Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 20:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40.exe
Resource
win7-20240729-en
7 signatures
150 seconds
General
-
Target
53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40.exe
-
Size
458KB
-
MD5
9683bfdccf3ba351ee2d0e45d1ea2f45
-
SHA1
007580a6470dbd24a7b3f9446131f132d8107506
-
SHA256
53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40
-
SHA512
6c7a63b50d39f65117afda202ec37dbfe061631b7821c2fa8f858deb6b960e4f650bdc87880c6b9dc3be4928d4002c1c46f0f869761b9500dcefed105cfb0e81
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbebC:q7Tc2NYHUrAwfMp3CDO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/704-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-22-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2948-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-122-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2256-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/396-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-376-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2308-389-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2060-399-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2416-403-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-440-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/1364-442-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/1352-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/500-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/396-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-627-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-850-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-954-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1160-1010-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 704 pjjjd.exe 2200 pjppj.exe 2808 fxxxxrr.exe 2948 7tbhnn.exe 2884 9vjvj.exe 3016 jjjdd.exe 2660 9nbhhh.exe 2724 ffxxxxf.exe 2292 hhbbbt.exe 2260 pjvvv.exe 2372 hbbbtn.exe 1992 djvdj.exe 2672 frxxfll.exe 2908 bhnntn.exe 2388 jpvpv.exe 1612 hhbttn.exe 2256 1xlrxxx.exe 1872 1rffflr.exe 1780 vpvpp.exe 2976 9tbttn.exe 2384 jjjvv.exe 2192 hhnntt.exe 764 5pvdj.exe 620 xlxflrx.exe 2112 vdpvv.exe 1724 rrxxflr.exe 1512 3nntnn.exe 944 xxrrxxf.exe 3000 jvddd.exe 396 1xlrxff.exe 788 7jvpv.exe 2352 xfrrrxx.exe 2244 tnntbh.exe 2820 vvjjv.exe 2180 flxrxfl.exe 2696 hntntt.exe 2736 9nnntt.exe 2944 dvvjj.exe 2836 7fxxxxx.exe 2912 bhtttn.exe 2804 dpdjv.exe 2636 rlrllfx.exe 2772 1xrlrlr.exe 2768 hntnbb.exe 1976 5jvpv.exe 1444 xfffflr.exe 2308 9htnnn.exe 2060 jjjpv.exe 2416 rrxfxrx.exe 2664 3frxxll.exe 988 bbhhhh.exe 2792 1jpvv.exe 3004 7xrrrxx.exe 1364 3rflrxf.exe 1352 thnnhh.exe 500 jjddp.exe 2168 fflfllr.exe 880 3hnhth.exe 2396 jjpvd.exe 2120 pdppp.exe 2436 lrfxxxx.exe 2572 hhtbhh.exe 1920 vvjjp.exe 620 3xrrflx.exe -
resource yara_rule behavioral1/memory/704-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-40-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2948-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-136-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2256-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-389-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2664-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-440-0x0000000001C70000-0x0000000001C9A000-memory.dmp upx behavioral1/memory/1352-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/500-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-850-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1488 wrote to memory of 704 1488 