Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 20:13
Static task
static1
Behavioral task
behavioral1
Sample
e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90N.exe
Resource
win7-20240903-en
General
-
Target
e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90N.exe
-
Size
82KB
-
MD5
d2c1a78877ec264e9183c46e1137b940
-
SHA1
d84e229059378aae4e1e2ea64ecfa91252b13e6c
-
SHA256
e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90
-
SHA512
b394ec72e6f8c59391a5d8b60b7c9d05684a3f487eb06d9c50939f24629643350bd90415b2715923a8c46e8efd71852d891cc38e1e6035f92b1a81adca8ba24b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeqe:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4r2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/372-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3332-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5024 vpdvv.exe 2372 vppjj.exe 3672 lfxrlll.exe 1916 rrrlrrl.exe 3064 hbhhtn.exe 4180 7vddv.exe 2836 frrflfr.exe 636 hhbbtt.exe 3000 ddvpp.exe 1244 xlrrlrl.exe 388 ttntth.exe 3004 vjppj.exe 208 lxxxxll.exe 3176 lflllll.exe 3656 nbbbnn.exe 4172 jjjpj.exe 4168 rrrrlll.exe 4012 ntbtnn.exe 3692 pdjdv.exe 4672 xrrlffx.exe 1460 htbbbt.exe 1448 5pjdv.exe 1196 ppddp.exe 4636 rffxlrr.exe 3332 flffrlf.exe 2740 nttbth.exe 2792 dvjdp.exe 3968 lfllxrl.exe 5028 tnttnt.exe 1172 jvvvp.exe 3512 rlffxfx.exe 3740 btnntt.exe 4268 rxxrlfx.exe 3244 nbhbnn.exe 976 9ppjv.exe 4600 vpjdp.exe 3148 rxfxrrr.exe 2800 rlrlffx.exe 2272 hbbtnn.exe 4408 dvpjv.exe 4588 vpjjv.exe 3608 fxrfrrl.exe 3956 rllfxlf.exe 2472 bhbtnh.exe 1964 jjvpp.exe 2888 vdvdj.exe 4036 fxrrllf.exe 4396 rxlxlfl.exe 4792 thnhbb.exe 336 dpppd.exe 3556 jppjd.exe 1864 frxfrff.exe 552 tnbbtt.exe 3876 bttnhb.exe 1456 vpdvj.exe 3228 jpvpj.exe 5008 9lfxllf.exe 3696 ffflllf.exe 3972 thnnnn.exe 3896 jdvvp.exe 2540 jvvpj.exe 4492 rxrrlll.exe 2772 lrlxxxr.exe 3000 3nttnn.exe -
resource yara_rule behavioral2/memory/372-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3332-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 372 wrote to memory of 5024 372 e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90N.exe 82 PID 372 wrote to memory of 5024 372 e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90N.exe 82 PID 372 wrote to memory of 5024 372 e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90N.exe 82 PID 5024 wrote to memory of 2372 5024 vpdvv.exe 83 PID 5024 wrote to memory of 2372 5024 vpdvv.exe 83 PID 5024 wrote to memory of 2372 5024 vpdvv.exe 83 PID 2372 wrote to memory of 3672 2372 vppjj.exe 84 PID 2372 wrote to memory of 3672 2372 vppjj.exe 84 PID 2372 wrote to memory of 3672 2372 vppjj.exe 84 PID 3672 wrote to memory of 1916 3672 lfxrlll.exe 85 PID 3672 wrote to memory of 1916 3672 lfxrlll.exe 85 PID 3672 wrote to memory of 1916 3672 lfxrlll.exe 85 PID 1916 wrote to memory of 3064 1916 rrrlrrl.exe 86 PID 1916 wrote to memory of 3064 1916 rrrlrrl.exe 86 PID 1916 wrote to memory of 3064 1916 rrrlrrl.exe 86 PID 3064 wrote to memory of 4180 3064 hbhhtn.exe 87 PID 3064 wrote to memory of 4180 3064 hbhhtn.exe 87 PID 3064 wrote to memory of 4180 3064 hbhhtn.exe 87 PID 4180 wrote to memory of 2836 4180 7vddv.exe 88 PID 4180 wrote to memory of 2836 