Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 10:31
Static task
static1
Behavioral task
behavioral1
Sample
8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exe
Resource
win7-20240729-en
General
-
Target
8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exe
-
Size
81KB
-
MD5
7293c0318ee84d9610d992e01f80dcd1
-
SHA1
aeafb464d6a1fd880c24d4b292e2c1df1c20df29
-
SHA256
8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17
-
SHA512
009586e0bbc71ca72da8d6bd6dfb6f97db7c7d617a672e17df42da839aecaf41de8e9d3824792caa8d318079bd5290fba39107d88cda1cbac135dcde199e6525
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeqY:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4k
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/4176-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/364-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-36-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ffflrll.exetbhttt.exexxrxfll.exefrffxff.exexrrrrxf.exe1thhht.exevddjj.exe5jjpd.exefllrrfl.exennbhnn.exejjvvd.exeffrxflx.exenbhhhh.exebbnnnn.exeppdvj.exebbhbnn.exehthnhb.exejvpdd.exeflrrrxx.exexxllrrr.exenhbbbb.exevvpjd.exepjpjv.exeflrllll.exehbttth.exepddvv.exexlfrlxr.exehttthn.exevvvpj.exepdvpj.exellxfrxf.exehbhnnt.exevpppj.exexffflrx.exerrllxff.exebntbhn.exepddvv.exebtnnhb.exevvjjj.exehthbtt.exerrxrfll.exe7rrffff.exe9jdvv.exedddvj.exefrflfll.exenbhhbh.exe9hnnnt.exe3flllrr.exefrrrxlf.exethnhnt.exejjjjj.exevdppp.exellfffll.exexfffllf.exetthttb.exejvdvp.exepdppv.exe9rffrxx.exelfxxxff.exettnttb.exevjjjd.exelrxfrxr.exehhtttb.exevpvvp.exepid Process 432 ffflrll.exe 364 tbhttt.exe 1788 xxrxfll.exe 2228 frffxff.exe 1008 xrrrrxf.exe 5084 1thhht.exe 216 vddjj.exe 1408 5jjpd.exe 2352 fllrrfl.exe 4648 nnbhnn.exe 4948 jjvvd.exe 1664 ffrxflx.exe 1560 nbhhhh.exe 3392 bbnnnn.exe 4152 ppdvj.exe 3144 bbhbnn.exe 1780 hthnhb.exe 4408 jvpdd.exe 1576 flrrrxx.exe 2336 xxllrrr.exe 1444 nhbbbb.exe 3880 vvpjd.exe 1688 pjpjv.exe 3324 flrllll.exe 2156 hbttth.exe 4108 pddvv.exe 4148 xlfrlxr.exe 1724 httthn.exe 4600 vvvpj.exe 1504 pdvpj.exe 720 llxfrxf.exe 4440 hbhnnt.exe 4528 vpppj.exe 4312 xffflrx.exe 2240 rrllxff.exe 4736 bntbhn.exe 808 pddvv.exe 3748 btnnhb.exe 1040 vvjjj.exe 1036 hthbtt.exe 3104 rrxrfll.exe 3568 7rrffff.exe 3340 9jdvv.exe 440 dddvj.exe 4388 frflfll.exe 2296 nbhhbh.exe 4384 9hnnnt.exe 932 3flllrr.exe 4676 frrrxlf.exe 628 thnhnt.exe 1820 jjjjj.exe 3452 vdppp.exe 1336 llfffll.exe 4664 xfffllf.exe 1788 tthttb.exe 3876 jvdvp.exe 1308 pdppv.exe 3704 9rffrxx.exe 5084 lfxxxff.exe 3092 ttnttb.exe 856 vjjjd.exe 2096 lrxfrxr.exe 2352 hhtttb.exe 2828 vpvvp.exe -
Processes:
resource yara_rule behavioral2/memory/4176-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/364-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
