Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 07:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492bN.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492bN.exe
-
Size
54KB
-
MD5
c45df4ea0a871798ae849a406b09a740
-
SHA1
251f7c076c33504ba80f0f4d10cb97388a89f1e1
-
SHA256
801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492b
-
SHA512
89979745d22016cafa244dcd62d18d471c4413f3daf9375769f2db0bc817ebb94ac99ae581612d00a7ea264da3f74d8cc6a6b81715b842d439023ccddac7f22c
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJVC:0cdpeeBSHHMHLf9RyIETC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2368-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3820-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-326-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-350-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-364-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-398-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-444-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-469-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-485-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-492-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-503-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-509-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-519-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-556-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-578-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-606-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-625-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-684-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-709-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-722-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-726-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-895-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-1452-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-1699-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1208 jpvpj.exe 4616 9dppj.exe 4596 flffxxx.exe 4164 hhnbtb.exe 2152 nhnhnn.exe 1344 vvppd.exe 1356 5fffxxr.exe 3140 tnbtbb.exe 1612 ddpjp.exe 3048 9lrlrxx.exe 220 lffxxxr.exe 5012 bntttt.exe 4132 dvvpp.exe 4500 vjvjp.exe 1884 3llfxxr.exe 4336 thhnnh.exe 2744 dvjvp.exe 2332 rllfxxr.exe 4976 ppdpp.exe 2156 vjvvd.exe 2664 fxxrllf.exe 4084 lfffrfl.exe 1220 hhhbbt.exe 4992 vpppv.exe 5088 hhhnnt.exe 3820 jddvj.exe 4556 1jjdv.exe 4688 5llfxxr.exe 4344 bntnhh.exe 316 tbnnbb.exe 3212 3dppv.exe 2528 vpdpj.exe 3076 llflllf.exe 3672 hnnhhb.exe 3612 djdvj.exe 764 7pjvp.exe 4200 rfrrlxr.exe 4216 nnttnh.exe 1572 bhhbnh.exe 1652 vppdd.exe 2688 vpvpj.exe 2132 fxxrfrl.exe 4368 7nbnbb.exe 4300 hhhhhh.exe 4736 pdvvp.exe 3100 5rxlrlf.exe 1772 tbbbtb.exe 3416 jddvj.exe 3976 nbnhbt.exe 4484 pdjdd.exe 3596 pvdvp.exe 3560 xxrrrrr.exe 3196 nhnnhh.exe 3240 htthtt.exe 2168 3nhhtn.exe 2376 dppjv.exe 2632 dvdvp.exe 1080 5flrffx.exe 2152 nbbtnn.exe 1100 nhnhtt.exe 2364 ppjdd.exe 2344 3rxrrrr.exe 5004 bbbthb.exe 348 ttthbb.