Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
63b180ed7b0a57637360921d07196c9aec1bd4f354334fb3644543ef1790dc57.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
63b180ed7b0a57637360921d07196c9aec1bd4f354334fb3644543ef1790dc57.exe
-
Size
455KB
-
MD5
772c232ea5224bedac0fca1e518d7b22
-
SHA1
a65c5994814a23b4e3e81e690106a6721b7a7a40
-
SHA256
63b180ed7b0a57637360921d07196c9aec1bd4f354334fb3644543ef1790dc57
-
SHA512
b603a7185083125cc149fd4935c2dca351309ffd92667a347bad6b3e816b92bfd4012aca19988e5a21a0464f4436ef59c069d2328d8ca02d48e21e8e7798366e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTI:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2684-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-55-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2896-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1280-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1280-114-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1280-112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1216-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-128-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1756-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/440-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-222-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2344-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-281-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1612-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-477-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1264-486-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/280-514-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-656-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1496-696-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3024-761-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-790-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2784 vddjj.exe 2692 rfxxffx.exe 2760 jjdjd.exe 2732 1htbhn.exe 2708 vdvjv.exe 2552 7hbbht.exe 3032 vvvjj.exe 556 lfxfrxl.exe 2896 btntnt.exe 1460 ttnthn.exe 1280 7vjjj.exe 2640 llxlflr.exe 1216 djpdv.exe 1756 jjvdj.exe 664 ppjpj.exe 2808 5lffffx.exe 1232 pdvvd.exe 1676 lxlrffr.exe 2144 bbtnbh.exe 1764 ppjpd.exe 2188 hnnbtt.exe 440 jjvjj.exe 888 flrrflr.exe 2344 3pjpv.exe 1596 lxlrffr.exe 3020 pjvdj.exe 2232 rfxxxfr.exe 1824 nnbbhh.exe 348 7lflffr.exe 2052 fxrlrxf.exe 1988 dpddp.exe 1612 nhbhnn.exe 2744 vvddd.exe 2760 flrfrrf.exe 2736 hhhnnn.exe 1404 ttttnn.exe 2544 dvjpp.exe 2616 xxllrrl.exe 3028 ttnnhn.exe 828 dpjpd.exe 2812 rrlrxff.exe 2908 lfrxxfx.exe 3016 nhnttt.exe 1400 pdppp.exe 2728 rlrxflf.exe 2640 5lxfrxl.exe 924 tbtbnb.exe 1216 9vjdd.exe 1756 1lfxxxf.exe 2872 9rxrxxf.exe 2128 1bhnnn.exe 1848 vpjpd.exe 1212 jdjjp.exe 2208 rrlrfll.exe 2400 9hhnbb.exe 2204 3dvpv.exe 392 5vdpp.exe 2252 xrrrflr.exe 1696 tnttnh.exe 1264 1hbhnt.exe 752 dddpj.exe 2344 rrlfxfr.exe 2184 btbhnn.exe 280 pjddj.exe -
