Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 20:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe
-
Size
54KB
-
MD5
b286483fb6d61f417c889121666538d6
-
SHA1
d84d87728b018c74ec989cf5f5b353555b90b678
-
SHA256
21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0
-
SHA512
7890f8e102c7e8d5877661704722c838f9268b3ce18f49ef90b9810f1427ec940c1df24c6c070a2a07e9ad63afafdf396fa897462bb00af084301034a2e79202
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJt:0cdpeeBSHHMHLf9RyIET
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1172-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3788-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/460-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3352-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-359-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-429-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-460-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-482-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-495-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-511-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-539-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-636-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-676-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-713-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-726-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-805-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5024 djdvd.exe 3796 8800684.exe 4196 lxxxlrf.exe 3212 bnhtnn.exe 2140 e44082.exe 1248 664484.exe 5112 q08044.exe 2900 0444428.exe 3960 64044.exe 2524 648822.exe 3788 hbbnbb.exe 684 pvjvp.exe 3156 i884648.exe 460 llfrllx.exe 5000 xrfxfxx.exe 4996 7xxrrrl.exe 1444 xxrlxrl.exe 4480 jvvpp.exe 4848 066048.exe 5072 xrlxrrr.exe 4420 8020460.exe 3232 7lrlxrl.exe 4764 48068.exe 2664 46626.exe 2776 vdvpd.exe 1192 i068826.exe 5100 6026004.exe 1884 406042.exe 3668 vpvpp.exe 3056 88004.exe 3524 860468.exe 4268 i084004.exe 3632 fxfxrrl.exe 1908 m6686.exe 4440 044860.exe 2796 flrlxrf.exe 1468 08288.exe 4216 pjppj.exe 2532 642448.exe 4260 m8064.exe 4320 i004648.exe 448 pjjdv.exe 2964 djvjd.exe 4740 rlxrxxf.exe 1552 w26266.exe 736 djdvp.exe 1612 g6882.exe 1184 jjpdp.exe 1620 280604.exe 4612 40604.exe 2948 jjjdv.exe 3352 4844888.exe 3880 pdpjv.exe 3496 060004.exe 4776 lxxrlll.exe 1592 44026.exe 4592 lrrxrxr.exe 3348 k22046.exe 1836 44000.exe 1260 26008.exe 2332 ffffrrr.exe 2560 jdppp.exe 2524 ddppd.exe 4784 xrlfxxx.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00820.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 202244.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g6280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w62004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46248.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o844882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1172 wrote to memory of 5024 1172 21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe 83 PID 1172 wrote to memory of 5024 1172 21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe 83 PID 1172 wrote to memory of 5024 1172 21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe 83 PID 5024 wrote to memory of 3796 5024 djdvd.exe 84 PID 5024 wrote to memory of 3796 5024 djdvd.exe 84 PID 5024 wrote to memory of 3796 5024 djdvd.exe 84 PID 3796 wrote to memory of 4196 3796 8800684.exe 85 PID 3796 wrote to