Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 20:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe
Resource
win7-20241023-en
6 signatures
150 seconds
General
-
Target
20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe
-
Size
50KB
-
MD5
d66d1f39e03f980574c1cb69994925b7
-
SHA1
5622eadb2e97405ce00cbb01b934035b28b6adc2
-
SHA256
20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282
-
SHA512
b92a50c8e9dabc49afbe888706c1185f5c581cf8fb3ae6de72e0215e3bdedab46e11e5f37312d2c2a0b8210f4f088b65ecee29b61f524bb918b6da5530242970
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvl2:0cdpeeBSHHMHLf9RyIN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1664-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1808-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-358-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2896-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-370-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-374-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-432-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-436-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-458-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-556-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-605-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-667-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-737-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-768-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-811-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-824-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-864-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-958-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-1540-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-1571-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-1891-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3500 jdjjd.exe 2764 xrxxxxx.exe 3508 5hhbbb.exe 3620 3nnhhh.exe 2204 dvvpp.exe 2212 ffxxrxr.exe 2984 9lxrxll.exe 3864 hnnhhb.exe 516 vppjd.exe 1500 fxflffx.exe 4864 5bttnt.exe 1808 9hnntt.exe 972 7jpvv.exe 2788 rrllfff.exe 5048 rrrrllf.exe 3596 ttbthn.exe 4060 ppvvv.exe 3880 ppppp.exe 4952 ffxxxrr.exe 1504 hbhhbh.exe 2608 pddjv.exe 2060 fflxrll.exe 4036 lxllllf.exe 2584 ntnbbh.exe 2964 pjpvp.exe 4620 7xllfll.exe 3788 rxrrrxr.exe 4808 7ttnnn.exe 5020 hbhhhh.exe 3224 pvdjd.exe 4956 jjpvd.exe 2380 9lrrrrr.exe 844 rxffxlf.exe 4940 3ttttt.exe 3324 9nhnhh.exe 1064 1djdp.exe 2792 ppvdp.exe 4392 3flffff.exe 3884 hnttnn.exe 552 tbnhtt.exe 2996 ddpdd.exe 4340 1djpp.exe 4344 llrrrxl.exe 3692 fxrllrr.exe 1684 thnhhh.exe 2912 tbbbbb.exe 3604 jvvvv.exe 3980 llrxxll.exe 116 hbttnb.exe 3024 jjjjj.exe 3268 ddjjd.exe 5024 rfrrlrl.exe 2492 xxlrllf.exe 1628 hhhtnn.exe 1528 vpvpd.exe 1500 djjvp.exe 1900 9rrfflf.exe 556 nnhbnn.exe 2288 nbttth.exe 2008 5pvvp.exe 2012 pvvpj.exe 2496 fxxrfxr.exe 5048 hnttnh.exe 1452 jpjvp.