resource yara_rule behavioral1/memory/2684-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-75-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2896-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/440-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-790-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2784 2684 63b180ed7b0a57637360921d07196c9aec1bd4f354334fb3644543ef1790dc57.exe 31 PID 2684 wrote to memory of 2784 2684 63b180ed7b0a57637360921d07196c9aec1bd4f354334fb3644543ef1790dc57.exe 31 PID 2684 wrote to memory of 2784 2684 63b180ed7b0a57637360921d07196c9aec1bd4f354334fb3644543ef1790dc57.exe 31 PID 2684 wrote to memory of 2784 2684 63b180ed7b0a57637360921d07196c9aec1bd4f354334fb3644543ef1790dc57.exe 31 PID 2784 wrote to memory of 2692 2784 vddjj.exe 32 PID 2784 wrote to memory of 2692 2784 vddjj.exe 32 PID 2784 wrote to memory of 2692 2784 vddjj.exe 32 PID 2784 wrote to memory of 2692 2784 vddjj.exe 32 PID 2692 wrote to memory of 2760 2692 rfxxffx.exe 33 PID 2692 wrote to memory of 2760 2692 rfxxffx.exe 33 PID 2692 wrote to memory of 2760 2692 rfxxffx.exe 33 PID 2692 wrote to memory of 2760 2692 rfxxffx.exe 33 PID 2760 wrote to memory of 2732 2760 jjdjd.exe 34 PID 2760 wrote to memory of 2732 2760 jjdjd.exe 34 PID 2760 wrote to memory of 2732 2760 jjdjd.exe 34 PID 2760 wrote to memory of 2732 2760 jjdjd.exe 34 PID 2732 wrote to memory of 2708 2732 1htbhn.exe 35 PID 2732 wrote to memory of 2708 2732 1htbhn.exe 35 PID 2732 wrote to memory of 2708 2732 1htbhn.exe 35 PID 2732 wrote to memory of 2708 2732 1htbhn.exe 35 PID 2708 wrote to memory of 2552 2708 vdvjv.exe 36 PID 2708 wrote to memory of 2552 2708 vdvjv.exe 36 PID 2708 wrote to memory of 2552 2708 vdvjv.exe 36 PID 2708 wrote to memory of 2552 2708 vdvjv.exe 36 PID 2552 wrote to memory of 3032 2552 7hbbht.exe 37 PID 2552 wrote to memory of 3032 2552 7hbbht.exe 37 PID 2552 wrote to memory of 3032 2552 7hbbht.exe 37 PID 2552 wrote to memory of 3032 2552 7hbbht.exe 37 PID 3032 wrote to memory of 556 3032 vvvjj.exe 38 PID 3032 wrote to memory of 556 3032 vvvjj.exe 38 PID 3032 wrote to memory of 556 3032 vvvjj.exe 38 PID 3032 wrote to memory of 556 3032 vvvjj.exe 38 PID 556 wrote to memory of 2896 556 lfxfrxl.exe 39 PID 556 wrote to memory of 2896 556 lfxfrxl.exe 39 PID 556 wrote to memory of 2896 556 lfxfrxl.exe 39 PID 556 wrote to memory of 2896 556 lfxfrxl.exe 39 PID 2896 wrote to memory of 1460 2896 btntnt.exe 40 PID 2896 wrote to memory of 1460 2896 btntnt.exe 40 PID 2896 wrote to memory of 1460 2896 btntnt.exe 40 PID 2896 wrote to memory of 1460 2896 btntnt.exe 40 PID 1460 wrote to memory of 1280 1460 ttnthn.exe 41 PID 1460 wrote to memory of 1280 1460 ttnthn.exe 41 PID 1460 wrote to memory of 1280 1460 