Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 02:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe
-
Size
454KB
-
MD5
4b57c9766eecfcef559a26ba4b838d26
-
SHA1
5beac97aa545e79ce68ff3a5be2ed09edea83bf3
-
SHA256
ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e
-
SHA512
7378de75809f458fbe5676ea3a0d9ee689b18cc3c58fb50a55e99cb44d96a5cb80e0be003708b6db35985b9db6725e4cea79500a22ab12f93da2e186831318ef
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeToA:q7Tc2NYHUrAwfMp3CDcA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1620-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-464-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/784-759-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1700-922-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-890-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-820-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2684-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2236-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-1262-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3068-1294-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2364 xxrrffl.exe 2856 bbbthb.exe 2184 486240.exe 2884 424466.exe 1744 xrfllxf.exe 2720 04662.exe 2620 3nbhnh.exe 2160 fxrxflx.exe 2200 xxrxxxf.exe 2996 2084626.exe 1500 5rlrxfr.exe 2616 i640680.exe 2780 flrlxll.exe 2424 1flrlxf.exe 1692 6468884.exe 1696 8228068.exe 1108 480000.exe 608 q86200.exe 2236 tnhntb.exe 2372 vpjvd.exe 1052 60846.exe 2232 608644.exe 1388 a8662.exe 1684 dddjv.exe 860 604028.exe 1636 dvpdp.exe 464 0488068.exe 1796 3rrxflf.exe 908 o800224.exe 1056 824022.exe 1620 8244662.exe 592 e62866.exe 2852 w02462.exe 2832 rlllrfr.exe 2572 48668.exe 2724 ppjpp.exe 2540 xrrxlxl.exe 2720 4606028.exe 2820 608028.exe 2620 482866.exe 2160 020660.exe 2200 7thnnn.exe 1932 424444.exe 2028 8266068.exe 2740 3djjp.exe 2196 nhbbhh.exe 1308 1bhnnn.exe 1784 rrlrlll.exe 2764 thbbnh.exe 2420 8646286.exe 1464 thtthh.exe 1108 20628.exe 1916 k04448.exe 1924 m6408.exe 1240 820288.exe 604 0844000.exe 2464 llxlrll.exe 1972 c828620.exe 1388 fxllxfl.exe 1684 000488.exe 784 608426.exe 2928 vpddj.exe 1756 dpddp.exe 276 nhbhnn.exe -
resource yara_rule behavioral1/memory/1620-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-922-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-1255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-1295-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82402.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6408466.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42668.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0428888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26686.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 864466.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0442026.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2364 1620 ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe 99 PID 1620 wrote to memory of 2364 1620 ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe 99 PID 1620 wrote to memory of 2364 1620 ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe 99 PID 1620 wrote to memory of 2364 1620 ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe 99 PID 2364 wrote to memory of 2856 2364 xxrrffl.exe 31 PID 2364 wrote to memory of 2856 2364 xxrrffl.exe 31 PID 2364 wrote to memory of 2856 2364 xxrrffl.exe 31 PID 2364 wrote to memory of 2856 2364 