Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c5456a45cf87ada0ffc530c869e5c425e5854ef8e2e5eecf365acb72953c70d4N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c5456a45cf87ada0ffc530c869e5c425e5854ef8e2e5eecf365acb72953c70d4N.exe
-
Size
61KB
-
MD5
84a0d2aa6daa8e13784130804b9b0e80
-
SHA1
50fc13c6250ebdfe5a089be058a9a9b7f02a0f1f
-
SHA256
c5456a45cf87ada0ffc530c869e5c425e5854ef8e2e5eecf365acb72953c70d4
-
SHA512
0ccf8b0fc7aeb5d8548eb9cf45e8aac8a122aefd62c7326baa9a084455aeef19b99176283a2fc268b7105b37bd9b3edd8642cf4cc8130dad29c24c27690b2d53
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFaEubr9F:ymb3NkkiQ3mdBjFIvIFaEeF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/3520-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/708-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2544 hbhhnn.exe 2620 1vddv.exe 4024 ffxxfll.exe 3900 9bhbtt.exe 116 jdjpp.exe 4528 ffxxxll.exe 4792 bthhtt.exe 1508 pvjpv.exe 3256 tbnbbt.exe 400 ddjjj.exe 4100 5lfxrrr.exe 3480 tnnhhb.exe 3532 jvdjj.exe 3632 jjppj.exe 2692 5xflfxx.exe 1020 nhnhbb.exe 3400 ddjdp.exe 4648 lrrlrrf.exe 844 llxxrxx.exe 5104 5bnnnn.exe 4756 jjvdv.exe 3512 5xxrlll.exe 4196 5hhhbb.exe 4828 pdjdv.exe 708 pvjvp.exe 1476 xrfrlrr.exe 2944 bntnbt.exe 3036 5pjjd.exe 4964 rllrllx.exe 4504 9fllfff.exe 2548 7hnnhn.exe 4836 vjjdv.exe 4980 7flllll.exe 4444 hhhhhh.exe 4676 nbnhbb.exe 3624 pdddv.exe 2444 fflxrll.exe 1912 3nnnhb.exe 2308 thnhbb.exe 3556 vjpvp.exe 1648 ddddv.exe 4344 rflfxrf.exe 3004 hhbhhn.exe 5008 7vjjj.exe 2936 fxlfxrf.exe 1944 btbbnn.exe 4516 jvvpj.exe 2204 ffxrllf.exe 1504 rrrlllr.exe 3560 hbhttt.exe 3580 vdjjj.exe 4860 3pvpd.exe 2160 7lllxll.exe 4528 xrxffff.exe 5084 tnhhhh.exe 184 ppddv.exe 2312 fxxflll.exe 436 lxlfffx.exe 696 5tbbtt.exe 536 pjppv.exe 3948 pjjdv.exe 3056 rfrrxrf.exe 3532 9lrlffr.exe 2976 nhbthh.exe -
resource yara_rule behavioral2/memory/3520-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/708-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3520 wrote to memory of 2544 3520 c5456a45cf87ada0ffc530c869e5c425e5854ef8e2e5eecf365acb72953c70d4N.exe 83 PID 3520 wrote to memory of 2544 3520 c5456a45cf87ada0ffc530c869e5c425e5854ef8e2e5eecf365acb72953c70d4N.exe 83 PID 3520 wrote to memory of 2544 3520 c5456a45cf87ada0ffc530c869e5c425e5854ef8e2e5eecf365acb72953c70d4N.exe 83 PID 2544 wrote to memory of 2620 2544 hbhhnn.exe 84 PID 2544 wrote to memory of 2620 2544 hbhhnn.exe 84 PID 2544 wrote to memory of 2620 2544 hbhhnn.exe 84 PID 2620 wrote to memory of 4024 2620 1vddv.exe 85 PID 2620 wrote to memory of 4024 2620 1vddv.exe 85 PID 2620 