ttnthn.exe 41 PID 1460 wrote to memory of 1280 1460 ttnthn.exe 41 PID 1280 wrote to memory of 2640 1280 7vjjj.exe 42 PID 1280 wrote to memory of 2640 1280 7vjjj.exe 42 PID 1280 wrote to memory of 2640 1280 7vjjj.exe 42 PID 1280 wrote to memory of 2640 1280 7vjjj.exe 42 PID 2640 wrote to memory of 1216 2640 llxlflr.exe 43 PID 2640 wrote to memory of 1216 2640 llxlflr.exe 43 PID 2640 wrote to memory of 1216 2640 llxlflr.exe 43 PID 2640 wrote to memory of 1216 2640 llxlflr.exe 43 PID 1216 wrote to memory of 1756 1216 djpdv.exe 44 PID 1216 wrote to memory of 1756 1216 djpdv.exe 44 PID 1216 wrote to memory of 1756 1216 djpdv.exe 44 PID 1216 wrote to memory of 1756 1216 djpdv.exe 44 PID 1756 wrote to memory of 664 1756 jjvdj.exe 45 PID 1756 wrote to memory of 664 1756 jjvdj.exe 45 PID 1756 wrote to memory of 664 1756 jjvdj.exe 45 PID 1756 wrote to memory of 664 1756 jjvdj.exe 45 PID 664 wrote to memory of 2808 664 ppjpj.exe 46 PID 664 wrote to memory of 2808 664 ppjpj.exe 46 PID 664 wrote to memory of 2808 664 ppjpj.exe 46 PID 664 wrote to memory of 2808 664 ppjpj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\63b180ed7b0a57637360921d07196c9aec1bd4f354334fb3644543ef1790dc57.exe"C:\Users\Admin\AppData\Local\Temp\63b180ed7b0a57637360921d07196c9aec1bd4f354334fb3644543ef1790dc57.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\vddjj.exec:\vddjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\rfxxffx.exec:\rfxxffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\jjdjd.exec:\jjdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\1htbhn.exec:\1htbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\vdvjv.exec:\vdvjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\7hbbht.exec:\7hbbht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\vvvjj.exec:\vvvjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\btntnt.exec:\btntnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\ttnthn.exec:\ttnthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\7vjjj.exec:\7vjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\llxlflr.exec:\llxlflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\djpdv.exec:\djpdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\jjvdj.exec:\jjvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\ppjpj.exec:\ppjpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\5lffffx.exec:\5lffffx.exe17⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pdvvd.exec:\pdvvd.exe18⤵
- Executes dropped EXE
PID:1232 -
\??\c:\lxlrffr.exec:\lxlrffr.exe19⤵
- Executes dropped EXE
PID:1676 -
\??\c:\bbtnbh.exec:\bbtnbh.exe20⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ppjpd.exec:\ppjpd.exe21⤵
- Executes dropped EXE
PID:1764 -
\??\c:\hnnbtt.exec:\hnnbtt.exe22⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jjvjj.exec:\jjvjj.exe23⤵
- Executes dropped EXE
