Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 21:28
Static task
static1
Behavioral task
behavioral1
Sample
34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe
Resource
win7-20240708-en
General
-
Target
34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe
-
Size
105KB
-
MD5
d8b1eb5847774742429d5578ed0e8b57
-
SHA1
8dd1723c339a881b22899a3c9a6f0e7ea743e2f4
-
SHA256
34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7
-
SHA512
2b0eab56c7677175e38e424baa4c23356e52b170dd47ee18d225aa44d078a930b83c6e0df4146d4118a4e8a85e56cc9f8212b762265074e566d98baba506179c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHq82PCK:n3C9BRo7tvnJ99T/KZE89K
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/4680-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1596-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pdjdd.exexrxrrfx.exenhhtbt.exedjvpd.exedjvpv.exexrrxlfl.exennbbhn.exejppjj.exelrfffxx.exe1frlllf.exejvjpd.exevpvpj.exe5fxrfff.exe1hnhbh.exe9hnbnn.exepjjdd.exejpvpj.exelrfxffl.exetbhthh.exedvddj.exejdvpv.exehtthbt.exetntttb.exehbhhnn.exe7pvvj.exerfllflf.exenbnnnn.exejdvpj.exevvjvv.exe7lrlxxx.exetbbbhb.exehbbhbb.exedpjvp.exerlrrllr.exe3rrlfff.exenbnttt.exedjppv.exerlxrffr.exebbttbb.exenbhbtt.exepvjpp.exepjddv.exejddjd.exehhnttt.exethtnhb.exevpdjd.exe5ddpd.exe3jvvv.exerfflxxl.exe9hhttn.exehntthh.exepddvj.exelfrllrr.exelfllfff.exetnnnhh.exebtbbtn.exe7jpjd.exedpvvj.exelxxlrrf.exe3nhhbb.exehbbbtt.exeppdjv.exepjjdp.exe1frxrrr.exepid process 2712 pdjdd.exe 3572 xrxrrfx.exe 3580 nhhtbt.exe 3132 djvpd.exe 508 djvpv.exe 4140 xrrxlfl.exe 1736 nnbbhn.exe 4208 jppjj.exe 2736 lrfffxx.exe 4868 1frlllf.exe 4836 jvjpd.exe 4760 vpvpj.exe 4728 5fxrfff.exe 4672 1hnhbh.exe 2708 9hnbnn.exe 400 pjjdd.exe 2208 jpvpj.exe 1212 lrfxffl.exe 3976 tbhthh.exe 1636 dvddj.exe 1240 jdvpv.exe 1596 htthbt.exe 3548 tntttb.exe 1480 hbhhnn.exe 1628 7pvvj.exe 1040 rfllflf.exe 3728 nbnnnn.exe 3716 jdvpj.exe 3724 vvjvv.exe 1892 7lrlxxx.exe 2644 tbbbhb.exe 5020 hbbhbb.exe 1068 dpjvp.exe 1016 rlrrllr.exe 3008 3rrlfff.exe 4108 nbnttt.exe 1200 djppv.exe 2836 rlxrffr.exe 4464 bbttbb.exe 4764 nbhbtt.exe 4804 pvjpp.exe 4884 pjddv.exe 4676 jddjd.exe 4320 hhnttt.exe 1828 thtnhb.exe 1252 vpdjd.exe 1092 5ddpd.exe 5064 3jvvv.exe 3572 rfflxxl.exe 3468 9hhttn.exe 4460 hntthh.exe 2064 pddvj.exe 3832 lfrllrr.exe 2824 lfllfff.exe 3168 tnnnhh.exe 4776 btbbtn.exe 3444 7jpjd.exe 4736 dpvvj.exe 2088 lxxlrrf.exe 5092 3nhhbb.exe 2916 hbbbtt.exe 3984 ppdjv.exe 3320 pjjdp.exe 2136 1frxrrr.exe -
Processes:
