Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 22:36
Static task
static1
Behavioral task
behavioral1
Sample
488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596.exe
Resource
win7-20240903-en
General
-
Target
488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596.exe
-
Size
82KB
-
MD5
6e5f9c524a8d99227405fe947825f511
-
SHA1
a93809a62e4b8e6edc263e8200ad121fcf513da9
-
SHA256
488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596
-
SHA512
734793892a57eb3a6932b69bbf3bc66bf07cd94b5a1483d2a9b2089553ae1806d1f7bb98315ab8d3702c9aa9466be99d45af1c6650b93e651dd7b5a3890d69f1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmB5Gtn:ymb3NkkiQ3mdBjFo73thgQ/wEkM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4376-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1352-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/672-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3516 xllllxx.exe 3588 7jvvv.exe 3732 vpvvv.exe 3500 lfxrxrx.exe 1352 hhnhbt.exe 672 jdppv.exe 4996 dvjdp.exe 4288 7rrrrrr.exe 1492 1nnnnh.exe 2104 dvjjj.exe 4324 hhnnbb.exe 5004 jvjvd.exe 5096 dvdpv.exe 964 xlrrlxx.exe 4272 rrfxrrl.exe 2828 9thhhh.exe 3276 9pvdd.exe 1356 fxxrllf.exe 5092 nbbbtb.exe 4956 jjjjj.exe 3164 5frrxxf.exe 2516 nbnhbb.exe 4812 hbtnhh.exe 936 dpppp.exe 3360 fxrrrxr.exe 3016 llllllf.exe 1324 hhtbhh.exe 2532 vpjjd.exe 3344 hbhbtb.exe 3368 nhbbbb.exe 1160 1xxrrlf.exe 224 fxxxrrl.exe 1812 btbnhb.exe 4740 ddjdv.exe 4212 pjjdv.exe 4356 rxfflrl.exe 3048 bntttb.exe 1084 hbhbbb.exe 3600 pvppv.exe 5052 xrxrrrl.exe 464 lflfxxr.exe 4060 btbhhh.exe 2968 htnnnn.exe 3316 pjjjp.exe 632 jvddd.exe 4472 9rlfxxx.exe 4144 nnhhhh.exe 3988 djddd.exe 376 dvdvv.exe 3516 vjjdd.exe 4152 xrfxrrl.exe 4576 tbnnhh.exe 5108 dpddv.exe 2088 jdvvp.exe 1092 xrrxlxl.exe 3648 1bhhbb.exe 1620 thhbbb.exe 4888 pvjdp.exe 2712 ppddv.exe 1588 lflflfx.exe 4796 ntnnbt.exe 2168 bnnnhh.exe 3340 vjjjj.exe 2300 vppjv.exe -
resource yara_rule behavioral2/memory/4376-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/672-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-215-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxrrl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4376 wrote to memory of 3516 4376 488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596.exe 82 PID 4376 wrote to memory of 3516 4376 488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596.exe 82 PID 4376 wrote to memory of 3516 4376 488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596.exe 82 PID 3516 wrote to memory of 3588 3516 xllllxx.exe 83 PID 3516 wrote to memory of 3588 3516 xllllxx.exe 83 PID 3516 wrote to memory of 3588 3516 xllllxx.exe 83 PID 3588 wrote to memory of 3732 3588 7jvvv.exe 84 PID 3588 wrote to memory of 3732 3588 7jvvv.exe 84 PID 3588 wrote to memory of 3732 3588 7jvvv.exe 84 PID 3732 wrote to memory of 3500 3732 vpvvv.exe 85 PID 3732 wrote to memory of 3500 3732 vpvvv.exe 85 PID 3732 wrote to memory of 3500 3732 vpvvv.exe 85 PID 3500 wrote to memory of 1352 3500 lfxrxrx.exe 86 PID 3500 wrote to memory of 1352 3500 lfxrxrx.exe 86 PID 3500 wrote to memory of 1352 3500 lfxrxrx.exe 86 PID 1352 wrote to memory of 672 1352 hhnhbt.exe 87 PID 1352 wrote to memory of 672 1352 hhnhbt.exe 87 PID 1352 wrote to memory of 672 1352 hhnhbt.exe 