PID:440 -
\??\c:\flrrflr.exec:\flrrflr.exe24⤵
- Executes dropped EXE
PID:888 -
\??\c:\3pjpv.exec:\3pjpv.exe25⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lxlrffr.exec:\lxlrffr.exe26⤵
- Executes dropped EXE
PID:1596 -
\??\c:\pjvdj.exec:\pjvdj.exe27⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rfxxxfr.exec:\rfxxxfr.exe28⤵
- Executes dropped EXE
PID:2232 -
\??\c:\nnbbhh.exec:\nnbbhh.exe29⤵
- Executes dropped EXE
PID:1824 -
\??\c:\7lflffr.exec:\7lflffr.exe30⤵
- Executes dropped EXE
PID:348 -
\??\c:\fxrlrxf.exec:\fxrlrxf.exe31⤵
- Executes dropped EXE
PID:2052 -
\??\c:\dpddp.exec:\dpddp.exe32⤵
- Executes dropped EXE
PID:1988 -
\??\c:\lrlxrrf.exec:\lrlxrrf.exe33⤵PID:1600
-
\??\c:\nhbhnn.exec:\nhbhnn.exe34⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vvddd.exec:\vvddd.exe35⤵
- Executes dropped EXE
PID:2744 -
\??\c:\flrfrrf.exec:\flrfrrf.exe36⤵
- Executes dropped EXE
PID:2760 -
\??\c:\hhhnnn.exec:\hhhnnn.exe37⤵
- Executes dropped EXE
PID:2736 -
\??\c:\ttttnn.exec:\ttttnn.exe38⤵
- Executes dropped EXE
PID:1404 -
\??\c:\dvjpp.exec:\dvjpp.exe39⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xxllrrl.exec:\xxllrrl.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\ttnnhn.exec:\ttnnhn.exe41⤵
- Executes dropped EXE
PID:3028 -
\??\c:\dpjpd.exec:\dpjpd.exe42⤵
- Executes dropped EXE
PID:828 -
\??\c:\rrlrxff.exec:\rrlrxff.exe43⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lfrxxfx.exec:\lfrxxfx.exe44⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nhnttt.exec:\nhnttt.exe45⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pdppp.exec:\pdppp.exe46⤵
- Executes dropped EXE
PID:1400 -
\??\c:\rlrxflf.exec:\rlrxflf.exe47⤵
- Executes dropped EXE
PID:2728 -
\??\c:\5lxfrxl.exec:\5lxfrxl.exe48⤵
- Executes dropped EXE
PID:2640 -
\??\c:\tbtbnb.exec:\tbtbnb.exe49⤵
- Executes dropped EXE
PID:924 -
\??\c:\9vjdd.exec:\9vjdd.exe50⤵
- Executes dropped EXE
PID:1216 -
\??\c:\1lfxxxf.exec:\1lfxxxf.exe51⤵
- Executes dropped EXE
PID:1756 -
\??\c:\9rxrxxf.exec:\9rxrxxf.exe52⤵
- Executes dropped EXE
PID:2872 -
\??\c:\1bhnnn.exec:\1bhnnn.exe53⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vpjpd.exec:\vpjpd.exe54⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jdjjp.exec:\jdjjp.exe55⤵
- Executes dropped EXE
PID:1212 -
\??\c:\rrlrfll.exec:\rrlrfll.exe56⤵
- Executes dropped EXE
PID:2208 -
\??\c:\9hhnbb.exec:\9hhnbb.exe57⤵
- Executes dropped EXE
PID:2400 -
\??\c:\3dvpv.exec:\3dvpv.exe58⤵
- Executes dropped EXE
PID:2204 -
\??\c:\5vdpp.exec:\5vdpp.exe59⤵
- Executes dropped EXE
PID:392 -
\??\c:\xrrrflr.exec:\xrrrflr.exe60⤵
- Executes dropped EXE
PID:2252 -
\??\c:\tnttnh.exec:\tnttnh.exe61⤵
- Executes dropped EXE
PID:1696 -
\??\c:\1hbhnt.exec:\1hbhnt.exe62⤵
- Executes dropped EXE
PID:1264 -
\??\c:\dddpj.exec:\dddpj.exe63⤵
- Executes dropped EXE
PID:752 -