resource yara_rule behavioral2/memory/4680-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2708-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1596-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rxrrllf.exehtbttb.exethnnbb.exexrfxrrl.exetntbhn.exejddjd.exenbbntn.exenbbhhn.exe7vvpj.exedvddd.exelrflllf.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exepdjdd.exexrxrrfx.exenhhtbt.exedjvpd.exedjvpv.exexrrxlfl.exennbbhn.exejppjj.exelrfffxx.exe1frlllf.exejvjpd.exevpvpj.exe5fxrfff.exe1hnhbh.exe9hnbnn.exepjjdd.exejpvpj.exelrfxffl.exetbhthh.exedvddj.exejdvpv.exedescription pid process target process PID 4680 wrote to memory of 2712 4680 34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe pdjdd.exe PID 4680 wrote to memory of 2712 4680 34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe pdjdd.exe PID 4680 wrote to memory of 2712 4680 34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe pdjdd.exe PID 2712 wrote to memory of 3572 2712 pdjdd.exe xrxrrfx.exe PID 2712 wrote to memory of 3572 2712 pdjdd.exe xrxrrfx.exe PID 2712 wrote to memory of 3572 2712 pdjdd.exe xrxrrfx.exe PID 3572 wrote to memory of 3580 3572 xrxrrfx.exe nhhtbt.exe PID 3572 wrote to memory of 3580 3572 xrxrrfx.exe nhhtbt.exe PID 3572 wrote to memory of 3580 3572 xrxrrfx.exe nhhtbt.exe PID 3580 wrote to memory of 3132 3580 nhhtbt.exe djvpd.exe PID 3580 wrote to memory of 3132 3580 nhhtbt.exe djvpd.exe PID 3580 wrote to memory of 3132 3580 nhhtbt.exe djvpd.exe PID 3132 wrote to memory of 508 3132 djvpd.exe djvpv.exe PID 3132 wrote to memory of 508 3132 djvpd.exe djvpv.exe PID 3132 wrote to memory of 508 3132 djvpd.exe djvpv.exe PID 508 wrote to memory of 4140 508 djvpv.exe xrrxlfl.exe PID 508 wrote to memory of 4140 508 djvpv.exe xrrxlfl.exe PID 508 wrote to memory of 4140 508 djvpv.exe xrrxlfl.exe PID 4140 wrote to memory of 1736 4140 xrrxlfl.exe nnbbhn.exe PID 4140 wrote to memory of 1736 4140 xrrxlfl.exe nnbbhn.exe PID 4140 wrote to memory of 1736 4140 xrrxlfl.exe nnbbhn.exe PID 1736 wrote to memory of 4208 1736 nnbbhn.exe jppjj.exe PID 1736 wrote to memory of 4208 1736 nnbbhn.exe jppjj.exe PID 1736 wrote to memory of 4208 1736 nnbbhn.exe jppjj.exe PID 4208 wrote to memory of 2736 4208 jppjj.exe lrfffxx.exe PID 4208 wrote to memory of 2736 4208 jppjj.exe lrfffxx.exe PID 4208 wrote to memory of 2736 4208 jppjj.exe lrfffxx.exe PID 2736 wrote to memory of 4868 2736 lrfffxx.exe 1frlllf.exe PID 2736 wrote to memory of 4868 2736 lrfffxx.exe 1frlllf.exe PID 2736 wrote to memory of 4868 2736 lrfffxx.exe 1frlllf.exe PID 4868 wrote to memory of 4836 4868 1frlllf.exe jvjpd.exe PID 4868 wrote to memory of 4836 4868 1frlllf.exe jvjpd.exe PID 4868 wrote to memory of 4836 4868 1frlllf.exe jvjpd.exe PID 4836 wrote to memory of 4760 4836 jvjpd.exe vpvpj.exe PID 4836 wrote to memory of 4760 4836 jvjpd.exe vpvpj.exe PID 4836 wrote to memory of 4760 4836 jvjpd.exe vpvpj.exe PID 4760 wrote to memory of 4728 4760 vpvpj.exe 5fxrfff.exe PID 4760 wrote to memory of 4728 4760 vpvpj.exe 5fxrfff.exe PID 4760 wrote to memory of 4728 4760 vpvpj.exe 5fxrfff.exe PID 4728 wrote to memory of 4672 4728 5fxrfff.exe 1hnhbh.exe PID 4728 wrote to memory of 4672 4728 5fxrfff.exe 1hnhbh.exe PID 4728 wrote to memory of 4672 4728 5fxrfff.exe 1hnhbh.exe PID 4672 wrote to