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1208 2368 801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492bN.exe 82 PID 2368 wrote to memory of 1208 2368 801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492bN.exe 82 PID 2368 wrote to memory of 1208 2368 801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492bN.exe 82 PID 1208 wrote to memory of 4616 1208 jpvpj.exe 83 PID 1208 wrote to memory of 4616 1208 jpvpj.exe 83 PID 1208 wrote to memory of 4616 1208 jpvpj.exe 83 PID 4616 wrote to memory of 4596 4616 9dppj.exe 84 PID 4616 wrote to memory of 4596 4616 9dppj.exe 84 PID 4616 wrote to memory of 4596 4616 9dppj.exe 84 PID 4596 wrote to memory of 4164 4596 flffxxx.exe 85 PID 4596 wrote to memory of 4164 4596 flffxxx.exe 85 PID 4596 wrote to memory of 4164 4596 flffxxx.exe 85 PID 4164 wrote to memory of 2152 4164 hhnbtb.exe 86 PID 4164 wrote to memory of 2152 4164 hhnbtb.exe 86 PID 4164 wrote to memory of 2152 4164 hhnbtb.exe 86 PID 2152 wrote to memory of 1344 2152 nhnhnn.exe 87 PID 2152 wrote to memory of 1344 2152 nhnhnn.exe 87 PID 2152 wrote to memory of 1344 2152 nhnhnn.exe 87 PID 1344 wrote to memory of 1356 1344 vvppd.exe 88 PID 1344 wrote to memory of 1356 1344 vvppd.exe 88 PID 1344 wrote to memory of 1356 1344 vvppd.exe 88 PID 1356 wrote to memory of 3140 1356 5fffxxr.exe 89 PID 1356 wrote to memory of 3140 1356 5fffxxr.exe 89 PID 1356 wrote to memory of 3140 1356 5fffxxr.exe 89 PID 3140 wrote to memory of 1612 3140 tnbtbb.exe 90 PID 3140 wrote to memory of 1612 3140 tnbtbb.exe 90 PID 3140 wrote to memory of 1612 3140 tnbtbb.exe 90 PID 1612 wrote to memory of 3048 1612 ddpjp.exe 91 PID 1612 wrote to memory of 3048 1612 ddpjp.exe 91 PID 1612 wrote to memory of 3048 1612 ddpjp.exe 91 PID 3048 wrote to memory of 220 3048 9lrlrxx.exe 92 PID 3048 wrote to memory of 220 3048 9lrlrxx.exe 92 PID 3048 wrote to memory of 220 3048 9lrlrxx.exe 92 PID 220 wrote to memory of 5012 220 lffxxxr.exe 93 PID 220 wrote to memory of 5012 220 lffxxxr.exe 93 PID 220 wrote to memory of 5012 220 lffxxxr.exe 93 PID 5012 wrote to memory of 4132 5012 bntttt.exe 94 PID 5012 wrote to memory of 4132 5012 bntttt.exe 94 PID 5012 wrote to memory of 4132 5012 bntttt.exe 94 PID 4132 wrote to memory of 4500 4132 dvvpp.exe 95 PID 4132 wrote to memory of 4500 4132 dvvpp.exe 95 PID 4132 wrote to memory of 4500 4132 dvvpp.exe 95 PID 4500 wrote to memory of 1884 4500 vjvjp.exe 96 PID 4500 wrote to memory of 1884 4500 vjvjp.exe 96 PID 4500 wrote to memory of 1884 4500 vjvjp.exe 96 PID 1884 wrote to memory of 4336 1884 3llfxxr.exe 97 PID 1884 wrote to memory of 4336 1884 3llfxxr.exe 97 PID 1884 wrote to memory of 4336 1884 3llfxxr.exe 97 PID 4336 wrote to memory of 2744 4336 thhnnh.exe 98 PID 4336 wrote to memory of 2744 4336 thhnnh.exe 98 PID 4336 wrote to memory of 2744 4336 thhnnh.exe 98 PID 2744 wrote to memory of 2332 2744 dvjvp.exe 99 PID 2744 wrote to memory of 2332 2744 dvjvp.exe 99 PID 2744 wrote to memory of 2332 2744 dvjvp.exe 99 PID 2332 wrote to memory of 4976 2332 rllfxxr.exe 100 PID 2332 wrote to memory of 4976 2332 rllfxxr.exe 100 PID 2332 wrote to memory of 4976 2332 rllfxxr.exe 100 PID 4976 wrote to memory of 2156 4976 ppdpp.exe 101 PID 4976 wrote to memory of 2156 4976 ppdpp.exe 101 PID 4976 wrote to memory of 2156 4976 ppdpp.exe 101 PID 2156 wrote to memory of 2664 2156 vjvvd.exe 102 PID 2156 wrote to memory of 2664 2156 vjvvd.exe 102 PID 2156 wrote to memory of 2664 2156 vjvvd.exe 102 PID 2664 wrote to memory of 4084 2664 