Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 00:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
af19fa484d85b08047d6ac8f59c5ce3c9dab790f34946c14c2243270b88d1d00.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
af19fa484d85b08047d6ac8f59c5ce3c9dab790f34946c14c2243270b88d1d00.exe
-
Size
453KB
-
MD5
40c8bde846d9ee11883b0e5098d0473f
-
SHA1
efc765918ed5d2c78f0dcf0d7b59cad7d86f7337
-
SHA256
af19fa484d85b08047d6ac8f59c5ce3c9dab790f34946c14c2243270b88d1d00
-
SHA512
f16d0d791938bf77e66b1f52417e83b809c22319d74f0ee465616734e7e521e2af6f684a015957bdec42e38cdc790ec281d606ae4ebccb91ced8252c5a663fff
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAben:q7Tc2NYHUrAwfMp3CDn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 34 IoCs
resource yara_rule behavioral1/memory/2212-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-254-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2384-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-362-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1996-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-395-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2880-454-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2112-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-535-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2800-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2144 vdvdp.exe 2820 nhbnnt.exe 2920 pjdpj.exe 2668 ttbntb.exe 888 pjdjp.exe 2544 btntnn.exe 2672 dvvjd.exe 3004 nttbnn.exe 2976 lfrflrr.exe 2396 3ntbbn.exe 2732 ffxlxff.exe 1724 nbtbhh.exe 2608 ddvpd.exe 2844 rxxxxxx.exe 1688 7vjjj.exe 1708 rrrrlrl.exe 332 thttbt.exe 2404 rxfffxl.exe 1720 hhbntb.exe 2444 jvvjv.exe 444 9nhntb.exe 2424 rlxlxfr.exe 1348 btnthh.exe 2512 xrllflf.exe 2496 lrrlxfx.exe 1796 7nbnhn.exe 2252 7lfrflx.exe 2428 tnnbnb.exe 2944 1lflxlx.exe 1948 nhnhnn.exe 2056 vvvdj.exe 2212 xrlrffl.exe 1592 tnbthn.exe 2704 5jvvd.exe 2820 rrlxffl.exe 2384 nthhnt.exe 2584 jjjpj.exe 2604 1rfrrxl.exe 2552 3frfffr.exe 2544 3bthtb.exe 2020 jvvvd.exe 1856 rrrxrrx.exe 3004 3thhtb.exe 1996 hbtbht.exe 2160 pjvvd.exe 2876 rrxxffx.exe 2312 5hthhn.exe 2868 vvpjv.exe 1744 pjdjp.exe 2076 rrrxflf.exe 2880 tnnntb.exe 1480 djjvj.exe 1760 9jddj.exe 1028 7lllrrf.exe 3060 1bnthn.exe 2032 3pdjj.exe 1444 rlxflxx.exe 1788 tnbbnn.exe 408 3hbhtb.exe 2116 pvvdd.exe 1792 rlrxffr.exe 1092 btnhtt.exe 1292 jvpvj.exe 1716 9fflffl.exe -
resource yara_rule behavioral1/memory/2212-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-408-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2112-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-563-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2260-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-782-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2144 2212 af19fa484d85b08047d6ac8f59c5ce3c9dab790f34946c14c2243270b88d1d00.exe 30 PID 2212 wrote to memory of 2144 2212 af19fa484d85b08047d6ac8f59c5ce3c9dab790f34946c14c2243270b88d1d00.exe 30 PID 2212 wrote to memory of 2144 2212 af19fa484d85b08047d6ac8f59c5ce3c9dab790f34946c14c2243270b88d1d00.exe 30 PID 2212 wrote to memory of 2144 2212 af19fa484d85b08047d6ac8f59c5ce3c9dab790f34946c14c2243270b88d1d00.exe 30 PID 2144 wrote to memory of 2820 2144 vdvdp.exe 31 PID 2144 wrote to memory of 2820 2144 vdvdp.exe 31 PID 2144 wrote to memory of 2820 2144 vdvdp.exe 31 PID 2144 wrote to memory of 2820 2144 vdvdp.exe 31 PID 2820 wrote to memory of 2920 2820 