Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 18:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
13406d30efa6b2bb979f03e0a037158b896d2c93bb7f1885e62a03620d5cdf1d.exe
Resource
win7-20240729-en
6 signatures
150 seconds
General
-
Target
13406d30efa6b2bb979f03e0a037158b896d2c93bb7f1885e62a03620d5cdf1d.exe
-
Size
147KB
-
MD5
ca091f138741abc09133751a54234a27
-
SHA1
01f1e7c3c2c5a834f4e4b4ce25b65d39f303c838
-
SHA256
13406d30efa6b2bb979f03e0a037158b896d2c93bb7f1885e62a03620d5cdf1d
-
SHA512
4ae8198f551989832d4f8a39291bbd05e262869ee9513db06f640381549988610385f39bb7876910cfbc5c42c1cfef8f8a46a9bff6a5a2c541c9b499136b8618
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIY7is8URxQkwco8rIr5nhkEFIsSy5x0i5beF:n3C9BRIgis8lmZO5hVS4leF
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3624-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/424-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3012 9ffxlfx.exe 3940 hbntbh.exe 4844 dvvjv.exe 4968 lllxxlf.exe 224 thhbtt.exe 2732 fxrfxrf.exe 3488 flrfxxr.exe 3708 5ntnbn.exe 1444 djjdp.exe 368 9xrlfxr.exe 424 bttnnh.exe 2096 vjjdd.exe 3912 vvdpd.exe 4916 flrfxrl.exe 2492 9bnhhb.exe 2944 dpppd.exe 608 llfrlrl.exe 4568 bntnhh.exe 1956 hbhhhb.exe 2152 jddjj.exe 3476 5rxlffr.exe 1828 9ddvp.exe 3440 rflxlfr.exe 3128 htnnbt.exe 864 ddvvp.exe 1196 rlrrllf.exe 4624 nbbthh.exe 4500 vpjdv.exe 1016 5rfxrrl.exe 680 xxrlllf.exe 3904 nhhnnb.exe 2360 5hhtnn.exe 2140 jdjvp.exe 3508 lxxrfxr.exe 2992 tnttbb.exe 5032 hthbtt.exe 3648 vpjdd.exe 1228 dvvpv.exe 1360 1xfrlxr.exe 4092 nhnnbt.exe 3560 bnnhhh.exe 4444 vvjdv.exe 4284 vpjdd.exe 3052 rlrlfxr.exe 1652 thnnnn.exe 3752 hbhhbb.exe 3008 1xrlxxx.exe 4312 ffrllxl.exe 4844 bnbttt.exe 2900 hnbtnh.exe 1272 ddddv.exe 1760 fxxlxxx.exe 1380 1fxrlll.exe 2440 nnnnhn.exe 2396 3hnhbb.exe 3808 7jjdp.exe 2804 dvdvv.exe 1444 xxxlffr.exe 3720 xlxlllr.exe 2308 hbnntb.exe 1036 nhnntn.exe 772 jddvp.exe 4408 fxfxxxl.exe 2716 lrxlflf.exe -
resource yara_rule behavioral2/memory/3624-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/424-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3624 wrote to memory of 3012 3624 13406d30efa6b2bb979f03e0a037158b896d2c93bb7f1885e62a03620d5cdf1d.exe 83 PID 3624 wrote to memory of 3012 3624 13406d30efa6b2bb979f03e0a037158b896d2c93bb7f1885e62a03620d5cdf1d.exe 83 PID 3624 wrote to memory of 3012 3624 13406d30efa6b2bb979f03e0a037158b896d2c93bb7f1885e62a03620d5cdf1d.exe 83 PID 3012 wrote to memory of 3940 3012 9ffxlfx.exe 84 PID 3012 wrote to memory of 3940 3012 9ffxlfx.exe 84 PID 3012 wrote to memory of 3940 3012 9ffxlfx.exe 84 PID 3940 wrote to memory of 4844 3940 