\??\c:\rrlfxfr.exec:\rrlfxfr.exe64⤵
- Executes dropped EXE
PID:2344 -
\??\c:\btbhnn.exec:\btbhnn.exe65⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pjddj.exec:\pjddj.exe66⤵
- Executes dropped EXE
PID:280 -
\??\c:\7pjpj.exec:\7pjpj.exe67⤵PID:2444
-
\??\c:\rrfrlff.exec:\rrfrlff.exe68⤵PID:996
-
\??\c:\bthtnn.exec:\bthtnn.exe69⤵PID:1672
-
\??\c:\1pddp.exec:\1pddp.exe70⤵PID:2780
-
\??\c:\jjdpj.exec:\jjdpj.exe71⤵PID:2772
-
\??\c:\xlxxxxl.exec:\xlxxxxl.exe72⤵PID:2700
-
\??\c:\ntbnhh.exec:\ntbnhh.exe73⤵PID:2668
-
\??\c:\9dpdv.exec:\9dpdv.exe74⤵PID:2832
-
\??\c:\1vpvd.exec:\1vpvd.exe75⤵PID:2956
-
\??\c:\llxrrxx.exec:\llxrrxx.exe76⤵PID:2804
-
\??\c:\hbnntt.exec:\hbnntt.exe77⤵PID:2680
-
\??\c:\vppdj.exec:\vppdj.exe78⤵PID:2820
-
\??\c:\3dvdj.exec:\3dvdj.exe79⤵PID:1404
-
\??\c:\lfllfxx.exec:\lfllfxx.exe80⤵PID:3036
-
\??\c:\nntnht.exec:\nntnht.exe81⤵PID:2012
-
\??\c:\1thhnt.exec:\1thhnt.exe82⤵PID:1924
-
\??\c:\ddpvd.exec:\ddpvd.exe83⤵PID:1640
-
\??\c:\fflrlxl.exec:\fflrlxl.exe84⤵PID:1996
-
\??\c:\9thnbh.exec:\9thnbh.exe85⤵PID:2916
-
\??\c:\dvjvp.exec:\dvjvp.exe86⤵PID:2368
-
\??\c:\pjvpv.exec:\pjvpv.exe87⤵PID:580
-
\??\c:\ffxxrfl.exec:\ffxxrfl.exe88⤵PID:2728
-
\??\c:\9bhnbb.exec:\9bhnbb.exe89⤵PID:1432
-
\??\c:\hbnbtb.exec:\hbnbtb.exe90⤵PID:1872
-
\??\c:\vpjvj.exec:\vpjvj.exe91⤵PID:1216
-
\??\c:\llxlxfx.exec:\llxlxfx.exe92⤵PID:2864
-
\??\c:\btbbnn.exec:\btbbnn.exe93⤵PID:1632
-
\??\c:\bbtbnb.exec:\bbtbnb.exe94⤵PID:1496
-
\??\c:\dvvvj.exec:\dvvvj.exe95⤵PID:2520
-
\??\c:\ffxfrrr.exec:\ffxfrrr.exe96⤵PID:2112
-
\??\c:\rlxlxfl.exec:\rlxlxfl.exe97⤵PID:2452
-
\??\c:\nnnnht.exec:\nnnnht.exe98⤵PID:2304
-
\??\c:\jdpjj.exec:\jdpjj.exe99⤵PID:2340
-
\??\c:\dvvdj.exec:\dvvdj.exe100⤵PID:2188
-
\??\c:\5xflxxl.exec:\5xflxxl.exe101⤵PID:1092
-
\??\c:\hbbbnn.exec:\hbbbnn.exe102⤵PID:1936
-
\??\c:\bnbbnn.exec:\bnbbnn.exe103⤵
- System Location Discovery: System Language Discovery
PID:892 -
\??\c:\dpddj.exec:\dpddj.exe104⤵PID:696
-
\??\c:\lxrxllx.exec:\lxrxllx.exe105⤵PID:3024
-
\??\c:\xllrrrf.exec:\xllrrrf.exe106⤵PID:2184
-
\??\c:\5tnttt.exec:\5tnttt.exe107⤵PID:280
-
\??\c:\ppddj.exec:\ppddj.exe108⤵PID:2624
-
\??\c:\5lfxrrx.exec:\5lfxrrx.exe109⤵PID:2440
-
\??\c:\3rrfllx.exec:\3rrfllx.exe110⤵PID:2688
-
\??\c:\hnbbhh.exec:\hnbbhh.exe111⤵PID:2780
-
\??\c:\ppjpv.exec:\ppjpv.exe112⤵PID:1736
-
\??\c:\xrlxxff.exec:\xrlxxff.exe113⤵PID:2700
-
\??\c:\rxrxlfx.exec:\rxrxlfx.exe114⤵PID:2676
-
\??\c:\7nbhnt.exec:\7nbhnt.exe115⤵PID:2408
-
\??\c:\pvpdp.exec:\pvpdp.exe116⤵PID:2704
-
\??\c:\xlffrxf.exec:\xlffrxf.exe117⤵PID:2660
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe118⤵PID:2584
-
\??\c:\thttbb.exec:\thttbb.exe119⤵PID:2556
-
\??\c:\7jddv.exec:\7jddv.exe120⤵PID:2664
-
\??\c:\xxllrxf.exec:\xxllrxf.exe121⤵PID:2012
-
\??\c:\tnhnbb.exec:\tnhnbb.exe122⤵PID:2720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-