memory of 2708 4672 1hnhbh.exe 9hnbnn.exe PID 4672 wrote to memory of 2708 4672 1hnhbh.exe 9hnbnn.exe PID 4672 wrote to memory of 2708 4672 1hnhbh.exe 9hnbnn.exe PID 2708 wrote to memory of 400 2708 9hnbnn.exe pjjdd.exe PID 2708 wrote to memory of 400 2708 9hnbnn.exe pjjdd.exe PID 2708 wrote to memory of 400 2708 9hnbnn.exe pjjdd.exe PID 400 wrote to memory of 2208 400 pjjdd.exe jpvpj.exe PID 400 wrote to memory of 2208 400 pjjdd.exe jpvpj.exe PID 400 wrote to memory of 2208 400 pjjdd.exe jpvpj.exe PID 2208 wrote to memory of 1212 2208 jpvpj.exe lrfxffl.exe PID 2208 wrote to memory of 1212 2208 jpvpj.exe lrfxffl.exe PID 2208 wrote to memory of 1212 2208 jpvpj.exe lrfxffl.exe PID 1212 wrote to memory of 3976 1212 lrfxffl.exe tbhthh.exe PID 1212 wrote to memory of 3976 1212 lrfxffl.exe tbhthh.exe PID 1212 wrote to memory of 3976 1212 lrfxffl.exe tbhthh.exe PID 3976 wrote to memory of 1636 3976 tbhthh.exe dvddj.exe PID 3976 wrote to memory of 1636 3976 tbhthh.exe dvddj.exe PID 3976 wrote to memory of 1636 3976 tbhthh.exe dvddj.exe PID 1636 wrote to memory of 1240 1636 dvddj.exe jdvpv.exe PID 1636 wrote to memory of 1240 1636 dvddj.exe jdvpv.exe PID 1636 wrote to memory of 1240 1636 dvddj.exe jdvpv.exe PID 1240 wrote to memory of 1596 1240 jdvpv.exe htthbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe"C:\Users\Admin\AppData\Local\Temp\34086b7ad3ef2425bfad0eca29a8b05a71d615115aaaa31498ea4ce9e47ca0e7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\pdjdd.exec:\pdjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\xrxrrfx.exec:\xrxrrfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\nhhtbt.exec:\nhhtbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\djvpd.exec:\djvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\djvpv.exec:\djvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\xrrxlfl.exec:\xrrxlfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\nnbbhn.exec:\nnbbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\jppjj.exec:\jppjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\lrfffxx.exec:\lrfffxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\1frlllf.exec:\1frlllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\jvjpd.exec:\jvjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\vpvpj.exec:\vpvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\5fxrfff.exec:\5fxrfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\1hnhbh.exec:\1hnhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\9hnbnn.exec:\9hnbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\pjjdd.exec:\pjjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\jpvpj.exec:\jpvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\lrfxffl.exec:\lrfxffl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\tbhthh.exec:\tbhthh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\dvddj.exec:\dvddj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\jdvpv.exec:\jdvpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\htthbt.exec:\htthbt.exe23⤵