hbntbh.exe 85 PID 3940 wrote to memory of 4844 3940 hbntbh.exe 85 PID 3940 wrote to memory of 4844 3940 hbntbh.exe 85 PID 4844 wrote to memory of 4968 4844 dvvjv.exe 86 PID 4844 wrote to memory of 4968 4844 dvvjv.exe 86 PID 4844 wrote to memory of 4968 4844 dvvjv.exe 86 PID 4968 wrote to memory of 224 4968 lllxxlf.exe 88 PID 4968 wrote to memory of 224 4968 lllxxlf.exe 88 PID 4968 wrote to memory of 224 4968 lllxxlf.exe 88 PID 224 wrote to memory of 2732 224 thhbtt.exe 89 PID 224 wrote to memory of 2732 224 thhbtt.exe 89 PID 224 wrote to memory of 2732 224 thhbtt.exe 89 PID 2732 wrote to memory of 3488 2732 fxrfxrf.exe 90 PID 2732 wrote to memory of 3488 2732 fxrfxrf.exe 90 PID 2732 wrote to memory of 3488 2732 fxrfxrf.exe 90 PID 3488 wrote to memory of 3708 3488 flrfxxr.exe 91 PID 3488 wrote to memory of 3708 3488 flrfxxr.exe 91 PID 3488 wrote to memory of 3708 3488 flrfxxr.exe 91 PID 3708 wrote to memory of 1444 3708 5ntnbn.exe 92 PID 3708 wrote to memory of 1444 3708 5ntnbn.exe 92 PID 3708 wrote to memory of 1444 3708 5ntnbn.exe 92 PID 1444 wrote to memory of 368 1444 djjdp.exe 93 PID 1444 wrote to memory of 368 1444 djjdp.exe 93 PID 1444 wrote to memory of 368 1444 djjdp.exe 93 PID 368 wrote to memory of 424 368 9xrlfxr.exe 94 PID 368 wrote to memory of 424 368 9xrlfxr.exe 94 PID 368 wrote to memory of 424 368 9xrlfxr.exe 94 PID 424 wrote to memory of 2096 424 bttnnh.exe 95 PID 424 wrote to memory of 2096 424 bttnnh.exe 95 PID 424 wrote to memory of 2096 424 bttnnh.exe 95 PID 2096 wrote to memory of 3912 2096 vjjdd.exe 96 PID 2096 wrote to memory of 3912 2096 vjjdd.exe 96 PID 2096 wrote to memory of 3912 2096 vjjdd.exe 96 PID 3912 wrote to memory of 4916 3912 vvdpd.exe 97 PID 3912 wrote to memory of 4916 3912 vvdpd.exe 97 PID 3912 wrote to memory of 4916 3912 vvdpd.exe 97 PID 4916 wrote to memory of 2492 4916 flrfxrl.exe 98 PID 4916 wrote to memory of 2492 4916 flrfxrl.exe 98 PID 4916 wrote to memory of 2492 4916 flrfxrl.exe 98 PID 2492 wrote to memory of 2944 2492 9bnhhb.exe 99 PID 2492 wrote to memory of 2944 2492 9bnhhb.exe 99 PID 2492 wrote to memory of 2944 2492 9bnhhb.exe 99 PID 2944 wrote to memory of 608 2944 dpppd.exe 100 PID 2944 wrote to memory of 608 2944 dpppd.exe 100 PID 2944 wrote to memory of 608 2944 dpppd.exe 100 PID 608 wrote to memory of 4568 608 llfrlrl.exe 101 PID 608 wrote to memory of 4568 608 llfrlrl.exe 101 PID 608 wrote to memory of 4568 608 llfrlrl.exe 101 PID 4568 wrote to memory of 1956 4568 bntnhh.exe 102 PID 4568 wrote to memory of 1956 4568 bntnhh.exe 102 PID 4568 wrote to memory of 1956 4568 bntnhh.exe 102 PID 1956 wrote to memory of 