wrote to memory of 4024 2620 1vddv.exe 85 PID 4024 wrote to memory of 3900 4024 ffxxfll.exe 86 PID 4024 wrote to memory of 3900 4024 ffxxfll.exe 86 PID 4024 wrote to memory of 3900 4024 ffxxfll.exe 86 PID 3900 wrote to memory of 116 3900 9bhbtt.exe 87 PID 3900 wrote to memory of 116 3900 9bhbtt.exe 87 PID 3900 wrote to memory of 116 3900 9bhbtt.exe 87 PID 116 wrote to memory of 4528 116 jdjpp.exe 88 PID 116 wrote to memory of 4528 116 jdjpp.exe 88 PID 116 wrote to memory of 4528 116 jdjpp.exe 88 PID 4528 wrote to memory of 4792 4528 ffxxxll.exe 89 PID 4528 wrote to memory of 4792 4528 ffxxxll.exe 89 PID 4528 wrote to memory of 4792 4528 ffxxxll.exe 89 PID 4792 wrote to memory of 1508 4792 bthhtt.exe 90 PID 4792 wrote to memory of 1508 4792 bthhtt.exe 90 PID 4792 wrote to memory of 1508 4792 bthhtt.exe 90 PID 1508 wrote to memory of 3256 1508 pvjpv.exe 91 PID 1508 wrote to memory of 3256 1508 pvjpv.exe 91 PID 1508 wrote to memory of 3256 1508 pvjpv.exe 91 PID 3256 wrote to memory of 400 3256 tbnbbt.exe 92 PID 3256 wrote to memory of 400 3256 tbnbbt.exe 92 PID 3256 wrote to memory of 400 3256 tbnbbt.exe 92 PID 400 wrote to memory of 4100 400 ddjjj.exe 93 PID 400 wrote to memory of 4100 400 ddjjj.exe 93 PID 400 wrote to memory of 4100 400 ddjjj.exe 93 PID 4100 wrote to memory of 3480 4100 5lfxrrr.exe 94 PID 4100 wrote to memory of 3480 4100 5lfxrrr.exe 94 PID 4100 wrote to memory of 3480 4100 5lfxrrr.exe 94 PID 3480 wrote to memory of 3532 3480 tnnhhb.exe 95 PID 3480 wrote to memory of 3532 3480 tnnhhb.exe 95 PID 3480 wrote to memory of 3532 3480 tnnhhb.exe 95 PID 3532 wrote to memory of 3632 3532 jvdjj.exe 96 PID 3532 wrote to memory of 3632 3532 jvdjj.exe 96 PID 3532 wrote to memory of 3632 3532 jvdjj.exe 96 PID 3632 wrote to memory of 2692 3632 jjppj.exe 97 PID 3632 wrote to memory of 2692 3632 jjppj.exe 97 PID 3632 wrote to memory of 2692 3632 jjppj.exe 97 PID 2692 wrote to memory of 1020 2692 5xflfxx.exe 98 PID 2692 wrote to memory of 1020 2692 5xflfxx.exe 98 PID 2692 wrote to memory of 1020 2692 5xflfxx.exe 98 PID 1020 wrote to memory of 3400 1020 nhnhbb.exe 99 PID 1020 wrote to memory of 3400 1020 nhnhbb.exe 99 PID 1020 wrote to memory of 3400 1020 nhnhbb.exe 99 PID 3400 wrote to memory of 4648 3400 ddjdp.exe 100 PID 3400 wrote to memory of 4648 3400 ddjdp.exe 100 PID 3400 wrote to memory of 4648 3400 ddjdp.exe 100 PID 4648 wrote to memory of 844 4648 lrrlrrf.exe 101 PID 4648 wrote to memory of 844 4648 lrrlrrf.exe 101 PID 4648 wrote to memory of 844 4648 lrrlrrf.exe 101 PID 844 wrote to memory of 5104 844 llxxrxx.exe 102 PID 844 