Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 22:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe
-
Size
53KB
-
MD5
864bf3fac5dde4189a2ec07d7f651cc5
-
SHA1
23d2923fc8be4ae09ccbc158112fbe5c57b6bafb
-
SHA256
7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b
-
SHA512
1b74a2052d9f37771b672ec064b383742abf0b110b17ab1bf023d4444ba1bedc23dc9777e532d6b81bb8886be412fcc90a7dafe73b355a8c6670151a82126bdc
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlm:0cdpeeBSHHMHLf9RyIB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/32-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1992-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1992-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/724-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2896-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2504-338-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-370-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-410-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-417-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-421-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/956-458-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-465-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-481-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-497-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-582-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-601-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-662-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-675-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-706-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1004-755-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-777-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-1003-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-1070-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-1153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1940 lffrffr.exe 2912 vpjdj.exe 1992 rlxxxxr.exe 2548 hnnhhh.exe 3704 086684.exe 3588 m4008.exe 1712 62000.exe 4608 e82622.exe 4568 dpdjd.exe 1656 jjvpv.exe 1896 8248440.exe 1480 pvjjp.exe 2848 20448.exe 1780 80882.exe 3628 a6080.exe 2884 44066.exe 3368 tbtnbh.exe 2156 frxxrfx.exe 2592 62886.exe 3824 xrrfrrf.exe 4624 s4448.exe 4252 84828.exe 2824 0624460.exe 8 8204264.exe 4764 9pvjd.exe 2464 e06660.exe 1372 08422.exe 4112 5ttnbb.exe 1844 8200042.exe 4212 2206062.exe 3288 jjdjj.exe 3496 80666.exe 2140 24604.exe 5044 022222.exe 5008 jdpvj.exe 1612 jjvjj.exe 3968 vpdvv.exe 4028 xlffrrf.exe 3520 jvvvj.exe 4636 8060008.exe 1076 q84088.exe 652 6668284.exe 4504 48422.exe 4588 lxxrffr.exe 4360 xfxrfrf.exe 2228 2246266.exe 2516 1pddj.exe 1496 w64644.exe 724 xxxlrfx.exe 2896 ddddddv.exe 3356 lxrrllf.exe 3608 622422.exe 4008 602664.exe 4396 2064608.exe 1028 ddddd.exe 3548 rllxlfr.exe 1656 622204.exe 3812 88666.exe 1604 rxxxfff.exe 1488 lffxrrl.exe 1748 84282.exe 2860 7vvpj.exe 3540 vjdvp.exe 3552 rxrrffx.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0624460.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 466424.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 668828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0000404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w26644.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 684826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66608.