Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 00:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946.exe
-
Size
455KB
-
MD5
34ba055ccefa7f7c51290aab003a3646
-
SHA1
3268a60f7a4be956c8a67c2bf2153f2e6958e835
-
SHA256
9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946
-
SHA512
04db03670f95875a3088c9680e52b97586c1ead7274c2dec23b89224a627b6c9283915e5c90adc1e35104244c1dfec3b5783fe1e9dd854c4af151c04e91c4b05
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTT:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2720-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-56-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1688-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-139-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2472-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-174-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2088-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-280-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2348-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-306-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1900-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-337-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2748-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-425-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1452-429-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1760-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/608-541-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1728-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-747-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2184-772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-779-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2720 820644.exe 2732 pjjpj.exe 1800 3xllrxx.exe 2896 llxlffx.exe 2576 8242060.exe 1688 626806.exe 2616 hhbhtb.exe 988 26064.exe 1216 88628.exe 2436 fxlllxr.exe 2104 tthhtt.exe 2864 xffxllr.exe 1580 0462408.exe 1244 jdpdd.exe 2472 488680.exe 1740 880806.exe 2556 0426228.exe 2232 2606886.exe 2088 rlxflrf.exe 2440 00468.exe 1472 486642.exe 916 660646.exe 440 608066.exe 1276 3ntntt.exe 1804 lxfxxrr.exe 1656 9tntnb.exe 896 5pjdv.exe 2976 vvpjv.exe 1616 jpdpj.exe 2356 042262.exe 2348 00402.exe 2364 86402.exe 1900 1thttb.exe 2804 dpdpp.exe 1524 e82844.exe 2736 604826.exe 2712 i202846.exe 2628 8202068.exe 2604 m4468.exe 2652 04808.exe 2748 jvpjv.exe 532 tbtttb.exe 2616 w48044.exe 1108 64848.exe 2208 ddjpp.exe 2464 fxxfflr.exe 1584 1rlrxfr.exe 1768 886440.exe 2108 4202840.exe 1540 o806880.exe 1452 7fxxffl.exe 1760 w20684.exe 1868 048066.exe 1736 llflxfl.exe 2392 604684.exe 2352 264088.exe 2240 vpjpj.exe 2032 nnbnht.exe 2428 4806228.exe 1132 9jdvj.exe 2096 xxllxxf.exe 440 44448.exe 1684 xrflffr.exe 1284 pjvvj.exe -
resource yara_rule behavioral1/memory/2720-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-772-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44468.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 260262.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66468.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4424848.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o668220.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26468.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 826866.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u444068.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 248462.