Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 23:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4N.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4N.exe
-
Size
66KB
-
MD5
ce4826005bb4045528189c95d5e48320
-
SHA1
9560083ae24c56640a828487dd336c1b51a59f3e
-
SHA256
0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4
-
SHA512
4f5ee932bcbbcc3f91f254f886b9b03d8b221c56324fe56c057c25542ade64b1fbc74786a48c42211074175006a1dc72108ff614a606c2fed7e1e1910e351c59
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Bqfo4n:ymb3NkkiQ3mdBjFI9cqfVn
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3688-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3760-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1156 7rrlxxf.exe 1028 thbtnh.exe 4732 7vvpd.exe 2808 djjdj.exe 3920 3rlfrrr.exe 5008 bhtttn.exe 4320 dppdv.exe 1540 vppdp.exe 3044 rrlxrff.exe 4916 pvvpj.exe 4584 5dvjd.exe 2032 frxrrxr.exe 4828 jddvp.exe 2476 9xrfrrl.exe 4328 xxlfxrl.exe 1440 bthbtb.exe 4836 bnbthh.exe 2532 pjjpp.exe 2964 rlrllff.exe 3136 dpvvv.exe 2836 1lllxrf.exe 1380 xrrrffx.exe 2504 nttnhh.exe 2028 djjjj.exe 2132 xfffffx.exe 4020 fxxxffr.exe 2584 nhhbtt.exe 2312 nbhhbh.exe 3760 dpjvd.exe 4636 llrrffx.exe 4784 bttnhh.exe 1220 rrxrllf.exe 2936 3rlfxxl.exe 1924 pjjjd.exe 4292 vjpjv.exe 2972 tnnhth.exe 2668 jvdvp.exe 1820 djvjd.exe 1796 lfxfxrx.exe 2656 nhnnnh.exe 116 thnhtb.exe 1284 lxrfxxx.exe 3796 nbnnhh.exe 4416 5dpjj.exe 4372 rlrfxrx.exe 4396 lrxxrrl.exe 2356 lrxxrrl.exe 3284 nntnhh.exe 5048 3ththh.exe 4124 pjjpj.exe 2336 rflfrrl.exe 3504 lflfxrr.exe 3436 thttnn.exe 1096 dvdvp.exe 4708 pjdpd.exe 3264 fxxxlll.exe 3216 7rrlxrr.exe 4120 3nnhbt.exe 548 pvvpd.exe 4516 9vvpd.exe 4220 xrrlrrl.exe 3220 nhnnnn.exe 3236 djvpd.exe 3788 jvvvj.exe -
resource yara_rule behavioral2/memory/3688-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3688 wrote to memory of 1156 3688 0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4N.exe 82 PID 3688 wrote to memory of 1156 3688 0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4N.exe 82 PID 3688 wrote to memory of 1156 3688 0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4N.exe 82 PID 1156 wrote to memory of 1028 1156 7rrlxxf.exe 83 PID 1156 wrote to memory of 1028 1156 7rrlxxf.exe 83 PID 1156 wrote to memory of 1028 1156 7rrlxxf.exe 83 PID 1028 wrote to memory of 4732 1028 thbtnh.exe 84 PID 1028 wrote to memory of 4732 1028 thbtnh.exe 84 PID 1028 wrote to memory of 4732 1028 thbtnh.exe 84 PID 4732 wrote to memory of 2808 4732 7vvpd.exe 85 PID 4732 wrote to memory of 2808 4732 7vvpd.exe 85 PID 4732 wrote to memory of 2808 4732 7vvpd.exe 85 PID 2808 wrote to memory of 3920 2808 djjdj.exe 86 PID 2808 wrote to memory of 3920 2808 djjdj.exe 86 PID 2808 wrote to memory of 3920 2808 djjdj.exe 86 PID 3920 wrote to memory of 5008 3920 3rlfrrr.exe 87 PID 3920 wrote to memory of 5008 3920 3rlfrrr.exe 87 PID 3920 wrote to memory of 5008 3920 3rlfrrr.exe 87 PID 5008 wrote to memory of 4320 5008 bhtttn.exe 88 PID 5008 wrote to memory of 4320 5008 bhtttn.exe 88 PID 5008 wrote to memory of 4320 5008 bhtttn.exe 88 