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1664 wrote to memory of 3500 1664 20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe 83 PID 1664 wrote to memory of 3500 1664 20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe 83 PID 1664 wrote to memory of 3500 1664 20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe 83 PID 3500 wrote to memory of 2764 3500 jdjjd.exe 84 PID 3500 wrote to memory of 2764 3500 jdjjd.exe 84 PID 3500 wrote to memory of 2764 3500 jdjjd.exe 84 PID 2764 wrote to memory of 3508 2764 xrxxxxx.exe 85 PID 2764 wrote to memory of 3508 2764 xrxxxxx.exe 85 PID 2764 wrote to memory of 3508 2764 xrxxxxx.exe 85 PID 3508 wrote to memory of 3620 3508 5hhbbb.exe 86 PID 3508 wrote to memory of 3620 3508 5hhbbb.exe 86 PID 3508 wrote to memory of 3620 3508 5hhbbb.exe 86 PID 3620 wrote to memory of 2204 3620 3nnhhh.exe 87 PID 3620 wrote to memory of 2204 3620 3nnhhh.exe 87 PID 3620 wrote to memory of 2204 3620 3nnhhh.exe 87 PID 2204 wrote to memory of 2212 2204 dvvpp.exe 88 PID 2204 wrote to memory of 2212 2204 dvvpp.exe 88 PID 2204 wrote to memory of 2212 2204 dvvpp.exe 88 PID 2212 wrote to memory of 2984 2212 ffxxrxr.exe 89 PID 2212 wrote to memory of 2984 2212 ffxxrxr.exe 89 PID 2212 wrote to memory of 2984 2212 ffxxrxr.exe 89 PID 2984 wrote to memory of 3864 2984 9lxrxll.exe 90 PID 2984 wrote to memory of 3864 2984 9lxrxll.exe 90 PID 2984 wrote to memory of 3864 2984 9lxrxll.exe 90 PID 3864 wrote to memory of 516 3864 hnnhhb.exe 91 PID 3864 wrote to memory of 516 3864 hnnhhb.exe 91 PID 3864 wrote to memory of 516 3864 hnnhhb.exe 91 PID 516 wrote to memory of 1500 516 vppjd.exe 92 PID 516 wrote to memory of 1500 516 vppjd.exe 92 PID 516 wrote to memory of 1500 516 vppjd.exe 92 PID 1500 wrote to memory of 4864 1500 fxflffx.exe 93 PID 1500 wrote to memory of 4864 1500 fxflffx.exe 93 PID 1500 wrote to memory of 4864 1500 fxflffx.exe 93 PID 4864 wrote to memory of 1808 4864 5bttnt.exe 94 PID 4864 wrote to memory of 1808 4864 5bttnt.exe 94 PID 4864 wrote to memory of 1808 4864 5bttnt.exe 94 PID 1808 wrote to memory of 972 1808 9hnntt.exe 95 PID 1808 wrote to memory of 972 1808 9hnntt.exe 95 PID 1808 wrote to memory of 972 1808 9hnntt.exe 95 PID 972 wrote to memory of 2788 972 7jpvv.exe 96 PID 972 wrote to memory of 2788 972 7jpvv.exe 96 PID 972 wrote to memory of 2788 972 7jpvv.exe 96 PID 2788 wrote to memory of 5048 2788 rrllfff.exe 97 PID 2788 wrote to memory of 5048 2788 rrllfff.exe 97 PID 2788 wrote to memory of 5048 2788 rrllfff.exe 97 PID 5048 wrote to memory of 3596 5048 rrrrllf.exe 98 PID 5048 wrote to memory of 3596 5048 rrrrllf.exe 98 PID 5048 wrote to memory of 3596 5048 rrrrllf.exe 98 PID 3596 wrote to memory of 4060 3596 ttbthn.exe 99 PID 3596 wrote to memory of 4060 3596 ttbthn.exe 99 PID 3596 wrote to memory of 4060 3596 ttbthn.exe 99 PID 4060 wrote to memory of 3880 4060 ppvvv.exe 100 PID 4060 wrote to memory of 3880 4060 ppvvv.exe 100 PID 4060 wrote to memory of 3880 4060 ppvvv.exe 100 PID 3880 wrote to memory of 4952 3880 ppppp.exe 101 PID 3880 wrote to memory of 4952 3880 ppppp.exe 101 PID 3880 wrote to memory of 4952 3880 ppppp.exe 101 PID 4952 wrote to memory of 1504 4952 ffxxxrr.exe 102 PID 4952 wrote to memory of 1504 4952 ffxxxrr.exe 102 PID 4952 wrote to memory of 1504 4952 ffxxxrr.exe 102 PID 1504 wrote to memory of 2608 1504 hbhhbh.exe 103 PID 1504 wrote to memory of 2608 1504 hbhhbh.exe 103 PID 1504 wrote to memory of 2608 1504 hbhhbh.exe 103 PID 2608 wrote to memory of 2060 2608 pddjv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe"C:\Users\Admin\AppData\Local\Temp\20f7d72feb99d42814edcd10e400466a161bd0b86f90763360820a90b7582282.