wrote to memory of 5104 844 llxxrxx.exe 102 PID 844 wrote to memory of 5104 844 llxxrxx.exe 102 PID 5104 wrote to memory of 4756 5104 5bnnnn.exe 103 PID 5104 wrote to memory of 4756 5104 5bnnnn.exe 103 PID 5104 wrote to memory of 4756 5104 5bnnnn.exe 103 PID 4756 wrote to memory of 3512 4756 jjvdv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5456a45cf87ada0ffc530c869e5c425e5854ef8e2e5eecf365acb72953c70d4N.exe"C:\Users\Admin\AppData\Local\Temp\c5456a45cf87ada0ffc530c869e5c425e5854ef8e2e5eecf365acb72953c70d4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\hbhhnn.exec:\hbhhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\1vddv.exec:\1vddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\ffxxfll.exec:\ffxxfll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\9bhbtt.exec:\9bhbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\jdjpp.exec:\jdjpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\ffxxxll.exec:\ffxxxll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\bthhtt.exec:\bthhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\pvjpv.exec:\pvjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\tbnbbt.exec:\tbnbbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\ddjjj.exec:\ddjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\5lfxrrr.exec:\5lfxrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\tnnhhb.exec:\tnnhhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\jvdjj.exec:\jvdjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\jjppj.exec:\jjppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\5xflfxx.exec:\5xflfxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\nhnhbb.exec:\nhnhbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\ddjdp.exec:\ddjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\lrrlrrf.exec:\lrrlrrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\llxxrxx.exec:\llxxrxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\5bnnnn.exec:\5bnnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\jjvdv.exec:\jjvdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\5xxrlll.exec:\5xxrlll.exe23⤵
- Executes dropped EXE
PID:3512 -
\??\c:\5hhhbb.exec:\5hhhbb.exe24⤵
- Executes dropped EXE
PID:4196 -
\??\c:\pdjdv.exec:\pdjdv.exe25⤵
- Executes dropped EXE
PID:4828 -
\??\c:\pvjvp.exec:\pvjvp.exe26⤵
- Executes dropped EXE
PID:708 -
\??\c:\xrfrlrr.exec:\xrfrlrr.exe27⤵
- Executes dropped EXE
PID:1476 -
\??\c:\bntnbt.exec:\bntnbt.exe28⤵
- Executes dropped EXE
PID:2944 -
\??\c:\5pjjd.exec:\5pjjd.exe29⤵
- Executes dropped EXE
PID:3036 -
\??\c:\rllrllx.exec:\rllrllx.exe30⤵