87 PID 672 wrote to memory of 4996 672 jdppv.exe 88 PID 672 wrote to memory of 4996 672 jdppv.exe 88 PID 672 wrote to memory of 4996 672 jdppv.exe 88 PID 4996 wrote to memory of 4288 4996 dvjdp.exe 89 PID 4996 wrote to memory of 4288 4996 dvjdp.exe 89 PID 4996 wrote to memory of 4288 4996 dvjdp.exe 89 PID 4288 wrote to memory of 1492 4288 7rrrrrr.exe 90 PID 4288 wrote to memory of 1492 4288 7rrrrrr.exe 90 PID 4288 wrote to memory of 1492 4288 7rrrrrr.exe 90 PID 1492 wrote to memory of 2104 1492 1nnnnh.exe 91 PID 1492 wrote to memory of 2104 1492 1nnnnh.exe 91 PID 1492 wrote to memory of 2104 1492 1nnnnh.exe 91 PID 2104 wrote to memory of 4324 2104 dvjjj.exe 92 PID 2104 wrote to memory of 4324 2104 dvjjj.exe 92 PID 2104 wrote to memory of 4324 2104 dvjjj.exe 92 PID 4324 wrote to memory of 5004 4324 hhnnbb.exe 93 PID 4324 wrote to memory of 5004 4324 hhnnbb.exe 93 PID 4324 wrote to memory of 5004 4324 hhnnbb.exe 93 PID 5004 wrote to memory of 5096 5004 jvjvd.exe 94 PID 5004 wrote to memory of 5096 5004 jvjvd.exe 94 PID 5004 wrote to memory of 5096 5004 jvjvd.exe 94 PID 5096 wrote to memory of 964 5096 dvdpv.exe 95 PID 5096 wrote to memory of 964 5096 dvdpv.exe 95 PID 5096 wrote to memory of 964 5096 dvdpv.exe 95 PID 964 wrote to memory of 4272 964 xlrrlxx.exe 96 PID 964 wrote to memory of 4272 964 xlrrlxx.exe 96 PID 964 wrote to memory of 4272 964 xlrrlxx.exe 96 PID 4272 wrote to memory of 2828 4272 rrfxrrl.exe 97 PID 4272 wrote to memory of 2828 4272 rrfxrrl.exe 97 PID 4272 wrote to memory of 2828 4272 rrfxrrl.exe 97 PID 2828 wrote to memory of 3276 2828 9thhhh.exe 98 PID 2828 wrote to memory of 3276 2828 9thhhh.exe 98 PID 2828 wrote to memory of 3276 2828 9thhhh.exe 98 PID 3276 wrote to memory of 1356 3276 9pvdd.exe 99 PID 3276 wrote to memory of 1356 3276 9pvdd.exe 99 PID 3276 wrote to memory of 1356 3276 9pvdd.exe 99 PID 1356 wrote to memory of 5092 1356 fxxrllf.exe 100 PID 1356 wrote to memory of 5092 1356 fxxrllf.exe 100 PID 1356 wrote to memory of 5092 1356 fxxrllf.exe 100 PID 5092 wrote to memory of 4956 5092 nbbbtb.exe 101 PID 5092 wrote to memory of 4956 5092 nbbbtb.exe 101 PID 5092 wrote to memory of 4956 5092 nbbbtb.exe 101 PID 4956 wrote to memory of 3164 4956 jjjjj.exe 102 PID 4956 wrote to memory of 3164 4956 jjjjj.exe 102 PID 4956 wrote to memory of 3164 4956 jjjjj.exe 102 PID 3164 wrote to memory of 2516 3164 5frrxxf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596.exe"C:\Users\Admin\AppData\Local\Temp\488648803ccf93d85ffc52c04ac0cf3152bf9a0ed0130fcbf26e8023da6a7596.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\xllllxx.exec:\xllllxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\7jvvv.exec:\7jvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\vpvvv.exec:\vpvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\lfxrxrx.exec:\lfxrxrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\hhnhbt.exec:\hhnhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\jdppv.exec:\jdppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\dvjdp.exec:\dvjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\7rrrrrr.exec:\7rrrrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\1nnnnh.exec:\1nnnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\dvjjj.exec:\dvjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\hhnnbb.exec:\hhnnbb.