fxxrllf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492bN.exe"C:\Users\Admin\AppData\Local\Temp\801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\jpvpj.exec:\jpvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\9dppj.exec:\9dppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\flffxxx.exec:\flffxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\hhnbtb.exec:\hhnbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\nhnhnn.exec:\nhnhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\vvppd.exec:\vvppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\5fffxxr.exec:\5fffxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\tnbtbb.exec:\tnbtbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\ddpjp.exec:\ddpjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\9lrlrxx.exec:\9lrlrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\lffxxxr.exec:\lffxxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\bntttt.exec:\bntttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\dvvpp.exec:\dvvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\vjvjp.exec:\vjvjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\3llfxxr.exec:\3llfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\thhnnh.exec:\thhnnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\dvjvp.exec:\dvjvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\rllfxxr.exec:\rllfxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\ppdpp.exec:\ppdpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\vjvvd.exec:\vjvvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\fxxrllf.exec:\fxxrllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\lfffrfl.exec:\lfffrfl.exe23⤵
- Executes dropped EXE
PID:4084 -
\??\c:\hhhbbt.exec:\hhhbbt.exe24⤵
- Executes dropped EXE
PID:1220 -
\??\c:\vpppv.exec:\vpppv.exe25⤵
- Executes dropped EXE
PID:4992 -
\??\c:\hhhnnt.exec:\hhhnnt.exe26⤵
- Executes dropped EXE
PID:5088 -
\??\c:\jddvj.exec:\jddvj.exe27⤵
- Executes dropped EXE
PID:3820 -
\??\c:\1jjdv.exec:\1jjdv.exe28⤵
- Executes dropped EXE
PID:4556 -
\??\c:\5llfxxr.exec:\5llfxxr.exe29⤵
- Executes dropped EXE
PID:4688 -
\??\c:\bntnhh.exec:\bntnhh.exe30⤵
- Executes dropped EXE
PID:4344 -
\??\c:\tbnnbb.exec:\tbnnbb.exe31⤵
- Executes dropped EXE
PID:316 -
\??\c:\3dppv.exec:\3dppv.exe32⤵
- Executes dropped EXE
PID:3212 -
\??\c:\vpdpj.exec:\vpdpj.exe33⤵
- Executes dropped EXE
PID:2528 -
\??\c:\llflllf.exec:\llflllf.exe34⤵
- Executes dropped EXE
PID:3076 -
\??\c:\hnnhhb.exec:\hnnhhb.exe35⤵
- Executes dropped EXE
PID:3672 -
\??\c:\djdvj.exec:\djdvj.exe36⤵
- Executes dropped EXE
PID:3612 -
\??\c:\7pjvp.exec:\7pjvp.exe37⤵
- Executes dropped EXE
PID:764 -
\??\c:\rfrrlxr.exec:\rfrrlxr.exe38⤵
- Executes dropped EXE
PID:4200 -
\??\c:\nnttnh.exec:\nnttnh.exe39⤵
- Executes dropped EXE
PID:4216 -
\??\c:\bhhbnh.exec:\bhhbnh.exe40⤵
- Executes dropped EXE
PID:1572 -
\??\c:\vppdd.exec:\vppdd.exe41⤵
- Executes dropped EXE
PID:1652 -
\??\c:\vpvpj.exec:\vpvpj.exe42⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fxxrfrl.exec:\fxxrfrl.exe43⤵
- Executes dropped EXE
PID:2132 -
\??\c:\7nbnbb.exec:\7nbnbb.exe44⤵
- Executes dropped EXE
PID:4368 -
\??\c:\hhhhhh.exec:\hhhhhh.exe45⤵
- Executes dropped EXE
PID:4300 -
\??\c:\pdvvp.exec:\pdvvp.exe46⤵
- Executes dropped EXE
PID:4736 -
\??\c:\5rxlrlf.exec:\5rxlrlf.exe47⤵
- Executes dropped EXE
PID:3100 -
\??\c:\tbbbtb.exec:\tbbbtb.exe48⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jddvj.exec:\jddvj.exe49⤵
- Executes dropped EXE
PID:3416 -
\??\c:\nbnhbt.exec:\nbnhbt.exe50⤵
- Executes dropped EXE
PID:3976 -
\??\c:\pdjdd.exec:\pdjdd.exe51⤵
- Executes dropped EXE
PID:4484 -
\??\c:\pvdvp.exec:\pvdvp.exe52⤵
- Executes dropped EXE
PID:3596 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe53⤵
- Executes dropped EXE
PID:3560 -
\??\c:\nhnnhh.exec:\nhnnhh.exe54⤵
- Executes dropped EXE
PID:3196 -