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2720 2400 9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946.exe 30 PID 2400 wrote to memory of 2720 2400 9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946.exe 30 PID 2400 wrote to memory of 2720 2400 9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946.exe 30 PID 2400 wrote to memory of 2720 2400 9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946.exe 30 PID 2720 wrote to memory of 2732 2720 820644.exe 31 PID 2720 wrote to memory of 2732 2720 820644.exe 31 PID 2720 wrote to memory of 2732 2720 820644.exe 31 PID 2720 wrote to memory of 2732 2720 820644.exe 31 PID 2732 wrote to memory of 1800 2732 pjjpj.exe 32 PID 2732 wrote to memory of 1800 2732 pjjpj.exe 32 PID 2732 wrote to memory of 1800 2732 pjjpj.exe 32 PID 2732 wrote to memory of 1800 2732 pjjpj.exe 32 PID 1800 wrote to memory of 2896 1800 3xllrxx.exe 33 PID 1800 wrote to memory of 2896 1800 3xllrxx.exe 33 PID 1800 wrote to memory of 2896 1800 3xllrxx.exe 33 PID 1800 wrote to memory of 2896 1800 3xllrxx.exe 33 PID 2896 wrote to memory of 2576 2896 llxlffx.exe 34 PID 2896 wrote to memory of 2576 2896 llxlffx.exe 34 PID 2896 wrote to memory of 2576 2896 llxlffx.exe 34 PID 2896 wrote to memory of 2576 2896 llxlffx.exe 34 PID 2576 wrote to memory of 1688 2576 8242060.exe 35 PID 2576 wrote to memory of 1688 2576 8242060.exe 35 PID 2576 wrote to memory of 1688 2576 8242060.exe 35 PID 2576 wrote to memory of 1688 2576 8242060.exe 35 PID 1688 wrote to memory of 2616 1688 626806.exe 36 PID 1688 wrote to memory of 2616 1688 626806.exe 36 PID 1688 wrote to memory of 2616 1688 626806.exe 36 PID 1688 wrote to memory of 2616 1688 626806.exe 36 PID 2616 wrote to memory of 988 2616 hhbhtb.exe 37 PID 2616 wrote to memory of 988 2616 hhbhtb.exe 37 PID 2616 wrote to memory of 988 2616 hhbhtb.exe 37 PID 2616 wrote to memory of 988 2616 hhbhtb.exe 37 PID 988 wrote to memory of 1216 988 26064.exe 38 PID 988 wrote to memory of 1216 988 26064.exe 38 PID 988 wrote to memory of 1216 988 26064.exe 38 PID 988 wrote to memory of 1216 988 26064.exe 38 PID 1216 wrote to memory of 2436 1216 88628.exe 39 PID 1216 wrote to memory of 2436 1216 88628.exe 39 PID 1216 wrote to memory of 2436 1216 88628.exe 39 PID 1216 wrote to memory of 2436 1216 88628.exe 39 PID 2436 wrote to memory of 2104 2436 fxlllxr.exe 40 PID 2436 wrote to memory of 2104 2436 fxlllxr.exe 40 PID 2436 wrote to memory of 2104 2436 fxlllxr.exe 40 PID 2436 wrote to memory of 2104 2436 fxlllxr.exe 40 PID 2104 wrote to memory of 2864 2104 tthhtt.exe 41 PID 2104 wrote to memory of 2864 2104 tthhtt.exe 41 PID 2104 wrote to memory of 2864 2104 tthhtt.exe 41 PID 2104 wrote to memory of 2864 2104 tthhtt.exe 41 PID 2864 wrote to memory of 1580 2864 xffxllr.exe 42 PID 2864 wrote to memory of 1580 2864 xffxllr.exe 42 PID 2864 wrote to memory of 1580 2864 xffxllr.exe 42 PID 2864 wrote to memory of 1580 2864 xffxllr.exe 42 PID 1580 wrote to memory of 1244 1580 0462408.exe 43 PID 1580 wrote to memory of 1244 1580 0462408.exe 43 PID 1580 wrote to memory of 1244 1580 0462408.exe 43 PID 1580 wrote to memory of 1244 1580 0462408.exe 43 PID 1244 wrote to memory of 2472 1244 jdpdd.exe 44 PID 1244 wrote to memory of 2472 1244 jdpdd.exe 44 PID 1244 wrote to memory of 2472 1244 jdpdd.exe 44 PID 1244 wrote to memory of 2472 1244 jdpdd.exe 44 PID 2472 wrote to memory of 1740 2472 488680.exe 45 PID 2472 wrote to memory of 1740 2472 488680.exe 45 PID 2472 wrote to memory of 1740 2472 488680.exe 45 PID 2472 wrote to memory of 1740 2472 488680.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946.exe"C:\Users\Admin\AppData\Local\Temp\9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\820644.exec:\820644.