- Executes dropped EXE
PID:1596 -
\??\c:\tntttb.exec:\tntttb.exe24⤵
- Executes dropped EXE
PID:3548 -
\??\c:\hbhhnn.exec:\hbhhnn.exe25⤵
- Executes dropped EXE
PID:1480 -
\??\c:\7pvvj.exec:\7pvvj.exe26⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rfllflf.exec:\rfllflf.exe27⤵
- Executes dropped EXE
PID:1040 -
\??\c:\nbnnnn.exec:\nbnnnn.exe28⤵
- Executes dropped EXE
PID:3728 -
\??\c:\jdvpj.exec:\jdvpj.exe29⤵
- Executes dropped EXE
PID:3716 -
\??\c:\vvjvv.exec:\vvjvv.exe30⤵
- Executes dropped EXE
PID:3724 -
\??\c:\7lrlxxx.exec:\7lrlxxx.exe31⤵
- Executes dropped EXE
PID:1892 -
\??\c:\tbbbhb.exec:\tbbbhb.exe32⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hbbhbb.exec:\hbbhbb.exe33⤵
- Executes dropped EXE
PID:5020 -
\??\c:\dpjvp.exec:\dpjvp.exe34⤵
- Executes dropped EXE
PID:1068 -
\??\c:\rlrrllr.exec:\rlrrllr.exe35⤵
- Executes dropped EXE
PID:1016 -
\??\c:\3rrlfff.exec:\3rrlfff.exe36⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nbnttt.exec:\nbnttt.exe37⤵
- Executes dropped EXE
PID:4108 -
\??\c:\djppv.exec:\djppv.exe38⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rlxrffr.exec:\rlxrffr.exe39⤵
- Executes dropped EXE
PID:2836 -
\??\c:\bbttbb.exec:\bbttbb.exe40⤵
- Executes dropped EXE
PID:4464 -
\??\c:\nbhbtt.exec:\nbhbtt.exe41⤵
- Executes dropped EXE
PID:4764 -
\??\c:\pvjpp.exec:\pvjpp.exe42⤵
- Executes dropped EXE
PID:4804 -
\??\c:\pjddv.exec:\pjddv.exe43⤵
- Executes dropped EXE
PID:4884 -
\??\c:\jddjd.exec:\jddjd.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4676 -
\??\c:\hhnttt.exec:\hhnttt.exe45⤵
- Executes dropped EXE
PID:4320 -
\??\c:\thtnhb.exec:\thtnhb.exe46⤵
- Executes dropped EXE
PID:1828 -
\??\c:\vpdjd.exec:\vpdjd.exe47⤵
- Executes dropped EXE
PID:1252 -
\??\c:\5ddpd.exec:\5ddpd.exe48⤵
- Executes dropped EXE
PID:1092 -
\??\c:\3jvvv.exec:\3jvvv.exe49⤵
- Executes dropped EXE
PID:5064 -
\??\c:\rfflxxl.exec:\rfflxxl.exe50⤵
- Executes dropped EXE
PID:3572 -
\??\c:\9hhttn.exec:\9hhttn.exe51⤵
- Executes dropped EXE
PID:3468 -
\??\c:\hntthh.exec:\hntthh.exe52⤵
- Executes dropped EXE
PID:4460 -
\??\c:\pddvj.exec:\pddvj.exe53⤵
- Executes dropped EXE
PID:2064 -
\??\c:\lfrllrr.exec:\lfrllrr.exe54⤵
- Executes dropped EXE
PID:3832 -
\??\c:\lfllfff.exec:\lfllfff.exe55⤵
- Executes dropped EXE
PID:2824 -
\??\c:\tnnnhh.exec:\tnnnhh.exe56⤵
- Executes dropped EXE
PID:3168 -
\??\c:\btbbtn.exec:\btbbtn.exe57⤵
- Executes dropped EXE
PID:4776 -
\??\c:\7jpjd.exec:\7jpjd.exe58⤵
- Executes dropped EXE
PID:3444 -
\??\c:\dpvvj.exec:\dpvvj.exe59⤵
- Executes dropped EXE
PID:4736 -
\??\c:\lxxlrrf.exec:\lxxlrrf.exe60⤵
- Executes dropped EXE
PID:2088 -
\??\c:\3nhhbb.exec:\3nhhbb.exe61⤵
- Executes dropped EXE
PID:5092 -
\??\c:\hbbbtt.exec:\hbbbtt.exe62⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ppdjv.exec:\ppdjv.exe63⤵
