Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 07:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
General
-
Target
bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe
-
Size
54KB
-
MD5
b811c51873a98c783ac102140f14a5db
-
SHA1
d2e5683d0e1771ce6b79a952bb3c410cd15e4651
-
SHA256
bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f
-
SHA512
69c42f8c50f39d15ef79033152e6fa27d246859b2d1c56d1a680e7b4f1dfb92755b0d63bdb824622d345f3e28117fa078b77d506b7313419d351fce3d59b50b3
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJV2:0cdpeeBSHHMHLf9RyIET2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2668-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1088-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/800-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-332-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-339-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-355-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-411-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-421-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-461-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-486-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-508-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-524-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-579-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-622-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-695-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-735-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-772-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-836-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-858-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-994-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-1133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-1209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-1216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-1473-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4772 44444.exe 1892 tnhtht.exe 1136 fxllfxx.exe 4944 nhhhnb.exe 216 htbthb.exe 3152 0066040.exe 624 jjppj.exe 1560 c482044.exe 3744 68060.exe 1620 84082.exe 2720 rfrxllx.exe 4116 g4488.exe 2352 08448.exe 3636 4482042.exe 4656 c288266.exe 2016 vvjpv.exe 4848 a2202.exe 1488 jjjpd.exe 5108 600482.exe 388 0882260.exe 5016 2226486.exe 2772 3hnbth.exe 2036 xxfxrrx.exe 1368 82220.exe 540 602204.exe 4856 fffrxrl.exe 1772 6282402.exe 3308 3jjvj.exe 1232 bttbhb.exe 912 jjjpv.exe 4600 m0648.exe 2028 pdpdd.exe 1288 86088.exe 3808 vdvdp.exe 2376 dvvvv.exe 2180 tbhtbt.exe 4468 pvpdp.exe 996 a2866.exe 1088 8006828.exe 3544 844826.exe 1824 lflxlxl.exe 4368 2004426.exe 3576 428220.exe 4312 jdvjv.exe 4000 448686.exe 4608 48200.exe 8 3nbttn.exe 1416 xffxlfr.exe 752 rrlxlfr.exe 2524 7jjdd.exe 3328 8842048.exe 2024 3nhthh.exe 856 2048648.exe 4128 s6882.exe 2432 60040.exe 1136 0664604.exe 4944 42422.exe 1048 40884.exe 2880 688640.exe 880 20604.exe 3064 q26462.exe 4252 rfflxrl.exe 4056 a2842.exe 2008 6060088.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2448.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s0264.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2064868.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26642.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2660482.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 266486.