xxrrffl.exe 31 PID 2856 wrote to memory of 2184 2856 bbbthb.exe 32 PID 2856 wrote to memory of 2184 2856 bbbthb.exe 32 PID 2856 wrote to memory of 2184 2856 bbbthb.exe 32 PID 2856 wrote to memory of 2184 2856 bbbthb.exe 32 PID 2184 wrote to memory of 2884 2184 486240.exe 33 PID 2184 wrote to memory of 2884 2184 486240.exe 33 PID 2184 wrote to memory of 2884 2184 486240.exe 33 PID 2184 wrote to memory of 2884 2184 486240.exe 33 PID 2884 wrote to memory of 1744 2884 424466.exe 34 PID 2884 wrote to memory of 1744 2884 424466.exe 34 PID 2884 wrote to memory of 1744 2884 424466.exe 34 PID 2884 wrote to memory of 1744 2884 424466.exe 34 PID 1744 wrote to memory of 2720 1744 xrfllxf.exe 35 PID 1744 wrote to memory of 2720 1744 xrfllxf.exe 35 PID 1744 wrote to memory of 2720 1744 xrfllxf.exe 35 PID 1744 wrote to memory of 2720 1744 xrfllxf.exe 35 PID 2720 wrote to memory of 2620 2720 04662.exe 36 PID 2720 wrote to memory of 2620 2720 04662.exe 36 PID 2720 wrote to memory of 2620 2720 04662.exe 36 PID 2720 wrote to memory of 2620 2720 04662.exe 36 PID 2620 wrote to memory of 2160 2620 3nbhnh.exe 70 PID 2620 wrote to memory of 2160 2620 3nbhnh.exe 70 PID 2620 wrote to memory of 2160 2620 3nbhnh.exe 70 PID 2620 wrote to memory of 2160 2620 3nbhnh.exe 70 PID 2160 wrote to memory of 2200 2160 fxrxflx.exe 38 PID 2160 wrote to memory of 2200 2160 fxrxflx.exe 38 PID 2160 wrote to memory of 2200 2160 fxrxflx.exe 38 PID 2160 wrote to memory of 2200 2160 fxrxflx.exe 38 PID 2200 wrote to memory of 2996 2200 xxrxxxf.exe 39 PID 2200 wrote to memory of 2996 2200 xxrxxxf.exe 39 PID 2200 wrote to memory of 2996 2200 xxrxxxf.exe 39 PID 2200 wrote to memory of 2996 2200 xxrxxxf.exe 39 PID 2996 wrote to memory of 1500 2996 2084626.exe 40 PID 2996 wrote to memory of 1500 2996 2084626.exe 40 PID 2996 wrote to memory of 1500 2996 2084626.exe 40 PID 2996 wrote to memory of 1500 2996 2084626.exe 40 PID 1500 wrote to memory of 2616 1500 5rlrxfr.exe 41 PID 1500 wrote to memory of 2616 1500 5rlrxfr.exe 41 PID 1500 wrote to memory of 2616 1500 5rlrxfr.exe 41 PID 1500 wrote to memory of 2616 1500 5rlrxfr.exe 41 PID 2616 wrote to memory of 2780 2616 i640680.exe 42 PID 2616 wrote to memory of 2780 2616 i640680.exe 42 PID 2616 wrote to memory of 2780 2616 i640680.exe 42 PID 2616 wrote to memory of 2780 2616 i640680.exe 42 PID 2780 wrote to memory of 2424 2780 flrlxll.exe 43 PID 2780 wrote to memory of 2424 2780 flrlxll.exe 43 PID 2780 wrote to memory of 2424 2780 flrlxll.exe 43 PID 2780 wrote to memory of 2424 2780 flrlxll.exe 43 PID 2424 wrote to memory of 1692 2424 1flrlxf.exe 44 PID 2424 wrote to memory of 1692 2424 1flrlxf.exe 44 PID 2424 wrote to memory of 1692 2424 1flrlxf.exe 44 PID 2424 wrote to memory of 1692 2424 1flrlxf.exe 44 PID 1692 wrote to memory of 1696 1692 6468884.exe 45 PID 1692 wrote to memory of 1696 1692 6468884.exe 45 PID 1692 wrote to memory of 1696 1692 6468884.exe 45 PID 1692 wrote to memory of 1696 1692 6468884.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe"C:\Users\Admin\AppData\Local\Temp\ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\xxrrffl.exec:\xxrrffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\bbbthb.exec:\bbbthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\486240.exec:\486240.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\424466.exec:\424466.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\xrfllxf.exec:\xrfllxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\04662.exec:\04662.