2152 1956 hbhhhb.exe 103 PID 1956 wrote to memory of 2152 1956 hbhhhb.exe 103 PID 1956 wrote to memory of 2152 1956 hbhhhb.exe 103 PID 2152 wrote to memory of 3476 2152 jddjj.exe 104 PID 2152 wrote to memory of 3476 2152 jddjj.exe 104 PID 2152 wrote to memory of 3476 2152 jddjj.exe 104 PID 3476 wrote to memory of 1828 3476 5rxlffr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\13406d30efa6b2bb979f03e0a037158b896d2c93bb7f1885e62a03620d5cdf1d.exe"C:\Users\Admin\AppData\Local\Temp\13406d30efa6b2bb979f03e0a037158b896d2c93bb7f1885e62a03620d5cdf1d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\9ffxlfx.exec:\9ffxlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\hbntbh.exec:\hbntbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\dvvjv.exec:\dvvjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\lllxxlf.exec:\lllxxlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\thhbtt.exec:\thhbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\fxrfxrf.exec:\fxrfxrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\flrfxxr.exec:\flrfxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\5ntnbn.exec:\5ntnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\djjdp.exec:\djjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\9xrlfxr.exec:\9xrlfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\bttnnh.exec:\bttnnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
\??\c:\vjjdd.exec:\vjjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\vvdpd.exec:\vvdpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\flrfxrl.exec:\flrfxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\9bnhhb.exec:\9bnhhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\dpppd.exec:\dpppd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\llfrlrl.exec:\llfrlrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\bntnhh.exec:\bntnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\hbhhhb.exec:\hbhhhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\jddjj.exec:\jddjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\5rxlffr.exec:\5rxlffr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\9ddvp.exec:\9ddvp.exe23⤵
- Executes dropped EXE
PID:1828 -
\??\c:\rflxlfr.exec:\rflxlfr.exe24⤵
- Executes dropped EXE
PID:3440 -
\??\c:\htnnbt.exec:\htnnbt.exe25⤵
- Executes dropped EXE
PID:3128 -
\??\c:\ddvvp.exec:\ddvvp.exe26⤵
- Executes dropped EXE
PID:864 -
\??\c:\rlrrllf.exec:\rlrrllf.exe27⤵
- Executes dropped EXE
PID:1196 -
\??\c:\nbbthh.exec:\nbbthh.exe28⤵
- Executes dropped EXE
PID:4624 -
\??\c:\vpjdv.exec:\vpjdv.exe29⤵
- Executes dropped EXE
PID:4500 -