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\pjjpj.exec:\pjjpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\3xllrxx.exec:\3xllrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\llxlffx.exec:\llxlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\8242060.exec:\8242060.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\626806.exec:\626806.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\hhbhtb.exec:\hhbhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\26064.exec:\26064.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\88628.exec:\88628.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\fxlllxr.exec:\fxlllxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\tthhtt.exec:\tthhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\xffxllr.exec:\xffxllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\0462408.exec:\0462408.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\jdpdd.exec:\jdpdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\488680.exec:\488680.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\880806.exec:\880806.exe17⤵
- Executes dropped EXE
PID:1740 -
\??\c:\0426228.exec:\0426228.exe18⤵
- Executes dropped EXE
PID:2556 -
\??\c:\2606886.exec:\2606886.exe19⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rlxflrf.exec:\rlxflrf.exe20⤵
- Executes dropped EXE
PID:2088 -
\??\c:\00468.exec:\00468.exe21⤵
- Executes dropped EXE
PID:2440 -
\??\c:\486642.exec:\486642.exe22⤵
- Executes dropped EXE
PID:1472 -
\??\c:\660646.exec:\660646.exe23⤵
- Executes dropped EXE
PID:916 -
\??\c:\608066.exec:\608066.exe24⤵
- Executes dropped EXE
PID:440 -
\??\c:\3ntntt.exec:\3ntntt.exe25⤵
- Executes dropped EXE
PID:1276 -
\??\c:\lxfxxrr.exec:\lxfxxrr.exe26⤵
- Executes dropped EXE
PID:1804 -
\??\c:\9tntnb.exec:\9tntnb.exe27⤵
- Executes dropped EXE
PID:1656 -
\??\c:\5pjdv.exec:\5pjdv.exe28⤵
- Executes dropped EXE
PID:896 -
\??\c:\vvpjv.exec:\vvpjv.exe29⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jpdpj.exec:\jpdpj.exe30⤵
- Executes dropped EXE
PID:1616 -
\??\c:\042262.exec:\042262.exe31⤵
- Executes dropped EXE
PID:2356 -
\??\c:\00402.exec:\00402.exe32⤵
- Executes dropped EXE
PID:2348 -
\??\c:\86402.exec:\86402.exe33⤵
- Executes dropped EXE
PID:2364 -
\??\c:\1thttb.exec:\1thttb.exe34⤵
- Executes dropped EXE
PID:1900 -
\??\c:\dpdpp.exec:\dpdpp.exe35⤵
- Executes dropped EXE
PID:2804 -
\??\c:\e82844.exec:\e82844.exe36⤵
- Executes dropped EXE
PID:1524 -
\??\c:\604826.exec:\604826.exe37⤵
- Executes dropped EXE
PID:2736 -
\??\c:\i202846.exec:\i202846.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\8202068.exec:\8202068.exe39⤵
- Executes dropped EXE
PID:2628 -
\??\c:\m4468.exec:\m4468.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\04808.exec:\04808.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\jvpjv.exec:\jvpjv.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\tbtttb.exec:\tbtttb.exe43⤵
- Executes dropped EXE
PID:532 -
\??\c:\w48044.exec:\w48044.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\64848.exec:\64848.exe45⤵
- Executes dropped EXE
PID:1108 -
\??\c:\ddjpp.exec:\ddjpp.exe46⤵
- Executes dropped EXE
PID:2208 -
\??\c:\fxxfflr.exec:\fxxfflr.exe47⤵
- Executes dropped EXE
PID:2464 -
\??\c:\1rlrxfr.exec:\1rlrxfr.exe48⤵
- Executes dropped EXE
PID:1584 -
\??\c:\886440.exec:\886440.exe49⤵
- Executes dropped EXE
PID:1768 -
\??\c:\4202840.exec:\4202840.exe50⤵
- Executes dropped EXE
PID:2108 -
\??\c:\o806880.exec:\o806880.exe51⤵
- Executes dropped EXE
PID:1540 -
\??\c:\7fxxffl.exec:\7fxxffl.exe52⤵