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\3nbhnh.exec:\3nbhnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\fxrxflx.exec:\fxrxflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\xxrxxxf.exec:\xxrxxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\2084626.exec:\2084626.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\5rlrxfr.exec:\5rlrxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\i640680.exec:\i640680.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\flrlxll.exec:\flrlxll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\1flrlxf.exec:\1flrlxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\6468884.exec:\6468884.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\8228068.exec:\8228068.exe17⤵
- Executes dropped EXE
PID:1696 -
\??\c:\480000.exec:\480000.exe18⤵
- Executes dropped EXE
PID:1108 -
\??\c:\q86200.exec:\q86200.exe19⤵
- Executes dropped EXE
PID:608 -
\??\c:\tnhntb.exec:\tnhntb.exe20⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vpjvd.exec:\vpjvd.exe21⤵
- Executes dropped EXE
PID:2372 -
\??\c:\60846.exec:\60846.exe22⤵
- Executes dropped EXE
PID:1052 -
\??\c:\608644.exec:\608644.exe23⤵
- Executes dropped EXE
PID:2232 -
\??\c:\a8662.exec:\a8662.exe24⤵
- Executes dropped EXE
PID:1388 -
\??\c:\dddjv.exec:\dddjv.exe25⤵
- Executes dropped EXE
PID:1684 -
\??\c:\604028.exec:\604028.exe26⤵
- Executes dropped EXE
PID:860 -
\??\c:\dvpdp.exec:\dvpdp.exe27⤵
- Executes dropped EXE
PID:1636 -
\??\c:\0488068.exec:\0488068.exe28⤵
- Executes dropped EXE
PID:464 -
\??\c:\3rrxflf.exec:\3rrxflf.exe29⤵
- Executes dropped EXE
PID:1796 -
\??\c:\o800224.exec:\o800224.exe30⤵
- Executes dropped EXE
PID:908 -
\??\c:\824022.exec:\824022.exe31⤵
- Executes dropped EXE
PID:1056 -
\??\c:\8244662.exec:\8244662.exe32⤵
- Executes dropped EXE
PID:1620 -
\??\c:\e62866.exec:\e62866.exe33⤵
- Executes dropped EXE
PID:592 -
\??\c:\w02462.exec:\w02462.exe34⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rlllrfr.exec:\rlllrfr.exe35⤵
- Executes dropped EXE
PID:2832 -
\??\c:\48668.exec:\48668.exe36⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ppjpp.exec:\ppjpp.exe37⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xrrxlxl.exec:\xrrxlxl.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\4606028.exec:\4606028.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\608028.exec:\608028.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\482866.exec:\482866.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\020660.exec:\020660.exe42⤵
- Executes dropped EXE
PID:2160 -
\??\c:\7thnnn.exec:\7thnnn.exe43⤵
- Executes dropped EXE
PID:2200 -
\??\c:\424444.exec:\424444.exe44⤵
- Executes dropped EXE
PID:1932 -
\??\c:\8266068.exec:\8266068.exe45⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3djjp.exec:\3djjp.exe46⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nhbbhh.exec:\nhbbhh.exe47⤵
- Executes dropped EXE
PID:2196 -
\??\c:\1bhnnn.exec:\1bhnnn.exe48⤵
- Executes dropped EXE
PID:1308 -
\??\c:\rrlrlll.exec:\rrlrlll.exe49⤵
- Executes dropped EXE
PID:1784 -
\??\c:\thbbnh.exec:\thbbnh.exe50⤵
- Executes dropped EXE
PID:2764 -
\??\c:\8646286.exec:\8646286.exe51⤵
- Executes dropped EXE
PID:2420 -
\??\c:\thtthh.exec:\thtthh.exe52⤵
- Executes dropped EXE
PID:1464 -
\??\c:\20628.exec:\20628.exe53⤵
- Executes dropped EXE
PID:1108 -
\??\c:\k04448.exec:\k04448.exe54⤵
