Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2025 02:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f.exe
Resource
win7-20241010-en
6 signatures
150 seconds
General
-
Target
8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f.exe
-
Size
61KB
-
MD5
f2c1b49e9873f3f1a4baa2b407b87308
-
SHA1
0f1545db8235abd2602d76bc95d573c59f0001bb
-
SHA256
8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f
-
SHA512
3976b702d5721fb24e52a83fbf7d5d34799f312c80d37d98c3ffcdb925b4cc858f5e9f6bbbd0f4fd060013e6e95e373277e20bede98b0a9fdb677b08e992af7f
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJiT:0cdpeeBSHHMHLf9RyIEQT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/404-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/620-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-326-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-346-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-371-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-387-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-391-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-398-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-402-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-447-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-451-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-461-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-466-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-478-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-482-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-495-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-547-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-770-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-1843-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-1967-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3472 fflfxrr.exe 3088 9bhnnn.exe 2876 btbbbt.exe 2168 3vvpd.exe 1460 flllxll.exe 2068 thnhbb.exe 3964 hbhnhn.exe 5036 3fxxxfl.exe 4404 1flfxfl.exe 1688 7hhhbb.exe 448 jvdvp.exe 3488 vvddd.exe 3948 rrrrlll.exe 4172 bhnntb.exe 2228 thhbbb.exe 1372 jddvv.exe 2528 jjpjd.exe 4416 htbbtn.exe 1628 9htnnn.exe 2524 jvdpp.exe 3160 1djdj.exe 1924 xfrlrlx.exe 3156 xlrlfxx.exe 3908 7hhbhh.exe 3992 vpvpv.exe 4748 vppjd.exe 2420 flxxfxx.exe 1224 lllrlxr.exe 3848 tnnhbb.exe 1556 pppjd.exe 1828 fffxrll.exe 3628 rrflflf.exe 3448 bbhbtn.exe 2684 nnnntt.exe 1044 1vppj.exe 432 jdvpd.exe 4316 5rrlfxf.exe 1564 3fffrrl.exe 4156 ntnhhh.exe 3872 bhnnhb.exe 2876 pdvpd.exe 5028 7vdvv.exe 4708 rlrlffl.exe 3876 1rrrllx.exe 1440 thhbnn.exe 3964 bthhbh.exe 5024 ppppj.exe 2620 djddp.exe 4408 ffxrfxr.exe 1064 xlxrlfx.exe 468 nnnntn.exe 4284 pvdpp.exe 3164 vjvvv.exe 3488 xlxrrfx.exe 4884 fxfxrlf.exe 668 5bhbtn.exe 1292 5thhbt.exe 4132 ppddp.exe 5000 llrlrrx.exe 1476 flfxxrf.exe 4388 hhbbhb.exe 3480 1vvpv.exe 620 hnnbbt.exe 1472 rfrlfxr.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 404 wrote to memory of 3472 404 8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f.exe 83 PID 404 wrote to memory of 3472 404 8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f.exe 83 PID 404 wrote to memory of 3472 404 8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f.exe 83 PID 3472 wrote to memory of 3088 3472 fflfxrr.exe 84 PID 3472 wrote to memory of 3088 3472 fflfxrr.exe 84 PID 3472 wrote to memory of 3088 3472 fflfxrr.exe 84 PID 3088 wrote to memory of 2876 3088 9bhnnn.exe 85 PID 3088 wrote to memory