4180 7vddv.exe 88 PID 4180 wrote to memory of 2836 4180 7vddv.exe 88 PID 2836 wrote to memory of 636 2836 frrflfr.exe 89 PID 2836 wrote to memory of 636 2836 frrflfr.exe 89 PID 2836 wrote to memory of 636 2836 frrflfr.exe 89 PID 636 wrote to memory of 3000 636 hhbbtt.exe 90 PID 636 wrote to memory of 3000 636 hhbbtt.exe 90 PID 636 wrote to memory of 3000 636 hhbbtt.exe 90 PID 3000 wrote to memory of 1244 3000 ddvpp.exe 91 PID 3000 wrote to memory of 1244 3000 ddvpp.exe 91 PID 3000 wrote to memory of 1244 3000 ddvpp.exe 91 PID 1244 wrote to memory of 388 1244 xlrrlrl.exe 92 PID 1244 wrote to memory of 388 1244 xlrrlrl.exe 92 PID 1244 wrote to memory of 388 1244 xlrrlrl.exe 92 PID 388 wrote to memory of 3004 388 ttntth.exe 93 PID 388 wrote to memory of 3004 388 ttntth.exe 93 PID 388 wrote to memory of 3004 388 ttntth.exe 93 PID 3004 wrote to memory of 208 3004 vjppj.exe 94 PID 3004 wrote to memory of 208 3004 vjppj.exe 94 PID 3004 wrote to memory of 208 3004 vjppj.exe 94 PID 208 wrote to memory of 3176 208 lxxxxll.exe 95 PID 208 wrote to memory of 3176 208 lxxxxll.exe 95 PID 208 wrote to memory of 3176 208 lxxxxll.exe 95 PID 3176 wrote to memory of 3656 3176 lflllll.exe 96 PID 3176 wrote to memory of 3656 3176 lflllll.exe 96 PID 3176 wrote to memory of 3656 3176 lflllll.exe 96 PID 3656 wrote to memory of 4172 3656 nbbbnn.exe 97 PID 3656 wrote to memory of 4172 3656 nbbbnn.exe 97 PID 3656 wrote to memory of 4172 3656 nbbbnn.exe 97 PID 4172 wrote to memory of 4168 4172 jjjpj.exe 98 PID 4172 wrote to memory of 4168 4172 jjjpj.exe 98 PID 4172 wrote to memory of 4168 4172 jjjpj.exe 98 PID 4168 wrote to memory of 4012 4168 rrrrlll.exe 99 PID 4168 wrote to memory of 4012 4168 rrrrlll.exe 99 PID 4168 wrote to memory of 4012 4168 rrrrlll.exe 99 PID 4012 wrote to memory of 3692 4012 ntbtnn.exe 100 PID 4012 wrote to memory of 3692 4012 ntbtnn.exe 100 PID 4012 wrote to memory of 3692 4012 ntbtnn.exe 100 PID 3692 wrote to memory of 4672 3692 pdjdv.exe 101 PID 3692 wrote to memory of 4672 3692 pdjdv.exe 101 PID 3692 wrote to memory of 4672 3692 pdjdv.exe 101 PID 4672 wrote to memory of 1460 4672 xrrlffx.exe 102 PID 4672 wrote to memory of 1460 4672 xrrlffx.exe 102 PID 4672 wrote to memory of 1460 4672 xrrlffx.exe 102 PID 1460 wrote to memory of 1448 1460 htbbbt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90N.exe"C:\Users\Admin\AppData\Local\Temp\e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\vpdvv.exec:\vpdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\vppjj.exec:\vppjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\lfxrlll.exec:\lfxrlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\rrrlrrl.exec:\rrrlrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\hbhhtn.exec:\hbhhtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\7vddv.exec:\7vddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\frrflfr.exec:\frrflfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\hhbbtt.exec:\hhbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\ddvpp.exec:\ddvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\xlrrlrl.exec:\xlrrlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\ttntth.exec:\ttntth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