Analysis
-
max time kernel
102s -
max time network
15s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 20:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a94f119a17976b55a6c9f415582f81c0N.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
a94f119a17976b55a6c9f415582f81c0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
120 seconds
General
-
Target
a94f119a17976b55a6c9f415582f81c0N.exe
-
Size
208KB
-
MD5
a94f119a17976b55a6c9f415582f81c0
-
SHA1
3b3112702de77e2cfdd2ded0c31ca13dafe9b085
-
SHA256
8e3571997c4ae41c38944d0de262e52125e4993193cc6f7c36cafd20034bdcb0
-
SHA512
b9b29aedb298bd0a513ebd0e66d59de087f3708846b8845bc856fa8c73db7cc64fd533a35b8443ee2ed2d29da393c89b0e463ddf952b90a1882fb78acd099e3f
-
SSDEEP
3072:YaCccMSFPJMHwqXYyD56LZPqG8ToYG6CJnh/rbKHWYsS+O4NLthEjQT6:lCccMSd6wgD5SRyJCJR3KHtFQEj
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3028 FSJTIVL.exe 2112 NIUMSP.exe 760 IVLWDAH.exe 2452 MFEQGVV.exe 2700 LDXTTA.exe 1404 YDDR.exe 1884 STJKQF.exe 1676 ZRTXW.exe 2436 ZZSGPQU.exe 912 LPLG.exe 932 JHEKRW.exe 1592 VXKCOT.exe 1120 UKTFOV.exe 2812 QKAL.exe 2648 LVV.exe 2732 MVBX.exe 2568 EAYHFN.exe 2452 LTTBU.exe 2672 MBRKV.exe 2904 WWVDQ.exe 2504 FEGESK.exe 2276 CGOBVKP.exe 2444 MEG.exe 2512 CXOAKV.exe 1772 QXUYLU.exe 2076 NAQ.exe 872 BAXAZI.exe 2540 SNT.exe 2208 RAQDPGJ.exe 2868 RIPEP.exe 2612 DDQJP.exe 2356 NBIV.exe 1700 XDE.exe 2980 OQBNRBH.exe 2560 ALD.exe 2108 GJANUD.exe 2232 XWXFLLX.exe 1676 NPFRJ.exe 304 VZSL.exe 2364 HEWS.exe 992 VPRJVL.exe 1708 WVCZ.exe 2056 QNPWP.exe 1660 GFW.exe 2208 EDIC.exe 2840 WGICD.exe 2632 BLNJ.exe 1704 BTLS.exe 2788 JLGMSQ.exe 2652 VBZEFUX.exe 1516 JBGKH.exe 2108 IOPMHD.exe 2428 WPBSZ.exe 1676 FZK.exe 1532 RUZFSB.exe 264 MXB.exe 3000 UPPPFVZ.exe 1592 HFNBFXG.exe 2336 JFB.exe 2744 XIVGJ.exe 2820 XQI.exe 1300 LYOV.exe 2684 KLXFDJR.exe 2476 RJVS.exe -
Loads dropped DLL 64 IoCs
pid Process 916 cmd.exe 916 cmd.exe 2228 cmd.exe 2228 cmd.exe 1184 cmd.exe 1184 cmd.exe 828 cmd.exe 828 cmd.exe 2580 cmd.exe 2580 cmd.exe 1724 cmd.exe 1724 cmd.exe 2756 cmd.exe 2756 cmd.exe 2880 cmd.exe 2880 cmd.exe 2844 cmd.exe 2844 cmd.exe 3008 cmd.exe 3008 cmd.exe 2460 cmd.exe 2460 cmd.exe 1184 cmd.exe 1184 cmd.exe 2296 cmd.exe 2296 cmd.exe 672 cmd.exe 672 cmd.exe 2128 cmd.exe 2128 cmd.exe 1368 cmd.exe 1368 cmd.exe 2308 cmd.exe 2308 cmd.exe 1496 cmd.exe 1496 cmd.exe 2164 cmd.exe 2164 cmd.exe 2456 cmd.exe 2456 cmd.exe 1564 cmd.exe 1564 cmd.exe 2872 cmd.exe 2872 cmd.exe 2484 cmd.exe 2484 cmd.exe 1888 cmd.exe 1888 cmd.exe 2400 cmd.exe 2400 cmd.exe 828 cmd.exe 828 cmd.exe 1600 cmd.exe 1600 cmd.exe 652 cmd.exe 652 cmd.exe 2804 cmd.exe 2804 cmd.exe 2408 cmd.exe 2408 cmd.exe 1860 cmd.exe 1860 cmd.exe 1800 cmd.exe 1800 cmd.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\STJKQF.exe.bat YDDR.exe File opened for modification C:\windows\SysWOW64\GJANUD.exe ALD.exe File created C:\windows\SysWOW64\ORRTLI.exe ROVWRBH.exe File created C:\windows\SysWOW64\AEZ.exe VGO.exe File created C:\windows\SysWOW64\RGKGD.exe MBING.exe File created C:\windows\SysWOW64\LYOV.exe XQI.exe File opened for modification C:\windows\SysWOW64\GABRNSM.exe UFMEX.exe File created C:\windows\SysWOW64\GABRNSM.exe.bat UFMEX.exe File created C:\windows\SysWOW64\AZLVCMZ.exe.bat YEI.exe File created C:\windows\SysWOW64\WRV.exe PUXHYT.exe File created C:\windows\SysWOW64\SNT.exe.bat BAXAZI.exe File opened for modification C:\windows\SysWOW64\JBGKH.exe VBZEFUX.exe File opened for modification C:\windows\SysWOW64\JFB.exe HFNBFXG.exe File opened for modification C:\windows\SysWOW64\MBING.exe ALO.exe File opened for modification C:\windows\SysWOW64\BTLS.exe BLNJ.exe File created C:\windows\SysWOW64\AEZ.exe.bat VGO.exe File opened for modification