nhbnnt.exe 32 PID 2820 wrote to memory of 2920 2820 nhbnnt.exe 32 PID 2820 wrote to memory of 2920 2820 nhbnnt.exe 32 PID 2820 wrote to memory of 2920 2820 nhbnnt.exe 32 PID 2920 wrote to memory of 2668 2920 pjdpj.exe 33 PID 2920 wrote to memory of 2668 2920 pjdpj.exe 33 PID 2920 wrote to memory of 2668 2920 pjdpj.exe 33 PID 2920 wrote to memory of 2668 2920 pjdpj.exe 33 PID 2668 wrote to memory of 888 2668 ttbntb.exe 34 PID 2668 wrote to memory of 888 2668 ttbntb.exe 34 PID 2668 wrote to memory of 888 2668 ttbntb.exe 34 PID 2668 wrote to memory of 888 2668 ttbntb.exe 34 PID 888 wrote to memory of 2544 888 pjdjp.exe 35 PID 888 wrote to memory of 2544 888 pjdjp.exe 35 PID 888 wrote to memory of 2544 888 pjdjp.exe 35 PID 888 wrote to memory of 2544 888 pjdjp.exe 35 PID 2544 wrote to memory of 2672 2544 btntnn.exe 36 PID 2544 wrote to memory of 2672 2544 btntnn.exe 36 PID 2544 wrote to memory of 2672 2544 btntnn.exe 36 PID 2544 wrote to memory of 2672 2544 btntnn.exe 36 PID 2672 wrote to memory of 3004 2672 dvvjd.exe 37 PID 2672 wrote to memory of 3004 2672 dvvjd.exe 37 PID 2672 wrote to memory of 3004 2672 dvvjd.exe 37 PID 2672 wrote to memory of 3004 2672 dvvjd.exe 37 PID 3004 wrote to memory of 2976 3004 nttbnn.exe 38 PID 3004 wrote to memory of 2976 3004 nttbnn.exe 38 PID 3004 wrote to memory of 2976 3004 nttbnn.exe 38 PID 3004 wrote to memory of 2976 3004 nttbnn.exe 38 PID 2976 wrote to memory of 2396 2976 lfrflrr.exe 39 PID 2976 wrote to memory of 2396 2976 lfrflrr.exe 39 PID 2976 wrote to memory of 2396 2976 lfrflrr.exe 39 PID 2976 wrote to memory of 2396 2976 lfrflrr.exe 39 PID 2396 wrote to memory of 2732 2396 3ntbbn.exe 40 PID 2396 wrote to memory of 2732 2396 3ntbbn.exe 40 PID 2396 wrote to memory of 2732 2396 3ntbbn.exe 40 PID 2396 wrote to memory of 2732 2396 3ntbbn.exe 40 PID 2732 wrote to memory of 1724 2732 ffxlxff.exe 41 PID 2732 wrote to memory of 1724 2732 ffxlxff.exe 41 PID 2732 wrote to memory of 1724 2732 ffxlxff.exe 41 PID 2732 wrote to memory of 1724 2732 ffxlxff.exe 41 PID 1724 wrote to memory of 2608 1724 nbtbhh.exe 42 PID 1724 wrote to memory of 2608 1724 nbtbhh.exe 42 PID 1724 wrote to memory of 2608 1724 nbtbhh.exe 42 PID 1724 wrote to memory of 2608 1724 nbtbhh.exe 42 PID 2608 wrote to memory of 2844 2608 ddvpd.exe 43 PID 2608 wrote to memory of 2844 2608 ddvpd.exe 43 PID 2608 wrote to memory of 2844 2608 ddvpd.exe 43 PID 2608 wrote to memory of 2844 2608 ddvpd.exe 43 PID 2844 wrote to memory of 1688 2844 rxxxxxx.exe 44 PID 2844 wrote to memory of 1688 2844 rxxxxxx.exe 44 PID 2844 wrote to memory of 1688 2844 rxxxxxx.exe 44 PID 2844 wrote to memory of 1688 2844 rxxxxxx.exe 44 PID 1688 wrote to memory of 1708 1688 7vjjj.exe 45 PID 1688 wrote to memory of 1708 1688 7vjjj.exe 45 PID 1688 wrote to memory of 1708 1688 7vjjj.exe 45 PID 1688 wrote to memory of 1708 1688 7vjjj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\af19fa484d85b08047d6ac8f59c5ce3c9dab790f34946c14c2243270b88d1d00.exe"C:\Users\Admin\AppData\Local\Temp\af19fa484d85b08047d6ac8f59c5ce3c9dab790f34946c14c2243270b88d1d00.