of 2876 3088 9bhnnn.exe 85 PID 3088 wrote to memory of 2876 3088 9bhnnn.exe 85 PID 2876 wrote to memory of 2168 2876 btbbbt.exe 87 PID 2876 wrote to memory of 2168 2876 btbbbt.exe 87 PID 2876 wrote to memory of 2168 2876 btbbbt.exe 87 PID 2168 wrote to memory of 1460 2168 3vvpd.exe 88 PID 2168 wrote to memory of 1460 2168 3vvpd.exe 88 PID 2168 wrote to memory of 1460 2168 3vvpd.exe 88 PID 1460 wrote to memory of 2068 1460 flllxll.exe 89 PID 1460 wrote to memory of 2068 1460 flllxll.exe 89 PID 1460 wrote to memory of 2068 1460 flllxll.exe 89 PID 2068 wrote to memory of 3964 2068 thnhbb.exe 91 PID 2068 wrote to memory of 3964 2068 thnhbb.exe 91 PID 2068 wrote to memory of 3964 2068 thnhbb.exe 91 PID 3964 wrote to memory of 5036 3964 hbhnhn.exe 92 PID 3964 wrote to memory of 5036 3964 hbhnhn.exe 92 PID 3964 wrote to memory of 5036 3964 hbhnhn.exe 92 PID 5036 wrote to memory of 4404 5036 3fxxxfl.exe 93 PID 5036 wrote to memory of 4404 5036 3fxxxfl.exe 93 PID 5036 wrote to memory of 4404 5036 3fxxxfl.exe 93 PID 4404 wrote to memory of 1688 4404 1flfxfl.exe 94 PID 4404 wrote to memory of 1688 4404 1flfxfl.exe 94 PID 4404 wrote to memory of 1688 4404 1flfxfl.exe 94 PID 1688 wrote to memory of 448 1688 7hhhbb.exe 95 PID 1688 wrote to memory of 448 1688 7hhhbb.exe 95 PID 1688 wrote to memory of 448 1688 7hhhbb.exe 95 PID 448 wrote to memory of 3488 448 jvdvp.exe 96 PID 448 wrote to memory of 3488 448 jvdvp.exe 96 PID 448 wrote to memory of 3488 448 jvdvp.exe 96 PID 3488 wrote to memory of 3948 3488 vvddd.exe 97 PID 3488 wrote to memory of 3948 3488 vvddd.exe 97 PID 3488 wrote to memory of 3948 3488 vvddd.exe 97 PID 3948 wrote to memory of 4172 3948 rrrrlll.exe 98 PID 3948 wrote to memory of 4172 3948 rrrrlll.exe 98 PID 3948 wrote to memory of 4172 3948 rrrrlll.exe 98 PID 4172 wrote to memory of 2228 4172 bhnntb.exe 99 PID 4172 wrote to memory of 2228 4172 bhnntb.exe 99 PID 4172 wrote to memory of 2228 4172 bhnntb.exe 99 PID 2228 wrote to memory of 1372 2228 thhbbb.exe 100 PID 2228 wrote to memory of 1372 2228 thhbbb.exe 100 PID 2228 wrote to memory of 1372 2228 thhbbb.exe 100 PID 1372 wrote to memory of 2528 1372 jddvv.exe 101 PID 1372 wrote to memory of 2528 1372 jddvv.exe 101 PID 1372 wrote to memory of 2528 1372 jddvv.exe 101 PID 2528 wrote to memory of 4416 2528 jjpjd.exe 102 PID 2528 wrote to memory of 4416 2528 jjpjd.exe 102 PID 2528 wrote to memory of 4416 2528 jjpjd.exe 102 PID 4416 wrote to memory of 1628 4416 htbbtn.exe 103 PID 4416 wrote to memory of 1628 4416 htbbtn.exe 103 PID 4416 wrote to memory of 1628 4416 htbbtn.exe 103 PID 1628 wrote to memory of 2524 1628 9htnnn.exe 104 PID 1628 wrote to memory of 2524 1628 9htnnn.exe 104 PID 1628 wrote to memory of 2524 1628 9htnnn.exe 104 PID 2524 wrote to memory of 3160 2524 jvdpp.exe 105 PID 2524 wrote to memory of 3160 2524 jvdpp.exe 105 PID 2524 wrote to memory of 3160 2524 jvdpp.exe 105 PID 3160 wrote to memory of 1924 3160 1djdj.