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lfxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2668 wrote to memory of 4772 2668 bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe 83 PID 2668 wrote to memory of 4772 2668 bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe 83 PID 2668 wrote to memory of 4772 2668 bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe 83 PID 4772 wrote to memory of 1892 4772 44444.exe 84 PID 4772 wrote to memory of 1892 4772 44444.exe 84 PID 4772 wrote to memory of 1892 4772 44444.exe 84 PID 1892 wrote to memory of 1136 1892 tnhtht.exe 85 PID 1892 wrote to memory of 1136 1892 tnhtht.exe 85 PID 1892 wrote to memory of 1136 1892 tnhtht.exe 85 PID 1136 wrote to memory of 4944 1136 fxllfxx.exe 86 PID 1136 wrote to memory of 4944 1136 fxllfxx.exe 86 PID 1136 wrote to memory of 4944 1136 fxllfxx.exe 86 PID 4944 wrote to memory of 216 4944 nhhhnb.exe 87 PID 4944 wrote to memory of 216 4944 nhhhnb.exe 87 PID 4944 wrote to memory of 216 4944 nhhhnb.exe 87 PID 216 wrote to memory of 3152 216 htbthb.exe 88 PID 216 wrote to memory of 3152 216 htbthb.exe 88 PID 216 wrote to memory of 3152 216 htbthb.exe 88 PID 3152 wrote to memory of 624 3152 0066040.exe 89 PID 3152 wrote to memory of 624 3152 0066040.exe 89 PID 3152 wrote to memory of 624 3152 0066040.exe 89 PID 624 wrote to memory of 1560 624 jjppj.exe 90 PID 624 wrote to memory of 1560 624 jjppj.exe 90 PID 624 wrote to memory of 1560 624 jjppj.exe 90 PID 1560 wrote to memory of 3744 1560 c482044.exe 91 PID 1560 wrote to memory of 3744 1560 c482044.exe 91 PID 1560 wrote to memory of 3744 1560 c482044.exe 91 PID 3744 wrote to memory of 1620 3744 68060.exe 92 PID 3744 wrote to memory of 1620 3744 68060.exe 92 PID 3744 wrote to memory of 1620 3744 68060.exe 92 PID 1620 wrote to memory of 2720 1620 84082.exe 93 PID 1620 wrote to memory of 2720 1620 84082.exe 93 PID 1620 wrote to memory of 2720 1620 84082.exe 93 PID 2720 wrote to memory of 4116 2720 rfrxllx.exe 94 PID 2720 wrote to memory of 4116 2720 rfrxllx.exe 94 PID 2720 wrote to memory of 4116 2720 rfrxllx.exe 94 PID 4116 wrote to memory of 2352 4116 g4488.exe 95 PID 4116 wrote to memory of 2352 4116 g4488.exe 95 PID 4116 wrote to memory of 2352 4116 g4488.exe 95 PID 2352 wrote to memory of 3636 2352 08448.exe 96 PID 2352 wrote to memory of 3636 2352 08448.exe 96 PID 2352 wrote to memory of 3636 2352 08448.exe 96 PID 3636 wrote to memory of 4656 3636 4482042.exe 97 PID 3636 wrote to memory of 4656 3636 4482042.exe 97 PID 3636 wrote to memory of 4656 3636 4482042.exe 97 PID 4656 wrote to memory of 2016 4656 c288266.exe 98 PID 4656 wrote to memory of 2016 4656 c288266.exe 98 PID 4656 wrote to memory of 2016 4656 c288266.exe 98 PID 2016 wrote to memory of 4848 2016 vvjpv.exe 99 PID 2016 wrote to memory of 4848 2016 vvjpv.exe 99 PID 2016 wrote to memory of 4848 2016 vvjpv.exe 99 PID 4848 wrote to memory of 1488 4848 a2202.exe 100 PID 4848 wrote to memory of 1488 4848 a2202.exe 100 PID 4848 wrote to memory of 1488 4848 a2202.exe 100 PID 1488 wrote to memory of 5108 1488 jjjpd.exe 101 PID 1488 wrote to memory of 5108 1488 jjjpd.exe 101 PID 1488 wrote to memory of 5108 1488 jjjpd.exe 101 PID 5108 wrote to memory of 388 5108 600482.exe 102 PID 5108 wrote to memory of 388 5108 600482.exe 102 PID 5108 wrote to memory of 388 5108 600482.exe 102 PID 388 wrote to memory of 5016 388 0882260.exe 103 PID 388 wrote to memory of 5016 388 0882260.exe 103 PID 388 wrote to memory of 5016 388 0882260.exe 103 PID 5016 wrote to memory of 2772 5016 2226486.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe"C:\Users\Admin\AppData\Local\Temp\bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\44444.exec:\44444.