\??\c:\5rfxrrl.exec:\5rfxrrl.exe30⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xxrlllf.exec:\xxrlllf.exe31⤵
- Executes dropped EXE
PID:680 -
\??\c:\nhhnnb.exec:\nhhnnb.exe32⤵
- Executes dropped EXE
PID:3904 -
\??\c:\5hhtnn.exec:\5hhtnn.exe33⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jdjvp.exec:\jdjvp.exe34⤵
- Executes dropped EXE
PID:2140 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe35⤵
- Executes dropped EXE
PID:3508 -
\??\c:\tnttbb.exec:\tnttbb.exe36⤵
- Executes dropped EXE
PID:2992 -
\??\c:\hthbtt.exec:\hthbtt.exe37⤵
- Executes dropped EXE
PID:5032 -
\??\c:\vpjdd.exec:\vpjdd.exe38⤵
- Executes dropped EXE
PID:3648 -
\??\c:\dvvpv.exec:\dvvpv.exe39⤵
- Executes dropped EXE
PID:1228 -
\??\c:\1xfrlxr.exec:\1xfrlxr.exe40⤵
- Executes dropped EXE
PID:1360 -
\??\c:\nhnnbt.exec:\nhnnbt.exe41⤵
- Executes dropped EXE
PID:4092 -
\??\c:\bnnhhh.exec:\bnnhhh.exe42⤵
- Executes dropped EXE
PID:3560 -
\??\c:\vvjdv.exec:\vvjdv.exe43⤵
- Executes dropped EXE
PID:4444 -
\??\c:\vpjdd.exec:\vpjdd.exe44⤵
- Executes dropped EXE
PID:4284 -
\??\c:\rlrlfxr.exec:\rlrlfxr.exe45⤵
- Executes dropped EXE
PID:3052 -
\??\c:\thnnnn.exec:\thnnnn.exe46⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hbhhbb.exec:\hbhhbb.exe47⤵
- Executes dropped EXE
PID:3752 -
\??\c:\1xrlxxx.exec:\1xrlxxx.exe48⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ffrllxl.exec:\ffrllxl.exe49⤵
- Executes dropped EXE
PID:4312 -
\??\c:\bnbttt.exec:\bnbttt.exe50⤵
- Executes dropped EXE
PID:4844 -
\??\c:\hnbtnh.exec:\hnbtnh.exe51⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ddddv.exec:\ddddv.exe52⤵
- Executes dropped EXE
PID:1272 -
\??\c:\fxxlxxx.exec:\fxxlxxx.exe53⤵
- Executes dropped EXE
PID:1760 -
\??\c:\1fxrlll.exec:\1fxrlll.exe54⤵
- Executes dropped EXE
PID:1380 -
\??\c:\nnnnhn.exec:\nnnnhn.exe55⤵
- Executes dropped EXE
PID:2440 -
\??\c:\3hnhbb.exec:\3hnhbb.exe56⤵
- Executes dropped EXE
PID:2396 -
\??\c:\7jjdp.exec:\7jjdp.exe57⤵
- Executes dropped EXE
PID:3808 -
\??\c:\dvdvv.exec:\dvdvv.exe58⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xxxlffr.exec:\xxxlffr.exe59⤵
- Executes dropped EXE
PID:1444 -
\??\c:\xlxlllr.exec:\xlxlllr.exe60⤵
- Executes dropped EXE
PID:3720 -
\??\c:\hbnntb.exec:\hbnntb.exe61⤵
- Executes dropped EXE
PID:2308 -
\??\c:\nhnntn.exec:\nhnntn.exe62⤵
- Executes dropped EXE
PID:1036 -
\??\c:\jddvp.exec:\jddvp.exe63⤵
- Executes dropped EXE
PID:772 -
\??\c:\fxfxxxl.exec:\fxfxxxl.exe64⤵
- Executes dropped EXE
PID:4408 -
\??\c:\lrxlflf.exec:\lrxlflf.exe65⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hhnnhh.exec:\hhnnhh.exe66⤵PID:2492
-
\??\c:\jjpjj.exec:\jjpjj.exe67⤵PID:3340
-