llffxff.exedddvj.exebtbbtt.exepvvdv.exentbbnh.exebhnnnn.exe1thhht.exevvdjj.exelrfrrxx.exe5xflxxx.exetnhhhb.exerfrfxxl.exefrffxff.exetthnbt.exethnhnt.exepdddv.exefrrxxxf.exevjdjj.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xflxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exeffflrll.exetbhttt.exexxrxfll.exefrffxff.exexrrrrxf.exe1thhht.exevddjj.exe5jjpd.exefllrrfl.exennbhnn.exejjvvd.exeffrxflx.exenbhhhh.exebbnnnn.exeppdvj.exebbhbnn.exehthnhb.exejvpdd.exeflrrrxx.exexxllrrr.exenhbbbb.exedescription pid Process procid_target PID 4176 wrote to memory of 432 4176 8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exe 82 PID 4176 wrote to memory of 432 4176 8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exe 82 PID 4176 wrote to memory of 432 4176 8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exe 82 PID 432 wrote to memory of 364 432 ffflrll.exe 83 PID 432 wrote to memory of 364 432 ffflrll.exe 83 PID 432 wrote to memory of 364 432 ffflrll.exe 83 PID 364 wrote to memory of 1788 364 tbhttt.exe 84 PID 364 wrote to memory of 1788 364 tbhttt.exe 84 PID 364 wrote to memory of 1788 364 tbhttt.exe 84 PID 1788 wrote to memory of 2228 1788 xxrxfll.exe 85 PID 1788 wrote to memory of 2228 1788 xxrxfll.exe 85 PID 1788 wrote to memory of 2228 1788 xxrxfll.exe 85 PID 2228 wrote to memory of 1008 2228 frffxff.exe 86 PID 2228 wrote to memory of 1008 2228 frffxff.exe 86 PID 2228 wrote to memory of 1008 2228 frffxff.exe 86 PID 1008 wrote to memory of 5084 1008 xrrrrxf.exe 87 PID 1008 wrote to memory of 5084 1008 xrrrrxf.exe 87 PID 1008 wrote to memory of 5084 1008 xrrrrxf.exe 87 PID 5084 wrote to memory of 216 5084 1thhht.exe 88 PID 5084 wrote to memory of 216 5084 1thhht.exe 88 PID 5084 wrote to memory of 216 5084 1thhht.exe 88 PID 216 wrote to memory of 1408 216 vddjj.exe 89 PID 216 wrote to memory of 1408 216 vddjj.exe 89 PID 216 wrote to memory of 1408 216 vddjj.exe 89 PID 1408 wrote to memory of 2352 1408 5jjpd.exe 90 PID 1408 wrote to memory of 2352 1408 5jjpd.exe 90 PID 1408 wrote to memory of 2352 1408 5jjpd.exe 90 PID 2352 wrote to memory of 4648 2352 fllrrfl.exe 91 PID 2352 wrote to memory of 4648 2352 fllrrfl.exe 91 PID 2352 wrote to memory of 4648 2352 fllrrfl.exe 91 PID 4648 wrote to memory of 4948 4648 nnbhnn.exe 92 PID 4648 wrote to memory of 4948 4648 nnbhnn.exe 92 PID 4648 wrote to memory of 4948 4648 nnbhnn.exe 92 PID 4948 wrote to memory of 1664 4948 jjvvd.exe 93 PID 4948 wrote to memory of 1664 4948 jjvvd.exe 93 PID 4948 wrote to memory of 1664 4948 jjvvd.exe 93 PID 1664 wrote to memory of 1560 1664 ffrxflx.exe 94 PID 1664 wrote to memory of 1560 1664 ffrxflx.exe 94 PID 1664 wrote to memory of 1560 1664 ffrxflx.exe 94 PID 1560 wrote to memory of 3392 1560 nbhhhh.exe 95 PID 1560 wrote to memory of 3392 1560 nbhhhh.exe 95 PID 1560 wrote to memory of 3392 