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\tnhtht.exec:\tnhtht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\fxllfxx.exec:\fxllfxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\nhhhnb.exec:\nhhhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\htbthb.exec:\htbthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\0066040.exec:\0066040.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\jjppj.exec:\jjppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\c482044.exec:\c482044.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\68060.exec:\68060.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\84082.exec:\84082.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\rfrxllx.exec:\rfrxllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\g4488.exec:\g4488.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\08448.exec:\08448.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\4482042.exec:\4482042.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\c288266.exec:\c288266.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\vvjpv.exec:\vvjpv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\a2202.exec:\a2202.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\jjjpd.exec:\jjjpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\600482.exec:\600482.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\0882260.exec:\0882260.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\2226486.exec:\2226486.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\3hnbth.exec:\3hnbth.exe23⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xxfxrrx.exec:\xxfxrrx.exe24⤵
- Executes dropped EXE
PID:2036 -
\??\c:\82220.exec:\82220.exe25⤵
- Executes dropped EXE
PID:1368 -
\??\c:\602204.exec:\602204.exe26⤵
- Executes dropped EXE
PID:540 -
\??\c:\fffrxrl.exec:\fffrxrl.exe27⤵
- Executes dropped EXE
PID:4856 -
\??\c:\6282402.exec:\6282402.exe28⤵
- Executes dropped EXE
PID:1772 -
\??\c:\3jjvj.exec:\3jjvj.exe29⤵
- Executes dropped EXE
PID:3308 -
\??\c:\bttbhb.exec:\bttbhb.exe30⤵
- Executes dropped EXE
PID:1232 -
\??\c:\jjjpv.exec:\jjjpv.exe31⤵
- Executes dropped EXE
PID:912 -
\??\c:\m0648.exec:\m0648.exe32⤵
- Executes dropped EXE
PID:4600 -
\??\c:\pdpdd.exec:\pdpdd.exe33⤵
- Executes dropped EXE
PID:2028 -
\??\c:\86088.exec:\86088.exe34⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vdvdp.exec:\vdvdp.exe35⤵
- Executes dropped EXE
PID:3808 -
\??\c:\dvvvv.exec:\dvvvv.exe36⤵
- Executes dropped EXE
PID:2376 -
\??\c:\tbhtbt.exec:\tbhtbt.exe37⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pvpdp.exec:\pvpdp.exe38⤵
- Executes dropped EXE
PID:4468 -
\??\c:\a2866.exec:\a2866.exe39⤵
- Executes dropped EXE
PID:996 -
\??\c:\8006828.exec:\8006828.exe40⤵
- Executes dropped EXE
PID:1088 -
\??\c:\844826.exec:\844826.exe41⤵
- Executes dropped EXE
PID:3544 -
\??\c:\lflxlxl.exec:\lflxlxl.exe42⤵
- Executes dropped EXE
PID:1824 -
\??\c:\2004426.exec:\2004426.exe43⤵
- Executes dropped EXE
PID:4368 -
\??\c:\428220.exec:\428220.exe44⤵
- Executes dropped EXE
PID:3576 -
\??\c:\jdvjv.exec:\jdvjv.exe45⤵
- Executes dropped EXE
PID:4312 -
\??\c:\448686.exec:\448686.exe46⤵
- Executes dropped EXE
PID:4000 -
\??\c:\48200.exec:\48200.exe47⤵
- Executes dropped EXE
PID:4608 -
\??\c:\3nbttn.exec:\3nbttn.exe48⤵
- Executes dropped EXE
PID:8 -
\??\c:\xffxlfr.exec:\xffxlfr.exe49⤵
- Executes dropped EXE
PID:1416 -
\??\c:\rrlxlfr.exec:\rrlxlfr.exe50⤵
- Executes dropped EXE
PID:752 -
\??\c:\7jjdd.exec:\7jjdd.exe51⤵
- Executes dropped EXE
PID:2524 -
\??\c:\8842048.exec:\8842048.exe52⤵
- Executes dropped EXE