memory of 4196 3796 8800684.exe 85 PID 3796 wrote to memory of 4196 3796 8800684.exe 85 PID 4196 wrote to memory of 3212 4196 lxxxlrf.exe 86 PID 4196 wrote to memory of 3212 4196 lxxxlrf.exe 86 PID 4196 wrote to memory of 3212 4196 lxxxlrf.exe 86 PID 3212 wrote to memory of 2140 3212 bnhtnn.exe 87 PID 3212 wrote to memory of 2140 3212 bnhtnn.exe 87 PID 3212 wrote to memory of 2140 3212 bnhtnn.exe 87 PID 2140 wrote to memory of 1248 2140 e44082.exe 88 PID 2140 wrote to memory of 1248 2140 e44082.exe 88 PID 2140 wrote to memory of 1248 2140 e44082.exe 88 PID 1248 wrote to memory of 5112 1248 664484.exe 89 PID 1248 wrote to memory of 5112 1248 664484.exe 89 PID 1248 wrote to memory of 5112 1248 664484.exe 89 PID 5112 wrote to memory of 2900 5112 q08044.exe 90 PID 5112 wrote to memory of 2900 5112 q08044.exe 90 PID 5112 wrote to memory of 2900 5112 q08044.exe 90 PID 2900 wrote to memory of 3960 2900 0444428.exe 91 PID 2900 wrote to memory of 3960 2900 0444428.exe 91 PID 2900 wrote to memory of 3960 2900 0444428.exe 91 PID 3960 wrote to memory of 2524 3960 64044.exe 92 PID 3960 wrote to memory of 2524 3960 64044.exe 92 PID 3960 wrote to memory of 2524 3960 64044.exe 92 PID 2524 wrote to memory of 3788 2524 648822.exe 93 PID 2524 wrote to memory of 3788 2524 648822.exe 93 PID 2524 wrote to memory of 3788 2524 648822.exe 93 PID 3788 wrote to memory of 684 3788 hbbnbb.exe 94 PID 3788 wrote to memory of 684 3788 hbbnbb.exe 94 PID 3788 wrote to memory of 684 3788 hbbnbb.exe 94 PID 684 wrote to memory of 3156 684 pvjvp.exe 95 PID 684 wrote to memory of 3156 684 pvjvp.exe 95 PID 684 wrote to memory of 3156 684 pvjvp.exe 95 PID 3156 wrote to memory of 460 3156 i884648.exe 96 PID 3156 wrote to memory of 460 3156 i884648.exe 96 PID 3156 wrote to memory of 460 3156 i884648.exe 96 PID 460 wrote to memory of 5000 460 llfrllx.exe 97 PID 460 wrote to memory of 5000 460 llfrllx.exe 97 PID 460 wrote to memory of 5000 460 llfrllx.exe 97 PID 5000 wrote to memory of 4996 5000 xrfxfxx.exe 98 PID 5000 wrote to memory of 4996 5000 xrfxfxx.exe 98 PID 5000 wrote to memory of 4996 5000 xrfxfxx.exe 98 PID 4996 wrote to memory of 1444 4996 7xxrrrl.exe 99 PID 4996 wrote to memory of 1444 4996 7xxrrrl.exe 99 PID 4996 wrote to memory of 1444 4996 7xxrrrl.exe 99 PID 1444 wrote to memory of 4480 1444 xxrlxrl.exe 100 PID 1444 wrote to memory of 4480 1444 xxrlxrl.exe 100 PID 1444 wrote to memory of 4480 1444 xxrlxrl.exe 100 PID 4480 wrote to memory of 4848 4480 jvvpp.exe 101 PID 4480 wrote to memory of 4848 4480 jvvpp.exe 101 PID 4480 wrote to memory of 4848 4480 jvvpp.exe 101 PID 4848 wrote to memory of 5072 4848 066048.exe 102 PID 4848 wrote to memory of 5072 4848 066048.exe 102 PID 4848 wrote to memory of 5072 4848 066048.exe 102 PID 5072 wrote to memory of 4420 5072 xrlxrrr.exe 103 PID 5072 wrote to memory of 4420 5072 xrlxrrr.exe 103 PID 5072 wrote to memory of 4420 5072 xrlxrrr.exe 103 PID 4420 wrote to memory of 3232 4420 8020460.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe"C:\Users\Admin\AppData\Local\Temp\21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\djdvd.exec:\djdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\8800684.exec:\8800684.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\lxxxlrf.exec:\lxxxlrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\bnhtnn.exec:\bnhtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\e44082.exec:\e44082.