868804.exe 1956 0800040.exe 1740 jdppd.exe 1064 dvpvj.exe 1524 2028006.exe 2820 3xllllx.exe 2448 64640.exe 2044 btntbb.exe 2556 866026.exe 2532 082288.exe 2104 3nthnn.exe 2460 xlrllfx.exe 3008 htbbbb.exe 1852 vjvdv.exe -
resource yara_rule behavioral1/memory/2296-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-370-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2576-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-464-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2556-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-545-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/1416-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-626-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42066.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0462268.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 868840.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 820060.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4666228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2408 2296 4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe 28 PID 2296 wrote to memory of 2408 2296 4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe 28 PID 2296 wrote to memory of 2408 2296 4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe 28 PID 2296 wrote to memory of 2408 2296 4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe 28 PID 2408 wrote to memory of 2436 2408 3xfrrrr.exe 29 PID 2408 wrote to memory of 2436 2408 3xfrrrr.exe 29 PID 2408 wrote to memory of 2436 2408 3xfrrrr.exe 29 PID 2408 wrote to memory of 2436 2408 3xfrrrr.exe 29 PID 2436 wrote to memory of 2892 2436 jvddj.exe 30 PID 2436 wrote to memory of 2892 2436 jvddj.exe 30 PID 2436 wrote to memory of 2892 2436 jvddj.exe 30 PID 2436 wrote to memory of 2892 2436 jvddj.exe 30 PID 2892 wrote to memory of 2980 2892 20002.exe 31 PID 2892 wrote to memory of 2980 2892 20002.exe 31 PID 2892 wrote to memory of 2980 2892 20002.exe 31 PID 2892 wrote to memory of 2980 2892 20002.exe 31 PID 2980 wrote to memory of 2920 2980 k04062.exe 32 PID 2980 wrote to memory of 2920 2980 k04062.exe 32 PID 2980 wrote to memory of 2920 2980 k04062.exe 32 PID 2980 wrote to memory of 2920 2980 k04062.exe 32 PID 2920 wrote to memory of 2620 2920 lfrxflr.exe 33 PID 2920 wrote to memory of 2620 2920 lfrxflr.exe 33 PID 2920 wrote to memory of 2620 2920 lfrxflr.exe 33 PID 2920 wrote to memory of 2620 2920 lfrxflr.exe 33 PID 2620 wrote to memory of 2592 2620 pdvpv.exe 34 PID 2620 wrote to memory of 2592 2620 pdvpv.exe 34 PID 2620 wrote to memory of 2592 2620 pdvpv.exe 34 PID 2620 wrote to memory of 2592 2620 pdvpv.exe 34 PID 2592 wrote to memory of 2624 2592 6086842.exe 35 PID 2592 wrote to memory of 2624 2592 6086842.exe 35 PID 2592 wrote to memory of 2624 2592 6086842.exe 35 PID 2592 wrote to memory of 2624 2592 6086842.exe 35 PID 2624 wrote to memory of 536 2624 7jdjj.exe 36 PID 2624 wrote to memory of 536 2624 7jdjj.exe 36 