Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad18cb828a48236c67e087b966a35de8da5631fb9424a58d7a2bdf0ed8262cb4.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
ad18cb828a48236c67e087b966a35de8da5631fb9424a58d7a2bdf0ed8262cb4.exe
-
Size
457KB
-
MD5
5ebd3478d2b2a657810807d3aebec80c
-
SHA1
27f76a307d50cc96bc7df9fb93114197c9d883c8
-
SHA256
ad18cb828a48236c67e087b966a35de8da5631fb9424a58d7a2bdf0ed8262cb4
-
SHA512
375776a72e8b73c87606a432c041b96f063f947c2aa84184c3539284338286c8754b1ed10231e05514e939a2b4d8f75bcc5085f16b61ef098bd62e5cc4521d9a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2936-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-100-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2204-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-518-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1712-535-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1676-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-589-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/960-787-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-870-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2784 vpdjv.exe 2580 1lrrrrr.exe 2840 1hhtnn.exe 2896 9thhnh.exe 2572 xxlfrlx.exe 1908 7bhbhh.exe 3008 jdppv.exe 988 5tbthh.exe 568 vpddp.exe 2204 7lxlfxr.exe 2212 pdpvd.exe 2888 tbhtnh.exe 2012 vvppj.exe 2040 3hnbtt.exe 2880 vppvj.exe 1572 rlllrrf.exe 1964 jdvvd.exe 2952 lflfrll.exe 2280 vjpvd.exe 2136 xxxlfrx.exe 2200 1vjdj.exe 2036 1dpvd.exe 904 lflrflx.exe 2184 3bbntt.exe 688 xlffllr.exe 1936 nnnbhn.exe 2368 xxrxfrx.exe 1920 nbntnt.exe 2532 3xfxfff.exe 284 flrrllr.exe 2548 pjdjv.exe 2788 9bthnt.exe 1524 pdppp.exe 2444 xlffrlx.exe 2852 1xrfrxl.exe 2772 htnnbh.exe 2620 ppjvd.exe 2896 jdvvd.exe 2640 rlfrflr.exe 304 9nhbtb.exe 264 hbtbnn.exe 596 7jdvp.exe 2468 fxflrxr.exe 1716 nnbhbh.exe 2540 pjjdj.exe 2104 vjpvj.exe 1768 rrlrffl.exe 2544 htnnhh.exe 2108 hbtntt.exe 2340 djjdd.exe 1452 xrffxfx.exe 1612 rlxrxrf.exe 2476 7tnthb.exe 2768 vdvpd.exe 1724 ffxffrx.exe 2556 5lflrfr.exe 2232 1nbbhh.exe 2352 jdjpv.exe 2268 3lrrrxf.exe 2200 ffxfrrl.exe 1932 7hntnn.exe 2424 jdvdj.exe 1596 fxrxflx.exe 2412 lfrrffl.exe -
resource yara_rule behavioral1/memory/2936-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-409-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2476-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-436-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1724-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-870-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-877-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2784 2936 ad18cb828a48236c67e087b966a35de8da5631fb9424a58d7a2bdf0ed8262cb4.exe 30 PID 2936 wrote to memory of 2784 2936 ad18cb828a48236c67e087b966a35de8da5631fb9424a58d7a2bdf0ed8262cb4.exe 30 PID 2936 wrote to memory of 2784 2936 ad18cb828a48236c67e087b966a35de8da5631fb9424a58d7a2bdf0ed8262cb4.exe 30 PID 2936 wrote to memory of 2784 2936 ad18cb828a48236c67e087b966a35de8da5631fb9424a58d7a2bdf0ed8262cb4.exe 30 PID 2784 wrote to memory of 2580 2784 vpdjv.exe 31 PID 2784 wrote to memory of 2580 2784 vpdjv.exe 31 PID 2784 wrote to memory of 2580 2784 vpdjv.exe 31 PID 2784 wrote to memory of 2580 2784 vpdjv.exe 31 PID 2580 wrote to memory of 2840 2580 1lrrrrr.exe 32 PID 2580 wrote to memory of 2840 2580 1lrrrrr.exe 32 PID 2580 wrote to memory of 2840 2580 1lrrrrr.exe 32 PID 2580 wrote to memory