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\jvjvd.exec:\jvjvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\dvdpv.exec:\dvdpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\xlrrlxx.exec:\xlrrlxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\9thhhh.exec:\9thhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\9pvdd.exec:\9pvdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\fxxrllf.exec:\fxxrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\nbbbtb.exec:\nbbbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\jjjjj.exec:\jjjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\5frrxxf.exec:\5frrxxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\nbnhbb.exec:\nbnhbb.exe23⤵
- Executes dropped EXE
PID:2516 -
\??\c:\hbtnhh.exec:\hbtnhh.exe24⤵
- Executes dropped EXE
PID:4812 -
\??\c:\dpppp.exec:\dpppp.exe25⤵
- Executes dropped EXE
PID:936 -
\??\c:\fxrrrxr.exec:\fxrrrxr.exe26⤵
- Executes dropped EXE
PID:3360 -
\??\c:\llllllf.exec:\llllllf.exe27⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hhtbhh.exec:\hhtbhh.exe28⤵
- Executes dropped EXE
PID:1324 -
\??\c:\vpjjd.exec:\vpjjd.exe29⤵
- Executes dropped EXE
PID:2532 -
\??\c:\hbhbtb.exec:\hbhbtb.exe30⤵
- Executes dropped EXE
PID:3344 -
\??\c:\nhbbbb.exec:\nhbbbb.exe31⤵
- Executes dropped EXE
PID:3368 -
\??\c:\1xxrrlf.exec:\1xxrrlf.exe32⤵
- Executes dropped EXE
PID:1160 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe33⤵
- Executes dropped EXE
PID:224 -
\??\c:\btbnhb.exec:\btbnhb.exe34⤵
- Executes dropped EXE
PID:1812 -
\??\c:\ddjdv.exec:\ddjdv.exe35⤵
- Executes dropped EXE
PID:4740 -
\??\c:\pjjdv.exec:\pjjdv.exe36⤵
- Executes dropped EXE
PID:4212 -
\??\c:\rxfflrl.exec:\rxfflrl.exe37⤵
- Executes dropped EXE
PID:4356 -
\??\c:\bntttb.exec:\bntttb.exe38⤵
- Executes dropped EXE
PID:3048 -
\??\c:\hbhbbb.exec:\hbhbbb.exe39⤵
- Executes dropped EXE
PID:1084 -
\??\c:\pvppv.exec:\pvppv.exe40⤵
- Executes dropped EXE
PID:3600 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe41⤵
- Executes dropped EXE
PID:5052 -
\??\c:\lflfxxr.exec:\lflfxxr.exe42⤵
- Executes dropped EXE
PID:464 -
\??\c:\btbhhh.exec:\btbhhh.exe43⤵
- Executes dropped EXE
PID:4060 -
\??\c:\htnnnn.exec:\htnnnn.exe44⤵
- Executes dropped EXE
PID:2968 -
\??\c:\pjjjp.exec:\pjjjp.exe45⤵
- Executes dropped EXE
PID:3316 -
\??\c:\jvddd.exec:\jvddd.exe46⤵
- Executes dropped EXE
PID:632 -
\??\c:\9rlfxxx.exec:\9rlfxxx.exe47⤵
- Executes dropped EXE
PID:4472 -
\??\c:\nnhhhh.exec:\nnhhhh.exe48⤵
- Executes dropped EXE
PID:4144 -
\??\c:\djddd.exec:\djddd.exe49⤵
- Executes dropped EXE
PID:3988 -
\??\c:\dvdvv.exec:\dvdvv.exe50⤵
- Executes dropped EXE
PID:376 -
\??\c:\vjjdd.exec:\vjjdd.exe51⤵
- Executes dropped EXE
PID:3516 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe52⤵
- Executes dropped EXE
PID:4152 -
\??\c:\tbnnhh.exec:\tbnnhh.exe53⤵
- Executes dropped EXE
PID:4576 -
\??\c:\dpddv.exec:\dpddv.exe54⤵
- Executes dropped EXE
PID:5108 -
\??\c:\jdvvp.exec:\jdvvp.exe55⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xrrxlxl.exec:\xrrxlxl.exe56⤵
- Executes dropped EXE
PID:1092 -
\??\c:\1bhhbb.exec:\1bhhbb.exe57⤵
- Executes dropped EXE
PID:3648 -
\??\c:\thhbbb.exec:\thhbbb.exe58⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pvjdp.exec:\pvjdp.exe59⤵