PID 2624 wrote to memory of 536 2624 7jdjj.exe 36 PID 2624 wrote to memory of 536 2624 7jdjj.exe 36 PID 536 wrote to memory of 1168 536 jdjjp.exe 37 PID 536 wrote to memory of 1168 536 jdjjp.exe 37 PID 536 wrote to memory of 1168 536 jdjjp.exe 37 PID 536 wrote to memory of 1168 536 jdjjp.exe 37 PID 1168 wrote to memory of 1500 1168 nnnbth.exe 38 PID 1168 wrote to memory of 1500 1168 nnnbth.exe 38 PID 1168 wrote to memory of 1500 1168 nnnbth.exe 38 PID 1168 wrote to memory of 1500 1168 nnnbth.exe 38 PID 1500 wrote to memory of 1876 1500 xfxrxrr.exe 39 PID 1500 wrote to memory of 1876 1500 xfxrxrr.exe 39 PID 1500 wrote to memory of 1876 1500 xfxrxrr.exe 39 PID 1500 wrote to memory of 1876 1500 xfxrxrr.exe 39 PID 1876 wrote to memory of 2932 1876 rlfrfll.exe 40 PID 1876 wrote to memory of 2932 1876 rlfrfll.exe 40 PID 1876 wrote to memory of 2932 1876 rlfrfll.exe 40 PID 1876 wrote to memory of 2932 1876 rlfrfll.exe 40 PID 2932 wrote to memory of 2312 2932 a0828.exe 41 PID 2932 wrote to memory of 2312 2932 a0828.exe 41 PID 2932 wrote to memory of 2312 2932 a0828.exe 41 PID 2932 wrote to memory of 2312 2932 a0828.exe 41 PID 2312 wrote to memory of 1940 2312 4864220.exe 42 PID 2312 wrote to memory of 1940 2312 4864220.exe 42 PID 2312 wrote to memory of 1940 2312 4864220.exe 42 PID 2312 wrote to memory of 1940 2312 4864220.exe 42 PID 1940 wrote to memory of 1232 1940 822406.exe 43 PID 1940 wrote to memory of 1232 1940 822406.exe 43 PID 1940 wrote to memory of 1232 1940 822406.exe 43 PID 1940 wrote to memory of 1232 1940 822406.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe"C:\Users\Admin\AppData\Local\Temp\4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\3xfrrrr.exec:\3xfrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\jvddj.exec:\jvddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\20002.exec:\20002.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\k04062.exec:\k04062.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\lfrxflr.exec:\lfrxflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\pdvpv.exec:\pdvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\6086842.exec:\6086842.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\7jdjj.exec:\7jdjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\jdjjp.exec:\jdjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\nnnbth.exec:\nnnbth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\xfxrxrr.exec:\xfxrxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\rlfrfll.exec:\rlfrfll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\a0828.exec:\a0828.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\4864220.exec:\4864220.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\822406.exec:\822406.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\1thhtb.exec:\1thhtb.exe17⤵
- Executes dropped EXE
PID:1232 -
\??\c:\6020648.exec:\6020648.exe18⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rfrrfff.exec:\rfrrfff.exe19⤵