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 32 wrote to memory of 1940 32 7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe 83 PID 32 wrote to memory of 1940 32 7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe 83 PID 32 wrote to memory of 1940 32 7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe 83 PID 1940 wrote to memory of 2912 1940 lffrffr.exe 84 PID 1940 wrote to memory of 2912 1940 lffrffr.exe 84 PID 1940 wrote to memory of 2912 1940 lffrffr.exe 84 PID 2912 wrote to memory of 1992 2912 vpjdj.exe 85 PID 2912 wrote to memory of 1992 2912 vpjdj.exe 85 PID 2912 wrote to memory of 1992 2912 vpjdj.exe 85 PID 1992 wrote to memory of 2548 1992 rlxxxxr.exe 86 PID 1992 wrote to memory of 2548 1992 rlxxxxr.exe 86 PID 1992 wrote to memory of 2548 1992 rlxxxxr.exe 86 PID 2548 wrote to memory of 3704 2548 hnnhhh.exe 87 PID 2548 wrote to memory of 3704 2548 hnnhhh.exe 87 PID 2548 wrote to memory of 3704 2548 hnnhhh.exe 87 PID 3704 wrote to memory of 3588 3704 086684.exe 88 PID 3704 wrote to memory of 3588 3704 086684.exe 88 PID 3704 wrote to memory of 3588 3704 086684.exe 88 PID 3588 wrote to memory of 1712 3588 m4008.exe 89 PID 3588 wrote to memory of 1712 3588 m4008.exe 89 PID 3588 wrote to memory of 1712 3588 m4008.exe 89 PID 1712 wrote to memory of 4608 1712 62000.exe 90 PID 1712 wrote to memory of 4608 1712 62000.exe 90 PID 1712 wrote to memory of 4608 1712 62000.exe 90 PID 4608 wrote to memory of 4568 4608 e82622.exe 91 PID 4608 wrote to memory of 4568 4608 e82622.exe 91 PID 4608 wrote to memory of 4568 4608 e82622.exe 91 PID 4568 wrote to memory of 1656 4568 dpdjd.exe 92 PID 4568 wrote to memory of 1656 4568 dpdjd.exe 92 PID 4568 wrote to memory of 1656 4568 dpdjd.exe 92 PID 1656 wrote to memory of 1896 1656 jjvpv.exe 93 PID 1656 wrote to memory of 1896 1656 jjvpv.exe 93 PID 1656 wrote to memory of 1896 1656 jjvpv.exe 93 PID 1896 wrote to memory of 1480 1896 8248440.exe 94 PID 1896 wrote to memory of 1480 1896 8248440.exe 94 PID 1896 wrote to memory of 1480 1896 8248440.exe 94 PID 1480 wrote to memory of 2848 1480 pvjjp.exe 95 PID 1480 wrote to memory of 2848 1480 pvjjp.exe 95 PID 1480 wrote to memory of 2848 1480 pvjjp.exe 95 PID 2848 wrote to memory of 1780 2848 20448.exe 96 PID 2848 wrote to memory of 1780 2848 20448.exe 96 PID 2848 wrote to memory of 1780 2848 20448.exe 96 PID 1780 wrote to memory of 3628 1780 80882.exe 97 PID 1780 wrote to memory of 3628 1780 80882.exe 97 PID 1780 wrote to memory of 3628 1780 80882.exe 97 PID 3628 wrote to memory of 2884 3628 a6080.exe 98 PID 3628 wrote to memory of 2884 3628 a6080.exe 98 PID 3628 wrote to memory of 2884 3628 a6080.exe 98 PID 2884 wrote to memory of 3368 2884 44066.exe 99 PID 2884 wrote to memory of 3368 2884 44066.exe 99 PID 2884 wrote to memory of 3368 2884 44066.exe 99 PID 3368 wrote to memory of 2156 3368 tbtnbh.exe 100 PID 3368 wrote to memory of 2156 3368 tbtnbh.exe 100 PID 3368 wrote to memory of 2156 3368 tbtnbh.exe 100 PID 2156 wrote to memory of 2592 2156 frxxrfx.exe 101 PID 2156 wrote to memory of 2592 2156 frxxrfx.exe 101 PID 2156 wrote to memory of 2592 2156 frxxrfx.exe 101 PID 2592 wrote to memory of 3824 2592 62886.exe 102 PID 2592 wrote to memory of 3824 2592 62886.exe 102 PID 2592 wrote to memory of 3824 2592 62886.exe 102 PID 3824 wrote to memory of 4624 3824 xrrfrrf.exe 103 PID 3824 wrote to memory of 4624 3824 xrrfrrf.exe 103 PID 3824 wrote to memory of 4624 3824 xrrfrrf.exe 103 PID 4624 wrote to memory of 4252 4624 s4448.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe"C:\Users\Admin\AppData\Local\Temp\7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\lffrffr.exec:\lffrffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\vpjdj.exec:\vpjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\rlxxxxr.exec:\rlxxxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\hnnhhh.exec:\hnnhhh.