1560 nbhhhh.exe 95 PID 3392 wrote to memory of 4152 3392 bbnnnn.exe 96 PID 3392 wrote to memory of 4152 3392 bbnnnn.exe 96 PID 3392 wrote to memory of 4152 3392 bbnnnn.exe 96 PID 4152 wrote to memory of 3144 4152 ppdvj.exe 97 PID 4152 wrote to memory of 3144 4152 ppdvj.exe 97 PID 4152 wrote to memory of 3144 4152 ppdvj.exe 97 PID 3144 wrote to memory of 1780 3144 bbhbnn.exe 98 PID 3144 wrote to memory of 1780 3144 bbhbnn.exe 98 PID 3144 wrote to memory of 1780 3144 bbhbnn.exe 98 PID 1780 wrote to memory of 4408 1780 hthnhb.exe 99 PID 1780 wrote to memory of 4408 1780 hthnhb.exe 99 PID 1780 wrote to memory of 4408 1780 hthnhb.exe 99 PID 4408 wrote to memory of 1576 4408 jvpdd.exe 100 PID 4408 wrote to memory of 1576 4408 jvpdd.exe 100 PID 4408 wrote to memory of 1576 4408 jvpdd.exe 100 PID 1576 wrote to memory of 2336 1576 flrrrxx.exe 101 PID 1576 wrote to memory of 2336 1576 flrrrxx.exe 101 PID 1576 wrote to memory of 2336 1576 flrrrxx.exe 101 PID 2336 wrote to memory of 1444 2336 xxllrrr.exe 102 PID 2336 wrote to memory of 1444 2336 xxllrrr.exe 102 PID 2336 wrote to memory of 1444 2336 xxllrrr.exe 102 PID 1444 wrote to memory of 3880 1444 nhbbbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exe"C:\Users\Admin\AppData\Local\Temp\8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\ffflrll.exec:\ffflrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\tbhttt.exec:\tbhttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\xxrxfll.exec:\xxrxfll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\frffxff.exec:\frffxff.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\xrrrrxf.exec:\xrrrrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\1thhht.exec:\1thhht.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\vddjj.exec:\vddjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\5jjpd.exec:\5jjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\fllrrfl.exec:\fllrrfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\nnbhnn.exec:\nnbhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\jjvvd.exec:\jjvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\ffrxflx.exec:\ffrxflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\nbhhhh.exec:\nbhhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\bbnnnn.exec:\bbnnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\ppdvj.exec:\ppdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\bbhbnn.exec:\bbhbnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\hthnhb.exec:\hthnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\jvpdd.exec:\jvpdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\flrrrxx.exec:\flrrrxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\xxllrrr.exec:\xxllrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\nhbbbb.exec:\nhbbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\vvpjd.exec:\vvpjd.exe23⤵