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\jdjjd.exec:\jdjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\5hhbbb.exec:\5hhbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\3nnhhh.exec:\3nnhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\dvvpp.exec:\dvvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\ffxxrxr.exec:\ffxxrxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\9lxrxll.exec:\9lxrxll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\hnnhhb.exec:\hnnhhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\vppjd.exec:\vppjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\fxflffx.exec:\fxflffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\5bttnt.exec:\5bttnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\9hnntt.exec:\9hnntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\7jpvv.exec:\7jpvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\rrllfff.exec:\rrllfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\rrrrllf.exec:\rrrrllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\ttbthn.exec:\ttbthn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\ppvvv.exec:\ppvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\ppppp.exec:\ppppp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\ffxxxrr.exec:\ffxxxrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\hbhhbh.exec:\hbhhbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\pddjv.exec:\pddjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\fflxrll.exec:\fflxrll.exe23⤵
- Executes dropped EXE
PID:2060 -
\??\c:\lxllllf.exec:\lxllllf.exe24⤵
- Executes dropped EXE
PID:4036 -
\??\c:\ntnbbh.exec:\ntnbbh.exe25⤵
- Executes dropped EXE
PID:2584 -
\??\c:\pjpvp.exec:\pjpvp.exe26⤵
- Executes dropped EXE
PID:2964 -
\??\c:\7xllfll.exec:\7xllfll.exe27⤵
- Executes dropped EXE
PID:4620 -
\??\c:\rxrrrxr.exec:\rxrrrxr.exe28⤵
- Executes dropped EXE
PID:3788 -
\??\c:\7ttnnn.exec:\7ttnnn.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4808 -
\??\c:\hbhhhh.exec:\hbhhhh.exe30⤵
- Executes dropped EXE
PID:5020 -
\??\c:\pvdjd.exec:\pvdjd.exe31⤵
- Executes dropped EXE
PID:3224 -
\??\c:\jjpvd.exec:\jjpvd.exe32⤵
- Executes dropped EXE
PID:4956 -
\??\c:\9lrrrrr.exec:\9lrrrrr.exe33⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rxffxlf.exec:\rxffxlf.exe34⤵
- Executes dropped EXE
PID:844 -
\??\c:\3ttttt.exec:\3ttttt.exe35⤵
- Executes dropped EXE
PID:4940 -
\??\c:\9nhnhh.exec:\9nhnhh.exe36⤵
- Executes dropped EXE
PID:3324 -
\??\c:\1djdp.exec:\1djdp.exe37⤵
- Executes dropped EXE
PID:1064 -
\??\c:\ppvdp.exec:\ppvdp.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\3flffff.exec:\3flffff.exe39⤵
- Executes dropped EXE
PID:4392 -
\??\c:\hnttnn.exec:\hnttnn.exe40⤵
- Executes dropped EXE
PID:3884 -
\??\c:\tbnhtt.exec:\tbnhtt.exe41⤵
- Executes dropped EXE
PID:552 -
\??\c:\ddpdd.exec:\ddpdd.exe42⤵
- Executes dropped EXE
PID:2996 -
\??\c:\1djpp.exec:\1djpp.exe43⤵
- Executes dropped EXE
PID:4340 -
\??\c:\llrrrxl.exec:\llrrrxl.exe44⤵
- Executes dropped EXE
PID:4344 -
\??\c:\fxrllrr.exec:\fxrllrr.exe45⤵
- Executes dropped EXE
PID:3692 -
\??\c:\thnhhh.exec:\thnhhh.exe46⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tbbbbb.exec:\tbbbbb.exe47⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jvvvv.exec:\jvvvv.exe48⤵
- Executes dropped EXE
PID:3604 -
\??\c:\llrxxll.exec:\llrxxll.exe49⤵
- Executes dropped EXE
PID:3980 -
\??\c:\hbttnb.exec:\hbttnb.exe50⤵
- Executes dropped EXE
PID:116 -
\??\c:\jjjjj.exec:\jjjjj.exe51⤵
- Executes dropped EXE
PID:3024 -
\??\c:\ddjjd.exec:\ddjjd.exe52⤵
- Executes dropped EXE
PID:3268 -
\??\c:\rfrrlrl.exec:\rfrrlrl.exe53⤵
- Executes dropped EXE
PID:5024 -