of 2840 2580 1lrrrrr.exe 32 PID 2840 wrote to memory of 2896 2840 1hhtnn.exe 33 PID 2840 wrote to memory of 2896 2840 1hhtnn.exe 33 PID 2840 wrote to memory of 2896 2840 1hhtnn.exe 33 PID 2840 wrote to memory of 2896 2840 1hhtnn.exe 33 PID 2896 wrote to memory of 2572 2896 9thhnh.exe 34 PID 2896 wrote to memory of 2572 2896 9thhnh.exe 34 PID 2896 wrote to memory of 2572 2896 9thhnh.exe 34 PID 2896 wrote to memory of 2572 2896 9thhnh.exe 34 PID 2572 wrote to memory of 1908 2572 xxlfrlx.exe 35 PID 2572 wrote to memory of 1908 2572 xxlfrlx.exe 35 PID 2572 wrote to memory of 1908 2572 xxlfrlx.exe 35 PID 2572 wrote to memory of 1908 2572 xxlfrlx.exe 35 PID 1908 wrote to memory of 3008 1908 7bhbhh.exe 36 PID 1908 wrote to memory of 3008 1908 7bhbhh.exe 36 PID 1908 wrote to memory of 3008 1908 7bhbhh.exe 36 PID 1908 wrote to memory of 3008 1908 7bhbhh.exe 36 PID 3008 wrote to memory of 988 3008 jdppv.exe 37 PID 3008 wrote to memory of 988 3008 jdppv.exe 37 PID 3008 wrote to memory of 988 3008 jdppv.exe 37 PID 3008 wrote to memory of 988 3008 jdppv.exe 37 PID 988 wrote to memory of 568 988 5tbthh.exe 38 PID 988 wrote to memory of 568 988 5tbthh.exe 38 PID 988 wrote to memory of 568 988 5tbthh.exe 38 PID 988 wrote to memory of 568 988 5tbthh.exe 38 PID 568 wrote to memory of 2204 568 vpddp.exe 39 PID 568 wrote to memory of 2204 568 vpddp.exe 39 PID 568 wrote to memory of 2204 568 vpddp.exe 39 PID 568 wrote to memory of 2204 568 vpddp.exe 39 PID 2204 wrote to memory of 2212 2204 7lxlfxr.exe 40 PID 2204 wrote to memory of 2212 2204 7lxlfxr.exe 40 PID 2204 wrote to memory of 2212 2204 7lxlfxr.exe 40 PID 2204 wrote to memory of 2212 2204 7lxlfxr.exe 40 PID 2212 wrote to memory of 2888 2212 pdpvd.exe 41 PID 2212 wrote to memory of 2888 2212 pdpvd.exe 41 PID 2212 wrote to memory of 2888 2212 pdpvd.exe 41 PID 2212 wrote to memory of 2888 2212 pdpvd.exe 41 PID 2888 wrote to memory of 2012 2888 tbhtnh.exe 42 PID 2888 wrote to memory of 2012 2888 tbhtnh.exe 42 PID 2888 wrote to memory of 2012 2888 tbhtnh.exe 42 PID 2888 wrote to memory of 2012 2888 tbhtnh.exe 42 PID 2012 wrote to memory of 2040 2012 vvppj.exe 43 PID 2012 wrote to memory of 2040 2012 vvppj.exe 43 PID 2012 wrote to memory of 2040 2012 vvppj.exe 43 PID 2012 wrote to memory of 2040 2012 vvppj.exe 43 PID 2040 wrote to memory of 2880 2040 3hnbtt.exe 44 PID 2040 wrote to memory of 2880 2040 3hnbtt.exe 44 PID 2040 wrote to memory of 2880 2040 3hnbtt.exe 44 PID 2040 wrote to memory of 2880 2040 3hnbtt.exe 44 PID 2880 wrote to memory of 1572 2880 vppvj.exe 45 PID 2880 wrote to memory of 1572 2880 vppvj.exe 45 PID 2880 wrote to memory of 1572 2880 vppvj.exe 45 PID 2880 wrote to memory of 1572 2880 vppvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad18cb828a48236c67e087b966a35de8da5631fb9424a58d7a2bdf0ed8262cb4.exe"C:\Users\Admin\AppData\Local\Temp\ad18cb828a48236c67e087b966a35de8da5631fb9424a58d7a2bdf0ed8262cb4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\vpdjv.exec:\vpdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\1lrrrrr.exec:\1lrrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\1hhtnn.exec:\1hhtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\9thhnh.exec:\9thhnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\xxlfrlx.exec:\xxlfrlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\7bhbhh.exec:\7bhbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\jdppv.exec:\jdppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\5tbthh.exec:\5tbthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\vpddp.exec:\vpddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\7lxlfxr.exec:\7lxlfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\pdpvd.exec:\pdpvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\tbhtnh.exec:\tbhtnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\vvppj.exec:\vvppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\3hnbtt.exec:\3hnbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\vppvj.exec:\vppvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\rlllrrf.exec:\rlllrrf.exe17⤵
- Executes dropped EXE
PID:1572 -
\??\c:\jdvvd.exec:\jdvvd.exe18⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lflfrll.exec:\lflfrll.exe19⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vjpvd.exec:\vjpvd.exe20⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xxxlfrx.exec:\xxxlfrx.exe21⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1vjdj.exec:\1vjdj.exe22⤵
- Executes dropped EXE
PID:2200 -
\??\c:\1dpvd.exec:\1dpvd.exe23⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lflrflx.exec:\lflrflx.exe24⤵
- Executes dropped EXE
PID:904 -
\??\c:\3bbntt.exec:\3bbntt.exe25⤵
- Executes dropped EXE
PID:2184 -
\??\c:\xlffllr.exec:\xlffllr.exe26⤵
- Executes dropped EXE
PID:688 -
\??\c:\nnnbhn.exec:\nnnbhn.exe27⤵
- Executes dropped EXE
PID:1936 -
\??\c:\xxrxfrx.exec:\xxrxfrx.exe28⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nbntnt.exec:\nbntnt.exe29⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3xfxfff.exec:\3xfxfff.exe30⤵
- Executes dropped EXE
PID:2532 -
\??\c:\flrrllr.exec:\flrrllr.exe31⤵
- Executes dropped EXE
PID:284 -
\??\c:\pjdjv.exec:\pjdjv.exe32⤵
- Executes dropped EXE
PID:2548 -
\??\c:\9bthnt.exec:\9bthnt.exe33⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pdppp.exec:\pdppp.exe34⤵
- Executes dropped EXE
PID:1524 -
\??\c:\xlffrlx.exec:\xlffrlx.exe35⤵
- Executes dropped EXE
PID:2444 -
\??\c:\1xrfrxl.exec:\1xrfrxl.exe36⤵
- Executes dropped EXE
PID:2852 -
\??\c:\htnnbh.exec:\htnnbh.exe37⤵
- Executes dropped EXE
PID:2772 -
\??\c:\ppjvd.exec:\ppjvd.exe38⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jdvvd.exec:\jdvvd.exe39⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rlfrflr.exec:\rlfrflr.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\9nhbtb.exec:\9nhbtb.exe41⤵
- Executes dropped EXE
PID:304 -
\??\c:\hbtbnn.exec:\hbtbnn.exe42⤵
- Executes dropped EXE
PID:264 -
\??\c:\7jdvp.exec:\7jdvp.exe43⤵
- Executes dropped EXE
PID:596 -
\??\c:\fxflrxr.exec:\fxflrxr.exe44⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nnbhbh.exec:\nnbhbh.exe45⤵
- Executes dropped EXE
PID:1716 -
\??\c:\pjjdj.exec:\pjjdj.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vjpvj.exec:\vjpvj.exe47⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rrlrffl.exec:\rrlrffl.exe48⤵
- Executes dropped EXE
PID:1768 -
\??\c:\htnnhh.exec:\htnnhh.exe49⤵
- Executes dropped EXE
PID:2544 -
\??\c:\hbtntt.exec:\hbtntt.exe50⤵
- Executes dropped EXE
PID:2108 -
\??\c:\djjdd.exec:\djjdd.exe51⤵
- Executes dropped EXE
PID:2340 -
\??\c:\xrffxfx.exec:\xrffxfx.exe52⤵
- Executes dropped EXE
PID:1452 -
\??\c:\rlxrxrf.exec:\rlxrxrf.exe53⤵
- Executes dropped EXE
PID:1612 -
\??\c:\7tnthb.exec:\7tnthb.exe54⤵
- Executes dropped EXE
PID:2476 -
\??\c:\vdvpd.exec:\vdvpd.exe55⤵
- Executes dropped EXE