\vjppj.exec:\vjppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\lxxxxll.exec:\lxxxxll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\lflllll.exec:\lflllll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\nbbbnn.exec:\nbbbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\jjjpj.exec:\jjjpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\rrrrlll.exec:\rrrrlll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\ntbtnn.exec:\ntbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\pdjdv.exec:\pdjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\xrrlffx.exec:\xrrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\htbbbt.exec:\htbbbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\5pjdv.exec:\5pjdv.exe23⤵
- Executes dropped EXE
PID:1448 -
\??\c:\ppddp.exec:\ppddp.exe24⤵
- Executes dropped EXE
PID:1196 -
\??\c:\rffxlrr.exec:\rffxlrr.exe25⤵
- Executes dropped EXE
PID:4636 -
\??\c:\flffrlf.exec:\flffrlf.exe26⤵
- Executes dropped EXE
PID:3332 -
\??\c:\nttbth.exec:\nttbth.exe27⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dvjdp.exec:\dvjdp.exe28⤵
- Executes dropped EXE
PID:2792 -
\??\c:\lfllxrl.exec:\lfllxrl.exe29⤵
- Executes dropped EXE
PID:3968 -
\??\c:\tnttnt.exec:\tnttnt.exe30⤵
- Executes dropped EXE
PID:5028 -
\??\c:\jvvvp.exec:\jvvvp.exe31⤵
- Executes dropped EXE
PID:1172 -
\??\c:\rlffxfx.exec:\rlffxfx.exe32⤵
- Executes dropped EXE
PID:3512 -
\??\c:\btnntt.exec:\btnntt.exe33⤵
- Executes dropped EXE
PID:3740 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe34⤵
- Executes dropped EXE
PID:4268 -
\??\c:\nbhbnn.exec:\nbhbnn.exe35⤵
- Executes dropped EXE
PID:3244 -
\??\c:\9ppjv.exec:\9ppjv.exe36⤵
- Executes dropped EXE
PID:976 -
\??\c:\vpjdp.exec:\vpjdp.exe37⤵
- Executes dropped EXE
PID:4600 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe38⤵
- Executes dropped EXE
PID:3148 -
\??\c:\rlrlffx.exec:\rlrlffx.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hbbtnn.exec:\hbbtnn.exe40⤵
- Executes dropped EXE
PID:2272 -
\??\c:\dvpjv.exec:\dvpjv.exe41⤵
- Executes dropped EXE
PID:4408 -
\??\c:\vpjjv.exec:\vpjjv.exe42⤵
- Executes dropped EXE
PID:4588 -
\??\c:\fxrfrrl.exec:\fxrfrrl.exe43⤵
- Executes dropped EXE
PID:3608 -
\??\c:\rllfxlf.exec:\rllfxlf.exe44⤵
- Executes dropped EXE
PID:3956 -
\??\c:\bhbtnh.exec:\bhbtnh.exe45⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jjvpp.exec:\jjvpp.exe46⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vdvdj.exec:\vdvdj.exe47⤵
- Executes dropped EXE
PID:2888 -
\??\c:\fxrrllf.exec:\fxrrllf.exe48⤵
- Executes dropped EXE
PID:4036 -
\??\c:\rxlxlfl.exec:\rxlxlfl.exe49⤵
- Executes dropped EXE
PID:4396 -
\??\c:\thnhbb.exec:\thnhbb.exe50⤵
- Executes dropped EXE
PID:4792 -
\??\c:\dpppd.exec:\dpppd.exe51⤵
- Executes dropped EXE
PID:336 -
\??\c:\jppjd.exec:\jppjd.exe52⤵
- Executes dropped EXE
PID:3556 -
\??\c:\frxfrff.exec:\frxfrff.exe53⤵
- Executes dropped EXE
PID:1864 -
\??\c:\tnbbtt.exec:\tnbbtt.exe54⤵
- Executes dropped EXE
PID:552 -
\??\c:\bttnhb.exec:\bttnhb.exe55⤵
- Executes dropped EXE
PID:3876 -
\??\c:\vpdvj.exec:\vpdvj.exe56⤵
- Executes dropped EXE
PID:1456 -
\??\c:\jpvpj.exec:\jpvpj.exe57⤵
- Executes dropped EXE
PID:3228 -
\??\c:\9lfxllf.exec:\9lfxllf.exe58⤵