PID 4320 wrote to memory of 1540 4320 dppdv.exe 89 PID 4320 wrote to memory of 1540 4320 dppdv.exe 89 PID 4320 wrote to memory of 1540 4320 dppdv.exe 89 PID 1540 wrote to memory of 3044 1540 vppdp.exe 90 PID 1540 wrote to memory of 3044 1540 vppdp.exe 90 PID 1540 wrote to memory of 3044 1540 vppdp.exe 90 PID 3044 wrote to memory of 4916 3044 rrlxrff.exe 91 PID 3044 wrote to memory of 4916 3044 rrlxrff.exe 91 PID 3044 wrote to memory of 4916 3044 rrlxrff.exe 91 PID 4916 wrote to memory of 4584 4916 pvvpj.exe 92 PID 4916 wrote to memory of 4584 4916 pvvpj.exe 92 PID 4916 wrote to memory of 4584 4916 pvvpj.exe 92 PID 4584 wrote to memory of 2032 4584 5dvjd.exe 93 PID 4584 wrote to memory of 2032 4584 5dvjd.exe 93 PID 4584 wrote to memory of 2032 4584 5dvjd.exe 93 PID 2032 wrote to memory of 4828 2032 frxrrxr.exe 94 PID 2032 wrote to memory of 4828 2032 frxrrxr.exe 94 PID 2032 wrote to memory of 4828 2032 frxrrxr.exe 94 PID 4828 wrote to memory of 2476 4828 jddvp.exe 95 PID 4828 wrote to memory of 2476 4828 jddvp.exe 95 PID 4828 wrote to memory of 2476 4828 jddvp.exe 95 PID 2476 wrote to memory of 4328 2476 9xrfrrl.exe 96 PID 2476 wrote to memory of 4328 2476 9xrfrrl.exe 96 PID 2476 wrote to memory of 4328 2476 9xrfrrl.exe 96 PID 4328 wrote to memory of 1440 4328 xxlfxrl.exe 97 PID 4328 wrote to memory of 1440 4328 xxlfxrl.exe 97 PID 4328 wrote to memory of 1440 4328 xxlfxrl.exe 97 PID 1440 wrote to memory of 4836 1440 bthbtb.exe 98 PID 1440 wrote to memory of 4836 1440 bthbtb.exe 98 PID 1440 wrote to memory of 4836 1440 bthbtb.exe 98 PID 4836 wrote to memory of 2532 4836 bnbthh.exe 99 PID 4836 wrote to memory of 2532 4836 bnbthh.exe 99 PID 4836 wrote to memory of 2532 4836 bnbthh.exe 99 PID 2532 wrote to memory of 2964 2532 pjjpp.exe 100 PID 2532 wrote to memory of 2964 2532 pjjpp.exe 100 PID 2532 wrote to memory of 2964 2532 pjjpp.exe 100 PID 2964 wrote to memory of 3136 2964 rlrllff.exe 101 PID 2964 wrote to memory of 3136 2964 rlrllff.exe 101 PID 2964 wrote to memory of 3136 2964 rlrllff.exe 101 PID 3136 wrote to memory of 2836 3136 dpvvv.exe 102 PID 3136 wrote to memory of 2836 3136 dpvvv.exe 102 PID 3136 wrote to memory of 2836 3136 dpvvv.exe 102 PID 2836 wrote to memory of 1380 2836 1lllxrf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4N.exe"C:\Users\Admin\AppData\Local\Temp\0c5623d6fef32b58e3468fd4f5320e81f3b5d74394e26dedb2cd0e791b8238a4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\7rrlxxf.exec:\7rrlxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\thbtnh.exec:\thbtnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\7vvpd.exec:\7vvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\djjdj.exec:\djjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\3rlfrrr.exec:\3rlfrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\bhtttn.exec:\bhtttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\dppdv.exec:\dppdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\vppdp.exec:\vppdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\rrlxrff.exec:\rrlxrff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