C:\windows\SysWOW64\QKAL.exe UKTFOV.exe File created C:\windows\SysWOW64\WPBSZ.exe IOPMHD.exe File created C:\windows\SysWOW64\XQI.exe.bat XIVGJ.exe File created C:\windows\SysWOW64\MAMFA.exe PXEI.exe File created C:\windows\SysWOW64\GZMKD.exe.bat ORRTLI.exe File created C:\windows\SysWOW64\SNT.exe BAXAZI.exe File opened for modification C:\windows\SysWOW64\FEGESK.exe WWVDQ.exe File created C:\windows\SysWOW64\CGOBVKP.exe FEGESK.exe File created C:\windows\SysWOW64\GJANUD.exe.bat ALD.exe File created C:\windows\SysWOW64\LYOV.exe.bat XQI.exe File created C:\windows\SysWOW64\STJKQF.exe YDDR.exe File created C:\windows\SysWOW64\WWVDQ.exe MBRKV.exe File created C:\windows\SysWOW64\ORRTLI.exe.bat ROVWRBH.exe File opened for modification C:\windows\SysWOW64\YDDR.exe LDXTTA.exe File created C:\windows\SysWOW64\ZTANR.exe AYRKR.exe File created C:\windows\SysWOW64\ELIPS.exe SQH.exe File created C:\windows\SysWOW64\UKTFOV.exe VXKCOT.exe File opened for modification C:\windows\SysWOW64\UKTFOV.exe VXKCOT.exe File created C:\windows\SysWOW64\FEGESK.exe WWVDQ.exe File created C:\windows\SysWOW64\WGICD.exe.bat EDIC.exe File created C:\windows\SysWOW64\IKG.exe THPDX.exe File opened for modification C:\windows\SysWOW64\CEYV.exe AEZ.exe File created C:\windows\SysWOW64\MFEQGVV.exe.bat IVLWDAH.exe File created C:\windows\SysWOW64\YDDR.exe.bat LDXTTA.exe File created C:\windows\SysWOW64\WWVDQ.exe.bat MBRKV.exe File created C:\windows\SysWOW64\XQI.exe XIVGJ.exe File created C:\windows\SysWOW64\MBING.exe ALO.exe File opened for modification C:\windows\SysWOW64\LPLG.exe ZZSGPQU.exe File created C:\windows\SysWOW64\LPLG.exe.bat ZZSGPQU.exe File created C:\windows\SysWOW64\WPBSZ.exe.bat IOPMHD.exe File created C:\windows\SysWOW64\JFB.exe HFNBFXG.exe File opened for modification C:\windows\SysWOW64\WRV.exe PUXHYT.exe File opened for modification C:\windows\SysWOW64\MAMFA.exe PXEI.exe File opened for modification C:\windows\SysWOW64\QXUYLU.exe CXOAKV.exe File opened for modification C:\windows\SysWOW64\RAQDPGJ.exe SNT.exe File opened for modification C:\windows\SysWOW64\RJVS.exe KLXFDJR.exe File created C:\windows\SysWOW64\ZTANR.exe.bat AYRKR.exe File created C:\windows\SysWOW64\RAQDPGJ.exe.bat SNT.exe File opened for modification C:\windows\SysWOW64\OQBNRBH.exe XDE.exe File opened for modification C:\windows\SysWOW64\XQI.exe XIVGJ.exe File created C:\windows\SysWOW64\RJVS.exe KLXFDJR.exe File created C:\windows\SysWOW64\MFEQGVV.exe IVLWDAH.exe File created C:\windows\SysWOW64\CGOBVKP.exe.bat FEGESK.exe File created C:\windows\SysWOW64\GJANUD.exe ALD.exe File opened for modification C:\windows\SysWOW64\GZMKD.exe ORRTLI.exe File created C:\windows\SysWOW64\ELIPS.exe.bat SQH.exe File created C:\windows\SysWOW64\MBING.exe.bat ALO.exe File created C:\windows\SysWOW64\QKAL.exe.bat UKTFOV.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\ZRTXW.exe STJKQF.exe File created C:\windows\TBVPW.exe.bat RJVS.exe File created C:\windows\NBG.exe BLNJFO.exe File opened for modification C:\windows\LDXTTA.exe MFEQGVV.exe File created C:\windows\FROHSW.exe TBVPW.exe File opened for modification C:\windows\THPDX.exe OCS.exe File created C:\windows\CBEB.exe WDGGQTB.exe File created C:\windows\system\ALD.exe OQBNRBH.exe File opened for modification C:\windows\system\VBZEFUX.exe JLGMSQ.exe File created C:\windows\system\WZSBVTT.exe AZLVCMZ.exe File created C:\windows\ZRTXW.exe STJKQF.exe File created C:\windows\ZZSGPQU.exe ZRTXW.exe File created C:\windows\system\FSOISHU.exe.bat MAMFA.exe File created C:\windows\WDGGQTB.exe.bat HJDJW.exe File created C:\windows\system\ALO.exe.bat ELIPS.exe File created C:\windows\KLXFDJR.exe LYOV.exe File opened for modification