- Executes dropped EXE
PID:2044 -
\??\c:\3hbhtb.exec:\3hbhtb.exe20⤵
- Executes dropped EXE
PID:1636 -
\??\c:\2602046.exec:\2602046.exe21⤵
- Executes dropped EXE
PID:2180 -
\??\c:\82640.exec:\82640.exe22⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7fflxlf.exec:\7fflxlf.exe23⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xrlllll.exec:\xrlllll.exe24⤵
- Executes dropped EXE
PID:2164 -
\??\c:\thttbh.exec:\thttbh.exe25⤵
- Executes dropped EXE
PID:3020 -
\??\c:\c444680.exec:\c444680.exe26⤵
- Executes dropped EXE
PID:1624 -
\??\c:\lfffxfr.exec:\lfffxfr.exe27⤵
- Executes dropped EXE
PID:1412 -
\??\c:\7frlrxf.exec:\7frlrxf.exe28⤵
- Executes dropped EXE
PID:1884 -
\??\c:\dvddj.exec:\dvddj.exe29⤵
- Executes dropped EXE
PID:1664 -
\??\c:\20240.exec:\20240.exe30⤵
- Executes dropped EXE
PID:916 -
\??\c:\ffrlrxf.exec:\ffrlrxf.exe31⤵
- Executes dropped EXE
PID:1800 -
\??\c:\pdjvj.exec:\pdjvj.exe32⤵
- Executes dropped EXE
PID:2064 -
\??\c:\w08844.exec:\w08844.exe33⤵
- Executes dropped EXE
PID:3032 -
\??\c:\rfffrlr.exec:\rfffrlr.exe34⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bthtbb.exec:\bthtbb.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\260640.exec:\260640.exe36⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rlxxffr.exec:\rlxxffr.exe37⤵
- Executes dropped EXE
PID:2408 -
\??\c:\dvvvp.exec:\dvvvp.exe38⤵
- Executes dropped EXE
PID:2868 -
\??\c:\1jdjv.exec:\1jdjv.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hbtbnh.exec:\hbtbnh.exe40⤵
- Executes dropped EXE
PID:2880 -
\??\c:\dpdjp.exec:\dpdjp.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\xrlxrxr.exec:\xrlxrxr.exe42⤵
- Executes dropped EXE
PID:1632 -
\??\c:\640840.exec:\640840.exe43⤵
- Executes dropped EXE
PID:2576 -
\??\c:\frfxxxf.exec:\frfxxxf.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2644 -
\??\c:\8600006.exec:\8600006.exe45⤵
- Executes dropped EXE
PID:2176 -
\??\c:\60286.exec:\60286.exe46⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xxrfflf.exec:\xxrfflf.exe47⤵
- Executes dropped EXE
PID:1092 -
\??\c:\8262802.exec:\8262802.exe48⤵
- Executes dropped EXE
PID:1036 -
\??\c:\2082224.exec:\2082224.exe49⤵
- Executes dropped EXE
PID:1812 -
\??\c:\1vjjp.exec:\1vjjp.exe50⤵
- Executes dropped EXE
PID:2660 -
\??\c:\m2068.exec:\m2068.exe51⤵
- Executes dropped EXE
PID:2940 -
\??\c:\868804.exec:\868804.exe52⤵
- Executes dropped EXE
PID:1820 -
\??\c:\0800040.exec:\0800040.exe53⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jdppd.exec:\jdppd.exe54⤵
- Executes dropped EXE
PID:1740 -
\??\c:\dvpvj.exec:\dvpvj.exe55⤵
- Executes dropped EXE
PID:1064 -
\??\c:\2028006.exec:\2028006.exe56⤵
- Executes dropped EXE
PID:1524 -
\??\c:\3xllllx.exec:\3xllllx.exe57⤵
- Executes dropped EXE
PID:2820 -
\??\c:\64640.exec:\64640.exe58⤵
- Executes dropped EXE
PID:2448 -
\??\c:\btntbb.exec:\btntbb.exe59⤵
- Executes dropped EXE
PID:2044 -
\??\c:\866026.exec:\866026.exe60⤵
- Executes dropped EXE
PID:2556 -