- Executes dropped EXE
PID:3880 -
\??\c:\pjpjv.exec:\pjpjv.exe24⤵
- Executes dropped EXE
PID:1688 -
\??\c:\flrllll.exec:\flrllll.exe25⤵
- Executes dropped EXE
PID:3324 -
\??\c:\hbttth.exec:\hbttth.exe26⤵
- Executes dropped EXE
PID:2156 -
\??\c:\pddvv.exec:\pddvv.exe27⤵
- Executes dropped EXE
PID:4108 -
\??\c:\xlfrlxr.exec:\xlfrlxr.exe28⤵
- Executes dropped EXE
PID:4148 -
\??\c:\httthn.exec:\httthn.exe29⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vvvpj.exec:\vvvpj.exe30⤵
- Executes dropped EXE
PID:4600 -
\??\c:\pdvpj.exec:\pdvpj.exe31⤵
- Executes dropped EXE
PID:1504 -
\??\c:\llxfrxf.exec:\llxfrxf.exe32⤵
- Executes dropped EXE
PID:720 -
\??\c:\hbhnnt.exec:\hbhnnt.exe33⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vpppj.exec:\vpppj.exe34⤵
- Executes dropped EXE
PID:4528 -
\??\c:\xffflrx.exec:\xffflrx.exe35⤵
- Executes dropped EXE
PID:4312 -
\??\c:\rrllxff.exec:\rrllxff.exe36⤵
- Executes dropped EXE
PID:2240 -
\??\c:\bntbhn.exec:\bntbhn.exe37⤵
- Executes dropped EXE
PID:4736 -
\??\c:\pddvv.exec:\pddvv.exe38⤵
- Executes dropped EXE
PID:808 -
\??\c:\btnnhb.exec:\btnnhb.exe39⤵
- Executes dropped EXE
PID:3748 -
\??\c:\vvjjj.exec:\vvjjj.exe40⤵
- Executes dropped EXE
PID:1040 -
\??\c:\hthbtt.exec:\hthbtt.exe41⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rrxrfll.exec:\rrxrfll.exe42⤵
- Executes dropped EXE
PID:3104 -
\??\c:\7rrffff.exec:\7rrffff.exe43⤵
- Executes dropped EXE
PID:3568 -
\??\c:\9jdvv.exec:\9jdvv.exe44⤵
- Executes dropped EXE
PID:3340 -
\??\c:\dddvj.exec:\dddvj.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:440 -
\??\c:\frflfll.exec:\frflfll.exe46⤵
- Executes dropped EXE
PID:4388 -
\??\c:\nbhhbh.exec:\nbhhbh.exe47⤵
- Executes dropped EXE
PID:2296 -
\??\c:\9hnnnt.exec:\9hnnnt.exe48⤵
- Executes dropped EXE
PID:4384 -
\??\c:\3flllrr.exec:\3flllrr.exe49⤵
- Executes dropped EXE
PID:932 -
\??\c:\frrrxlf.exec:\frrrxlf.exe50⤵
- Executes dropped EXE
PID:4676 -
\??\c:\thnhnt.exec:\thnhnt.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:628 -
\??\c:\jjjjj.exec:\jjjjj.exe52⤵
- Executes dropped EXE
PID:1820 -
\??\c:\vdppp.exec:\vdppp.exe53⤵
- Executes dropped EXE
PID:3452 -
\??\c:\llfffll.exec:\llfffll.exe54⤵
- Executes dropped EXE
PID:1336 -
\??\c:\xfffllf.exec:\xfffllf.exe55⤵
- Executes dropped EXE
PID:4664 -
\??\c:\tthttb.exec:\tthttb.exe56⤵
- Executes dropped EXE
PID:1788 -
\??\c:\jvdvp.exec:\jvdvp.exe57⤵
- Executes dropped EXE
PID:3876 -
\??\c:\pdppv.exec:\pdppv.exe58⤵
- Executes dropped EXE
PID:1308 -
\??\c:\9rffrxx.exec:\9rffrxx.exe59⤵
- Executes dropped EXE
PID:3704 -
\??\c:\lfxxxff.exec:\lfxxxff.exe60⤵
- Executes dropped EXE
PID:5084 -
\??\c:\ttnttb.exec:\ttnttb.exe61⤵
- Executes dropped EXE
PID:3092 -
\??\c:\vjjjd.exec:\vjjjd.exe62⤵
- Executes dropped EXE