- Executes dropped EXE
PID:1916 -
\??\c:\m6408.exec:\m6408.exe55⤵
- Executes dropped EXE
PID:1924 -
\??\c:\820288.exec:\820288.exe56⤵
- Executes dropped EXE
PID:1240 -
\??\c:\0844000.exec:\0844000.exe57⤵
- Executes dropped EXE
PID:604 -
\??\c:\llxlrll.exec:\llxlrll.exe58⤵
- Executes dropped EXE
PID:2464 -
\??\c:\c828620.exec:\c828620.exe59⤵
- Executes dropped EXE
PID:1972 -
\??\c:\fxllxfl.exec:\fxllxfl.exe60⤵
- Executes dropped EXE
PID:1388 -
\??\c:\000488.exec:\000488.exe61⤵
- Executes dropped EXE
PID:1684 -
\??\c:\608426.exec:\608426.exe62⤵
- Executes dropped EXE
PID:784 -
\??\c:\vpddj.exec:\vpddj.exe63⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dpddp.exec:\dpddp.exe64⤵
- Executes dropped EXE
PID:1756 -
\??\c:\nhbhnn.exec:\nhbhnn.exe65⤵
- Executes dropped EXE
PID:276 -
\??\c:\pdddv.exec:\pdddv.exe66⤵PID:1776
-
\??\c:\604022.exec:\604022.exe67⤵PID:2248
-
\??\c:\vjjpd.exec:\vjjpd.exe68⤵PID:908
-
\??\c:\c084628.exec:\c084628.exe69⤵PID:2692
-
\??\c:\dvjpd.exec:\dvjpd.exe70⤵PID:1472
-
\??\c:\608466.exec:\608466.exe71⤵PID:2364
-
\??\c:\rlfrflx.exec:\rlfrflx.exe72⤵PID:2824
-
\??\c:\jjvdj.exec:\jjvdj.exe73⤵PID:2852
-
\??\c:\g8868.exec:\g8868.exe74⤵PID:1716
-
\??\c:\xlfrlrx.exec:\xlfrlrx.exe75⤵PID:1612
-
\??\c:\7jppv.exec:\7jppv.exe76⤵PID:2684
-
\??\c:\3bnthn.exec:\3bnthn.exe77⤵PID:2580
-
\??\c:\868462.exec:\868462.exe78⤵PID:780
-
\??\c:\4866286.exec:\4866286.exe79⤵PID:3060
-
\??\c:\i866268.exec:\i866268.exe80⤵PID:268
-
\??\c:\68602.exec:\68602.exe81⤵PID:2172
-
\??\c:\24482.exec:\24482.exe82⤵PID:2056
-
\??\c:\a8666.exec:\a8666.exe83⤵PID:1988
-
\??\c:\jjdpj.exec:\jjdpj.exe84⤵PID:2912
-
\??\c:\vvjvp.exec:\vvjvp.exe85⤵PID:2636
-
\??\c:\4828406.exec:\4828406.exe86⤵PID:584
-
\??\c:\fxlrflr.exec:\fxlrflr.exe87⤵PID:2780
-
\??\c:\860284.exec:\860284.exe88⤵PID:1468
-
\??\c:\60802.exec:\60802.exe89⤵PID:1476
-
\??\c:\dpdjv.exec:\dpdjv.exe90⤵PID:2448
-
\??\c:\080026.exec:\080026.exe91⤵PID:2576
-
\??\c:\24040.exec:\24040.exe92⤵PID:1200
-
\??\c:\6428068.exec:\6428068.exe93⤵PID:1148
-
\??\c:\46482.exec:\46482.exe94⤵PID:1376
-
\??\c:\thhhtb.exec:\thhhtb.exe95⤵PID:2888
-
\??\c:\684822.exec:\684822.exe96⤵PID:2156
-
\??\c:\s2228.exec:\s2228.exe97⤵PID:2384
-
\??\c:\vjvvd.exec:\vjvvd.exe98⤵PID:2488
-
\??\c:\2646840.exec:\2646840.exe99⤵PID:604
-
\??\c:\u644006.exec:\u644006.exe100⤵PID:1864
-
\??\c:\llllxfl.exec:\llllxfl.exe101⤵PID:1628
-
\??\c:\a2222.exec:\a2222.exe102⤵PID:1688
-
\??\c:\7xrlrfl.exec:\7xrlrfl.exe103⤵PID:2068
-
\??\c:\s2820.exec:\s2820.exe104⤵PID:784
-
\??\c:\dvpvd.exec:\dvpvd.exe105⤵PID:2960
-
\??\c:\6408466.exec:\6408466.exe106⤵
- System Location Discovery: System Language Discovery
PID:2344 -
\??\c:\tnbhnn.exec:\tnbhnn.exe107⤵PID:1348
-
\??\c:\7jddp.exec:\7jddp.exe108⤵PID:1532
-
\??\c:\04846.exec:\04846.exe109⤵PID:2032
-
\??\c:\m0246.exec:\m0246.exe110⤵PID:1056
-
\??\c:\q28882.exec:\q28882.exe111⤵PID:1652
-
\??\c:\c644062.exec:\c644062.exe112⤵PID:2656
-
\??\c:\e20022.exec:\e20022.exe113⤵PID:2664
-
\??\c:\vjvvp.exec:\vjvvp.exe114⤵PID:2744
-
\??\c:\486206.exec:\486206.exe115⤵PID:2676
-
\??\c:\hbbntt.exec:\hbbntt.exe116⤵PID:2600
-
\??\c:\nhnbhb.exec:\nhnbhb.exe117⤵PID:2652
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe118⤵PID:1660
-
\??\c:\3lrrrxl.exec:\3lrrrxl.exe119⤵PID:3040
-
\??\c:\02002.exec:\02002.exe120⤵PID:2108
-
\??\c:\86266.exec:\86266.exe121⤵PID:2320
-
\??\c:\246666.exec:\246666.exe122⤵PID:2972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-