53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40.exe 29 PID 1488 wrote to memory of 704 1488 53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40.exe 29 PID 1488 wrote to memory of 704 1488 53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40.exe 29 PID 1488 wrote to memory of 704 1488 53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40.exe 29 PID 704 wrote to memory of 2200 704 pjjjd.exe 30 PID 704 wrote to memory of 2200 704 pjjjd.exe 30 PID 704 wrote to memory of 2200 704 pjjjd.exe 30 PID 704 wrote to memory of 2200 704 pjjjd.exe 30 PID 2200 wrote to memory of 2808 2200 pjppj.exe 31 PID 2200 wrote to memory of 2808 2200 pjppj.exe 31 PID 2200 wrote to memory of 2808 2200 pjppj.exe 31 PID 2200 wrote to memory of 2808 2200 pjppj.exe 31 PID 2808 wrote to memory of 2948 2808 fxxxxrr.exe 32 PID 2808 wrote to memory of 2948 2808 fxxxxrr.exe 32 PID 2808 wrote to memory of 2948 2808 fxxxxrr.exe 32 PID 2808 wrote to memory of 2948 2808 fxxxxrr.exe 32 PID 2948 wrote to memory of 2884 2948 7tbhnn.exe 33 PID 2948 wrote to memory of 2884 2948 7tbhnn.exe 33 PID 2948 wrote to memory of 2884 2948 7tbhnn.exe 33 PID 2948 wrote to memory of 2884 2948 7tbhnn.exe 33 PID 2884 wrote to memory of 3016 2884 9vjvj.exe 34 PID 2884 wrote to memory of 3016 2884 9vjvj.exe 34 PID 2884 wrote to memory of 3016 2884 9vjvj.exe 34 PID 2884 wrote to memory of 3016 2884 9vjvj.exe 34 PID 3016 wrote to memory of 2660 3016 jjjdd.exe 35 PID 3016 wrote to memory of 2660 3016 jjjdd.exe 35 PID 3016 wrote to memory of 2660 3016 jjjdd.exe 35 PID 3016 wrote to memory of 2660 3016 jjjdd.exe 35 PID 2660 wrote to memory of 2724 2660 9nbhhh.exe 36 PID 2660 wrote to memory of 2724 2660 9nbhhh.exe 36 PID 2660 wrote to memory of 2724 2660 9nbhhh.exe 36 PID 2660 wrote to memory of 2724 2660 9nbhhh.exe 36 PID 2724 wrote to memory of 2292 2724 ffxxxxf.exe 37 PID 2724 wrote to memory of 2292 2724 ffxxxxf.exe 37 PID 2724 wrote to memory of 2292 2724 ffxxxxf.exe 37 PID 2724 wrote to memory of 2292 2724 ffxxxxf.exe 37 PID 2292 wrote to memory of 2260 2292 hhbbbt.exe 38 PID 2292 wrote to memory of 2260 2292 hhbbbt.exe 38 PID 2292 wrote to memory of 2260 2292 hhbbbt.exe 38 PID 2292 wrote to memory of 2260 2292 hhbbbt.exe 38 PID 2260 wrote to memory of 2372 2260 pjvvv.exe 39 PID 2260 wrote to memory of 2372 2260 pjvvv.exe 39 PID 2260 wrote to memory of 2372 2260 pjvvv.exe 39 PID 2260 wrote to memory of 2372 2260 pjvvv.exe 39 PID 2372 wrote to memory of 1992 2372 hbbbtn.exe 40 PID 2372 wrote to memory of 1992 2372 hbbbtn.exe 40 PID 2372 wrote to memory of 1992 2372 hbbbtn.exe 40 PID 2372 wrote to memory of 1992 2372 hbbbtn.exe 40 PID 1992 wrote to memory of 2672 1992 djvdj.exe 41 PID 1992 wrote to memory of 2672 1992 djvdj.exe 41 PID 1992 wrote to memory of 2672 1992 djvdj.exe 41 PID 1992 wrote to memory of 2672 1992 djvdj.exe 41 PID 2672 wrote to memory of 2908 2672 frxxfll.exe 42 PID 2672 wrote to memory of 2908 2672 frxxfll.exe 42 PID 2672 wrote to memory of 2908 2672 frxxfll.exe 42 PID 2672 wrote to memory of 2908 2672 frxxfll.exe 42 PID 2908 wrote to memory of 2388 2908 bhnntn.exe 43 PID 2908 wrote to memory of 2388 2908 bhnntn.exe 43 PID 2908 wrote to memory of 2388 2908 bhnntn.exe 43 PID 2908 wrote to memory of 2388 2908 bhnntn.exe 43 PID 2388 wrote to memory of 1612 2388 jpvpv.exe 44 PID 2388 wrote to memory of 1612 2388 jpvpv.exe 44 PID 2388 wrote to memory of 1612 2388 jpvpv.exe 44 PID 2388 wrote to memory of 1612 2388 jpvpv.