Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 19:47
Static task
static1
Behavioral task
behavioral1
Sample
695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe
Resource
win7-20240903-en
General
-
Target
695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe
-
Size
49KB
-
MD5
3b9eedf4db998c4f18a0c7ce94a47e44
-
SHA1
8e68b50ae5c2f8b589727f0c9135da44646f03d8
-
SHA256
695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15
-
SHA512
173fc95204b3924949ee001675e653b40e8cafdc3ef0f9b7e5d9e870067eb55b01c6d62ec5b73ab1740733d0ba7d07a50a066fb636246c48b16ae9808e2dbcfc
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5bx7DUa:0cdpeeBSHHMHLf9Rybx7D5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 59 IoCs
Processes:
resource yara_rule behavioral1/memory/2072-0-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-54-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2900-52-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2532-73-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2788-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-132-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1512-149-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2804-158-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2804-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-160-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1972-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-169-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2220-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1276-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/344-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-315-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2744-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-367-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1224-393-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-442-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-516-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/596-523-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/552-542-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1596-573-0x0000000000250000-0x0000000000279000-memory.dmp family_blackmoon behavioral1/memory/1432-628-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2692-641-0x00000000003B0000-0x00000000003D9000-memory.dmp family_blackmoon behavioral1/memory/1300-678-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2828-686-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-685-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-721-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/3032-754-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/308-811-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1876-928-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2712-1121-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2772-1128-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2720-1146-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2216-1247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-1254-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2120-1257-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2660-1287-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/300-1320-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2892-1403-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