- Executes dropped EXE
PID:4888 -
\??\c:\ppddv.exec:\ppddv.exe60⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lflflfx.exec:\lflflfx.exe61⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ntnnbt.exec:\ntnnbt.exe62⤵
- Executes dropped EXE
PID:4796 -
\??\c:\bnnnhh.exec:\bnnnhh.exe63⤵
- Executes dropped EXE
PID:2168 -
\??\c:\vjjjj.exec:\vjjjj.exe64⤵
- Executes dropped EXE
PID:3340 -
\??\c:\vppjv.exec:\vppjv.exe65⤵
- Executes dropped EXE
PID:2300 -
\??\c:\llfffff.exec:\llfffff.exe66⤵PID:4852
-
\??\c:\bbntbb.exec:\bbntbb.exe67⤵PID:2764
-
\??\c:\htnhbt.exec:\htnhbt.exe68⤵PID:448
-
\??\c:\3ddvv.exec:\3ddvv.exe69⤵PID:3232
-
\??\c:\lrlffxf.exec:\lrlffxf.exe70⤵PID:3300
-
\??\c:\3hbbtt.exec:\3hbbtt.exe71⤵PID:1112
-
\??\c:\nbhbtt.exec:\nbhbtt.exe72⤵PID:2844
-
\??\c:\pdjpj.exec:\pdjpj.exe73⤵PID:3268
-
\??\c:\xrxrxxl.exec:\xrxrxxl.exe74⤵PID:4952
-
\??\c:\frxxxxx.exec:\frxxxxx.exe75⤵
- System Location Discovery: System Language Discovery
PID:3612 -
\??\c:\7hhhhb.exec:\7hhhhb.exe76⤵
- System Location Discovery: System Language Discovery
PID:3532 -
\??\c:\3pjjp.exec:\3pjjp.exe77⤵PID:1636
-
\??\c:\xxffllf.exec:\xxffllf.exe78⤵PID:3144
-
\??\c:\xlrllll.exec:\xlrllll.exe79⤵PID:2196
-
\??\c:\bbbttt.exec:\bbbttt.exe80⤵PID:2992
-
\??\c:\vppjd.exec:\vppjd.exe81⤵PID:660
-
\??\c:\5rrrlff.exec:\5rrrlff.exe82⤵PID:2012
-
\??\c:\flrrlll.exec:\flrrlll.exe83⤵PID:2604
-
\??\c:\bnnnhh.exec:\bnnnhh.exe84⤵PID:3728
-
\??\c:\1hbhhh.exec:\1hbhhh.exe85⤵PID:4400
-
\??\c:\vjjdv.exec:\vjjdv.exe86⤵PID:2868
-
\??\c:\dvppd.exec:\dvppd.exe87⤵PID:3992
-
\??\c:\xllrxxx.exec:\xllrxxx.exe88⤵PID:1324
-
\??\c:\nnhhnn.exec:\nnhhnn.exe89⤵PID:1816
-
\??\c:\pjjdv.exec:\pjjdv.exe90⤵PID:3816
-
\??\c:\ddpjj.exec:\ddpjj.exe91⤵PID:2176
-
\??\c:\rrxfxrx.exec:\rrxfxrx.exe92⤵PID:2640
-
\??\c:\tnnhbb.exec:\tnnhbb.exe93⤵PID:5044
-
\??\c:\jpvjd.exec:\jpvjd.exe94⤵PID:5048
-
\??\c:\rlrfffx.exec:\rlrfffx.exe95⤵PID:3008
-
\??\c:\tthtbt.exec:\tthtbt.exe96⤵PID:3508
-
\??\c:\dvvpp.exec:\dvvpp.exe97⤵PID:1844
-
\??\c:\vvjjj.exec:\vvjjj.exe98⤵PID:2520
-
\??\c:\lxfxlll.exec:\lxfxlll.exe99⤵PID:4104
-
\??\c:\tnthbb.exec:\tnthbb.exe100⤵PID:1592
-
\??\c:\btbbth.exec:\btbbth.exe101⤵PID:3608
-
\??\c:\3pjjj.exec:\3pjjj.exe102⤵PID:1572
-
\??\c:\rrlffff.exec:\rrlffff.exe103⤵PID:4704
-
\??\c:\9lxlfrl.exec:\9lxlfrl.exe104⤵PID:920
-
\??\c:\5ntnhh.exec:\5ntnhh.exe105⤵PID:1852
-
\??\c:\hhhbhh.exec:\hhhbhh.exe106⤵PID:4568
-
\??\c:\pjpdv.exec:\pjpdv.exe107⤵PID:1348
-
\??\c:\jpvpj.exec:\jpvpj.exe108⤵PID:4416
-
\??\c:\frrlllf.exec:\frrlllf.exe109⤵PID:4376
-
\??\c:\hhnnnb.exec:\hhnnnb.exe110⤵PID:384
-
\??\c:\ddpjd.exec:\ddpjd.exe111⤵
- System Location Discovery: System Language Discovery
PID:4220 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe112⤵PID:3692
-
\??\c:\ffrffll.exec:\ffrffll.exe113⤵PID:2736
-
\??\c:\bntnnn.exec:\bntnnn.exe114⤵PID:400
-
\??\c:\jppjj.exec:\jppjj.exe115⤵PID:860
-
\??\c:\pdddj.exec:\pdddj.exe116⤵PID:5012
-
\??\c:\lllxlfx.exec:\lllxlfx.exe117⤵PID:672
-
\??\c:\nnbbbb.exec:\nnbbbb.exe118⤵PID:1620
-
\??\c:\vpddv.exec:\vpddv.exe119⤵PID:1144
-
\??\c:\xrrlffr.exec:\xrrlffr.exe120⤵PID:2712
-
\??\c:\hhnhbt.exec:\hhnhbt.exe121⤵PID:1836
-
\??\c:\3htntt.exec:\3htntt.exe122⤵PID:776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-