PID:856 -
\??\c:\lrxfrxr.exec:\lrxfrxr.exe63⤵
- Executes dropped EXE
PID:2096 -
\??\c:\hhtttb.exec:\hhtttb.exe64⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vpvvp.exec:\vpvvp.exe65⤵
- Executes dropped EXE
PID:2828 -
\??\c:\dpvdj.exec:\dpvdj.exe66⤵PID:1320
-
\??\c:\rllllrr.exec:\rllllrr.exe67⤵PID:1640
-
\??\c:\lrrrxfl.exec:\lrrrxfl.exe68⤵PID:4836
-
\??\c:\bbbbbb.exec:\bbbbbb.exe69⤵PID:3376
-
\??\c:\ppvdp.exec:\ppvdp.exe70⤵PID:2544
-
\??\c:\ppvvv.exec:\ppvvv.exe71⤵PID:3112
-
\??\c:\llxxfll.exec:\llxxfll.exe72⤵PID:5028
-
\??\c:\hthhhn.exec:\hthhhn.exe73⤵PID:4608
-
\??\c:\nnhhnn.exec:\nnhhnn.exe74⤵PID:3440
-
\??\c:\vpjjd.exec:\vpjjd.exe75⤵PID:952
-
\??\c:\9djjd.exec:\9djjd.exe76⤵PID:756
-
\??\c:\7ntttb.exec:\7ntttb.exe77⤵PID:4056
-
\??\c:\3bntbn.exec:\3bntbn.exe78⤵PID:2336
-
\??\c:\pjpvd.exec:\pjpvd.exe79⤵PID:3244
-
\??\c:\djdjp.exec:\djdjp.exe80⤵PID:1892
-
\??\c:\7xffxff.exec:\7xffxff.exe81⤵PID:2672
-
\??\c:\rfffflr.exec:\rfffflr.exe82⤵PID:1028
-
\??\c:\bbbbtt.exec:\bbbbtt.exe83⤵PID:2660
-
\??\c:\pjppj.exec:\pjppj.exe84⤵PID:3300
-
\??\c:\vjvvp.exec:\vjvvp.exe85⤵PID:2716
-
\??\c:\llffflx.exec:\llffflx.exe86⤵PID:2200
-
\??\c:\hntbtb.exec:\hntbtb.exe87⤵PID:704
-
\??\c:\bbtttb.exec:\bbtttb.exe88⤵PID:3992
-
\??\c:\vvjjj.exec:\vvjjj.exe89⤵PID:1304
-
\??\c:\7jvvv.exec:\7jvvv.exe90⤵PID:2084
-
\??\c:\5lfflrl.exec:\5lfflrl.exe91⤵PID:3228
-
\??\c:\btbhhn.exec:\btbhhn.exe92⤵PID:1604
-
\??\c:\bbntbh.exec:\bbntbh.exe93⤵PID:4164
-
\??\c:\vpvvv.exec:\vpvvv.exe94⤵PID:3372
-
\??\c:\jppjd.exec:\jppjd.exe95⤵PID:1964
-
\??\c:\ffrrrxf.exec:\ffrrrxf.exe96⤵PID:1120
-
\??\c:\ttbntn.exec:\ttbntn.exe97⤵PID:4284
-
\??\c:\bbhnhn.exec:\bbhnhn.exe98⤵PID:1896
-
\??\c:\vvjjd.exec:\vvjjd.exe99⤵PID:1816
-
\??\c:\ppppd.exec:\ppppd.exe100⤵PID:3320
-
\??\c:\1lxffrr.exec:\1lxffrr.exe101⤵PID:852
-
\??\c:\lllxffx.exec:\lllxffx.exe102⤵PID:1376
-
\??\c:\9tbbbh.exec:\9tbbbh.exe103⤵PID:1684
-
\??\c:\pdjjd.exec:\pdjjd.exe104⤵PID:4332
-
\??\c:\9ppvj.exec:\9ppvj.exe105⤵PID:512
-
\??\c:\xrxxrxx.exec:\xrxxrxx.exe106⤵PID:4388
-
\??\c:\9rlxfll.exec:\9rlxfll.exe107⤵PID:2144
-
\??\c:\nhhhhh.exec:\nhhhhh.exe108⤵PID:548
-
\??\c:\hhhnhh.exec:\hhhnhh.exe109⤵PID:884
-
\??\c:\vdvvp.exec:\vdvvp.exe110⤵PID:776
-
\??\c:\xxrrfll.exec:\xxrrfll.exe111⤵PID:3004
-
\??\c:\hnttnb.exec:\hnttnb.exe112⤵PID:2180
-
\??\c:\bbbbhn.exec:\bbbbhn.exe113⤵PID:1844
-
\??\c:\ppjpv.exec:\ppjpv.exe114⤵PID:3736
-
\??\c:\djpvv.exec:\djpvv.exe115⤵PID:1632
-
\??\c:\xxxxxfl.exec:\xxxxxfl.exe116⤵PID:4748
-
\??\c:\9lffffl.exec:\9lffffl.exe117⤵PID:2252
-
\??\c:\frxffll.exec:\frxffll.exe118⤵PID:3708
-
\??\c:\hnnnnt.exec:\hnnnnt.exe119⤵PID:3732
-
\??\c:\hbthhh.exec:\hbthhh.exe120⤵PID:3808
-
\??\c:\9vjdv.exec:\9vjdv.exe121⤵PID:1020
-
\??\c:\ppvvv.exec:\ppvvv.exe122⤵PID:2624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-