PID:2768 -
\??\c:\ffxffrx.exec:\ffxffrx.exe56⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5lflrfr.exec:\5lflrfr.exe57⤵
- Executes dropped EXE
PID:2556 -
\??\c:\1nbbhh.exec:\1nbbhh.exe58⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jdjpv.exec:\jdjpv.exe59⤵
- Executes dropped EXE
PID:2352 -
\??\c:\3lrrrxf.exec:\3lrrrxf.exe60⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ffxfrrl.exec:\ffxfrrl.exe61⤵
- Executes dropped EXE
PID:2200 -
\??\c:\7hntnn.exec:\7hntnn.exe62⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jdvdj.exec:\jdvdj.exe63⤵
- Executes dropped EXE
PID:2424 -
\??\c:\fxrxflx.exec:\fxrxflx.exe64⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lfrrffl.exec:\lfrrffl.exe65⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bbtbnn.exec:\bbtbnn.exe66⤵PID:688
-
\??\c:\vpvdj.exec:\vpvdj.exe67⤵PID:3032
-
\??\c:\jdpvp.exec:\jdpvp.exe68⤵PID:1604
-
\??\c:\3rfrrrr.exec:\3rfrrrr.exe69⤵PID:1712
-
\??\c:\tnhntb.exec:\tnhntb.exe70⤵PID:1920
-
\??\c:\5dvpd.exec:\5dvpd.exe71⤵PID:1676
-
\??\c:\1jvdj.exec:\1jvdj.exe72⤵PID:2056
-
\??\c:\xxlrfff.exec:\xxlrfff.exe73⤵PID:2060
-
\??\c:\nhhnbb.exec:\nhhnbb.exe74⤵PID:1632
-
\??\c:\bbnbnb.exec:\bbnbnb.exe75⤵PID:2848
-
\??\c:\pddvd.exec:\pddvd.exe76⤵
- System Location Discovery: System Language Discovery
PID:2932 -
\??\c:\7lxrxxx.exec:\7lxrxxx.exe77⤵PID:2284
-
\??\c:\tbtbnh.exec:\tbtbnh.exe78⤵PID:2836
-
\??\c:\bnntnn.exec:\bnntnn.exe79⤵PID:2688
-
\??\c:\vjvdp.exec:\vjvdp.exe80⤵PID:2592
-
\??\c:\rxlrxlx.exec:\rxlrxlx.exe81⤵PID:2572
-
\??\c:\rrllrrf.exec:\rrllrrf.exe82⤵PID:2748
-
\??\c:\htbbhh.exec:\htbbhh.exe83⤵PID:772
-
\??\c:\pdvdv.exec:\pdvdv.exe84⤵PID:1416
-
\??\c:\jjdjd.exec:\jjdjd.exe85⤵PID:2612
-
\??\c:\fxllxxl.exec:\fxllxxl.exe86⤵PID:2208
-
\??\c:\ntbnbb.exec:\ntbnbb.exe87⤵PID:2460
-
\??\c:\vpdjd.exec:\vpdjd.exe88⤵PID:836
-
\??\c:\fflrxxf.exec:\fflrxxf.exe89⤵PID:2864
-
\??\c:\bbtbhb.exec:\bbtbhb.exe90⤵PID:1852
-
\??\c:\ttbntb.exec:\ttbntb.exe91⤵PID:2108
-
\??\c:\pddjp.exec:\pddjp.exe92⤵PID:2340
-
\??\c:\jjdpv.exec:\jjdpv.exe93⤵PID:1996
-
\??\c:\9xrxlxf.exec:\9xrxlxf.exe94⤵PID:2040
-
\??\c:\xrlrflf.exec:\xrlrflf.exe95⤵PID:2476
-
\??\c:\bntbnn.exec:\bntbnn.exe96⤵PID:2756
-
\??\c:\3dvdv.exec:\3dvdv.exe97⤵PID:2956
-
\??\c:\fxlfrrf.exec:\fxlfrrf.exe98⤵PID:2456
-
\??\c:\fxxxrxl.exec:\fxxxrxl.exe99⤵PID:2228
-
\??\c:\bhttbb.exec:\bhttbb.exe100⤵PID:2448
-
\??\c:\vpddp.exec:\vpddp.exe101⤵PID:1004
-
\??\c:\1llflfl.exec:\1llflfl.exe102⤵PID:1132
-
\??\c:\1lflrrf.exec:\1lflrrf.exe103⤵PID:3040
-
\??\c:\hbttbt.exec:\hbttbt.exe104⤵PID:552
-
\??\c:\3dpvd.exec:\3dpvd.exe105⤵PID:1876
-
\??\c:\vvpdj.exec:\vvpdj.exe106⤵PID:1276
-
\??\c:\xrlrlfx.exec:\xrlrlfx.exe107⤵PID:960
-
\??\c:\nnnbnn.exec:\nnnbnn.exe108⤵PID:1704
-
\??\c:\5jjvj.exec:\5jjvj.exe109⤵PID:2516
-
\??\c:\pdpvj.exec:\pdpvj.exe110⤵PID:832
-
\??\c:\9xlflrr.exec:\9xlflrr.exe111⤵PID:2944
-
\??\c:\3ttthb.exec:\3ttthb.exe112⤵PID:2512
-
\??\c:\hbthth.exec:\hbthth.exe113⤵PID:2484
-
\??\c:\5pdjp.exec:\5pdjp.exe114⤵PID:2548
-
\??\c:\fxlxllx.exec:\fxlxllx.exe115⤵PID:1624
-
\??\c:\nnhhtt.exec:\nnhhtt.exe116⤵PID:1524
-
\??\c:\ppjvj.exec:\ppjvj.exe117⤵PID:2444
-
\??\c:\fxlrxff.exec:\fxlrxff.exe118⤵PID:1800
-
\??\c:\lxfllrf.exec:\lxfllrf.exe119⤵PID:2840
-
\??\c:\hbntbb.exec:\hbntbb.exe120⤵PID:2600
-
\??\c:\vvjvp.exec:\vvjvp.exe121⤵PID:2624
-
\??\c:\xxrffff.exec:\xxrffff.exe122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-