Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 21:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
596011535e1f98ab06aa8ce72ef854fae80da7ea6e4d6c4380f413ec40c79c3e.exe
Resource
win7-20250207-en
7 signatures
150 seconds
General
-
Target
596011535e1f98ab06aa8ce72ef854fae80da7ea6e4d6c4380f413ec40c79c3e.exe
-
Size
457KB
-
MD5
b0968197740f76cede5c6516cfc99850
-
SHA1
f3b18d0f66cea268bf4322f4b64db1ff5f219723
-
SHA256
596011535e1f98ab06aa8ce72ef854fae80da7ea6e4d6c4380f413ec40c79c3e
-
SHA512
aa1882d7a9caf7c4e257e491dfe86c928748b43cbc3ede271273a212ddd318ef26db728d59e8b72987f343c19ff82c6f43e583e2178e16ea69760523ebf1f976
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe4:q7Tc2NYHUrAwfMp3CD4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2740-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-235-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1548-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-248-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2532-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-552-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2532-572-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-955-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/348-1027-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2836 jjvdj.exe 2764 dpjjd.exe 2748 g8006.exe 3016 9vjjd.exe 2684 ppjvd.exe 2704 vjvpj.exe 2116 vdpjp.exe 1504 vvvvp.exe 2296 3xffffx.exe 2092 608400.exe 3008 024044.exe 2616 60846.exe 2876 0440808.exe 3004 426688.exe 2220 7thbhh.exe 600 6482222.exe 2200 64066.exe 2464 nttttb.exe 1312 dpvdj.exe 2728 1nbtbb.exe 2568 w80004.exe 1208 826422.exe 892 m8000.exe 336 xfxxffr.exe 1548 680462.exe 1728 btnnhh.exe 2264 jpjdd.exe 2532 82006.exe 2500 7vddj.exe 1044 xlxxffl.exe 1880 vpddd.exe 1108 fxxxllx.exe 1576 04628.exe 2064 864466.exe 2128 820044.exe 2764 rlfflrr.exe 2444 lfxxrrl.exe 2672 826240.exe 2632 0428620.exe 2244 vpjpd.exe 2708 lrlfllx.exe 2260 xxxlrrx.exe 2132 lrfrxfl.exe 372 5hbhnn.exe 3032 04848.exe 2832 fxxxxfr.exe 2700 hhttbb.exe 3036 nnttbb.exe 2948 dddpp.exe 3012 9lrxxfl.exe 1924 0468406.exe 2496 6080620.exe 784 htnnhb.exe 352 9tbtbb.exe 348 664288.exe 2584 04846.exe 1148 486622.exe 2544 26402.exe 808 bbtbhh.exe 1612 w20444.exe 1640 hbtbnt.exe 1040 g8662.exe 1048 jdpjv.exe 1532 242806.exe -
resource yara_rule behavioral1/memory/2740-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-431-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/348-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-842-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-905-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-955-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-995-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-1027-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1876-1035-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-1072-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-1085-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rllflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 640662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m8000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2836 2740 596011535e1f98ab06aa8ce72ef854fae80da7ea6e4d6c4380f413ec40c79c3e.exe 30 PID 2740 wrote to memory of 2836 2740 596011535e1f98ab06aa8ce72ef854fae80da7ea6e4d6c4380f413ec40c79c3e.exe 30 PID 2740 wrote to memory of 2836 2740 596011535e1f98ab06aa8ce72ef854fae80da7ea6e4d6c4380f413ec40c79c3e.exe 30 PID 2740 wrote to memory of 2836 2740 