ddpvd.exebhhtht.exejjjdd.exexrfrflx.exe9fxxlrx.exentnhnb.exetthbtt.exejjdvd.exejdpvv.exe7xxxlrl.exe7htthn.exeppvdd.exe7xrxlxl.exe5tnttb.exedvjjp.exe3djdv.exeffrlxfl.exe9bbhnh.exettbhhh.exejjpvj.exerfrffxx.exebtbhbh.exedjvpp.exexflfrfr.exe7xrrffl.exe9nbhnt.exetbtbnh.exevppjp.exe5xxxxff.exebbbtnt.exetbhnhn.exe3dvpv.exepjddj.exeflxfrxf.exe7lfrxxl.exehbhhtt.exedddjp.exepjpvj.exefxlflll.exe1rlrrlr.exettnbnt.exebbnhtt.exe5vvpp.exelfrxxxx.exe5tttbb.exe1nhhht.exejjdpv.exe1ffrlfx.exe9rrfrfr.exexrlxrll.exebbnbhh.exejdppv.exejpdpd.exeppjpp.exe1rrfrfl.exebtbhnh.exetttbtb.exevddpd.exeddpvd.exeffxllrx.exefrxxlxf.exehhtbhh.exehbtntt.exejjdjp.exepid process 2404 ddpvd.exe 2084 bhhtht.exe 2936 jjjdd.exe 2728 xrfrflx.exe 2900 9fxxlrx.exe 3004 ntnhnb.exe 2532 tthbtt.exe 2788 jjdvd.exe 2616 jdpvv.exe 2696 7xxxlrl.exe 2164 7htthn.exe 1476 ppvdd.exe 2856 7xrxlxl.exe 2016 5tnttb.exe 1512 dvjjp.exe 2804 3djdv.exe 2032 ffrlxfl.exe 1972 9bbhnh.exe 2824 ttbhhh.exe 2220 jjpvj.exe 2184 rfrffxx.exe 1560 btbhbh.exe 1040 djvpp.exe 1276 xflfrfr.exe 2576 7xrrffl.exe 344 9nbhnt.exe 1756 tbtbnh.exe 1212 vppjp.exe 2076 5xxxxff.exe 880 bbbtnt.exe 3056 tbhnhn.exe 2488 3dvpv.exe 2400 pjddj.exe 2988 flxfrxf.exe 2476 7lfrxxl.exe 2760 hbhhtt.exe 2920 dddjp.exe 2744 pjpvj.exe 3012 fxlflll.exe 2720 1rlrrlr.exe 2932 ttnbnt.exe 1900 bbnhtt.exe 2664 5vvpp.exe 2236 lfrxxxx.exe 568 5tttbb.exe 1224 1nhhht.exe 1580 jjdpv.exe 1104 1ffrlfx.exe 2152 9rrfrfr.exe 1416 xrlxrll.exe 1996 bbnbhh.exe 2844 jdppv.exe 352 jpdpd.exe 2436 ppjpp.exe 832 1rrfrfl.exe 2816 btbhnh.exe 2968 tttbtb.exe 2960 vddpd.exe 2120 ddpvd.exe 2584 ffxllrx.exe 2184 frxxlxf.exe 1684 hhtbhh.exe 3024 hbtntt.exe 1620 jjdjp.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
hnthnt.exeddvvj.exentbhbt.exerlfrxfr.exevdvvv.exethnntb.exebbbbnb.exepvpvj.exe1bhttn.exepvjpv.exexfxlrfx.exevjdjd.exedpjpp.exelllfrfl.exe9bbhnh.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbhnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exeddpvd.exebhhtht.exejjjdd.exexrfrflx.exe9fxxlrx.exentnhnb.exetthbtt.exejjdvd.exejdpvv.exe7xxxlrl.exe7htthn.exeppvdd.exe7xrxlxl.exe5tnttb.exedvjjp.exedescription pid process target process PID 2072 wrote to memory of 2404 2072 695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe ddpvd.exe PID 2072 wrote to memory of 2404 2072 695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe ddpvd.exe PID 2072 wrote to memory of 2404 2072 695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe ddpvd.exe PID 2072 wrote to memory of 2404 2072 695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe ddpvd.exe PID 2404 wrote to memory of 2084 2404 ddpvd.exe bhhtht.exe PID 2404 wrote to memory of 2084 2404 ddpvd.exe bhhtht.exe PID 2404 wrote to memory of 2084 2404 ddpvd.exe bhhtht.exe PID 2404 wrote to memory of 2084 2404 ddpvd.exe bhhtht.exe PID 2084 wrote to memory of 2936 2084 bhhtht.exe jjjdd.exe PID 2084 wrote to memory of 2936 2084 bhhtht.exe jjjdd.exe PID 2084 wrote to memory of 2936 2084 bhhtht.exe jjjdd.exe PID 2084 wrote to memory of 2936 2084 bhhtht.exe jjjdd.exe PID 2936 wrote to memory of 2728 2936 jjjdd.exe xrfrflx.exe PID 2936 wrote to memory of 2728 2936 jjjdd.exe xrfrflx.exe PID 2936 wrote to memory of 2728 2936 jjjdd.exe xrfrflx.exe PID 2936 wrote to memory of 2728 2936 jjjdd.exe xrfrflx.exe PID 2728 wrote to memory of 2900 2728 xrfrflx.exe 9fxxlrx.exe PID 