\pvvpj.exec:\pvvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\5dvjd.exec:\5dvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\frxrrxr.exec:\frxrrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\jddvp.exec:\jddvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\9xrfrrl.exec:\9xrfrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\xxlfxrl.exec:\xxlfxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\bthbtb.exec:\bthbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\bnbthh.exec:\bnbthh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\pjjpp.exec:\pjjpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\rlrllff.exec:\rlrllff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\dpvvv.exec:\dpvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\1lllxrf.exec:\1lllxrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\xrrrffx.exec:\xrrrffx.exe23⤵
- Executes dropped EXE
PID:1380 -
\??\c:\nttnhh.exec:\nttnhh.exe24⤵
- Executes dropped EXE
PID:2504 -
\??\c:\djjjj.exec:\djjjj.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2028 -
\??\c:\xfffffx.exec:\xfffffx.exe26⤵
- Executes dropped EXE
PID:2132 -
\??\c:\fxxxffr.exec:\fxxxffr.exe27⤵
- Executes dropped EXE
PID:4020 -
\??\c:\nhhbtt.exec:\nhhbtt.exe28⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nbhhbh.exec:\nbhhbh.exe29⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dpjvd.exec:\dpjvd.exe30⤵
- Executes dropped EXE
PID:3760 -
\??\c:\llrrffx.exec:\llrrffx.exe31⤵
- Executes dropped EXE
PID:4636 -
\??\c:\bttnhh.exec:\bttnhh.exe32⤵
- Executes dropped EXE
PID:4784 -
\??\c:\rrxrllf.exec:\rrxrllf.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1220 -
\??\c:\3rlfxxl.exec:\3rlfxxl.exe34⤵
- Executes dropped EXE
PID:2936 -
\??\c:\pjjjd.exec:\pjjjd.exe35⤵
- Executes dropped EXE
PID:1924 -
\??\c:\vjpjv.exec:\vjpjv.exe36⤵
- Executes dropped EXE
PID:4292 -
\??\c:\tnnhth.exec:\tnnhth.exe37⤵
- Executes dropped EXE
PID:2972 -
\??\c:\jvdvp.exec:\jvdvp.exe38⤵
- Executes dropped EXE
PID:2668 -
\??\c:\djvjd.exec:\djvjd.exe39⤵
- Executes dropped EXE
PID:1820 -
\??\c:\lfxfxrx.exec:\lfxfxrx.exe40⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nhnnnh.exec:\nhnnnh.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\thnhtb.exec:\thnhtb.exe42⤵
- Executes dropped EXE
PID:116 -
\??\c:\lxrfxxx.exec:\lxrfxxx.exe43⤵
- Executes dropped EXE
PID:1284 -
\??\c:\nbnnhh.exec:\nbnnhh.exe44⤵
- Executes dropped EXE
PID:3796 -
\??\c:\5dpjj.exec:\5dpjj.exe45⤵
- Executes dropped EXE
PID:4416 -
\??\c:\rlrfxrx.exec:\rlrfxrx.exe46⤵
- Executes dropped EXE
PID:4372 -
\??\c:\lrxxrrl.exec:\lrxxrrl.exe47⤵
- Executes dropped EXE
PID:4396 -
\??\c:\lrxxrrl.exec:\lrxxrrl.exe48⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nntnhh.exec:\nntnhh.exe49⤵
- Executes dropped EXE
PID:3284 -
\??\c:\3ththh.exec:\3ththh.exe50⤵
- Executes dropped EXE
PID:5048 -
\??\c:\pjjpj.exec:\pjjpj.exe51⤵
- Executes dropped EXE
PID:4124 -
\??\c:\rflfrrl.exec:\rflfrrl.exe52⤵
- Executes dropped EXE
PID:2336 -
\??\c:\lflfxrr.exec:\lflfxrr.exe53⤵
- Executes dropped EXE
PID:3504 -
\??\c:\thttnn.exec:\thttnn.exe54⤵