\??\c:\vjjdp.exec:\vjjdp.exe68⤵PID:3980
-
\??\c:\rffxlfx.exec:\rffxlfx.exe69⤵PID:4692
-
\??\c:\frrrrll.exec:\frrrrll.exe70⤵PID:1672
-
\??\c:\tbbbtt.exec:\tbbbtt.exe71⤵PID:4064
-
\??\c:\tnnhbb.exec:\tnnhbb.exe72⤵PID:1996
-
\??\c:\lrxfffr.exec:\lrxfffr.exe73⤵PID:2152
-
\??\c:\5bbtnh.exec:\5bbtnh.exe74⤵PID:1232
-
\??\c:\jddvj.exec:\jddvj.exe75⤵PID:3536
-
\??\c:\dpvpj.exec:\dpvpj.exe76⤵PID:3920
-
\??\c:\frlfxxr.exec:\frlfxxr.exe77⤵PID:3712
-
\??\c:\1xfxxxr.exec:\1xfxxxr.exe78⤵PID:4912
-
\??\c:\3bbttt.exec:\3bbttt.exe79⤵PID:2688
-
\??\c:\jvjjd.exec:\jvjjd.exe80⤵PID:4904
-
\??\c:\pjdvp.exec:\pjdvp.exe81⤵PID:2916
-
\??\c:\1lfrlll.exec:\1lfrlll.exe82⤵PID:3564
-
\??\c:\nhnbtn.exec:\nhnbtn.exe83⤵PID:1700
-
\??\c:\hhbhtt.exec:\hhbhtt.exe84⤵
- System Location Discovery: System Language Discovery
PID:808 -
\??\c:\vppjd.exec:\vppjd.exe85⤵PID:3256
-
\??\c:\lflfffl.exec:\lflfffl.exe86⤵PID:3904
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe87⤵PID:1940
-
\??\c:\nbnnnn.exec:\nbnnnn.exe88⤵
- System Location Discovery: System Language Discovery
PID:2360 -
\??\c:\5ppdv.exec:\5ppdv.exe89⤵PID:2652
-
\??\c:\vjjdd.exec:\vjjdd.exe90⤵PID:1120
-
\??\c:\vjvvj.exec:\vjvvj.exe91⤵PID:452
-
\??\c:\xrrfrlf.exec:\xrrfrlf.exe92⤵PID:1948
-
\??\c:\nhthht.exec:\nhthht.exe93⤵PID:4920
-
\??\c:\ppvpd.exec:\ppvpd.exe94⤵PID:2404
-
\??\c:\xxxrlll.exec:\xxxrlll.exe95⤵PID:1360
-
\??\c:\btbtth.exec:\btbtth.exe96⤵PID:3692
-
\??\c:\bttntt.exec:\bttntt.exe97⤵PID:3852
-
\??\c:\dvdvd.exec:\dvdvd.exe98⤵PID:4444
-
\??\c:\lfxrxrx.exec:\lfxrxrx.exe99⤵PID:3012
-
\??\c:\hhnhbb.exec:\hhnhbb.exe100⤵PID:2644
-
\??\c:\dvvdj.exec:\dvvdj.exe101⤵PID:2292
-
\??\c:\xrfxfrx.exec:\xrfxfrx.exe102⤵PID:3796
-
\??\c:\7ntttt.exec:\7ntttt.exe103⤵PID:3008
-
\??\c:\vjjdp.exec:\vjjdp.exe104⤵PID:3328
-
\??\c:\1xxrrrl.exec:\1xxrrrl.exe105⤵PID:1740
-
\??\c:\bnnnbb.exec:\bnnnbb.exe106⤵PID:1976
-
\??\c:\3nnhhh.exec:\3nnhhh.exe107⤵PID:1272
-
\??\c:\dddvj.exec:\dddvj.exe108⤵PID:1760
-
\??\c:\fxxrlxr.exec:\fxxrlxr.exe109⤵PID:2620
-
\??\c:\rllfxrr.exec:\rllfxrr.exe110⤵PID:2120
-
\??\c:\9nttnb.exec:\9nttnb.exe111⤵PID:4768
-
\??\c:\jpjdd.exec:\jpjdd.exe112⤵PID:220
-
\??\c:\dvpdv.exec:\dvpdv.exe113⤵PID:3632
-
\??\c:\rlfrlff.exec:\rlfrlff.exe114⤵PID:4144
-
\??\c:\nbnnnn.exec:\nbnnnn.exe115⤵PID:4080
-
\??\c:\ddvpv.exec:\ddvpv.exe116⤵PID:2096
-
\??\c:\pdjvd.exec:\pdjvd.exe117⤵PID:964
-
\??\c:\rfllxxx.exec:\rfllxxx.exe118⤵PID:772
-
\??\c:\htbtnn.exec:\htbtnn.exe119⤵PID:3672
-
\??\c:\bhnhbb.exec:\bhnhbb.exe120⤵PID:2716
-
\??\c:\pjjjd.exec:\pjjjd.exe121⤵PID:4456
-
\??\c:\1rxlfll.exec:\1rxlfll.exe122⤵PID:3340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-