\??\c:\082288.exec:\082288.exe61⤵
- Executes dropped EXE
PID:2532 -
\??\c:\3nthnn.exec:\3nthnn.exe62⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xlrllfx.exec:\xlrllfx.exe63⤵
- Executes dropped EXE
PID:2460 -
\??\c:\htbbbb.exec:\htbbbb.exe64⤵
- Executes dropped EXE
PID:3008 -
\??\c:\vjvdv.exec:\vjvdv.exe65⤵
- Executes dropped EXE
PID:1852 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe66⤵PID:1348
-
\??\c:\26802.exec:\26802.exe67⤵PID:1796
-
\??\c:\c260280.exec:\c260280.exe68⤵PID:1416
-
\??\c:\64884.exec:\64884.exe69⤵PID:1980
-
\??\c:\6800662.exec:\6800662.exe70⤵PID:1728
-
\??\c:\dpjjp.exec:\dpjjp.exe71⤵PID:1788
-
\??\c:\4240606.exec:\4240606.exe72⤵PID:904
-
\??\c:\2688204.exec:\2688204.exe73⤵PID:1712
-
\??\c:\2640624.exec:\2640624.exe74⤵PID:1772
-
\??\c:\08280.exec:\08280.exe75⤵PID:2380
-
\??\c:\bnbbtt.exec:\bnbbtt.exe76⤵PID:1864
-
\??\c:\6084002.exec:\6084002.exe77⤵PID:3044
-
\??\c:\dvpvj.exec:\dvpvj.exe78⤵PID:2252
-
\??\c:\q42288.exec:\q42288.exe79⤵PID:1604
-
\??\c:\pddpp.exec:\pddpp.exe80⤵PID:2324
-
\??\c:\nnntbb.exec:\nnntbb.exe81⤵PID:2436
-
\??\c:\vpjvj.exec:\vpjvj.exe82⤵PID:2096
-
\??\c:\tthhbh.exec:\tthhbh.exe83⤵PID:2704
-
\??\c:\046022.exec:\046022.exe84⤵PID:2732
-
\??\c:\fxllffr.exec:\fxllffr.exe85⤵PID:2776
-
\??\c:\5pdjv.exec:\5pdjv.exe86⤵PID:2736
-
\??\c:\4246402.exec:\4246402.exe87⤵PID:2604
-
\??\c:\tnhhtt.exec:\tnhhtt.exe88⤵PID:1480
-
\??\c:\jdpvd.exec:\jdpvd.exe89⤵PID:2592
-
\??\c:\7pdpj.exec:\7pdpj.exe90⤵PID:2176
-
\??\c:\rxlxlxr.exec:\rxlxlxr.exe91⤵PID:2624
-
\??\c:\2422484.exec:\2422484.exe92⤵PID:1184
-
\??\c:\3xxlrxf.exec:\3xxlrxf.exe93⤵PID:1036
-
\??\c:\nhbnnt.exec:\nhbnnt.exe94⤵PID:1496
-
\??\c:\w20026.exec:\w20026.exe95⤵PID:2672
-
\??\c:\q40688.exec:\q40688.exe96⤵PID:2948
-
\??\c:\btnnbb.exec:\btnnbb.exe97⤵PID:2472
-
\??\c:\vvjjd.exec:\vvjjd.exe98⤵PID:2540
-
\??\c:\080660.exec:\080660.exe99⤵PID:2312
-
\??\c:\7thbhh.exec:\7thbhh.exe100⤵PID:1808
-
\??\c:\42002.exec:\42002.exe101⤵PID:1732
-
\??\c:\202800.exec:\202800.exe102⤵PID:2800
-
\??\c:\pjvjv.exec:\pjvjv.exe103⤵PID:1056
-
\??\c:\6468402.exec:\6468402.exe104⤵PID:2668
-
\??\c:\42062.exec:\42062.exe105⤵PID:2172
-
\??\c:\828024.exec:\828024.exe106⤵PID:2992
-
\??\c:\xrffrrf.exec:\xrffrrf.exe107⤵PID:2040
-
\??\c:\xlxxxfl.exec:\xlxxxfl.exe108⤵PID:2460
-
\??\c:\vpdjv.exec:\vpdjv.exe109⤵PID:3008
-
\??\c:\e86284.exec:\e86284.exe110⤵PID:1744
-
\??\c:\ppdpp.exec:\ppdpp.exe111⤵PID:1348
-
\??\c:\2022246.exec:\2022246.exe112⤵PID:108
-
\??\c:\vpjpv.exec:\vpjpv.exe113⤵PID:1616
-
\??\c:\k42460.exec:\k42460.exe114⤵PID:1980
-
\??\c:\o280222.exec:\o280222.exe115⤵PID:1672
-
\??\c:\xrxxffr.exec:\xrxxffr.exe116⤵PID:1620
-
\??\c:\0402644.exec:\0402644.exe117⤵PID:2512
-
\??\c:\60402.exec:\60402.exe118⤵PID:1468
-
\??\c:\82008.exec:\82008.exe119⤵PID:1784
-
\??\c:\9hbtnh.exec:\9hbtnh.exe120⤵PID:2220
-
\??\c:\tnbntn.exec:\tnbntn.exe121⤵PID:2204
-
\??\c:\htbhtb.exec:\htbhtb.exe122⤵PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-