C:\windows\system\JLGMSQ.exe BTLS.exe File opened for modification C:\windows\system\EAYHFN.exe MVBX.exe File created C:\windows\TMHS.exe GMV.exe File opened for modification C:\windows\system\SQH.exe GABRNSM.exe File created C:\windows\RIPEP.exe RAQDPGJ.exe File created C:\windows\system\BAXAZI.exe NAQ.exe File opened for modification C:\windows\system\EDIC.exe GFW.exe File created C:\windows\system\SXNJ.exe WRV.exe File created C:\windows\system\SQH.exe.bat GABRNSM.exe File created C:\windows\ZZSGPQU.exe.bat ZRTXW.exe File opened for modification C:\windows\VXKCOT.exe JHEKRW.exe File created C:\windows\DDQJP.exe.bat RIPEP.exe File opened for modification C:\windows\system\GFW.exe QNPWP.exe File created C:\windows\system\EDIC.exe.bat GFW.exe File created C:\windows\PXEI.exe PKHYFND.exe File created C:\windows\LAEDVNF.exe.bat WFIHB.exe File created C:\windows\NIUMSP.exe FSJTIVL.exe File created C:\windows\system\ZVJNZMQ.exe.bat FCKZCU.exe File opened for modification C:\windows\system\LQMD.exe FSOISHU.exe File created C:\windows\ZRTXW.exe.bat STJKQF.exe File opened for modification C:\windows\system\JHEKRW.exe LPLG.exe File opened for modification C:\windows\FZK.exe WPBSZ.exe File opened for modification C:\windows\NIUMSP.exe FSJTIVL.exe File opened for modification C:\windows\RUZFSB.exe FZK.exe File created C:\windows\MVBX.exe LVV.exe File created C:\windows\system\HFNBFXG.exe.bat UPPPFVZ.exe File created C:\windows\TBVPW.exe RJVS.exe File opened for modification C:\windows\system\BLNJFO.exe ZTANR.exe File opened for modification C:\windows\system\VGO.exe CBEB.exe File created C:\windows\NBIV.exe DDQJP.exe File created C:\windows\system\EDIC.exe GFW.exe File created C:\windows\FZK.exe.bat WPBSZ.exe File opened for modification C:\windows\system\WMJ.exe YOMFOW.exe File created C:\windows\system\SNUPBRC.exe IKG.exe File opened for modification C:\windows\system\LVV.exe QKAL.exe File created C:\windows\RUZFSB.exe.bat FZK.exe File created C:\windows\system\MEG.exe CGOBVKP.exe File created C:\windows\system\SNUPBRC.exe.bat IKG.exe File created C:\windows\HJDJW.exe.bat LAEDVNF.exe File opened for modification C:\windows\KLXFDJR.exe LYOV.exe File opened for modification C:\windows\PXEI.exe PKHYFND.exe File created C:\windows\THPDX.exe OCS.exe File opened for modification C:\windows\WDGGQTB.exe HJDJW.exe File created C:\windows\NBIV.exe.bat DDQJP.exe File created C:\windows\NAQ.exe.bat QXUYLU.exe File created C:\windows\system\GFW.exe QNPWP.exe File opened for modification C:\windows\TBVPW.exe RJVS.exe File created C:\windows\system\BLNJFO.exe.bat ZTANR.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEGESK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPBSZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBZEFUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZLVCMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIPEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPPPFVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LTTBU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LQMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UKTFOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WWVDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZMKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDDR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAXAZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WVCZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NPFRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLXFDJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UYXXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LDXTTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEYV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZSGPQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFEQGVV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDQJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FSOISHU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDGGQTB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2884 