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f.exe"C:\Users\Admin\AppData\Local\Temp\8b78e4a870372ede7622c024335bab7c307f61808384034c476dd2440024cc5f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\fflfxrr.exec:\fflfxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\9bhnnn.exec:\9bhnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\btbbbt.exec:\btbbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\3vvpd.exec:\3vvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\flllxll.exec:\flllxll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\thnhbb.exec:\thnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\hbhnhn.exec:\hbhnhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\3fxxxfl.exec:\3fxxxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\1flfxfl.exec:\1flfxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\7hhhbb.exec:\7hhhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\jvdvp.exec:\jvdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\vvddd.exec:\vvddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\rrrrlll.exec:\rrrrlll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\bhnntb.exec:\bhnntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\thhbbb.exec:\thhbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\jddvv.exec:\jddvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\jjpjd.exec:\jjpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\htbbtn.exec:\htbbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\9htnnn.exec:\9htnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\jvdpp.exec:\jvdpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\1djdj.exec:\1djdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\xfrlrlx.exec:\xfrlrlx.exe23⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe24⤵
- Executes dropped EXE
PID:3156 -
\??\c:\7hhbhh.exec:\7hhbhh.exe25⤵
- Executes dropped EXE
PID:3908 -
\??\c:\vpvpv.exec:\vpvpv.exe26⤵
- Executes dropped EXE
PID:3992 -
\??\c:\vppjd.exec:\vppjd.exe27⤵
- Executes dropped EXE
PID:4748 -
\??\c:\flxxfxx.exec:\flxxfxx.exe28⤵
- Executes dropped EXE
PID:2420 -
\??\c:\lllrlxr.exec:\lllrlxr.exe29⤵
- Executes dropped EXE
PID:1224 -
\??\c:\tnnhbb.exec:\tnnhbb.exe30⤵
- Executes dropped EXE
PID:3848 -
\??\c:\pppjd.exec:\pppjd.exe31⤵
- Executes dropped EXE
PID:1556 -
\??\c:\fffxrll.exec:\fffxrll.exe32⤵
- Executes dropped EXE
PID:1828 -
\??\c:\rrflflf.exec:\rrflflf.exe33⤵
- Executes dropped EXE
PID:3628 -
\??\c:\bbhbtn.exec:\bbhbtn.exe34⤵
- Executes dropped EXE
PID:3448 -
\??\c:\nnnntt.exec:\nnnntt.exe35⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1vppj.exec:\1vppj.exe36⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jdvpd.exec:\jdvpd.exe37⤵
- Executes dropped EXE
PID:432 -
\??\c:\5rrlfxf.exec:\5rrlfxf.exe38⤵
- Executes dropped EXE
PID:4316 -
\??\c:\3fffrrl.exec:\3fffrrl.exe39⤵
- Executes dropped EXE
PID:1564 -
\??\c:\ntnhhh.exec:\ntnhhh.exe40⤵
- Executes dropped EXE
PID:4156 -
\??\c:\bhnnhb.exec:\bhnnhb.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3872 -
\??\c:\pdvpd.exec:\pdvpd.exe42⤵
- Executes dropped EXE
PID:2876 -
\??\c:\7vdvv.exec:\7vdvv.exe43⤵
- Executes dropped EXE
PID:5028 -
\??\c:\rlrlffl.exec:\rlrlffl.exe44⤵
- Executes dropped EXE
PID:4708 -
\??\c:\1rrrllx.exec:\1rrrllx.exe45⤵
- Executes dropped EXE
PID:3876 -
\??\c:\thhbnn.exec:\thhbnn.exe46⤵
- Executes dropped EXE
PID:1440 -
\??\c:\bthhbh.exec:\bthhbh.exe47⤵
- Executes dropped EXE
PID:3964 -
\??\c:\ppppj.exec:\ppppj.exe48⤵
- Executes dropped EXE
PID:5024 -
\??\c:\djddp.exec:\djddp.exe49⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ffxrfxr.exec:\ffxrfxr.exe50⤵
- Executes dropped EXE
PID:4408 -
\??\c:\xlxrlfx.exec:\xlxrlfx.exe51⤵
- Executes dropped EXE
PID:1064 -
\??\c:\nnnntn.exec:\nnnntn.exe52⤵
- Executes dropped EXE
PID:468 -
\??\c:\pvdpp.exec:\pvdpp.exe53⤵
- Executes dropped EXE
PID:4284 -
\??\c:\vjvvv.exec:\vjvvv.exe54⤵
- Executes dropped EXE
PID:3164 -
\??\c:\xlxrrfx.exec:\xlxrrfx.exe55⤵