- Executes dropped EXE
PID:1452 -
\??\c:\w20684.exec:\w20684.exe53⤵
- Executes dropped EXE
PID:1760 -
\??\c:\048066.exec:\048066.exe54⤵
- Executes dropped EXE
PID:1868 -
\??\c:\llflxfl.exec:\llflxfl.exe55⤵
- Executes dropped EXE
PID:1736 -
\??\c:\604684.exec:\604684.exe56⤵
- Executes dropped EXE
PID:2392 -
\??\c:\264088.exec:\264088.exe57⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vpjpj.exec:\vpjpj.exe58⤵
- Executes dropped EXE
PID:2240 -
\??\c:\nnbnht.exec:\nnbnht.exe59⤵
- Executes dropped EXE
PID:2032 -
\??\c:\4806228.exec:\4806228.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\9jdvj.exec:\9jdvj.exe61⤵
- Executes dropped EXE
PID:1132 -
\??\c:\xxllxxf.exec:\xxllxxf.exe62⤵
- Executes dropped EXE
PID:2096 -
\??\c:\44448.exec:\44448.exe63⤵
- Executes dropped EXE
PID:440 -
\??\c:\xrflffr.exec:\xrflffr.exe64⤵
- Executes dropped EXE
PID:1684 -
\??\c:\pjvvj.exec:\pjvvj.exe65⤵
- Executes dropped EXE
PID:1284 -
\??\c:\nthttt.exec:\nthttt.exe66⤵PID:1640
-
\??\c:\60460.exec:\60460.exe67⤵PID:1364
-
\??\c:\82206.exec:\82206.exe68⤵PID:608
-
\??\c:\7fllxll.exec:\7fllxll.exe69⤵PID:2924
-
\??\c:\8200846.exec:\8200846.exe70⤵PID:1448
-
\??\c:\0028682.exec:\0028682.exe71⤵PID:1728
-
\??\c:\042422.exec:\042422.exe72⤵PID:1420
-
\??\c:\btthht.exec:\btthht.exe73⤵PID:872
-
\??\c:\20284.exec:\20284.exe74⤵PID:2680
-
\??\c:\fflrlrf.exec:\fflrlrf.exe75⤵PID:2776
-
\??\c:\m6408.exec:\m6408.exe76⤵PID:2796
-
\??\c:\ttttnt.exec:\ttttnt.exe77⤵PID:1520
-
\??\c:\flfrlrl.exec:\flfrlrl.exe78⤵PID:1528
-
\??\c:\1lxrflx.exec:\1lxrflx.exe79⤵PID:1524
-
\??\c:\o668220.exec:\o668220.exe80⤵
- System Location Discovery: System Language Discovery
PID:2828 -
\??\c:\2688468.exec:\2688468.exe81⤵PID:2712
-
\??\c:\60624.exec:\60624.exe82⤵PID:2628
-
\??\c:\hthbht.exec:\hthbht.exe83⤵PID:2636
-
\??\c:\jjdjv.exec:\jjdjv.exe84⤵PID:1688
-
\??\c:\5pppv.exec:\5pppv.exe85⤵PID:480
-
\??\c:\046888.exec:\046888.exe86⤵PID:580
-
\??\c:\820648.exec:\820648.exe87⤵PID:576
-
\??\c:\w64484.exec:\w64484.exe88⤵PID:2220
-
\??\c:\3dppj.exec:\3dppj.exe89⤵PID:2436
-
\??\c:\1ttbhn.exec:\1ttbhn.exe90⤵PID:2216
-
\??\c:\ntntnn.exec:\ntntnn.exe91⤵PID:1852
-
\??\c:\7frfrrx.exec:\7frfrrx.exe92⤵PID:1752
-
\??\c:\60842.exec:\60842.exe93⤵PID:2132
-
\??\c:\60446.exec:\60446.exe94⤵PID:1880
-
\??\c:\642800.exec:\642800.exe95⤵PID:1244
-
\??\c:\22002.exec:\22002.exe96⤵PID:1724
-
\??\c:\rfxflrr.exec:\rfxflrr.exe97⤵PID:3068
-
\??\c:\5vvdp.exec:\5vvdp.exe98⤵PID:2248
-
\??\c:\86408.exec:\86408.exe99⤵PID:2308
-
\??\c:\9rrrfxf.exec:\9rrrfxf.exe100⤵PID:2312
-
\??\c:\llrrrrf.exec:\llrrrrf.exe101⤵PID:1932
-
\??\c:\0024280.exec:\0024280.exe102⤵PID:1508
-
\??\c:\6608460.exec:\6608460.exe103⤵PID:2948
-
\??\c:\826866.exec:\826866.exe104⤵PID:2184
-
\??\c:\e26206.exec:\e26206.exe105⤵PID:688
-
\??\c:\tbntth.exec:\tbntth.exe106⤵PID:2044
-
\??\c:\86464.exec:\86464.exe107⤵PID:1500
-
\??\c:\nnntnn.exec:\nnntnn.exe108⤵PID:1652
-
\??\c:\bbbnhn.exec:\bbbnhn.exe109⤵PID:1872
-
\??\c:\9pjvp.exec:\9pjvp.exe110⤵PID:2492
-
\??\c:\k64022.exec:\k64022.exe111⤵PID:608
-
\??\c:\820684.exec:\820684.exe112⤵PID:2924
-
\??\c:\622442.exec:\622442.exe113⤵PID:1616
-
\??\c:\86808.exec:\86808.exe114⤵PID:1728
-
\??\c:\1pdpd.exec:\1pdpd.exe115⤵PID:1680
-
\??\c:\htthth.exec:\htthth.exe116⤵PID:2060
-
\??\c:\jpvdd.exec:\jpvdd.exe117⤵PID:2784
-
\??\c:\40600.exec:\40600.exe118⤵PID:2776
-
\??\c:\pjvdp.exec:\pjvdp.exe119⤵PID:2284
-
\??\c:\4866840.exec:\4866840.exe120⤵PID:2732
-
\??\c:\9rffrrf.exec:\9rffrrf.exe121⤵PID:2868
-
\??\c:\8884220.exec:\8884220.exe122⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-