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\086684.exec:\086684.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\m4008.exec:\m4008.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\62000.exec:\62000.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\e82622.exec:\e82622.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\dpdjd.exec:\dpdjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\jjvpv.exec:\jjvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\8248440.exec:\8248440.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\pvjjp.exec:\pvjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\20448.exec:\20448.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\80882.exec:\80882.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\a6080.exec:\a6080.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\44066.exec:\44066.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\tbtnbh.exec:\tbtnbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\frxxrfx.exec:\frxxrfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\62886.exec:\62886.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\xrrfrrf.exec:\xrrfrrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\s4448.exec:\s4448.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\84828.exec:\84828.exe23⤵
- Executes dropped EXE
PID:4252 -
\??\c:\0624460.exec:\0624460.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2824 -
\??\c:\8204264.exec:\8204264.exe25⤵
- Executes dropped EXE
PID:8 -
\??\c:\9pvjd.exec:\9pvjd.exe26⤵
- Executes dropped EXE
PID:4764 -
\??\c:\e06660.exec:\e06660.exe27⤵
- Executes dropped EXE
PID:2464 -
\??\c:\08422.exec:\08422.exe28⤵
- Executes dropped EXE
PID:1372 -
\??\c:\5ttnbb.exec:\5ttnbb.exe29⤵
- Executes dropped EXE
PID:4112 -
\??\c:\8200042.exec:\8200042.exe30⤵
- Executes dropped EXE
PID:1844 -
\??\c:\2206062.exec:\2206062.exe31⤵
- Executes dropped EXE
PID:4212 -
\??\c:\jjdjj.exec:\jjdjj.exe32⤵
- Executes dropped EXE
PID:3288 -
\??\c:\80666.exec:\80666.exe33⤵
- Executes dropped EXE
PID:3496 -
\??\c:\24604.exec:\24604.exe34⤵
- Executes dropped EXE
PID:2140 -
\??\c:\022222.exec:\022222.exe35⤵
- Executes dropped EXE
PID:5044 -
\??\c:\jdpvj.exec:\jdpvj.exe36⤵
- Executes dropped EXE
PID:5008 -
\??\c:\jjvjj.exec:\jjvjj.exe37⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vpdvv.exec:\vpdvv.exe38⤵
- Executes dropped EXE
PID:3968 -
\??\c:\xlffrrf.exec:\xlffrrf.exe39⤵
- Executes dropped EXE
PID:4028 -
\??\c:\jvvvj.exec:\jvvvj.exe40⤵
- Executes dropped EXE
PID:3520 -
\??\c:\8060008.exec:\8060008.exe41⤵
- Executes dropped EXE
PID:4636 -
\??\c:\q84088.exec:\q84088.exe42⤵
- Executes dropped EXE
PID:1076 -
\??\c:\6668284.exec:\6668284.exe43⤵
- Executes dropped EXE
PID:652 -
\??\c:\48422.exec:\48422.exe44⤵
- Executes dropped EXE
PID:4504 -
\??\c:\lxxrffr.exec:\lxxrffr.exe45⤵
- Executes dropped EXE
PID:4588 -
\??\c:\xfxrfrf.exec:\xfxrfrf.exe46⤵
- Executes dropped EXE
PID:4360 -
\??\c:\2246266.exec:\2246266.exe47⤵
- Executes dropped EXE
PID:2228 -
\??\c:\1pddj.exec:\1pddj.exe48⤵
- Executes dropped EXE
PID:2516 -
\??\c:\w64644.exec:\w64644.exe49⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xxxlrfx.exec:\xxxlrfx.exe50⤵
- Executes dropped EXE
PID:724 -
\??\c:\ddddddv.exec:\ddddddv.exe51⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lxrrllf.exec:\lxrrllf.exe52⤵
- Executes dropped EXE
PID:3356 -