596011535e1f98ab06aa8ce72ef854fae80da7ea6e4d6c4380f413ec40c79c3e.exe 30 PID 2836 wrote to memory of 2764 2836 jjvdj.exe 31 PID 2836 wrote to memory of 2764 2836 jjvdj.exe 31 PID 2836 wrote to memory of 2764 2836 jjvdj.exe 31 PID 2836 wrote to memory of 2764 2836 jjvdj.exe 31 PID 2764 wrote to memory of 2748 2764 dpjjd.exe 32 PID 2764 wrote to memory of 2748 2764 dpjjd.exe 32 PID 2764 wrote to memory of 2748 2764 dpjjd.exe 32 PID 2764 wrote to memory of 2748 2764 dpjjd.exe 32 PID 2748 wrote to memory of 3016 2748 g8006.exe 33 PID 2748 wrote to memory of 3016 2748 g8006.exe 33 PID 2748 wrote to memory of 3016 2748 g8006.exe 33 PID 2748 wrote to memory of 3016 2748 g8006.exe 33 PID 3016 wrote to memory of 2684 3016 9vjjd.exe 34 PID 3016 wrote to memory of 2684 3016 9vjjd.exe 34 PID 3016 wrote to memory of 2684 3016 9vjjd.exe 34 PID 3016 wrote to memory of 2684 3016 9vjjd.exe 34 PID 2684 wrote to memory of 2704 2684 ppjvd.exe 35 PID 2684 wrote to memory of 2704 2684 ppjvd.exe 35 PID 2684 wrote to memory of 2704 2684 ppjvd.exe 35 PID 2684 wrote to memory of 2704 2684 ppjvd.exe 35 PID 2704 wrote to memory of 2116 2704 vjvpj.exe 36 PID 2704 wrote to memory of 2116 2704 vjvpj.exe 36 PID 2704 wrote to memory of 2116 2704 vjvpj.exe 36 PID 2704 wrote to memory of 2116 2704 vjvpj.exe 36 PID 2116 wrote to memory of 1504 2116 vdpjp.exe 37 PID 2116 wrote to memory of 1504 2116 vdpjp.exe 37 PID 2116 wrote to memory of 1504 2116 vdpjp.exe 37 PID 2116 wrote to memory of 1504 2116 vdpjp.exe 37 PID 1504 wrote to memory of 2296 1504 vvvvp.exe 38 PID 1504 wrote to memory of 2296 1504 vvvvp.exe 38 PID 1504 wrote to memory of 2296 1504 vvvvp.exe 38 PID 1504 wrote to memory of 2296 1504 vvvvp.exe 38 PID 2296 wrote to memory of 2092 2296 3xffffx.exe 39 PID 2296 wrote to memory of 2092 2296 3xffffx.exe 39 PID 2296 wrote to memory of 2092 2296 3xffffx.exe 39 PID 2296 wrote to memory of 2092 2296 3xffffx.exe 39 PID 2092 wrote to memory of 3008 2092 608400.exe 40 PID 2092 wrote to memory of 3008 2092 608400.exe 40 PID 2092 wrote to memory of 3008 2092 608400.exe 40 PID 2092 wrote to memory of 3008 2092 608400.exe 40 PID 3008 wrote to memory of 2616 3008 024044.exe 41 PID 3008 wrote to memory of 2616 3008 024044.exe 41 PID 3008 wrote to memory of 2616 3008 024044.exe 41 PID 3008 wrote to memory of 2616 3008 024044.exe 41 PID 2616 wrote to memory of 2876 2616 60846.exe 42 PID 2616 wrote to memory of 2876 2616 60846.exe 42 PID 2616 wrote to memory of 2876 2616 60846.exe 42 PID 2616 wrote to memory of 2876 2616 60846.exe 42 PID 2876 wrote to memory of 3004 2876 0440808.exe 43 PID 2876 wrote to memory of 3004 2876 0440808.exe 43 PID 2876 wrote to memory of 3004 2876 0440808.exe 43 PID 2876 wrote to memory of 3004 2876 0440808.exe 43 PID 3004 wrote to memory of 2220 3004 426688.exe 44 PID 3004 wrote to memory of 2220 3004 426688.exe 44 PID 3004 wrote to memory of 2220 3004 426688.exe 44 PID 3004 wrote to memory of 2220 3004 426688.exe 44 PID 2220 wrote to memory of 600 2220 7thbhh.exe 45 PID 2220 wrote to memory of 600 2220 7thbhh.exe 45 PID 2220 wrote to memory of 600 2220 7thbhh.exe 45 PID 2220 wrote to memory of 600 2220 7thbhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\596011535e1f98ab06aa8ce72ef854fae80da7ea6e4d6c4380f413ec40c79c3e.exe"C:\Users\Admin\AppData\Local\Temp\596011535e1f98ab06aa8ce72ef854fae80da7ea6e4d6c4380f413ec40c79c3e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\jjvdj.exec:\jjvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\dpjjd.exec:\dpjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\g8006.exec:\g8006.