- Executes dropped EXE
PID:4964 -
\??\c:\9fllfff.exec:\9fllfff.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4504 -
\??\c:\7hnnhn.exec:\7hnnhn.exe32⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vjjdv.exec:\vjjdv.exe33⤵
- Executes dropped EXE
PID:4836 -
\??\c:\7flllll.exec:\7flllll.exe34⤵
- Executes dropped EXE
PID:4980 -
\??\c:\hhhhhh.exec:\hhhhhh.exe35⤵
- Executes dropped EXE
PID:4444 -
\??\c:\nbnhbb.exec:\nbnhbb.exe36⤵
- Executes dropped EXE
PID:4676 -
\??\c:\pdddv.exec:\pdddv.exe37⤵
- Executes dropped EXE
PID:3624 -
\??\c:\fflxrll.exec:\fflxrll.exe38⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3nnnhb.exec:\3nnnhb.exe39⤵
- Executes dropped EXE
PID:1912 -
\??\c:\thnhbb.exec:\thnhbb.exe40⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vjpvp.exec:\vjpvp.exe41⤵
- Executes dropped EXE
PID:3556 -
\??\c:\ddddv.exec:\ddddv.exe42⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rflfxrf.exec:\rflfxrf.exe43⤵
- Executes dropped EXE
PID:4344 -
\??\c:\hhbhhn.exec:\hhbhhn.exe44⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7vjjj.exec:\7vjjj.exe45⤵
- Executes dropped EXE
PID:5008 -
\??\c:\fxlfxrf.exec:\fxlfxrf.exe46⤵
- Executes dropped EXE
PID:2936 -
\??\c:\btbbnn.exec:\btbbnn.exe47⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jvvpj.exec:\jvvpj.exe48⤵
- Executes dropped EXE
PID:4516 -
\??\c:\ffxrllf.exec:\ffxrllf.exe49⤵
- Executes dropped EXE
PID:2204 -
\??\c:\rrrlllr.exec:\rrrlllr.exe50⤵
- Executes dropped EXE
PID:1504 -
\??\c:\hbhttt.exec:\hbhttt.exe51⤵
- Executes dropped EXE
PID:3560 -
\??\c:\vdjjj.exec:\vdjjj.exe52⤵
- Executes dropped EXE
PID:3580 -
\??\c:\3pvpd.exec:\3pvpd.exe53⤵
- Executes dropped EXE
PID:4860 -
\??\c:\7lllxll.exec:\7lllxll.exe54⤵
- Executes dropped EXE
PID:2160 -
\??\c:\xrxffff.exec:\xrxffff.exe55⤵
- Executes dropped EXE
PID:4528 -
\??\c:\tnhhhh.exec:\tnhhhh.exe56⤵
- Executes dropped EXE
PID:5084 -
\??\c:\ppddv.exec:\ppddv.exe57⤵
- Executes dropped EXE
PID:184 -
\??\c:\fxxflll.exec:\fxxflll.exe58⤵
- Executes dropped EXE
PID:2312 -
\??\c:\lxlfffx.exec:\lxlfffx.exe59⤵
- Executes dropped EXE
PID:436 -
\??\c:\5tbbtt.exec:\5tbbtt.exe60⤵
- Executes dropped EXE
PID:696 -
\??\c:\pjppv.exec:\pjppv.exe61⤵
- Executes dropped EXE
PID:536 -
\??\c:\pjjdv.exec:\pjjdv.exe62⤵
- Executes dropped EXE
PID:3948 -
\??\c:\rfrrxrf.exec:\rfrrxrf.exe63⤵
- Executes dropped EXE
PID:3056 -
\??\c:\9lrlffr.exec:\9lrlffr.exe64⤵
- Executes dropped EXE
PID:3532 -
\??\c:\nhbthh.exec:\nhbthh.exe65⤵
- Executes dropped EXE
PID:2976 -
\??\c:\btbtnn.exec:\btbtnn.exe66⤵PID:2300
-
\??\c:\dpjdp.exec:\dpjdp.exe67⤵PID:4412