a94f119a17976b55a6c9f415582f81c0N.exe 3028 FSJTIVL.exe 2112 NIUMSP.exe 760 IVLWDAH.exe 2452 MFEQGVV.exe 2700 LDXTTA.exe 1404 YDDR.exe 1884 STJKQF.exe 1676 ZRTXW.exe 2436 ZZSGPQU.exe 912 LPLG.exe 932 JHEKRW.exe 1592 VXKCOT.exe 1120 UKTFOV.exe 2812 QKAL.exe 2648 LVV.exe 2732 MVBX.exe 2568 EAYHFN.exe 2452 LTTBU.exe 2672 MBRKV.exe 2904 WWVDQ.exe 2504 FEGESK.exe 2276 CGOBVKP.exe 2444 MEG.exe 2512 CXOAKV.exe 1772 QXUYLU.exe 2076 NAQ.exe 872 BAXAZI.exe 2540 SNT.exe 2208 RAQDPGJ.exe 2868 RIPEP.exe 2612 DDQJP.exe 2356 NBIV.exe 1700 XDE.exe 2980 OQBNRBH.exe 2560 ALD.exe 2108 GJANUD.exe 2232 XWXFLLX.exe 1676 NPFRJ.exe 304 VZSL.exe 2364 HEWS.exe 992 VPRJVL.exe 1708 WVCZ.exe 2056 QNPWP.exe 1660 GFW.exe 2208 EDIC.exe 2840 WGICD.exe 2632 BLNJ.exe 1704 BTLS.exe 2788 JLGMSQ.exe 2652 VBZEFUX.exe 1516 JBGKH.exe 2108 IOPMHD.exe 2428 WPBSZ.exe 1676 FZK.exe 1532 RUZFSB.exe 264 MXB.exe 3000 UPPPFVZ.exe 1592 HFNBFXG.exe 2336 JFB.exe 2744 XIVGJ.exe 2820 XQI.exe 1300 LYOV.exe 2684 KLXFDJR.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2884 a94f119a17976b55a6c9f415582f81c0N.exe 2884 a94f119a17976b55a6c9f415582f81c0N.exe 3028 FSJTIVL.exe 3028 FSJTIVL.exe 2112 NIUMSP.exe 2112 NIUMSP.exe 760 IVLWDAH.exe 760 IVLWDAH.exe 2452 MFEQGVV.exe 2452 MFEQGVV.exe 2700 LDXTTA.exe 2700 LDXTTA.exe 1404 YDDR.exe 1404 YDDR.exe 1884 STJKQF.exe 1884 STJKQF.exe 1676 ZRTXW.exe 1676 ZRTXW.exe 2436 ZZSGPQU.exe 2436 ZZSGPQU.exe 912 LPLG.exe 912 LPLG.exe 932 JHEKRW.exe 932 JHEKRW.exe 1592 VXKCOT.exe 1592 VXKCOT.exe 1120 UKTFOV.exe 1120 UKTFOV.exe 2812 QKAL.exe 2812 QKAL.exe 2648 LVV.exe 2648 LVV.exe 2732 MVBX.exe 2732 MVBX.exe 2568 EAYHFN.exe 2568 EAYHFN.exe 2452 LTTBU.exe 2452 LTTBU.exe 2672 MBRKV.exe 2672 MBRKV.exe 2904 WWVDQ.exe 2904 WWVDQ.exe 2504 FEGESK.exe 2504 FEGESK.exe 2276 CGOBVKP.exe 2276 CGOBVKP.exe 2444 MEG.exe 2444 MEG.exe 2512 CXOAKV.exe 2512 CXOAKV.exe 1772 QXUYLU.exe 1772 QXUYLU.exe 2076 NAQ.exe 2076 NAQ.exe 872 BAXAZI.exe 872 BAXAZI.exe 2540 SNT.exe 2540 SNT.exe 2208 RAQDPGJ.exe 2208 RAQDPGJ.exe 2868 RIPEP.exe 2868 RIPEP.exe 2612 DDQJP.exe 2612 DDQJP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2768 2884 a94f119a17976b55a6c9f415582f81c0N.exe 29 PID 2884 wrote to memory of 2768 2884 a94f119a17976b55a6c9f415582f81c0N.exe 29 PID 2884 wrote to memory of 2768 2884 a94f119a17976b55a6c9f415582f81c0N.exe 29 PID 2884 wrote to memory of 2768 2884 a94f119a17976b55a6c9f415582f81c0N.exe 29 PID 2768 wrote to memory of 3028 2768 cmd.exe 31 PID 2768 wrote to memory of 3028 2768 cmd.exe 31 PID 2768 wrote to memory of 3028 2768 cmd.exe 31 PID 2768 wrote to memory of 3028 2768 cmd.exe 31 PID 3028 wrote to memory of 2952 3028 FSJTIVL.exe 32 PID 3028 wrote to memory of 2952 3028 FSJTIVL.exe 32 PID 3028 wrote to memory of 2952 3028 FSJTIVL.exe 32 PID 3028 wrote to memory of 2952 3028 FSJTIVL.exe 32 PID 2952 wrote to memory of 2112 2952 cmd.exe 34 PID 2952 wrote to memory of 2112 2952 cmd.exe 34 PID 2952 wrote to memory of 2112 2952 cmd.exe 34 PID 2952 wrote to memory of 2112 2952 cmd.exe 34 PID 2112 wrote to memory of 2676 2112 NIUMSP.exe 35 PID 2112 wrote to memory of 2676 2112 NIUMSP.exe 35 PID 2112 wrote to memory of 2676 2112 NIUMSP.exe 35 PID 2112 wrote to memory of 2676 2112 NIUMSP.exe 35 PID 2676 wrote to memory of 760 2676 cmd.exe 37 PID 2676 wrote to memory of 760 2676 cmd.exe 37 PID 2676 wrote to memory of 760 2676 cmd.exe 