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\vdvdp.exec:\vdvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\nhbnnt.exec:\nhbnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\pjdpj.exec:\pjdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\ttbntb.exec:\ttbntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\pjdjp.exec:\pjdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\btntnn.exec:\btntnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\dvvjd.exec:\dvvjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\nttbnn.exec:\nttbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\lfrflrr.exec:\lfrflrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\3ntbbn.exec:\3ntbbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\ffxlxff.exec:\ffxlxff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nbtbhh.exec:\nbtbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\ddvpd.exec:\ddvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\rxxxxxx.exec:\rxxxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\7vjjj.exec:\7vjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\rrrrlrl.exec:\rrrrlrl.exe17⤵
- Executes dropped EXE
PID:1708 -
\??\c:\thttbt.exec:\thttbt.exe18⤵
- Executes dropped EXE
PID:332 -
\??\c:\rxfffxl.exec:\rxfffxl.exe19⤵
- Executes dropped EXE
PID:2404 -
\??\c:\hhbntb.exec:\hhbntb.exe20⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jvvjv.exec:\jvvjv.exe21⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9nhntb.exec:\9nhntb.exe22⤵
- Executes dropped EXE
PID:444 -
\??\c:\rlxlxfr.exec:\rlxlxfr.exe23⤵
- Executes dropped EXE
PID:2424 -
\??\c:\btnthh.exec:\btnthh.exe24⤵
- Executes dropped EXE
PID:1348 -
\??\c:\xrllflf.exec:\xrllflf.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2512 -
\??\c:\lrrlxfx.exec:\lrrlxfx.exe26⤵
- Executes dropped EXE
PID:2496 -
\??\c:\7nbnhn.exec:\7nbnhn.exe27⤵
- Executes dropped EXE
PID:1796 -
\??\c:\7lfrflx.exec:\7lfrflx.exe28⤵
- Executes dropped EXE
PID:2252 -
\??\c:\tnnbnb.exec:\tnnbnb.exe29⤵
- Executes dropped EXE
PID:2428 -
\??\c:\1lflxlx.exec:\1lflxlx.exe30⤵
- Executes dropped EXE
PID:2944 -
\??\c:\nhnhnn.exec:\nhnhnn.exe31⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vvvdj.exec:\vvvdj.exe32⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xrlrffl.exec:\xrlrffl.exe33⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tnbthn.exec:\tnbthn.exe34⤵
- Executes dropped EXE
PID:1592 -
\??\c:\5jvvd.exec:\5jvvd.exe35⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rrlxffl.exec:\rrlxffl.exe36⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nthhnt.exec:\nthhnt.exe37⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jjjpj.exec:\jjjpj.exe38⤵
- Executes dropped EXE
PID:2584 -
\??\c:\1rfrrxl.exec:\1rfrrxl.exe39⤵
- Executes dropped EXE
PID:2604 -
\??\c:\3frfffr.exec:\3frfffr.exe40⤵
- Executes dropped EXE
PID:2552 -
\??\c:\3bthtb.exec:\3bthtb.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jvvvd.exec:\jvvvd.exe42⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rrrxrrx.exec:\rrrxrrx.exe43⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3thhtb.exec:\3thhtb.exe44⤵
- Executes dropped EXE
PID:3004 -
\??\c:\hbtbht.exec:\hbtbht.exe45⤵
- Executes dropped EXE
PID:1996 -
\??\c:\pjvvd.exec:\pjvvd.exe46⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rrxxffx.exec:\rrxxffx.exe47⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5hthhn.exec:\5hthhn.exe48⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vvpjv.exec:\vvpjv.exe49⤵
- Executes dropped EXE
PID:2868 -
\??\c:\pjdjp.exec:\pjdjp.exe50⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rrrxflf.exec:\rrrxflf.exe51⤵
- Executes dropped EXE
PID:2076 -
\??\c:\tnnntb.exec:\tnnntb.exe52⤵
- Executes dropped EXE
PID:2880 -
\??\c:\djjvj.exec:\djjvj.exe53⤵
- Executes dropped EXE