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\664484.exec:\664484.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\q08044.exec:\q08044.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\0444428.exec:\0444428.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\64044.exec:\64044.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\648822.exec:\648822.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\hbbnbb.exec:\hbbnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\pvjvp.exec:\pvjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\i884648.exec:\i884648.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\llfrllx.exec:\llfrllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\xrfxfxx.exec:\xrfxfxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\7xxrrrl.exec:\7xxrrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\xxrlxrl.exec:\xxrlxrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\jvvpp.exec:\jvvpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\066048.exec:\066048.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\xrlxrrr.exec:\xrlxrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\8020460.exec:\8020460.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\7lrlxrl.exec:\7lrlxrl.exe23⤵
- Executes dropped EXE
PID:3232 -
\??\c:\48068.exec:\48068.exe24⤵
- Executes dropped EXE
PID:4764 -
\??\c:\46626.exec:\46626.exe25⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vdvpd.exec:\vdvpd.exe26⤵
- Executes dropped EXE
PID:2776 -
\??\c:\i068826.exec:\i068826.exe27⤵
- Executes dropped EXE
PID:1192 -
\??\c:\6026004.exec:\6026004.exe28⤵
- Executes dropped EXE
PID:5100 -
\??\c:\406042.exec:\406042.exe29⤵
- Executes dropped EXE
PID:1884 -
\??\c:\vpvpp.exec:\vpvpp.exe30⤵
- Executes dropped EXE
PID:3668 -
\??\c:\88004.exec:\88004.exe31⤵
- Executes dropped EXE
PID:3056 -
\??\c:\860468.exec:\860468.exe32⤵
- Executes dropped EXE
PID:3524 -
\??\c:\i084004.exec:\i084004.exe33⤵
- Executes dropped EXE
PID:4268 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe34⤵
- Executes dropped EXE
PID:3632 -
\??\c:\m6686.exec:\m6686.exe35⤵
- Executes dropped EXE
PID:1908 -
\??\c:\044860.exec:\044860.exe36⤵
- Executes dropped EXE
PID:4440 -
\??\c:\flrlxrf.exec:\flrlxrf.exe37⤵
- Executes dropped EXE
PID:2796 -
\??\c:\08288.exec:\08288.exe38⤵
- Executes dropped EXE
PID:1468 -
\??\c:\pjppj.exec:\pjppj.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4216 -
\??\c:\642448.exec:\642448.exe40⤵
- Executes dropped EXE
PID:2532 -
\??\c:\m8064.exec:\m8064.exe41⤵
- Executes dropped EXE
PID:4260 -
\??\c:\i004648.exec:\i004648.exe42⤵
- Executes dropped EXE
PID:4320 -
\??\c:\pjjdv.exec:\pjjdv.exe43⤵
- Executes dropped EXE
PID:448 -
\??\c:\djvjd.exec:\djvjd.exe44⤵
- Executes dropped EXE
PID:2964 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe45⤵
- Executes dropped EXE
PID:4740 -
\??\c:\w26266.exec:\w26266.exe46⤵
- Executes dropped EXE
PID:1552 -
\??\c:\djdvp.exec:\djdvp.exe47⤵
- Executes dropped EXE
PID:736 -
\??\c:\g6882.exec:\g6882.exe48⤵
- Executes dropped EXE
PID:1612 -
\??\c:\7flfffl.exec:\7flfffl.exe49⤵PID:4600
-
\??\c:\jjpdp.exec:\jjpdp.exe50⤵
- Executes dropped EXE
PID:1184 -
\??\c:\280604.exec:\280604.exe51⤵
- Executes dropped EXE
PID:1620 -
\??\c:\40604.exec:\40604.exe52⤵
- Executes dropped EXE
PID:4612 -
\??\c:\jjjdv.exec:\jjjdv.exe53⤵
- Executes dropped EXE
PID:2948 -
\??\c:\4844888.exec:\4844888.exe54⤵
- Executes dropped EXE