37 PID 2676 wrote to memory of 760 2676 cmd.exe 37 PID 760 wrote to memory of 916 760 IVLWDAH.exe 38 PID 760 wrote to memory of 916 760 IVLWDAH.exe 38 PID 760 wrote to memory of 916 760 IVLWDAH.exe 38 PID 760 wrote to memory of 916 760 IVLWDAH.exe 38 PID 916 wrote to memory of 2452 916 cmd.exe 40 PID 916 wrote to memory of 2452 916 cmd.exe 40 PID 916 wrote to memory of 2452 916 cmd.exe 40 PID 916 wrote to memory of 2452 916 cmd.exe 40 PID 2452 wrote to memory of 2944 2452 MFEQGVV.exe 41 PID 2452 wrote to memory of 2944 2452 MFEQGVV.exe 41 PID 2452 wrote to memory of 2944 2452 MFEQGVV.exe 41 PID 2452 wrote to memory of 2944 2452 MFEQGVV.exe 41 PID 2944 wrote to memory of 2700 2944 cmd.exe 43 PID 2944 wrote to memory of 2700 2944 cmd.exe 43 PID 2944 wrote to memory of 2700 2944 cmd.exe 43 PID 2944 wrote to memory of 2700 2944 cmd.exe 43 PID 2700 wrote to memory of 2228 2700 LDXTTA.exe 44 PID 2700 wrote to memory of 2228 2700 LDXTTA.exe 44 PID 2700 wrote to memory of 2228 2700 LDXTTA.exe 44 PID 2700 wrote to memory of 2228 2700 LDXTTA.exe 44 PID 2228 wrote to memory of 1404 2228 cmd.exe 46 PID 2228 wrote to memory of 1404 2228 cmd.exe 46 PID 2228 wrote to memory of 1404 2228 cmd.exe 46 PID 2228 wrote to memory of 1404 2228 cmd.exe 46 PID 1404 wrote to memory of 1184 1404 YDDR.exe 47 PID 1404 wrote to memory of 1184 1404 YDDR.exe 47 PID 1404 wrote to memory of 1184 1404 YDDR.exe 47 PID 1404 wrote to memory of 1184 1404 YDDR.exe 47 PID 1184 wrote to memory of 1884 1184 cmd.exe 49 PID 1184 wrote to memory of 1884 1184 cmd.exe 49 PID 1184 wrote to memory of 1884 1184 cmd.exe 49 PID 1184 wrote to memory of 1884 1184 cmd.exe 49 PID 1884 wrote to memory of 2428 1884 STJKQF.exe 50 PID 1884 wrote to memory of 2428 1884 STJKQF.exe 50 PID 1884 wrote to memory of 2428 1884 STJKQF.exe 50 PID 1884 wrote to memory of 2428 1884 STJKQF.exe 50 PID 2428 wrote to memory of 1676 2428 cmd.exe 52 PID 2428 wrote to memory of 1676 2428 cmd.exe 52 PID 2428 wrote to memory of 1676 2428 cmd.exe 52 PID 2428 wrote to memory of 1676 2428 cmd.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\a94f119a17976b55a6c9f415582f81c0N.exe"C:\Users\Admin\AppData\Local\Temp\a94f119a17976b55a6c9f415582f81c0N.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\FSJTIVL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\windows\FSJTIVL.exeC:\windows\FSJTIVL.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\NIUMSP.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\windows\NIUMSP.exeC:\windows\NIUMSP.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\IVLWDAH.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\windows\IVLWDAH.exeC:\windows\IVLWDAH.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\MFEQGVV.exe.bat" "8⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:916 -
C:\windows\SysWOW64\MFEQGVV.exeC:\windows\system32\MFEQGVV.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\LDXTTA.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\windows\LDXTTA.exeC:\windows\LDXTTA.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\YDDR.exe.bat" "12⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\windows\SysWOW64\YDDR.exeC:\windows\system32\YDDR.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\STJKQF.exe.bat" "14⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\windows\SysWOW64\STJKQF.exeC:\windows\system32\STJKQF.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\ZRTXW.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\windows\ZRTXW.exeC:\windows\ZRTXW.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1676 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\ZZSGPQU.exe.bat" "18⤵PID:1528
-