\??\c:\622422.exec:\622422.exe53⤵
- Executes dropped EXE
PID:3608 -
\??\c:\602664.exec:\602664.exe54⤵
- Executes dropped EXE
PID:4008 -
\??\c:\2064608.exec:\2064608.exe55⤵
- Executes dropped EXE
PID:4396 -
\??\c:\ddddd.exec:\ddddd.exe56⤵
- Executes dropped EXE
PID:1028 -
\??\c:\rllxlfr.exec:\rllxlfr.exe57⤵
- Executes dropped EXE
PID:3548 -
\??\c:\622204.exec:\622204.exe58⤵
- Executes dropped EXE
PID:1656 -
\??\c:\88666.exec:\88666.exe59⤵
- Executes dropped EXE
PID:3812 -
\??\c:\rxxxfff.exec:\rxxxfff.exe60⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lffxrrl.exec:\lffxrrl.exe61⤵
- Executes dropped EXE
PID:1488 -
\??\c:\84282.exec:\84282.exe62⤵
- Executes dropped EXE
PID:1748 -
\??\c:\7vvpj.exec:\7vvpj.exe63⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vjdvp.exec:\vjdvp.exe64⤵
- Executes dropped EXE
PID:3540 -
\??\c:\rxrrffx.exec:\rxrrffx.exe65⤵
- Executes dropped EXE
PID:3552 -
\??\c:\9htnhb.exec:\9htnhb.exe66⤵PID:2884
-
\??\c:\248260.exec:\248260.exe67⤵PID:4748
-
\??\c:\q68262.exec:\q68262.exe68⤵PID:3044
-
\??\c:\bbhbbt.exec:\bbhbbt.exe69⤵PID:5040
-
\??\c:\268888.exec:\268888.exe70⤵PID:5104
-
\??\c:\jddvd.exec:\jddvd.exe71⤵PID:2256
-
\??\c:\2404844.exec:\2404844.exe72⤵PID:3604
-
\??\c:\84442.exec:\84442.exe73⤵PID:3312
-
\??\c:\3fxrxfl.exec:\3fxrxfl.exe74⤵PID:4880
-
\??\c:\lxxrlll.exec:\lxxrlll.exe75⤵PID:3132
-
\??\c:\444488.exec:\444488.exe76⤵PID:2504
-
\??\c:\00684.exec:\00684.exe77⤵PID:2452
-
\??\c:\5nnhhh.exec:\5nnhhh.exe78⤵PID:4344
-
\??\c:\5hhnbh.exec:\5hhnbh.exe79⤵PID:1868
-
\??\c:\hhhbnh.exec:\hhhbnh.exe80⤵PID:2108
-
\??\c:\dvdjj.exec:\dvdjj.exe81⤵PID:616
-
\??\c:\btbtbb.exec:\btbtbb.exe82⤵PID:2664
-
\??\c:\tnbtnn.exec:\tnbtnn.exe83⤵PID:464
-
\??\c:\pvpjp.exec:\pvpjp.exe84⤵PID:1484
-
\??\c:\5pjdp.exec:\5pjdp.exe85⤵PID:4212
-
\??\c:\tttnnn.exec:\tttnnn.exe86⤵PID:5036
-
\??\c:\ntnhtt.exec:\ntnhtt.exe87⤵PID:3992
-
\??\c:\i248200.exec:\i248200.exe88⤵PID:3936
-
\??\c:\428420.exec:\428420.exe89⤵PID:932
-
\??\c:\nttthn.exec:\nttthn.exe90⤵PID:3000
-
\??\c:\o244480.exec:\o244480.exe91⤵PID:848
-
\??\c:\nhbttn.exec:\nhbttn.exe92⤵PID:1452
-
\??\c:\lffxllx.exec:\lffxllx.exe93⤵PID:5008
-
\??\c:\622848.exec:\622848.exe94⤵PID:5016
-
\??\c:\s4482.exec:\s4482.exe95⤵PID:3968
-
\??\c:\2262024.exec:\2262024.exe96⤵PID:224
-
\??\c:\0404886.exec:\0404886.exe97⤵PID:452
-
\??\c:\262648.exec:\262648.exe98⤵PID:4340
-
\??\c:\w68260.exec:\w68260.exe99⤵PID:2408
-
\??\c:\tthbnb.exec:\tthbnb.exe100⤵PID:4380
-
\??\c:\jdjdp.exec:\jdjdp.exe101⤵PID:4300
-
\??\c:\8220826.exec:\8220826.exe102⤵PID:1704
-
\??\c:\628484.exec:\628484.exe103⤵PID:3536
-
\??\c:\dvvdp.exec:\dvvdp.exe104⤵PID:748
-
\??\c:\468848.exec:\468848.exe105⤵PID:624
-
\??\c:\vjpjv.exec:\vjpjv.exe106⤵PID:1184
-
\??\c:\k28844.exec:\k28844.exe107⤵PID:4672
-
\??\c:\1lrrrrx.exec:\1lrrrrx.exe108⤵PID:1348
-
\??\c:\jpvvv.exec:\jpvvv.exe109⤵PID:4932
-
\??\c:\llflrrr.exec:\llflrrr.exe110⤵PID:4876
-
\??\c:\bhhhbt.exec:\bhhhbt.exe111⤵PID:2316
-
\??\c:\068266.exec:\068266.exe112⤵PID:3360
-
\??\c:\26048.exec:\26048.exe113⤵PID:3356
-
\??\c:\866044.exec:\866044.exe114⤵PID:956
-
\??\c:\e24648.exec:\e24648.exe115⤵PID:2976
-
\??\c:\jvvpj.exec:\jvvpj.exe116⤵PID:4928
-
\??\c:\tttnbt.exec:\tttnbt.exe117⤵PID:436
-
\??\c:\4808862.exec:\4808862.exe118⤵PID:3548
-
\??\c:\xrrrlrl.exec:\xrrrlrl.exe119⤵PID:1656
-
\??\c:\1djdd.exec:\1djdd.exe120⤵PID:2924
-
\??\c:\280426.exec:\280426.exe121⤵PID:3876
-
\??\c:\lxllxff.exec:\lxllxff.exe122⤵
- System Location Discovery: System Language Discovery
PID:2856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-