- Executes dropped EXE
PID:3984 -
\??\c:\pjjdp.exec:\pjjdp.exe64⤵
- Executes dropped EXE
PID:3320 -
\??\c:\1frxrrr.exec:\1frxrrr.exe65⤵
- Executes dropped EXE
PID:2136 -
\??\c:\lxffllf.exec:\lxffllf.exe66⤵PID:4984
-
\??\c:\5hhbbt.exec:\5hhbbt.exe67⤵PID:4728
-
\??\c:\jdvvp.exec:\jdvvp.exe68⤵PID:2972
-
\??\c:\vppjj.exec:\vppjj.exe69⤵PID:1488
-
\??\c:\rfrfffl.exec:\rfrfffl.exe70⤵PID:3512
-
\??\c:\lflffxr.exec:\lflffxr.exe71⤵PID:3532
-
\??\c:\1thtbb.exec:\1thtbb.exe72⤵PID:1412
-
\??\c:\pppvj.exec:\pppvj.exe73⤵PID:1888
-
\??\c:\1pppp.exec:\1pppp.exe74⤵PID:4204
-
\??\c:\3xrxrff.exec:\3xrxrff.exe75⤵PID:212
-
\??\c:\rlllflf.exec:\rlllflf.exe76⤵PID:4816
-
\??\c:\1lrrrrl.exec:\1lrrrrl.exe77⤵PID:4732
-
\??\c:\5xfxrrl.exec:\5xfxrrl.exe78⤵PID:2204
-
\??\c:\9thntt.exec:\9thntt.exe79⤵PID:2000
-
\??\c:\hbtnhh.exec:\hbtnhh.exe80⤵PID:3948
-
\??\c:\jdjjd.exec:\jdjjd.exe81⤵PID:888
-
\??\c:\dvpjj.exec:\dvpjj.exe82⤵PID:4148
-
\??\c:\xlrrlff.exec:\xlrrlff.exe83⤵PID:3500
-
\??\c:\nhttnh.exec:\nhttnh.exe84⤵PID:1220
-
\??\c:\nhttnt.exec:\nhttnt.exe85⤵PID:3052
-
\??\c:\7tbttt.exec:\7tbttt.exe86⤵PID:1612
-
\??\c:\ddjdd.exec:\ddjdd.exe87⤵PID:1512
-
\??\c:\rrrxxrr.exec:\rrrxxrr.exe88⤵PID:4844
-
\??\c:\rrrrllr.exec:\rrrrllr.exe89⤵PID:4132
-
\??\c:\tnbhtn.exec:\tnbhtn.exe90⤵PID:4972
-
\??\c:\ppvpp.exec:\ppvpp.exe91⤵PID:1400
-
\??\c:\ddjdd.exec:\ddjdd.exe92⤵PID:3972
-
\??\c:\7pjdd.exec:\7pjdd.exe93⤵PID:1984
-
\??\c:\rrrllll.exec:\rrrllll.exe94⤵PID:760
-
\??\c:\nbtnnt.exec:\nbtnnt.exe95⤵PID:1064
-
\??\c:\jjjjd.exec:\jjjjd.exe96⤵PID:4792
-
\??\c:\vpvpj.exec:\vpvpj.exe97⤵PID:1700
-
\??\c:\vdjvp.exec:\vdjvp.exe98⤵PID:452
-
\??\c:\fxxrxxx.exec:\fxxrxxx.exe99⤵PID:4108
-
\??\c:\thnnbb.exec:\thnnbb.exe100⤵
- System Location Discovery: System Language Discovery
PID:2472 -
\??\c:\nbtntn.exec:\nbtntn.exe101⤵PID:3676
-
\??\c:\jjvpj.exec:\jjvpj.exe102⤵PID:1912
-
\??\c:\5jppj.exec:\5jppj.exe103⤵PID:812
-
\??\c:\xxrllxf.exec:\xxrllxf.exe104⤵PID:4804
-
\??\c:\nbbntn.exec:\nbbntn.exe105⤵
- System Location Discovery: System Language Discovery
PID:4308 -
\??\c:\jjdvj.exec:\jjdvj.exe106⤵PID:4260
-
\??\c:\vjjjd.exec:\vjjjd.exe107⤵PID:2348
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe108⤵PID:2516
-
\??\c:\5xfxxxr.exec:\5xfxxxr.exe109⤵PID:4104
-
\??\c:\1thhhn.exec:\1thhhn.exe110⤵PID:8
-
\??\c:\hnbbbh.exec:\hnbbbh.exe111⤵PID:4468
-
\??\c:\9vvvj.exec:\9vvvj.exe112⤵PID:4232
-
\??\c:\jjvpj.exec:\jjvpj.exe113⤵PID:4460
-
\??\c:\xllxxxx.exec:\xllxxxx.exe114⤵PID:2064
-
\??\c:\nhhbtt.exec:\nhhbtt.exe115⤵PID:692
-
\??\c:\tbnhbh.exec:\tbnhbh.exe116⤵PID:2824
-
\??\c:\vpvpp.exec:\vpvpp.exe117⤵PID:1352
-
\??\c:\9jpjd.exec:\9jpjd.exe118⤵PID:2256
-
\??\c:\fxlfffl.exec:\fxlfffl.exe119⤵PID:3444
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe120⤵PID:732
-
\??\c:\nhhbbb.exec:\nhhbbb.exe121⤵PID:2088
-
\??\c:\bbbbbh.exec:\bbbbbh.exe122⤵PID:2320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-