\??\c:\xxlrllf.exec:\xxlrllf.exe54⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hhhtnn.exec:\hhhtnn.exe55⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vpvpd.exec:\vpvpd.exe56⤵
- Executes dropped EXE
PID:1528 -
\??\c:\djjvp.exec:\djjvp.exe57⤵
- Executes dropped EXE
PID:1500 -
\??\c:\9rrfflf.exec:\9rrfflf.exe58⤵
- Executes dropped EXE
PID:1900 -
\??\c:\nnhbnn.exec:\nnhbnn.exe59⤵
- Executes dropped EXE
PID:556 -
\??\c:\nbttth.exec:\nbttth.exe60⤵
- Executes dropped EXE
PID:2288 -
\??\c:\5pvvp.exec:\5pvvp.exe61⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pvvpj.exec:\pvvpj.exe62⤵
- Executes dropped EXE
PID:2012 -
\??\c:\fxxrfxr.exec:\fxxrfxr.exe63⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hnttnh.exec:\hnttnh.exe64⤵
- Executes dropped EXE
PID:5048 -
\??\c:\jpjvp.exec:\jpjvp.exe65⤵
- Executes dropped EXE
PID:1452 -
\??\c:\3pvvp.exec:\3pvvp.exe66⤵PID:3744
-
\??\c:\fxlflxr.exec:\fxlflxr.exe67⤵PID:3012
-
\??\c:\nhhhhh.exec:\nhhhhh.exe68⤵PID:2188
-
\??\c:\1vvvp.exec:\1vvvp.exe69⤵PID:4824
-
\??\c:\3rxrlfx.exec:\3rxrlfx.exe70⤵PID:1512
-
\??\c:\rrrrlll.exec:\rrrrlll.exe71⤵PID:4952
-
\??\c:\7tbbhh.exec:\7tbbhh.exe72⤵PID:5108
-
\??\c:\9jjdv.exec:\9jjdv.exe73⤵PID:4644
-
\??\c:\ffxrllx.exec:\ffxrllx.exe74⤵PID:4736
-
\??\c:\5lrrllx.exec:\5lrrllx.exe75⤵PID:512
-
\??\c:\9nhbbt.exec:\9nhbbt.exe76⤵PID:4036
-
\??\c:\vjpjj.exec:\vjpjj.exe77⤵PID:432
-
\??\c:\pdddv.exec:\pdddv.exe78⤵PID:2224
-
\??\c:\lfxfxxx.exec:\lfxfxxx.exe79⤵PID:2700
-
\??\c:\tnnnhn.exec:\tnnnhn.exe80⤵PID:2888
-
\??\c:\jjddd.exec:\jjddd.exe81⤵PID:3464
-
\??\c:\3ffxrlf.exec:\3ffxrlf.exe82⤵PID:4324
-
\??\c:\hbbnnn.exec:\hbbnnn.exe83⤵PID:2896
-
\??\c:\djdvp.exec:\djdvp.exe84⤵PID:3284
-
\??\c:\pddjj.exec:\pddjj.exe85⤵PID:3492
-
\??\c:\5fffxxx.exec:\5fffxxx.exe86⤵PID:3748
-
\??\c:\3rxrlfx.exec:\3rxrlfx.exe87⤵PID:4440
-
\??\c:\9httnh.exec:\9httnh.exe88⤵PID:404
-
\??\c:\thhbbb.exec:\thhbbb.exe89⤵PID:4940
-
\??\c:\ddppp.exec:\ddppp.exe90⤵PID:768
-
\??\c:\ffxrrrl.exec:\ffxrrrl.exe91⤵PID:4740
-
\??\c:\rxrfrfr.exec:\rxrfrfr.exe92⤵PID:2228
-
\??\c:\bbbbtt.exec:\bbbbtt.exe93⤵PID:612
-
\??\c:\dpvjd.exec:\dpvjd.exe94⤵PID:1776
-
\??\c:\1jjdd.exec:\1jjdd.exe95⤵PID:2996
-
\??\c:\3xfrxxr.exec:\3xfrxxr.exe96⤵PID:4340
-
\??\c:\5rxlffx.exec:\5rxlffx.exe97⤵PID:4344
-
\??\c:\tnhbbb.exec:\tnhbbb.exe98⤵PID:3692
-
\??\c:\vjjjv.exec:\vjjjv.exe99⤵PID:1684
-
\??\c:\vdvvp.exec:\vdvvp.exe100⤵PID:3544
-
\??\c:\rxrrllf.exec:\rxrrllf.exe101⤵PID:2404
-
\??\c:\bnttbb.exec:\bnttbb.exe102⤵PID:4256
-
\??\c:\btbthh.exec:\btbthh.exe103⤵PID:116
-
\??\c:\7ddvd.exec:\7ddvd.exe104⤵PID:4568
-
\??\c:\vpjjv.exec:\vpjjv.exe105⤵PID:5084
-
\??\c:\1vpjd.exec:\1vpjd.exe106⤵PID:1040
-
\??\c:\fllrlll.exec:\fllrlll.exe107⤵PID:1196
-
\??\c:\5bhhhn.exec:\5bhhhn.exe108⤵PID:1532
-
\??\c:\pvjdv.exec:\pvjdv.exe109⤵PID:1588
-
\??\c:\1dvpj.exec:\1dvpj.exe110⤵PID:4760
-
\??\c:\ffffxrx.exec:\ffffxrx.exe111⤵PID:1720
-
\??\c:\nnthtt.exec:\nnthtt.exe112⤵PID:2872
-
\??\c:\hhhbtt.exec:\hhhbtt.exe113⤵PID:3016
-
\??\c:\5lfxxrr.exec:\5lfxxrr.exe114⤵PID:1932
-
\??\c:\ttnnnn.exec:\ttnnnn.exe115⤵PID:4752
-
\??\c:\pvvvp.exec:\pvvvp.exe116⤵PID:880
-
\??\c:\rlllffx.exec:\rlllffx.exe117⤵PID:4092
-
\??\c:\bnnbbn.exec:\bnnbbn.exe118⤵PID:4768
-
\??\c:\jdvpj.exec:\jdvpj.exe119⤵PID:2952
-
\??\c:\rfxllll.exec:\rfxllll.exe120⤵PID:2988
-
\??\c:\tnbhbh.exec:\tnbhbh.exe121⤵PID:4432
-
\??\c:\9nhhbb.exec:\9nhhbb.exe122⤵PID:4352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-