\??\c:\htthtt.exec:\htthtt.exe55⤵
- Executes dropped EXE
PID:3240 -
\??\c:\3nhhtn.exec:\3nhhtn.exe56⤵
- Executes dropped EXE
PID:2168 -
\??\c:\dppjv.exec:\dppjv.exe57⤵
- Executes dropped EXE
PID:2376 -
\??\c:\dvdvp.exec:\dvdvp.exe58⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5flrffx.exec:\5flrffx.exe59⤵
- Executes dropped EXE
PID:1080 -
\??\c:\nbbtnn.exec:\nbbtnn.exe60⤵
- Executes dropped EXE
PID:2152 -
\??\c:\nhnhtt.exec:\nhnhtt.exe61⤵
- Executes dropped EXE
PID:1100 -
\??\c:\ppjdd.exec:\ppjdd.exe62⤵
- Executes dropped EXE
PID:2364 -
\??\c:\3rxrrrr.exec:\3rxrrrr.exe63⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bbbthb.exec:\bbbthb.exe64⤵
- Executes dropped EXE
PID:5004 -
\??\c:\ttthbb.exec:\ttthbb.exe65⤵
- Executes dropped EXE
PID:348 -
\??\c:\jvpjv.exec:\jvpjv.exe66⤵PID:3972
-
\??\c:\vvvjv.exec:\vvvjv.exe67⤵PID:776
-
\??\c:\lxrlflf.exec:\lxrlflf.exe68⤵PID:4632
-
\??\c:\5nnhbb.exec:\5nnhbb.exe69⤵PID:3756
-
\??\c:\btbthh.exec:\btbthh.exe70⤵PID:3320
-
\??\c:\vvjdj.exec:\vvjdj.exe71⤵PID:4560
-
\??\c:\dpdvj.exec:\dpdvj.exe72⤵PID:4116
-
\??\c:\9vdvp.exec:\9vdvp.exe73⤵
- System Location Discovery: System Language Discovery
PID:4612 -
\??\c:\rrlrfrr.exec:\rrlrfrr.exe74⤵PID:3408
-
\??\c:\bttnbb.exec:\bttnbb.exe75⤵PID:4008
-
\??\c:\xxfrfxl.exec:\xxfrfxl.exe76⤵PID:5020
-
\??\c:\lrxxxxr.exec:\lrxxxxr.exe77⤵PID:4680
-
\??\c:\3hnhnh.exec:\3hnhnh.exe78⤵PID:2536
-
\??\c:\7pvvp.exec:\7pvvp.exe79⤵PID:5096
-
\??\c:\vvppj.exec:\vvppj.exe80⤵PID:672
-
\??\c:\xfrllfx.exec:\xfrllfx.exe81⤵PID:3284
-
\??\c:\hhtnhn.exec:\hhtnhn.exe82⤵PID:4380
-
\??\c:\ttttnn.exec:\ttttnn.exe83⤵PID:5084
-
\??\c:\pjddd.exec:\pjddd.exe84⤵PID:1116
-
\??\c:\lffxlfl.exec:\lffxlfl.exe85⤵PID:3872
-
\??\c:\rrllffx.exec:\rrllffx.exe86⤵PID:4708
-
\??\c:\9nbbhh.exec:\9nbbhh.exe87⤵PID:3696
-
\??\c:\5pvvp.exec:\5pvvp.exe88⤵PID:2524
-
\??\c:\1vdvp.exec:\1vdvp.exe89⤵PID:3892
-
\??\c:\xrxxfff.exec:\xrxxfff.exe90⤵PID:1136
-
\??\c:\frxxrrl.exec:\frxxrrl.exe91⤵PID:468
-
\??\c:\hbbttn.exec:\hbbttn.exe92⤵PID:1272
-
\??\c:\vjvvp.exec:\vjvvp.exe93⤵PID:4136
-
\??\c:\9pvvp.exec:\9pvvp.exe94⤵PID:3388
-
\??\c:\3vvpd.exec:\3vvpd.exe95⤵PID:5100
-
\??\c:\rxxrllr.exec:\rxxrllr.exe96⤵PID:1328
-
\??\c:\3bbbbt.exec:\3bbbbt.exe97⤵PID:2144
-
\??\c:\htnnhh.exec:\htnnhh.exe98⤵PID:5064
-
\??\c:\vpdvv.exec:\vpdvv.exe99⤵
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\lrrrfff.exec:\lrrrfff.exe100⤵PID:3076
-
\??\c:\1lrlffx.exec:\1lrlffx.exe101⤵PID:3968
-
\??\c:\hbhnhh.exec:\hbhnhh.exe102⤵PID:3612
-
\??\c:\nhbhhh.exec:\nhbhhh.exe103⤵PID:3580
-
\??\c:\5pddd.exec:\5pddd.exe104⤵PID:4236
-
\??\c:\jjvdd.exec:\jjvdd.exe105⤵PID:1864
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe106⤵PID:2096
-
\??\c:\lrrllll.exec:\lrrllll.exe107⤵PID:4548
-
\??\c:\nnnhbb.exec:\nnnhbb.exe108⤵PID:4032
-
\??\c:\jpppd.exec:\jpppd.exe109⤵PID:2348
-
\??\c:\7vvvp.exec:\7vvvp.exe110⤵PID:2132
-
\??\c:\fxxffrl.exec:\fxxffrl.exe111⤵PID:3028
-
\??\c:\lrxrffx.exec:\lrxrffx.exe112⤵PID:1312
-
\??\c:\7hbtbb.exec:\7hbtbb.exe113⤵PID:112
-
\??\c:\nnhhtt.exec:\nnhhtt.exe114⤵PID:2816
-
\??\c:\dpvpj.exec:\dpvpj.exe115⤵PID:5112
-
\??\c:\xxrfllx.exec:\xxrfllx.exe116⤵PID:2924
-
\??\c:\rlrrlrl.exec:\rlrrlrl.exe117⤵PID:32
-
\??\c:\7hbbbh.exec:\7hbbbh.exe118⤵PID:2352
-
\??\c:\ntbthh.exec:\ntbthh.exe119⤵PID:4228
-
\??\c:\ddpvd.exec:\ddpvd.exe120⤵PID:1208
-
\??\c:\xxxrrlf.exec:\xxxrrlf.exe121⤵PID:3952
-
\??\c:\lrlllfr.exec:\lrlllfr.exe122⤵PID:4572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-