2728 wrote to memory of 2900 2728 xrfrflx.exe 9fxxlrx.exe PID 2728 wrote to memory of 2900 2728 xrfrflx.exe 9fxxlrx.exe PID 2728 wrote to memory of 2900 2728 xrfrflx.exe 9fxxlrx.exe PID 2900 wrote to memory of 3004 2900 9fxxlrx.exe ntnhnb.exe PID 2900 wrote to memory of 3004 2900 9fxxlrx.exe ntnhnb.exe PID 2900 wrote to memory of 3004 2900 9fxxlrx.exe ntnhnb.exe PID 2900 wrote to memory of 3004 2900 9fxxlrx.exe ntnhnb.exe PID 3004 wrote to memory of 2532 3004 ntnhnb.exe tthbtt.exe PID 3004 wrote to memory of 2532 3004 ntnhnb.exe tthbtt.exe PID 3004 wrote to memory of 2532 3004 ntnhnb.exe tthbtt.exe PID 3004 wrote to memory of 2532 3004 ntnhnb.exe tthbtt.exe PID 2532 wrote to memory of 2788 2532 tthbtt.exe jjdvd.exe PID 2532 wrote to memory of 2788 2532 tthbtt.exe jjdvd.exe PID 2532 wrote to memory of 2788 2532 tthbtt.exe jjdvd.exe PID 2532 wrote to memory of 2788 2532 tthbtt.exe jjdvd.exe PID 2788 wrote to memory of 2616 2788 jjdvd.exe jdpvv.exe PID 2788 wrote to memory of 2616 2788 jjdvd.exe jdpvv.exe PID 2788 wrote to memory of 2616 2788 jjdvd.exe jdpvv.exe PID 2788 wrote to memory of 2616 2788 jjdvd.exe jdpvv.exe PID 2616 wrote to memory of 2696 2616 jdpvv.exe 7xxxlrl.exe PID 2616 wrote to memory of 2696 2616 jdpvv.exe 7xxxlrl.exe PID 2616 wrote to memory of 2696 2616 jdpvv.exe 7xxxlrl.exe PID 2616 wrote to memory of 2696 2616 jdpvv.exe 7xxxlrl.exe PID 2696 wrote to memory of 2164 2696 7xxxlrl.exe 7htthn.exe PID 2696 wrote to memory of 2164 2696 7xxxlrl.exe 7htthn.exe PID 2696 wrote to memory of 2164 2696 7xxxlrl.exe 7htthn.exe PID 2696 wrote to memory of 2164 2696 7xxxlrl.exe 7htthn.exe PID 2164 wrote to memory of 1476 2164 7htthn.exe ppvdd.exe PID 2164 wrote to memory of 1476 2164 7htthn.exe ppvdd.exe PID 2164 wrote to memory of 1476 2164 7htthn.exe ppvdd.exe PID 2164 wrote to memory of 1476 2164 7htthn.exe ppvdd.exe PID 1476 wrote to memory of 2856 1476 ppvdd.exe 7xrxlxl.exe PID 1476 wrote to memory of 2856 1476 ppvdd.exe 7xrxlxl.exe PID 1476 wrote to memory of 2856 1476 ppvdd.exe 7xrxlxl.exe PID 1476 wrote to memory of 2856 1476 ppvdd.exe 7xrxlxl.exe PID 2856 wrote to memory of 2016 2856 7xrxlxl.exe 5tnttb.exe PID 2856 wrote to memory of 2016 2856 7xrxlxl.exe 5tnttb.exe PID 2856 wrote to memory of 2016 2856 7xrxlxl.exe 5tnttb.exe PID 2856 wrote to memory of 2016 2856 7xrxlxl.exe 5tnttb.exe PID 2016 wrote to memory of 1512 2016 5tnttb.exe dvjjp.exe PID 2016 wrote to memory of 1512 2016 5tnttb.exe dvjjp.exe PID 2016 wrote to memory of 1512 2016 5tnttb.exe dvjjp.exe PID 2016 wrote to memory of 1512 2016 5tnttb.exe dvjjp.exe PID 1512 wrote to memory of 2804 1512 dvjjp.exe 3djdv.exe PID 1512 wrote to memory of 2804 1512 dvjjp.exe 3djdv.exe PID 1512 wrote to memory of 2804 1512 dvjjp.exe 3djdv.exe PID 1512 wrote to memory of 2804 1512 dvjjp.exe 3djdv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe"C:\Users\Admin\AppData\Local\Temp\695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\ddpvd.exec:\ddpvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\bhhtht.exec:\bhhtht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\jjjdd.exec:\jjjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\xrfrflx.exec:\xrfrflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\9fxxlrx.exec:\9fxxlrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\ntnhnb.exec:\ntnhnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