PID:3328 -
\??\c:\4408208.exec:\4408208.exe53⤵PID:4784
-
\??\c:\3nhthh.exec:\3nhthh.exe54⤵
- Executes dropped EXE
PID:2024 -
\??\c:\2048648.exec:\2048648.exe55⤵
- Executes dropped EXE
PID:856 -
\??\c:\s6882.exec:\s6882.exe56⤵
- Executes dropped EXE
PID:4128 -
\??\c:\60040.exec:\60040.exe57⤵
- Executes dropped EXE
PID:2432 -
\??\c:\0664604.exec:\0664604.exe58⤵
- Executes dropped EXE
PID:1136 -
\??\c:\42422.exec:\42422.exe59⤵
- Executes dropped EXE
PID:4944 -
\??\c:\40884.exec:\40884.exe60⤵
- Executes dropped EXE
PID:1048 -
\??\c:\688640.exec:\688640.exe61⤵
- Executes dropped EXE
PID:2880 -
\??\c:\20604.exec:\20604.exe62⤵
- Executes dropped EXE
PID:880 -
\??\c:\q26462.exec:\q26462.exe63⤵
- Executes dropped EXE
PID:3064 -
\??\c:\rfflxrl.exec:\rfflxrl.exe64⤵
- Executes dropped EXE
PID:4252 -
\??\c:\a2842.exec:\a2842.exe65⤵
- Executes dropped EXE
PID:4056 -
\??\c:\6060088.exec:\6060088.exe66⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nhthbt.exec:\nhthbt.exe67⤵PID:3840
-
\??\c:\600428.exec:\600428.exe68⤵PID:800
-
\??\c:\rrxlxlx.exec:\rrxlxlx.exe69⤵PID:740
-
\??\c:\066082.exec:\066082.exe70⤵PID:2448
-
\??\c:\20044.exec:\20044.exe71⤵PID:448
-
\??\c:\48482.exec:\48482.exe72⤵PID:1400
-
\??\c:\68820.exec:\68820.exe73⤵PID:4356
-
\??\c:\o660426.exec:\o660426.exe74⤵PID:2224
-
\??\c:\nhtnht.exec:\nhtnht.exe75⤵PID:3452
-
\??\c:\044882.exec:\044882.exe76⤵PID:4508
-
\??\c:\9rxrrrr.exec:\9rxrrrr.exe77⤵PID:3456
-
\??\c:\w22644.exec:\w22644.exe78⤵PID:4812
-
\??\c:\xlrllfr.exec:\xlrllfr.exe79⤵PID:4256
-
\??\c:\nnnhbt.exec:\nnnhbt.exe80⤵PID:3784
-
\??\c:\o000264.exec:\o000264.exe81⤵PID:2084
-
\??\c:\jdjvj.exec:\jdjvj.exe82⤵PID:1116
-
\??\c:\206488.exec:\206488.exe83⤵PID:3068
-
\??\c:\9djdv.exec:\9djdv.exe84⤵PID:2312
-
\??\c:\204882.exec:\204882.exe85⤵PID:4052
-
\??\c:\824226.exec:\824226.exe86⤵PID:4048
-
\??\c:\7rxrfxl.exec:\7rxrfxl.exe87⤵PID:1104
-
\??\c:\228864.exec:\228864.exe88⤵PID:3196
-
\??\c:\1bbbbb.exec:\1bbbbb.exe89⤵PID:4080
-
\??\c:\bnnbbt.exec:\bnnbbt.exe90⤵PID:2856
-
\??\c:\nbnhtb.exec:\nbnhtb.exe91⤵PID:4280
-
\??\c:\pvdpj.exec:\pvdpj.exe92⤵PID:4196
-
\??\c:\rllxfxr.exec:\rllxfxr.exe93⤵PID:4820
-
\??\c:\644860.exec:\644860.exe94⤵PID:428
-
\??\c:\dpppj.exec:\dpppj.exe95⤵PID:3568
-
\??\c:\tnhthb.exec:\tnhthb.exe96⤵PID:936
-
\??\c:\6400808.exec:\6400808.exe97⤵PID:4880
-
\??\c:\3tnhth.exec:\3tnhth.exe98⤵PID:1712
-
\??\c:\u622600.exec:\u622600.exe99⤵PID:664
-
\??\c:\68868.exec:\68868.exe100⤵PID:1668
-
\??\c:\28482.exec:\28482.exe101⤵PID:2404
-
\??\c:\nhhtbt.exec:\nhhtbt.exe102⤵PID:4640
-
\??\c:\7lxlrxr.exec:\7lxlrxr.exe103⤵PID:2596
-
\??\c:\dpjdp.exec:\dpjdp.exe104⤵PID:4868
-
\??\c:\040480.exec:\040480.exe105⤵PID:3740
-
\??\c:\428260.exec:\428260.exe106⤵PID:1968
-
\??\c:\42826.exec:\42826.exe107⤵PID:1824
-
\??\c:\48260.exec:\48260.exe108⤵PID:4368
-
\??\c:\266486.exec:\266486.exe109⤵
- System Location Discovery: System Language Discovery
PID:1864 -
\??\c:\pppjd.exec:\pppjd.exe110⤵PID:3580
-
\??\c:\4048204.exec:\4048204.exe111⤵PID:2632
-
\??\c:\i204044.exec:\i204044.exe112⤵PID:1220
-
\??\c:\084460.exec:\084460.exe113⤵PID:2604
-
\??\c:\hthtnb.exec:\hthtnb.exe114⤵PID:1384
-
\??\c:\dppjj.exec:\dppjj.exe115⤵PID:2900
-
\??\c:\xrrrffx.exec:\xrrrffx.exe116⤵PID:2732
-
\??\c:\hntthb.exec:\hntthb.exe117⤵PID:4348
-
\??\c:\888800.exec:\888800.exe118⤵PID:4524
-
\??\c:\rrrlxrf.exec:\rrrlxrf.exe119⤵PID:4828
-
\??\c:\c660004.exec:\c660004.exe120⤵PID:548
-
\??\c:\08044.exec:\08044.exe121⤵PID:4700
-
\??\c:\hntbhb.exec:\hntbhb.exe122⤵PID:2392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-