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\9vjjd.exec:\9vjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\ppjvd.exec:\ppjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\vjvpj.exec:\vjvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\vdpjp.exec:\vdpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\vvvvp.exec:\vvvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\3xffffx.exec:\3xffffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\608400.exec:\608400.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\024044.exec:\024044.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\60846.exec:\60846.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\0440808.exec:\0440808.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\426688.exec:\426688.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\7thbhh.exec:\7thbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\6482222.exec:\6482222.exe17⤵
- Executes dropped EXE
PID:600 -
\??\c:\64066.exec:\64066.exe18⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nttttb.exec:\nttttb.exe19⤵
- Executes dropped EXE
PID:2464 -
\??\c:\dpvdj.exec:\dpvdj.exe20⤵
- Executes dropped EXE
PID:1312 -
\??\c:\1nbtbb.exec:\1nbtbb.exe21⤵
- Executes dropped EXE
PID:2728 -
\??\c:\w80004.exec:\w80004.exe22⤵
- Executes dropped EXE
PID:2568 -
\??\c:\826422.exec:\826422.exe23⤵
- Executes dropped EXE
PID:1208 -
\??\c:\m8000.exec:\m8000.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:892 -
\??\c:\xfxxffr.exec:\xfxxffr.exe25⤵
- Executes dropped EXE
PID:336 -
\??\c:\680462.exec:\680462.exe26⤵
- Executes dropped EXE
PID:1548 -
\??\c:\btnnhh.exec:\btnnhh.exe27⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jpjdd.exec:\jpjdd.exe28⤵
- Executes dropped EXE
PID:2264 -
\??\c:\82006.exec:\82006.exe29⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7vddj.exec:\7vddj.exe30⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xlxxffl.exec:\xlxxffl.exe31⤵
- Executes dropped EXE
PID:1044 -
\??\c:\vpddd.exec:\vpddd.exe32⤵
- Executes dropped EXE
PID:1880 -
\??\c:\fxxxllx.exec:\fxxxllx.exe33⤵
- Executes dropped EXE
PID:1108 -
\??\c:\04628.exec:\04628.exe34⤵
- Executes dropped EXE
PID:1576 -
\??\c:\864466.exec:\864466.exe35⤵
- Executes dropped EXE
PID:2064 -
\??\c:\820044.exec:\820044.exe36⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rlfflrr.exec:\rlfflrr.exe37⤵
- Executes dropped EXE
PID:2764 -
\??\c:\lfxxrrl.exec:\lfxxrrl.exe38⤵
- Executes dropped EXE
PID:2444 -
\??\c:\826240.exec:\826240.exe39⤵
- Executes dropped EXE
PID:2672 -
\??\c:\0428620.exec:\0428620.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vpjpd.exec:\vpjpd.exe41⤵
- Executes dropped EXE
PID:2244 -
\??\c:\lrlfllx.exec:\lrlfllx.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2708 -
\??\c:\xxxlrrx.exec:\xxxlrrx.exe43⤵
- Executes dropped EXE
PID:2260 -
\??\c:\lrfrxfl.exec:\lrfrxfl.exe44⤵
- Executes dropped EXE
PID:2132 -
\??\c:\5hbhnn.exec:\5hbhnn.exe45⤵
- Executes dropped EXE
PID:372 -
\??\c:\04848.exec:\04848.exe46⤵
- Executes dropped EXE
PID:3032 -
\??\c:\fxxxxfr.exec:\fxxxxfr.exe47⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hhttbb.exec:\hhttbb.exe48⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nnttbb.exec:\nnttbb.exe49⤵
- Executes dropped EXE
PID:3036 -
\??\c:\dddpp.exec:\dddpp.exe50⤵
- Executes dropped EXE
PID:2948 -
\??\c:\9lrxxfl.exec:\9lrxxfl.exe51⤵
- Executes dropped EXE
PID:3012 -
\??\c:\0468406.exec:\0468406.exe52⤵