\tthbtt.exec:\tthbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jjdvd.exec:\jjdvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\jdpvv.exec:\jdpvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\7xxxlrl.exec:\7xxxlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\7htthn.exec:\7htthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\ppvdd.exec:\ppvdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\7xrxlxl.exec:\7xrxlxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\5tnttb.exec:\5tnttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\dvjjp.exec:\dvjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\3djdv.exec:\3djdv.exe17⤵
- Executes dropped EXE
PID:2804 -
\??\c:\ffrlxfl.exec:\ffrlxfl.exe18⤵
- Executes dropped EXE
PID:2032 -
\??\c:\9bbhnh.exec:\9bbhnh.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1972 -
\??\c:\ttbhhh.exec:\ttbhhh.exe20⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jjpvj.exec:\jjpvj.exe21⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rfrffxx.exec:\rfrffxx.exe22⤵
- Executes dropped EXE
PID:2184 -
\??\c:\btbhbh.exec:\btbhbh.exe23⤵
- Executes dropped EXE
PID:1560 -
\??\c:\djvpp.exec:\djvpp.exe24⤵
- Executes dropped EXE
PID:1040 -
\??\c:\xflfrfr.exec:\xflfrfr.exe25⤵
- Executes dropped EXE
PID:1276 -
\??\c:\7xrrffl.exec:\7xrrffl.exe26⤵
- Executes dropped EXE
PID:2576 -
\??\c:\9nbhnt.exec:\9nbhnt.exe27⤵
- Executes dropped EXE
PID:344 -
\??\c:\tbtbnh.exec:\tbtbnh.exe28⤵
- Executes dropped EXE
PID:1756 -
\??\c:\vppjp.exec:\vppjp.exe29⤵
- Executes dropped EXE
PID:1212 -
\??\c:\5xxxxff.exec:\5xxxxff.exe30⤵
- Executes dropped EXE
PID:2076 -
\??\c:\bbbtnt.exec:\bbbtnt.exe31⤵
- Executes dropped EXE
PID:880 -
\??\c:\tbhnhn.exec:\tbhnhn.exe32⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3dvpv.exec:\3dvpv.exe33⤵
- Executes dropped EXE
PID:2488 -
\??\c:\pjddj.exec:\pjddj.exe34⤵
- Executes dropped EXE
PID:2400 -
\??\c:\flxfrxf.exec:\flxfrxf.exe35⤵
- Executes dropped EXE
PID:2988 -
\??\c:\7lfrxxl.exec:\7lfrxxl.exe36⤵
- Executes dropped EXE
PID:2476 -
\??\c:\hbhhtt.exec:\hbhhtt.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\dddjp.exec:\dddjp.exe38⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pjpvj.exec:\pjpvj.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\fxlflll.exec:\fxlflll.exe40⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1rlrrlr.exec:\1rlrrlr.exe41⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ttnbnt.exec:\ttnbnt.exe42⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bbnhtt.exec:\bbnhtt.exe43⤵
- Executes dropped EXE
PID:1900 -
\??\c:\5vvpp.exec:\5vvpp.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lfrxxxx.exec:\lfrxxxx.exe45⤵
- Executes dropped EXE
PID:2236 -
\??\c:\5tttbb.exec:\5tttbb.exe46⤵
- Executes dropped EXE
PID:568 -
\??\c:\1nhhht.exec:\1nhhht.exe47⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jjdpv.exec:\jjdpv.exe48⤵
- Executes dropped EXE
PID:1580 -
\??\c:\1ffrlfx.exec:\1ffrlfx.exe49⤵
- Executes dropped EXE
PID:1104 -
\??\c:\9rrfrfr.exec:\9rrfrfr.exe50⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xrlxrll.exec:\xrlxrll.exe51⤵
- Executes dropped EXE
PID:1416 -
\??\c:\bbnbhh.exec:\bbnbhh.exe52⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jdppv.exec:\jdppv.exe53⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jpdpd.exec:\jpdpd.exe54⤵
- Executes dropped EXE