PID:3352 -
\??\c:\pdpjv.exec:\pdpjv.exe55⤵
- Executes dropped EXE
PID:3880 -
\??\c:\060004.exec:\060004.exe56⤵
- Executes dropped EXE
PID:3496 -
\??\c:\lxxrlll.exec:\lxxrlll.exe57⤵
- Executes dropped EXE
PID:4776 -
\??\c:\44026.exec:\44026.exe58⤵
- Executes dropped EXE
PID:1592 -
\??\c:\lrrxrxr.exec:\lrrxrxr.exe59⤵
- Executes dropped EXE
PID:4592 -
\??\c:\k22046.exec:\k22046.exe60⤵
- Executes dropped EXE
PID:3348 -
\??\c:\44000.exec:\44000.exe61⤵
- Executes dropped EXE
PID:1836 -
\??\c:\26008.exec:\26008.exe62⤵
- Executes dropped EXE
PID:1260 -
\??\c:\ffffrrr.exec:\ffffrrr.exe63⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jdppp.exec:\jdppp.exe64⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ddppd.exec:\ddppd.exe65⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xrlfxxx.exec:\xrlfxxx.exe66⤵
- Executes dropped EXE
PID:4784 -
\??\c:\22282.exec:\22282.exe67⤵PID:2644
-
\??\c:\xlfrrff.exec:\xlfrrff.exe68⤵PID:616
-
\??\c:\2288288.exec:\2288288.exe69⤵PID:3156
-
\??\c:\o066666.exec:\o066666.exe70⤵PID:460
-
\??\c:\242484.exec:\242484.exe71⤵PID:1452
-
\??\c:\442646.exec:\442646.exe72⤵PID:2736
-
\??\c:\c606262.exec:\c606262.exe73⤵PID:4088
-
\??\c:\hhbtnb.exec:\hhbtnb.exe74⤵PID:4504
-
\??\c:\44228.exec:\44228.exe75⤵PID:5008
-
\??\c:\i048262.exec:\i048262.exe76⤵PID:4848
-
\??\c:\vvjdj.exec:\vvjdj.exe77⤵PID:2712
-
\??\c:\hbnnhh.exec:\hbnnhh.exe78⤵PID:4420
-
\??\c:\k40488.exec:\k40488.exe79⤵PID:2356
-
\??\c:\vddvd.exec:\vddvd.exe80⤵PID:3648
-
\??\c:\020000.exec:\020000.exe81⤵PID:1432
-
\??\c:\7nnnhn.exec:\7nnnhn.exe82⤵PID:1792
-
\??\c:\xfxflxf.exec:\xfxflxf.exe83⤵PID:4224
-
\??\c:\3rrrllr.exec:\3rrrllr.exe84⤵PID:1724
-
\??\c:\248444.exec:\248444.exe85⤵PID:4880
-
\??\c:\ffllffx.exec:\ffllffx.exe86⤵PID:2852
-
\??\c:\dpddv.exec:\dpddv.exe87⤵PID:5076
-
\??\c:\hhnhnt.exec:\hhnhnt.exe88⤵PID:3900
-
\??\c:\rxxxlxx.exec:\rxxxlxx.exe89⤵PID:3508
-
\??\c:\04680.exec:\04680.exe90⤵PID:2596
-
\??\c:\c060488.exec:\c060488.exe91⤵PID:2408
-
\??\c:\pvjjd.exec:\pvjjd.exe92⤵PID:3524
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe93⤵PID:2980
-
\??\c:\26048.exec:\26048.exe94⤵PID:1136
-
\??\c:\1vvpd.exec:\1vvpd.exe95⤵PID:1360
-
\??\c:\nhbtnh.exec:\nhbtnh.exe96⤵PID:1648
-
\??\c:\042660.exec:\042660.exe97⤵PID:4812
-
\??\c:\88442.exec:\88442.exe98⤵PID:2176
-
\??\c:\0666088.exec:\0666088.exe99⤵PID:1820
-
\??\c:\288004.exec:\288004.exe100⤵PID:1868
-
\??\c:\8048488.exec:\8048488.exe101⤵PID:4216
-
\??\c:\0488084.exec:\0488084.exe102⤵PID:2476
-
\??\c:\nhbhbb.exec:\nhbhbb.exe103⤵PID:3972
-
\??\c:\2862802.exec:\2862802.exe104⤵PID:5044
-
\??\c:\w28608.exec:\w28608.exe105⤵PID:2040
-
\??\c:\044482.exec:\044482.exe106⤵PID:4220
-
\??\c:\3tnbnh.exec:\3tnbnh.exe107⤵PID:728
-
\??\c:\806642.exec:\806642.exe108⤵PID:784
-
\??\c:\222262.exec:\222262.exe109⤵PID:4332
-
\??\c:\04048.exec:\04048.exe110⤵PID:4328
-
\??\c:\g0602.exec:\g0602.exe111⤵PID:1764
-
\??\c:\3ppjd.exec:\3ppjd.exe112⤵PID:732
-
\??\c:\9vpdd.exec:\9vpdd.exe113⤵PID:2672
-
\??\c:\40004.exec:\40004.exe114⤵PID:1628
-
\??\c:\66862.exec:\66862.exe115⤵PID:3452
-
\??\c:\3xfxllx.exec:\3xfxllx.exe116⤵PID:3644
-
\??\c:\rflrrll.exec:\rflrrll.exe117⤵PID:4376
-
\??\c:\thhthh.exec:\thhthh.exe118⤵PID:3880
-
\??\c:\thnbbt.exec:\thnbbt.exe119⤵PID:1516
-
\??\c:\84442.exec:\84442.exe120⤵PID:2144
-
\??\c:\1rxrrxl.exec:\1rxrrxl.exe121⤵PID:3652
-
\??\c:\8444806.exec:\8444806.exe122⤵PID:2432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-