- Executes dropped EXE
PID:1924 -
\??\c:\6080620.exec:\6080620.exe53⤵
- Executes dropped EXE
PID:2496 -
\??\c:\htnnhb.exec:\htnnhb.exe54⤵
- Executes dropped EXE
PID:784 -
\??\c:\9tbtbb.exec:\9tbtbb.exe55⤵
- Executes dropped EXE
PID:352 -
\??\c:\664288.exec:\664288.exe56⤵
- Executes dropped EXE
PID:348 -
\??\c:\04846.exec:\04846.exe57⤵
- Executes dropped EXE
PID:2584 -
\??\c:\486622.exec:\486622.exe58⤵
- Executes dropped EXE
PID:1148 -
\??\c:\26402.exec:\26402.exe59⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bbtbhh.exec:\bbtbhh.exe60⤵
- Executes dropped EXE
PID:808 -
\??\c:\w20444.exec:\w20444.exe61⤵
- Executes dropped EXE
PID:1612 -
\??\c:\hbtbnt.exec:\hbtbnt.exe62⤵
- Executes dropped EXE
PID:1640 -
\??\c:\g8662.exec:\g8662.exe63⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jdpjv.exec:\jdpjv.exe64⤵
- Executes dropped EXE
PID:1048 -
\??\c:\242806.exec:\242806.exe65⤵
- Executes dropped EXE
PID:1532 -
\??\c:\dvppp.exec:\dvppp.exe66⤵PID:1724
-
\??\c:\9dvpv.exec:\9dvpv.exe67⤵PID:1548
-
\??\c:\648840.exec:\648840.exe68⤵PID:2924
-
\??\c:\082848.exec:\082848.exe69⤵PID:2316
-
\??\c:\thtbhb.exec:\thtbhb.exe70⤵PID:1120
-
\??\c:\5htnnt.exec:\5htnnt.exe71⤵PID:2532
-
\??\c:\q48088.exec:\q48088.exe72⤵PID:1840
-
\??\c:\3bnnnn.exec:\3bnnnn.exe73⤵PID:888
-
\??\c:\s4628.exec:\s4628.exe74⤵PID:1756
-
\??\c:\lxrrxfr.exec:\lxrrxfr.exe75⤵PID:2740
-
\??\c:\nhbbbh.exec:\nhbbbh.exe76⤵PID:2884
-
\??\c:\9jdjj.exec:\9jdjj.exe77⤵PID:2636
-
\??\c:\62260.exec:\62260.exe78⤵PID:3056
-
\??\c:\64662.exec:\64662.exe79⤵PID:2656
-
\??\c:\rffffxx.exec:\rffffxx.exe80⤵PID:2796
-
\??\c:\tbhthn.exec:\tbhthn.exe81⤵PID:2444
-
\??\c:\0804284.exec:\0804284.exe82⤵PID:2744
-
\??\c:\ttnbhh.exec:\ttnbhh.exe83⤵PID:2640
-
\??\c:\vvvdj.exec:\vvvdj.exe84⤵PID:2268
-
\??\c:\3vjdj.exec:\3vjdj.exe85⤵PID:2956
-
\??\c:\bbbthh.exec:\bbbthh.exe86⤵PID:2060
-
\??\c:\nbnnhh.exec:\nbnnhh.exe87⤵PID:1736
-
\??\c:\66806.exec:\66806.exe88⤵PID:2044
-
\??\c:\22020.exec:\22020.exe89⤵PID:2608
-
\??\c:\jvvvv.exec:\jvvvv.exe90⤵PID:2092
-
\??\c:\ddpjp.exec:\ddpjp.exe91⤵PID:3008
-
\??\c:\frlflxf.exec:\frlflxf.exe92⤵PID:712
-
\??\c:\i648040.exec:\i648040.exe93⤵PID:2720
-
\??\c:\m8284.exec:\m8284.exe94⤵PID:1824
-
\??\c:\486406.exec:\486406.exe95⤵PID:1716
-
\??\c:\fxrxfrl.exec:\fxrxfrl.exe96⤵PID:1020
-
\??\c:\26842.exec:\26842.exe97⤵PID:576
-
\??\c:\nhtthh.exec:\nhtthh.exe98⤵PID:2376
-
\??\c:\ppddp.exec:\ppddp.exe99⤵PID:320
-
\??\c:\dvddp.exec:\dvddp.exe100⤵PID:3064
-
\??\c:\xlfxflr.exec:\xlfxflr.exe101⤵PID:2580
-
\??\c:\6084008.exec:\6084008.exe102⤵PID:1720
-
\??\c:\7rlllll.exec:\7rlllll.exe103⤵PID:1588
-
\??\c:\thnnbb.exec:\thnnbb.exe104⤵PID:808
-
\??\c:\w64406.exec:\w64406.exe105⤵PID:920
-
\??\c:\jdppd.exec:\jdppd.exe106⤵PID:1640
-
\??\c:\xfrrlfl.exec:\xfrrlfl.exe107⤵PID:1040
-
\??\c:\q46644.exec:\q46644.exe108⤵PID:1048
-
\??\c:\bnbthb.exec:\bnbthb.exe109⤵PID:1532
-
\??\c:\64288.exec:\64288.exe110⤵PID:2012
-
\??\c:\w28822.exec:\w28822.exe111⤵PID:1728
-
\??\c:\e64888.exec:\e64888.exe112⤵PID:2264
-
\??\c:\nbbbtt.exec:\nbbbtt.exe113⤵PID:2124
-
\??\c:\thtbtn.exec:\thtbtn.exe114⤵PID:2540
-
\??\c:\4240002.exec:\4240002.exe115⤵PID:1960
-
\??\c:\g4662.exec:\g4662.exe116⤵PID:1316
-
\??\c:\7xrflrx.exec:\7xrflrx.exe117⤵PID:1140
-
\??\c:\2404440.exec:\2404440.exe118⤵PID:1980
-
\??\c:\bnbbbb.exec:\bnbbbb.exe119⤵PID:1108
-
\??\c:\k86048.exec:\k86048.exe120⤵PID:1600
-
\??\c:\lrxxfxf.exec:\lrxxfxf.exe121⤵PID:1712
-
\??\c:\i644444.exec:\i644444.exe122⤵PID:1856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-