-
\??\c:\rxfrlfx.exec:\rxfrlfx.exe68⤵PID:3776
-
\??\c:\xlrlllf.exec:\xlrlllf.exe69⤵PID:4924
-
\??\c:\bbbbtb.exec:\bbbbtb.exe70⤵PID:3812
-
\??\c:\jdvpj.exec:\jdvpj.exe71⤵PID:3616
-
\??\c:\7ppjd.exec:\7ppjd.exe72⤵PID:892
-
\??\c:\lxflrxx.exec:\lxflrxx.exe73⤵PID:844
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe74⤵PID:60
-
\??\c:\3bhhhh.exec:\3bhhhh.exe75⤵PID:3852
-
\??\c:\djdvj.exec:\djdvj.exe76⤵PID:2968
-
\??\c:\5pvvp.exec:\5pvvp.exe77⤵PID:2684
-
\??\c:\rfrlfff.exec:\rfrlfff.exe78⤵PID:4804
-
\??\c:\hhhnhh.exec:\hhhnhh.exe79⤵PID:3248
-
\??\c:\nnhhtn.exec:\nnhhtn.exe80⤵PID:708
-
\??\c:\dvpvj.exec:\dvpvj.exe81⤵PID:4388
-
\??\c:\3vppj.exec:\3vppj.exe82⤵PID:2364
-
\??\c:\7xfxlfx.exec:\7xfxlfx.exe83⤵PID:1528
-
\??\c:\nnbttb.exec:\nnbttb.exe84⤵PID:1916
-
\??\c:\nhnhnn.exec:\nhnhnn.exe85⤵PID:1600
-
\??\c:\vvjdd.exec:\vvjdd.exe86⤵PID:208
-
\??\c:\jdjvp.exec:\jdjvp.exe87⤵PID:2560
-
\??\c:\xrrlxff.exec:\xrrlxff.exe88⤵PID:756
-
\??\c:\hnnhbn.exec:\hnnhbn.exe89⤵PID:2772
-
\??\c:\pjvdv.exec:\pjvdv.exe90⤵PID:2516
-
\??\c:\dvjdv.exec:\dvjdv.exe91⤵PID:3992
-
\??\c:\ffxxllf.exec:\ffxxllf.exe92⤵PID:4772
-
\??\c:\bbttnn.exec:\bbttnn.exe93⤵PID:4552
-
\??\c:\hbnthh.exec:\hbnthh.exe94⤵PID:1656
-
\??\c:\1djjv.exec:\1djjv.exe95⤵PID:2696
-
\??\c:\pvvpj.exec:\pvvpj.exe96⤵PID:1876
-
\??\c:\xxllllf.exec:\xxllllf.exe97⤵PID:4036
-
\??\c:\ttbbtt.exec:\ttbbtt.exe98⤵PID:372
-
\??\c:\nhhbtt.exec:\nhhbtt.exe99⤵PID:1208
-
\??\c:\jdppv.exec:\jdppv.exe100⤵PID:1952
-
\??\c:\xlxxxff.exec:\xlxxxff.exe101⤵PID:2544
-
\??\c:\lfffrrx.exec:\lfffrrx.exe102⤵PID:3732
-
\??\c:\tthhhh.exec:\tthhhh.exe103⤵PID:1172
-
\??\c:\7jppj.exec:\7jppj.exe104⤵PID:4516
-
\??\c:\rfxrllf.exec:\rfxrllf.exe105⤵PID:3716
-
\??\c:\fxflrfr.exec:\fxflrfr.exe106⤵PID:2184
-
\??\c:\thhbtt.exec:\thhbtt.exe107⤵PID:4568
-
\??\c:\jvvvp.exec:\jvvvp.exe108⤵PID:980
-
\??\c:\jdjdv.exec:\jdjdv.exe109⤵PID:1368
-
\??\c:\fxfxrff.exec:\fxfxrff.exe110⤵PID:4112
-
\??\c:\nbhbbb.exec:\nbhbbb.exe111⤵PID:968
-
\??\c:\pvpjj.exec:\pvpjj.exe112⤵
- System Location Discovery: System Language Discovery
PID:220 -
\??\c:\jpjjv.exec:\jpjjv.exe113⤵PID:924
-
\??\c:\5rffrlf.exec:\5rffrlf.exe114⤵PID:3264
-
\??\c:\bbttnn.exec:\bbttnn.exe115⤵PID:2020
-
\??\c:\bbnhth.exec:\bbnhth.exe116⤵PID:400
-
\??\c:\vjppp.exec:\vjppp.exe117⤵PID:4840
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe118⤵PID:2388
-
\??\c:\lflfrrx.exec:\lflfrrx.exe119⤵PID:2460
-
\??\c:\hnnthn.exec:\hnnthn.exe120⤵PID:1188
-
\??\c:\vdjjv.exec:\vdjjv.exe121⤵PID:4816
-
\??\c:\7jjpd.exec:\7jjpd.exe122⤵PID:384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-