PID:352 -
\??\c:\ppjpp.exec:\ppjpp.exe55⤵
- Executes dropped EXE
PID:2436 -
\??\c:\1rrfrfl.exec:\1rrfrfl.exe56⤵
- Executes dropped EXE
PID:832 -
\??\c:\btbhnh.exec:\btbhnh.exe57⤵
- Executes dropped EXE
PID:2816 -
\??\c:\tttbtb.exec:\tttbtb.exe58⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vddpd.exec:\vddpd.exe59⤵
- Executes dropped EXE
PID:2960 -
\??\c:\ddpvd.exec:\ddpvd.exe60⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ffxllrx.exec:\ffxllrx.exe61⤵
- Executes dropped EXE
PID:2584 -
\??\c:\frxxlxf.exec:\frxxlxf.exe62⤵
- Executes dropped EXE
PID:2184 -
\??\c:\hhtbhh.exec:\hhtbhh.exe63⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hbtntt.exec:\hbtntt.exe64⤵
- Executes dropped EXE
PID:3024 -
\??\c:\jjdjp.exec:\jjdjp.exe65⤵
- Executes dropped EXE
PID:1620 -
\??\c:\9vdpv.exec:\9vdpv.exe66⤵PID:1068
-
\??\c:\5lflxxx.exec:\5lflxxx.exe67⤵PID:900
-
\??\c:\5rxfxfx.exec:\5rxfxfx.exe68⤵PID:596
-
\??\c:\hnnbbt.exec:\hnnbbt.exe69⤵PID:2208
-
\??\c:\pjpjp.exec:\pjpjp.exe70⤵PID:2260
-
\??\c:\jdvvd.exec:\jdvvd.exe71⤵PID:552
-
\??\c:\1pddp.exec:\1pddp.exe72⤵PID:2552
-
\??\c:\xllxxrl.exec:\xllxxrl.exe73⤵PID:1500
-
\??\c:\xllxlfx.exec:\xllxlfx.exe74⤵PID:3064
-
\??\c:\ttthtb.exec:\ttthtb.exe75⤵PID:2404
-
\??\c:\nhbnnh.exec:\nhbnnh.exe76⤵PID:1596
-
\??\c:\ppjpp.exec:\ppjpp.exe77⤵PID:2704
-
\??\c:\dppjp.exec:\dppjp.exe78⤵PID:2200
-
\??\c:\1rxxflr.exec:\1rxxflr.exe79⤵PID:2748
-
\??\c:\3rlrxfl.exec:\3rlrxfl.exe80⤵PID:2880
-
\??\c:\tthnbh.exec:\tthnbh.exe81⤵PID:2052
-
\??\c:\ttnhnn.exec:\ttnhnn.exe82⤵PID:2628
-
\??\c:\5ddjp.exec:\5ddjp.exe83⤵PID:2892
-
\??\c:\jpvjv.exec:\jpvjv.exe84⤵PID:2644
-
\??\c:\rxxflrf.exec:\rxxflrf.exe85⤵PID:1432
-
\??\c:\fflrxff.exec:\fflrxff.exe86⤵PID:2896
-
\??\c:\3btnbh.exec:\3btnbh.exe87⤵PID:2692
-
\??\c:\nthhnt.exec:\nthhnt.exe88⤵PID:2336
-
\??\c:\vvjjj.exec:\vvjjj.exe89⤵PID:2292
-
\??\c:\ppjvp.exec:\ppjvp.exe90⤵PID:2432
-
\??\c:\llxxflr.exec:\llxxflr.exe91⤵PID:2796
-
\??\c:\ffxflxf.exec:\ffxflxf.exe92⤵PID:2156
-
\??\c:\hnhbbh.exec:\hnhbbh.exe93⤵PID:1300
-
\??\c:\nnhbtb.exec:\nnhbtb.exe94⤵PID:2016
-
\??\c:\3jvjd.exec:\3jvjd.exe95⤵PID:2828
-
\??\c:\dvjvp.exec:\dvjvp.exe96⤵PID:292
-
\??\c:\3rxffll.exec:\3rxffll.exe97⤵PID:2848
-
\??\c:\xrxxlrx.exec:\xrxxlrx.exe98⤵PID:1084
-
\??\c:\tbttbh.exec:\tbttbh.exe99⤵PID:1972
-
\??\c:\1htbtn.exec:\1htbtn.exe100⤵PID:2216
-
\??\c:\1vjjj.exec:\1vjjj.exe101⤵PID:2148
-
\??\c:\ddpjp.exec:\ddpjp.exe102⤵PID:2204
-
\??\c:\5frlrfl.exec:\5frlrfl.exe103⤵PID:2964
-
\??\c:\llfflrf.exec:\llfflrf.exe104⤵PID:2240
-
\??\c:\rxrfrfr.exec:\rxrfrfr.exe105⤵PID:3032
-
\??\c:\bhthnn.exec:\bhthnn.exe106⤵PID:2660
-
\??\c:\vvvvd.exec:\vvvvd.exe107⤵PID:1820
-
\??\c:\ppvjp.exec:\ppvjp.exe108⤵PID:1156
-
\??\c:\lfrlxxf.exec:\lfrlxxf.exe109⤵PID:1276
-
\??\c:\nbhbhn.exec:\nbhbhn.exe110⤵PID:2452
-
\??\c:\nntbbh.exec:\nntbbh.exe111⤵PID:2500
-
\??\c:\jjvdp.exec:\jjvdp.exe112⤵PID:1672
-
\??\c:\jdppv.exec:\jdppv.exe113⤵PID:2252
-
\??\c:\rrfllrx.exec:\rrfllrx.exe114⤵PID:308
-
\??\c:\fflrxfr.exec:\fflrxfr.exe115⤵PID:2396
-
\??\c:\bhbhbt.exec:\bhbhbt.exe116⤵PID:2316
-
\??\c:\ttbhhn.exec:\ttbhhn.exe117⤵PID:2352
-
\??\c:\3djpv.exec:\3djpv.exe118⤵PID:2992
-
\??\c:\jjjjp.exec:\jjjjp.exe119⤵PID:2084
-
\??\c:\lflfrrx.exec:\lflfrrx.exe120⤵PID:1576
-
\??\c:\llxlxxf.exec:\llxlxxf.exe121⤵PID:1588
-
\??\c:\5rxxffl.exec:\5rxxffl.exe122⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-