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40.exe"C:\Users\Admin\AppData\Local\Temp\53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\pjjjd.exec:\pjjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\pjppj.exec:\pjppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\fxxxxrr.exec:\fxxxxrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\7tbhnn.exec:\7tbhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\9vjvj.exec:\9vjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\jjjdd.exec:\jjjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\9nbhhh.exec:\9nbhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\ffxxxxf.exec:\ffxxxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\hhbbbt.exec:\hhbbbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\pjvvv.exec:\pjvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\hbbbtn.exec:\hbbbtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\djvdj.exec:\djvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\frxxfll.exec:\frxxfll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\bhnntn.exec:\bhnntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\jpvpv.exec:\jpvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\hhbttn.exec:\hhbttn.exe17⤵
- Executes dropped EXE
PID:1612 -
\??\c:\1xlrxxx.exec:\1xlrxxx.exe18⤵
- Executes dropped EXE
PID:2256 -
\??\c:\1rffflr.exec:\1rffflr.exe19⤵
- Executes dropped EXE
PID:1872 -
\??\c:\vpvpp.exec:\vpvpp.exe20⤵
- Executes dropped EXE
PID:1780 -
\??\c:\9tbttn.exec:\9tbttn.exe21⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jjjvv.exec:\jjjvv.exe22⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hhnntt.exec:\hhnntt.exe23⤵
- Executes dropped EXE
PID:2192 -
\??\c:\5pvdj.exec:\5pvdj.exe24⤵
- Executes dropped EXE
PID:764 -
\??\c:\xlxflrx.exec:\xlxflrx.exe25⤵
- Executes dropped EXE
PID:620 -
\??\c:\vdpvv.exec:\vdpvv.exe26⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rrxxflr.exec:\rrxxflr.exe27⤵
- Executes dropped EXE
PID:1724 -
\??\c:\3nntnn.exec:\3nntnn.exe28⤵
- Executes dropped EXE
PID:1512 -
\??\c:\xxrrxxf.exec:\xxrrxxf.exe29⤵
- Executes dropped EXE
PID:944 -
\??\c:\jvddd.exec:\jvddd.exe30⤵
- Executes dropped EXE
PID:3000 -
\??\c:\1xlrxff.exec:\1xlrxff.exe31⤵
- Executes dropped EXE
PID:396 -
\??\c:\7jvpv.exec:\7jvpv.exe32⤵
- Executes dropped EXE
PID:788 -
\??\c:\xfrrrxx.exec:\xfrrrxx.exe33⤵
- Executes dropped EXE
PID:2352 -
\??\c:\tnntbh.exec:\tnntbh.exe34⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vvjjv.exec:\vvjjv.exe35⤵
- Executes dropped EXE
PID:2820 -
\??\c:\flxrxfl.exec:\flxrxfl.exe36⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hntntt.exec:\hntntt.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\9nnntt.exec:\9nnntt.exe38⤵
- Executes dropped EXE
PID:2736 -
\??\c:\dvvjj.exec:\dvvjj.exe39⤵
- Executes dropped EXE
PID:2944 -
\??\c:\7fxxxxx.exec:\7fxxxxx.exe40⤵
- Executes dropped EXE
PID:2836 -
\??\c:\bhtttn.exec:\bhtttn.exe41⤵
- Executes dropped EXE
PID:2912 -
\??\c:\dpdjv.exec:\dpdjv.exe42⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rlrllfx.exec:\rlrllfx.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1xrlrlr.exec:\1xrlrlr.exe44⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hntnbb.exec:\hntnbb.exe45⤵
- Executes dropped EXE
PID:2768 -
\??\c:\5jvpv.exec:\5jvpv.exe46⤵
- Executes dropped EXE
PID:1976 -
\??\c:\xfffflr.exec:\xfffflr.exe47⤵
- Executes dropped EXE
PID:1444 -
\??\c:\9htnnn.exec:\9htnnn.exe48⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jjjpv.exec:\jjjpv.exe49⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rrxfxrx.exec:\rrxfxrx.exe50⤵
- Executes dropped EXE
PID:2416 -
\??\c:\3frxxll.exec:\3frxxll.exe51⤵
- Executes dropped EXE
PID:2664 -
\??\c:\bbhhhh.exec:\bbhhhh.exe52⤵