C:\windows\ZZSGPQU.exeC:\windows\ZZSGPQU.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2436 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\LPLG.exe.bat" "20⤵
- Loads dropped DLL
PID:828 -
C:\windows\SysWOW64\LPLG.exeC:\windows\system32\LPLG.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:912 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\system\JHEKRW.exe.bat" "22⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2580 -
C:\windows\system\JHEKRW.exeC:\windows\system\JHEKRW.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:932 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\VXKCOT.exe.bat" "24⤵PID:904
-
C:\windows\VXKCOT.exeC:\windows\VXKCOT.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1592 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\UKTFOV.exe.bat" "26⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1724 -
C:\windows\SysWOW64\UKTFOV.exeC:\windows\system32\UKTFOV.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1120 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\QKAL.exe.bat" "28⤵
- Loads dropped DLL
PID:2756 -
C:\windows\SysWOW64\QKAL.exeC:\windows\system32\QKAL.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2812 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\system\LVV.exe.bat" "30⤵
- Loads dropped DLL
PID:2880 -
C:\windows\system\LVV.exeC:\windows\system\LVV.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2648 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\MVBX.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
PID:2664 -
C:\windows\MVBX.exeC:\windows\MVBX.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2732 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system\EAYHFN.exe.bat" "34⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2844 -
C:\windows\system\EAYHFN.exeC:\windows\system\EAYHFN.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2568 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system\LTTBU.exe.bat" "36⤵
- Loads dropped DLL
PID:3008 -
C:\windows\system\LTTBU.exeC:\windows\system\LTTBU.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2452 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\MBRKV.exe.bat" "38⤵PID:2984
-
C:\windows\MBRKV.exeC:\windows\MBRKV.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2672 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\WWVDQ.exe.bat" "40⤵
- Loads dropped DLL
PID:2460 -
C:\windows\SysWOW64\WWVDQ.exeC:\windows\system32\WWVDQ.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2904 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\FEGESK.exe.bat" "42⤵
- Loads dropped DLL
PID:1184 -
C:\windows\SysWOW64\FEGESK.exeC:\windows\system32\FEGESK.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2504 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\CGOBVKP.exe.bat" "44⤵
- Loads dropped DLL
PID:2296 -
C:\windows\SysWOW64\CGOBVKP.exeC:\windows\system32\CGOBVKP.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2276 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\system\MEG.exe.bat" "46⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:672 -
C:\windows\system\MEG.exeC:\windows\system\MEG.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2444 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system\CXOAKV.exe.bat" "48⤵
- Loads dropped DLL
PID:2128 -
C:\windows\system\CXOAKV.exeC:\windows\system\CXOAKV.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2512 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\QXUYLU.exe.bat" "50⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1368 -
C:\windows\SysWOW64\QXUYLU.exeC:\windows\system32\QXUYLU.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1772 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\NAQ.exe.bat" "52⤵PID:564