PID:1480 -
\??\c:\9jddj.exec:\9jddj.exe54⤵
- Executes dropped EXE
PID:1760 -
\??\c:\7lllrrf.exec:\7lllrrf.exe55⤵
- Executes dropped EXE
PID:1028 -
\??\c:\1bnthn.exec:\1bnthn.exe56⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3pdjj.exec:\3pdjj.exe57⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rlxflxx.exec:\rlxflxx.exe58⤵
- Executes dropped EXE
PID:1444 -
\??\c:\tnbbnn.exec:\tnbbnn.exe59⤵
- Executes dropped EXE
PID:1788 -
\??\c:\3hbhtb.exec:\3hbhtb.exe60⤵
- Executes dropped EXE
PID:408 -
\??\c:\pvvdd.exec:\pvvdd.exe61⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rlrxffr.exec:\rlrxffr.exe62⤵
- Executes dropped EXE
PID:1792 -
\??\c:\btnhtt.exec:\btnhtt.exe63⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jvpvj.exec:\jvpvj.exe64⤵
- Executes dropped EXE
PID:1292 -
\??\c:\9fflffl.exec:\9fflffl.exe65⤵
- Executes dropped EXE
PID:1716 -
\??\c:\7thnth.exec:\7thnth.exe66⤵PID:1516
-
\??\c:\vjvdj.exec:\vjvdj.exe67⤵PID:664
-
\??\c:\ddppd.exec:\ddppd.exe68⤵PID:2960
-
\??\c:\rfxxlrx.exec:\rfxxlrx.exe69⤵PID:2112
-
\??\c:\5bnbht.exec:\5bnbht.exe70⤵PID:992
-
\??\c:\vjdvv.exec:\vjdvv.exe71⤵PID:1320
-
\??\c:\3fflfff.exec:\3fflfff.exe72⤵PID:1956
-
\??\c:\thtnbb.exec:\thtnbb.exe73⤵PID:2260
-
\??\c:\5hbnth.exec:\5hbnth.exe74⤵PID:2692
-
\??\c:\ppddv.exec:\ppddv.exe75⤵PID:1560
-
\??\c:\rrxfxxf.exec:\rrxfxxf.exe76⤵PID:2800
-
\??\c:\nbhbbt.exec:\nbhbbt.exe77⤵PID:2812
-
\??\c:\vpjjp.exec:\vpjjp.exe78⤵PID:2820
-
\??\c:\rrlrfxr.exec:\rrlrfxr.exe79⤵PID:2668
-
\??\c:\1lffxlx.exec:\1lffxlx.exe80⤵PID:2808
-
\??\c:\bhhttt.exec:\bhhttt.exe81⤵PID:2664
-
\??\c:\3jjjv.exec:\3jjjv.exe82⤵PID:2560
-
\??\c:\xllfllr.exec:\xllfllr.exe83⤵PID:2624
-
\??\c:\xxrxrrf.exec:\xxrxrrf.exe84⤵PID:1660
-
\??\c:\nhbntb.exec:\nhbntb.exe85⤵PID:2672
-
\??\c:\pjvjd.exec:\pjvjd.exe86⤵PID:3052
-
\??\c:\ffxfllx.exec:\ffxfllx.exe87⤵PID:1996
-
\??\c:\9hbbhn.exec:\9hbbhn.exe88⤵PID:236
-
\??\c:\bnttbh.exec:\bnttbh.exe89⤵PID:2876
-
\??\c:\jvvdj.exec:\jvvdj.exe90⤵PID:1676
-
\??\c:\rfxfrrx.exec:\rfxfrrx.exe91⤵PID:2868
-
\??\c:\nhbhtt.exec:\nhbhtt.exe92⤵PID:2608
-
\??\c:\pdvpj.exec:\pdvpj.exe93⤵PID:2076
-
\??\c:\jvjdj.exec:\jvjdj.exe94⤵PID:2880
-
\??\c:\lrrxfll.exec:\lrrxfll.exe95⤵PID:1932
-
\??\c:\bbhnhn.exec:\bbhnhn.exe96⤵PID:1936
-
\??\c:\jjdjd.exec:\jjdjd.exe97⤵PID:1040
-
\??\c:\rxlxffr.exec:\rxlxffr.exe98⤵PID:2084
-
\??\c:\hhhbbn.exec:\hhhbbn.exe99⤵PID:1800
-
\??\c:\ntnthn.exec:\ntnthn.exe100⤵PID:1600
-
\??\c:\ppvjj.exec:\ppvjj.exe101⤵PID:1788
-
\??\c:\1xxrxfr.exec:\1xxrxfr.exe102⤵PID:1132
-
\??\c:\7htbtb.exec:\7htbtb.exe103⤵PID:1952
-
\??\c:\vppvd.exec:\vppvd.exe104⤵PID:1920
-
\??\c:\rfxllxl.exec:\rfxllxl.exe105⤵PID:2432
-
\??\c:\7lflxrx.exec:\7lflxrx.exe106⤵PID:2200
-
\??\c:\3nhntt.exec:\3nhntt.exe107⤵PID:2040
-
\??\c:\vjvpp.exec:\vjvpp.exe108⤵PID:2000
-
\??\c:\fxrfllf.exec:\fxrfllf.exe109⤵PID:2388
-
\??\c:\5frxllr.exec:\5frxllr.exe110⤵PID:2072
-
\??\c:\bnbnnt.exec:\bnbnnt.exe111⤵PID:2324
-
\??\c:\9hbhtt.exec:\9hbhtt.exe112⤵PID:2480
-
\??\c:\dpddd.exec:\dpddd.exe113⤵PID:2412
-
\??\c:\bbtbnt.exec:\bbtbnt.exe114⤵PID:3040
-
\??\c:\vvjvj.exec:\vvjvj.exe115⤵PID:2260
-
\??\c:\xrlxllx.exec:\xrlxllx.exe116⤵PID:2692
-
\??\c:\bnhnbb.exec:\bnhnbb.exe117⤵PID:2660
-
\??\c:\7dvdj.exec:\7dvdj.exe118⤵PID:2832
-
\??\c:\fffxlrr.exec:\fffxlrr.exe119⤵PID:2920
-
\??\c:\flrrfff.exec:\flrrfff.exe120⤵PID:2384
-
\??\c:\tnbnbb.exec:\tnbnbb.exe121⤵PID:1312
-
\??\c:\pjvjv.exec:\pjvjv.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-