- Executes dropped EXE
PID:5008 -
\??\c:\ffflllf.exec:\ffflllf.exe59⤵
- Executes dropped EXE
PID:3696 -
\??\c:\thnnnn.exec:\thnnnn.exe60⤵
- Executes dropped EXE
PID:3972 -
\??\c:\jdvvp.exec:\jdvvp.exe61⤵
- Executes dropped EXE
PID:3896 -
\??\c:\jvvpj.exec:\jvvpj.exe62⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rxrrlll.exec:\rxrrlll.exe63⤵
- Executes dropped EXE
PID:4492 -
\??\c:\lrlxxxr.exec:\lrlxxxr.exe64⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3nttnn.exec:\3nttnn.exe65⤵
- Executes dropped EXE
PID:3000 -
\??\c:\bhttbh.exec:\bhttbh.exe66⤵PID:2316
-
\??\c:\jdddv.exec:\jdddv.exe67⤵PID:216
-
\??\c:\fxxrfff.exec:\fxxrfff.exe68⤵PID:4756
-
\??\c:\xlrlllf.exec:\xlrlllf.exe69⤵PID:1028
-
\??\c:\nbhhbb.exec:\nbhhbb.exe70⤵
- System Location Discovery: System Language Discovery
PID:244 -
\??\c:\btnhbt.exec:\btnhbt.exe71⤵PID:5112
-
\??\c:\vjpvp.exec:\vjpvp.exe72⤵PID:3176
-
\??\c:\rflfllf.exec:\rflfllf.exe73⤵PID:3540
-
\??\c:\fxffllr.exec:\fxffllr.exe74⤵PID:3144
-
\??\c:\jvvvp.exec:\jvvvp.exe75⤵PID:1492
-
\??\c:\vjddp.exec:\vjddp.exe76⤵PID:1352
-
\??\c:\xfxrfxr.exec:\xfxrfxr.exe77⤵PID:4604
-
\??\c:\tnnhnn.exec:\tnnhnn.exe78⤵PID:1656
-
\??\c:\bntttt.exec:\bntttt.exe79⤵PID:4748
-
\??\c:\vvjjp.exec:\vvjjp.exe80⤵PID:2632
-
\??\c:\rxfxlrl.exec:\rxfxlrl.exe81⤵PID:4028
-
\??\c:\fffxxrr.exec:\fffxxrr.exe82⤵PID:2352
-
\??\c:\tnbtbb.exec:\tnbtbb.exe83⤵PID:1960
-
\??\c:\btnnnn.exec:\btnnnn.exe84⤵PID:3480
-
\??\c:\vpdjp.exec:\vpdjp.exe85⤵PID:4636
-
\??\c:\vdjjd.exec:\vdjjd.exe86⤵PID:4616
-
\??\c:\lrxfxxr.exec:\lrxfxxr.exe87⤵PID:3452
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe88⤵PID:4916
-
\??\c:\hhbbbt.exec:\hhbbbt.exe89⤵PID:2024
-
\??\c:\tnhhbb.exec:\tnhhbb.exe90⤵PID:2104
-
\??\c:\ppjdd.exec:\ppjdd.exe91⤵PID:3776
-
\??\c:\dvpjd.exec:\dvpjd.exe92⤵PID:3904
-
\??\c:\llrxxxf.exec:\llrxxxf.exe93⤵PID:1980
-
\??\c:\rrfxrlf.exec:\rrfxrlf.exe94⤵PID:1672
-
\??\c:\thtnbb.exec:\thtnbb.exe95⤵PID:3020
-
\??\c:\bntnhh.exec:\bntnhh.exe96⤵PID:1228
-
\??\c:\1vvvv.exec:\1vvvv.exe97⤵PID:2688
-
\??\c:\jvdvj.exec:\jvdvj.exe98⤵PID:1628
-
\??\c:\flrrfff.exec:\flrrfff.exe99⤵PID:2164
-
\??\c:\fxxflll.exec:\fxxflll.exe100⤵PID:1756
-
\??\c:\tnhbth.exec:\tnhbth.exe101⤵PID:2288
-
\??\c:\tbhbtt.exec:\tbhbtt.exe102⤵PID:1620
-
\??\c:\djjjv.exec:\djjjv.exe103⤵PID:5116
-
\??\c:\dvjjp.exec:\dvjjp.exe104⤵PID:1372
-
\??\c:\dpjdv.exec:\dpjdv.exe105⤵PID:3960
-
\??\c:\fxxfxxr.exec:\fxxfxxr.exe106⤵PID:3768
-
\??\c:\ttbhbb.exec:\ttbhbb.exe107⤵PID:2720
-
\??\c:\btttnn.exec:\btttnn.exe108⤵PID:4900
-
\??\c:\5djdv.exec:\5djdv.exe109⤵PID:4860
-
\??\c:\1jddp.exec:\1jddp.exe110⤵PID:4076
-
\??\c:\lxfxrrx.exec:\lxfxrrx.exe111⤵PID:4552
-
\??\c:\lfrffff.exec:\lfrffff.exe112⤵PID:2604
-
\??\c:\bnnbnt.exec:\bnnbnt.exe113⤵PID:3592
-
\??\c:\7dppd.exec:\7dppd.exe114⤵PID:4804
-
\??\c:\pjpjd.exec:\pjpjd.exe115⤵PID:2752
-
\??\c:\rlflfff.exec:\rlflfff.exe116⤵PID:2060
-
\??\c:\lfflfff.exec:\lfflfff.exe117⤵PID:1824
-
\??\c:\hbnnnt.exec:\hbnnnt.exe118⤵PID:2812
-
\??\c:\jdvvp.exec:\jdvvp.exe119⤵PID:1164
-
\??\c:\ddpvv.exec:\ddpvv.exe120⤵PID:5004
-
\??\c:\xlfxrll.exec:\xlfxrll.exe121⤵PID:4180
-
\??\c:\htnnhh.exec:\htnnhh.exe122⤵PID:1484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-