- Executes dropped EXE
PID:3488 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe56⤵
- Executes dropped EXE
PID:4884 -
\??\c:\5bhbtn.exec:\5bhbtn.exe57⤵
- Executes dropped EXE
PID:668 -
\??\c:\5thhbt.exec:\5thhbt.exe58⤵
- Executes dropped EXE
PID:1292 -
\??\c:\ppddp.exec:\ppddp.exe59⤵
- Executes dropped EXE
PID:4132 -
\??\c:\llrlrrx.exec:\llrlrrx.exe60⤵
- Executes dropped EXE
PID:5000 -
\??\c:\flfxxrf.exec:\flfxxrf.exe61⤵
- Executes dropped EXE
PID:1476 -
\??\c:\hhbbhb.exec:\hhbbhb.exe62⤵
- Executes dropped EXE
PID:4388 -
\??\c:\1vvpv.exec:\1vvpv.exe63⤵
- Executes dropped EXE
PID:3480 -
\??\c:\hnnbbt.exec:\hnnbbt.exe64⤵
- Executes dropped EXE
PID:620 -
\??\c:\rfrlfxr.exec:\rfrlfxr.exe65⤵
- Executes dropped EXE
PID:1472 -
\??\c:\7lrrrxr.exec:\7lrrrxr.exe66⤵
- System Location Discovery: System Language Discovery
PID:3588 -
\??\c:\vvpjp.exec:\vvpjp.exe67⤵PID:4088
-
\??\c:\xxlfffl.exec:\xxlfffl.exe68⤵PID:4024
-
\??\c:\pjppp.exec:\pjppp.exe69⤵PID:2108
-
\??\c:\5dpdp.exec:\5dpdp.exe70⤵PID:2324
-
\??\c:\rfxfxxx.exec:\rfxfxxx.exe71⤵PID:3020
-
\??\c:\lrrrlfx.exec:\lrrrlfx.exe72⤵PID:4472
-
\??\c:\tbhbtt.exec:\tbhbtt.exe73⤵PID:4384
-
\??\c:\jvjdd.exec:\jvjdd.exe74⤵PID:2420
-
\??\c:\9jdvv.exec:\9jdvv.exe75⤵PID:1224
-
\??\c:\rrrrlrl.exec:\rrrrlrl.exe76⤵PID:4916
-
\??\c:\bhbbtt.exec:\bhbbtt.exe77⤵PID:4020
-
\??\c:\7nnnhb.exec:\7nnnhb.exe78⤵PID:4148
-
\??\c:\pddvv.exec:\pddvv.exe79⤵PID:1960
-
\??\c:\xxxrffl.exec:\xxxrffl.exe80⤵PID:3552
-
\??\c:\bttnbt.exec:\bttnbt.exe81⤵PID:3152
-
\??\c:\7hbthb.exec:\7hbthb.exe82⤵PID:4684
-
\??\c:\vvppj.exec:\vvppj.exe83⤵PID:1044
-
\??\c:\7xlffxx.exec:\7xlffxx.exe84⤵PID:4176
-
\??\c:\lxffxxx.exec:\lxffxxx.exe85⤵PID:4300
-
\??\c:\nttnhb.exec:\nttnhb.exe86⤵PID:3036
-
\??\c:\7bbbtt.exec:\7bbbtt.exe87⤵PID:3124
-
\??\c:\thnnnn.exec:\thnnnn.exe88⤵PID:5032
-
\??\c:\pjpjv.exec:\pjpjv.exe89⤵PID:396
-
\??\c:\hhbtnb.exec:\hhbtnb.exe90⤵PID:4592
-
\??\c:\bnthtn.exec:\bnthtn.exe91⤵PID:3656
-
\??\c:\1jjdd.exec:\1jjdd.exe92⤵PID:4336
-
\??\c:\jdpdj.exec:\jdpdj.exe93⤵PID:1360
-
\??\c:\fflfrlf.exec:\fflfrlf.exe94⤵PID:2220
-
\??\c:\tthbbt.exec:\tthbbt.exe95⤵PID:820
-
\??\c:\1ddvp.exec:\1ddvp.exe96⤵PID:1068
-
\??\c:\7djdj.exec:\7djdj.exe97⤵PID:1364
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe98⤵PID:2732
-
\??\c:\ffxfffl.exec:\ffxfffl.exe99⤵PID:468
-
\??\c:\rrxxrrl.exec:\rrxxrrl.exe100⤵PID:4664
-
\??\c:\nnhhbt.exec:\nnhhbt.exe101⤵PID:4392
-
\??\c:\5hbnbt.exec:\5hbnbt.exe102⤵PID:3948
-
\??\c:\1djdd.exec:\1djdd.exe103⤵PID:3128
-
\??\c:\ddvjd.exec:\ddvjd.exe104⤵PID:4456
-
\??\c:\3rxlrrx.exec:\3rxlrrx.exe105⤵PID:2244
-
\??\c:\rlfxrlr.exec:\rlfxrlr.exe106⤵
- System Location Discovery: System Language Discovery
PID:4132 -
\??\c:\bbnttt.exec:\bbnttt.exe107⤵PID:2164
-
\??\c:\5nnnbb.exec:\5nnnbb.exe108⤵PID:3492
-
\??\c:\pjjvj.exec:\pjjvj.exe109⤵PID:4388
-
\??\c:\dpjjd.exec:\dpjjd.exe110⤵PID:3480
-
\??\c:\rlxllll.exec:\rlxllll.exe111⤵PID:1708
-
\??\c:\fffrxrf.exec:\fffrxrf.exe112⤵PID:2672
-
\??\c:\5rrlfxr.exec:\5rrlfxr.exe113⤵PID:3316
-
\??\c:\7tnnnb.exec:\7tnnnb.exe114⤵PID:1924
-
\??\c:\bbthtn.exec:\bbthtn.exe115⤵PID:3156
-
\??\c:\1jjjd.exec:\1jjjd.exe116⤵PID:2476
-
\??\c:\5djjv.exec:\5djjv.exe117⤵PID:2084
-
\??\c:\flrxrrf.exec:\flrxrrf.exe118⤵PID:2444
-
\??\c:\xrxrllx.exec:\xrxrllx.exe119⤵PID:4864
-
\??\c:\1nnhbn.exec:\1nnhbn.exe120⤵PID:3780
-
\??\c:\bhhhtt.exec:\bhhhtt.exe121⤵PID:540
-
\??\c:\1ddvj.exec:\1ddvj.exe122⤵PID:384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-