-
C:\windows\NAQ.exeC:\windows\NAQ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2076 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system\BAXAZI.exe.bat" "54⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2308 -
C:\windows\system\BAXAZI.exeC:\windows\system\BAXAZI.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:872 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\SNT.exe.bat" "56⤵
- Loads dropped DLL
PID:1496 -
C:\windows\SysWOW64\SNT.exeC:\windows\system32\SNT.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2540 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\RAQDPGJ.exe.bat" "58⤵
- Loads dropped DLL
PID:2164 -
C:\windows\SysWOW64\RAQDPGJ.exeC:\windows\system32\RAQDPGJ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2208 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\RIPEP.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
PID:2820 -
C:\windows\RIPEP.exeC:\windows\RIPEP.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2868 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\DDQJP.exe.bat" "62⤵PID:2992
-
C:\windows\DDQJP.exeC:\windows\DDQJP.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2612 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\NBIV.exe.bat" "64⤵PID:2688
-
C:\windows\NBIV.exeC:\windows\NBIV.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2356 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system\XDE.exe.bat" "66⤵
- Loads dropped DLL
PID:2456 -
C:\windows\system\XDE.exeC:\windows\system\XDE.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1700 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\OQBNRBH.exe.bat" "68⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1564 -
C:\windows\SysWOW64\OQBNRBH.exeC:\windows\system32\OQBNRBH.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2980 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\system\ALD.exe.bat" "70⤵
- Loads dropped DLL
PID:2872 -
C:\windows\system\ALD.exeC:\windows\system\ALD.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2560 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\GJANUD.exe.bat" "72⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2484 -
C:\windows\SysWOW64\GJANUD.exeC:\windows\system32\GJANUD.exe73⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2108 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\system\XWXFLLX.exe.bat" "74⤵
- Loads dropped DLL
PID:1888 -
C:\windows\system\XWXFLLX.exeC:\windows\system\XWXFLLX.exe75⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2232 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\NPFRJ.exe.bat" "76⤵PID:2496
-
C:\windows\NPFRJ.exeC:\windows\NPFRJ.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1676 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system\VZSL.exe.bat" "78⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2400 -
C:\windows\system\VZSL.exeC:\windows\system\VZSL.exe79⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:304 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system\HEWS.exe.bat" "80⤵
- Loads dropped DLL
PID:828 -
C:\windows\system\HEWS.exeC:\windows\system\HEWS.exe81⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2364 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system\VPRJVL.exe.bat" "82⤵
- Loads dropped DLL
PID:1600 -
C:\windows\system\VPRJVL.exeC:\windows\system\VPRJVL.exe83⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:992 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\WVCZ.exe.bat" "84⤵PID:548
-
C:\windows\WVCZ.exeC:\windows\WVCZ.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1708 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\QNPWP.exe.bat" "86⤵PID:1452