- Executes dropped EXE
PID:988 -
\??\c:\1jpvv.exec:\1jpvv.exe53⤵
- Executes dropped EXE
PID:2792 -
\??\c:\7xrrrxx.exec:\7xrrrxx.exe54⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3rflrxf.exec:\3rflrxf.exe55⤵
- Executes dropped EXE
PID:1364 -
\??\c:\thnnhh.exec:\thnnhh.exe56⤵
- Executes dropped EXE
PID:1352 -
\??\c:\jjddp.exec:\jjddp.exe57⤵
- Executes dropped EXE
PID:500 -
\??\c:\fflfllr.exec:\fflfllr.exe58⤵
- Executes dropped EXE
PID:2168 -
\??\c:\3hnhth.exec:\3hnhth.exe59⤵
- Executes dropped EXE
PID:880 -
\??\c:\jjpvd.exec:\jjpvd.exe60⤵
- Executes dropped EXE
PID:2396 -
\??\c:\pdppp.exec:\pdppp.exe61⤵
- Executes dropped EXE
PID:2120 -
\??\c:\lrfxxxx.exec:\lrfxxxx.exe62⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hhtbhh.exec:\hhtbhh.exe63⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vvjjp.exec:\vvjjp.exe64⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3xrrflx.exec:\3xrrflx.exe65⤵
- Executes dropped EXE
PID:620 -
\??\c:\bbnnbb.exec:\bbnnbb.exe66⤵PID:2112
-
\??\c:\tbntbh.exec:\tbntbh.exe67⤵PID:236
-
\??\c:\pvjdj.exec:\pvjdj.exe68⤵PID:1796
-
\??\c:\xxffrrf.exec:\xxffrrf.exe69⤵PID:1512
-
\??\c:\nnhhnn.exec:\nnhhnn.exe70⤵PID:3060
-
\??\c:\hnhhnh.exec:\hnhhnh.exe71⤵PID:2328
-
\??\c:\jdddd.exec:\jdddd.exe72⤵PID:276
-
\??\c:\ffrrrxf.exec:\ffrrrxf.exe73⤵PID:396
-
\??\c:\bbhbbb.exec:\bbhbbb.exe74⤵PID:2344
-
\??\c:\5djjv.exec:\5djjv.exe75⤵PID:2336
-
\??\c:\3lfffrx.exec:\3lfffrx.exe76⤵PID:2100
-
\??\c:\fflrflr.exec:\fflrflr.exe77⤵PID:1596
-
\??\c:\1hnhhn.exec:\1hnhhn.exe78⤵PID:2880
-
\??\c:\jjvdp.exec:\jjvdp.exe79⤵PID:2708
-
\??\c:\frxrrxf.exec:\frxrrxf.exe80⤵PID:2760
-
\??\c:\ffffflr.exec:\ffffflr.exe81⤵PID:2748
-
\??\c:\hhhbbb.exec:\hhhbbb.exe82⤵PID:2632
-
\??\c:\ddppj.exec:\ddppj.exe83⤵PID:2856
-
\??\c:\3frrrrr.exec:\3frrrrr.exe84⤵PID:2608
-
\??\c:\ttbttn.exec:\ttbttn.exe85⤵PID:2680
-
\??\c:\nnnhhh.exec:\nnnhhh.exe86⤵PID:1040
-
\??\c:\djdvd.exec:\djdvd.exe87⤵PID:3044
-
\??\c:\xrrrrlr.exec:\xrrrrlr.exe88⤵PID:2768
-
\??\c:\9hbhnt.exec:\9hbhnt.exe89⤵PID:2012
-
\??\c:\ppdjd.exec:\ppdjd.exe90⤵PID:1776
-
\??\c:\9rfrxfl.exec:\9rfrxfl.exe91⤵
- System Location Discovery: System Language Discovery
PID:1984 -
\??\c:\tnhnnh.exec:\tnhnnh.exe92⤵PID:1676
-
\??\c:\bbhhtn.exec:\bbhhtn.exe93⤵PID:2672
-
\??\c:\pjpjd.exec:\pjpjd.exe94⤵PID:2584
-
\??\c:\xflxlfl.exec:\xflxlfl.exe95⤵PID:988
-
\??\c:\btbttt.exec:\btbttt.exe96⤵PID:2908
-
\??\c:\tbntnn.exec:\tbntnn.exe97⤵PID:1996
-
\??\c:\dvddj.exec:\dvddj.exe98⤵PID:340
-
\??\c:\xxrrfrl.exec:\xxrrfrl.exe99⤵PID:2972
-
\??\c:\nhhbtb.exec:\nhhbtb.exe100⤵PID:1160
-
\??\c:\ntbbhh.exec:\ntbbhh.exe101⤵PID:2956
-
\??\c:\7djpd.exec:\7djpd.exe102⤵PID:2392
-
\??\c:\rxrflxl.exec:\rxrflxl.exe103⤵PID:1696
-
\??\c:\3ntnth.exec:\3ntnth.exe104⤵PID:2296
-
\??\c:\btnhtt.exec:\btnhtt.exe105⤵PID:1764
-
\??\c:\pjppv.exec:\pjppv.exe106⤵PID:780
-
\??\c:\xrflflf.exec:\xrflflf.exe107⤵PID:2500
-
\??\c:\ntbbtt.exec:\ntbbtt.exe108⤵PID:684
-
\??\c:\bbnbbh.exec:\bbnbbh.exe109⤵PID:1224
-
\??\c:\jdpjj.exec:\jdpjj.exe110⤵PID:2472
-
\??\c:\flfrflx.exec:\flfrflx.exe111⤵PID:1540
-
\??\c:\bhbbnt.exec:\bhbbnt.exe112⤵PID:1916
-
\??\c:\vvjjp.exec:\vvjjp.exe113⤵PID:1288
-
\??\c:\dvpdj.exec:\dvpdj.exe114⤵PID:3052
-
\??\c:\nbttbh.exec:\nbttbh.exe115⤵PID:896
-
\??\c:\9pdjp.exec:\9pdjp.exe116⤵PID:1760
-
\??\c:\dvjpj.exec:\dvjpj.exe117⤵PID:3020
-
\??\c:\fxlrrfl.exec:\fxlrrfl.exe118⤵PID:1388
-
\??\c:\tbnbnh.exec:\tbnbnh.exe119⤵PID:2244
-
\??\c:\5pdvv.exec:\5pdvv.exe120⤵PID:2188
-
\??\c:\jjvdv.exec:\jjvdv.exe121⤵PID:1596
-
\??\c:\rrxxfxf.exec:\rrxxfxf.exe122⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-