-
C:\windows\QNPWP.exeC:\windows\QNPWP.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2056 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system\GFW.exe.bat" "88⤵
- Loads dropped DLL
PID:652 -
C:\windows\system\GFW.exeC:\windows\system\GFW.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1660 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system\EDIC.exe.bat" "90⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2804 -
C:\windows\system\EDIC.exeC:\windows\system\EDIC.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2208 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\WGICD.exe.bat" "92⤵
- Loads dropped DLL
PID:2408 -
C:\windows\SysWOW64\WGICD.exeC:\windows\system32\WGICD.exe93⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2840 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\BLNJ.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:840 -
C:\windows\BLNJ.exeC:\windows\BLNJ.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2632 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\BTLS.exe.bat" "96⤵
- Loads dropped DLL
PID:1860 -
C:\windows\SysWOW64\BTLS.exeC:\windows\system32\BTLS.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1704 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\system\JLGMSQ.exe.bat" "98⤵
- Loads dropped DLL
PID:1800 -
C:\windows\system\JLGMSQ.exeC:\windows\system\JLGMSQ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2788 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system\VBZEFUX.exe.bat" "100⤵PID:2892
-
C:\windows\system\VBZEFUX.exeC:\windows\system\VBZEFUX.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2652 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\JBGKH.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:3044 -
C:\windows\SysWOW64\JBGKH.exeC:\windows\system32\JBGKH.exe103⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1516 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\system\IOPMHD.exe.bat" "104⤵PID:1968
-
C:\windows\system\IOPMHD.exeC:\windows\system\IOPMHD.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2108 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\WPBSZ.exe.bat" "106⤵PID:1884
-
C:\windows\SysWOW64\WPBSZ.exeC:\windows\system32\WPBSZ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2428 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\FZK.exe.bat" "108⤵PID:2488
-
C:\windows\FZK.exeC:\windows\FZK.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1676 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\RUZFSB.exe.bat" "110⤵PID:3020
-
C:\windows\RUZFSB.exeC:\windows\RUZFSB.exe111⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1532 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system\MXB.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:1588 -
C:\windows\system\MXB.exeC:\windows\system\MXB.exe113⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:264 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\UPPPFVZ.exe.bat" "114⤵PID:2352
-
C:\windows\UPPPFVZ.exeC:\windows\UPPPFVZ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3000 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system\HFNBFXG.exe.bat" "116⤵PID:2308
-
C:\windows\system\HFNBFXG.exeC:\windows\system\HFNBFXG.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1592 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system32\JFB.exe.bat" "118⤵PID:768
-
C:\windows\SysWOW64\JFB.exeC:\windows\system32\JFB.exe119⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2336 -
C:\windows\SysWOW64\cmd.execmd /c ""C:\windows\XIVGJ.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:2740 -
C:\windows\XIVGJ.exeC:\windows\XIVGJ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-