- Executes dropped EXE
PID:3436 -
\??\c:\dvdvp.exec:\dvdvp.exe55⤵
- Executes dropped EXE
PID:1096 -
\??\c:\pjdpd.exec:\pjdpd.exe56⤵
- Executes dropped EXE
PID:4708 -
\??\c:\fxxxlll.exec:\fxxxlll.exe57⤵
- Executes dropped EXE
PID:3264 -
\??\c:\7rrlxrr.exec:\7rrlxrr.exe58⤵
- Executes dropped EXE
PID:3216 -
\??\c:\3nnhbt.exec:\3nnhbt.exe59⤵
- Executes dropped EXE
PID:4120 -
\??\c:\pvvpd.exec:\pvvpd.exe60⤵
- Executes dropped EXE
PID:548 -
\??\c:\9vvpd.exec:\9vvpd.exe61⤵
- Executes dropped EXE
PID:4516 -
\??\c:\xrrlrrl.exec:\xrrlrrl.exe62⤵
- Executes dropped EXE
PID:4220 -
\??\c:\nhnnnn.exec:\nhnnnn.exe63⤵
- Executes dropped EXE
PID:3220 -
\??\c:\djvpd.exec:\djvpd.exe64⤵
- Executes dropped EXE
PID:3236 -
\??\c:\jvvvj.exec:\jvvvj.exe65⤵
- Executes dropped EXE
PID:3788 -
\??\c:\xllxrrl.exec:\xllxrrl.exe66⤵PID:1532
-
\??\c:\tntnhh.exec:\tntnhh.exe67⤵PID:1972
-
\??\c:\httnhh.exec:\httnhh.exe68⤵PID:4804
-
\??\c:\pvjdd.exec:\pvjdd.exe69⤵PID:1312
-
\??\c:\vpppj.exec:\vpppj.exe70⤵PID:836
-
\??\c:\lffxrxl.exec:\lffxrxl.exe71⤵PID:384
-
\??\c:\5bnhht.exec:\5bnhht.exe72⤵PID:1816
-
\??\c:\hbnhtt.exec:\hbnhtt.exe73⤵PID:2664
-
\??\c:\ddjpd.exec:\ddjpd.exe74⤵PID:3680
-
\??\c:\dpjdv.exec:\dpjdv.exe75⤵PID:4580
-
\??\c:\9fxrfrx.exec:\9fxrfrx.exe76⤵PID:2964
-
\??\c:\lfllllf.exec:\lfllllf.exe77⤵PID:2932
-
\??\c:\btbbhh.exec:\btbbhh.exe78⤵PID:552
-
\??\c:\nhhnnn.exec:\nhhnnn.exe79⤵PID:2468
-
\??\c:\dpvpj.exec:\dpvpj.exe80⤵PID:3056
-
\??\c:\fxlffxr.exec:\fxlffxr.exe81⤵PID:2240
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe82⤵PID:3224
-
\??\c:\btnnnn.exec:\btnnnn.exe83⤵PID:2064
-
\??\c:\vdddv.exec:\vdddv.exe84⤵PID:4756
-
\??\c:\vjvjd.exec:\vjvjd.exe85⤵PID:1728
-
\??\c:\rflfxxr.exec:\rflfxxr.exe86⤵PID:2584
-
\??\c:\rffffff.exec:\rffffff.exe87⤵PID:4688
-
\??\c:\jjppp.exec:\jjppp.exe88⤵PID:2096
-
\??\c:\xxlfrrr.exec:\xxlfrrr.exe89⤵PID:2748
-
\??\c:\hbbbtt.exec:\hbbbtt.exe90⤵PID:968
-
\??\c:\bhnhbt.exec:\bhnhbt.exe91⤵PID:1752
-
\??\c:\dvdvv.exec:\dvdvv.exe92⤵PID:2212
-
\??\c:\lxrxfff.exec:\lxrxfff.exe93⤵PID:2328
-
\??\c:\xffxxrl.exec:\xffxxrl.exe94⤵PID:1148
-
\??\c:\bnnnbh.exec:\bnnnbh.exe95⤵PID:4524
-
\??\c:\ppvpp.exec:\ppvpp.exe96⤵PID:464
-
\??\c:\ddvdd.exec:\ddvdd.exe97⤵PID:1048
-
\??\c:\9rxrflf.exec:\9rxrflf.exe98⤵PID:3912
-
\??\c:\flrrllf.exec:\flrrllf.exe99⤵PID:4928
-
\??\c:\bbtttt.exec:\bbtttt.exe100⤵PID:4004
-
\??\c:\nntnhh.exec:\nntnhh.exe101⤵PID:2760
-
\??\c:\1vjdj.exec:\1vjdj.exe102⤵PID:2192
-
\??\c:\1jjpj.exec:\1jjpj.exe103⤵PID:4892
-
\??\c:\rlfxllf.exec:\rlfxllf.exe104⤵PID:4424
-
\??\c:\flfrrxl.exec:\flfrrxl.exe105⤵PID:4316
-
\??\c:\7btnhh.exec:\7btnhh.exe106⤵PID:3348
-
\??\c:\pvdvp.exec:\pvdvp.exe107⤵PID:4496
-
\??\c:\dvvpd.exec:\dvvpd.exe108⤵PID:3392
-
\??\c:\rlxrfxr.exec:\rlxrfxr.exe109⤵PID:4732
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe110⤵PID:3784
-
\??\c:\htbtbb.exec:\htbtbb.exe111⤵PID:2336
-
\??\c:\dppjv.exec:\dppjv.exe112⤵PID:1452
-
\??\c:\jddvj.exec:\jddvj.exe113⤵PID:3316
-
\??\c:\5rxrrfx.exec:\5rxrrfx.exe114⤵PID:1096
-
\??\c:\htnnnn.exec:\htnnnn.exe115⤵PID:2692
-
\??\c:\hnthnb.exec:\hnthnb.exe116⤵PID:3916
-
\??\c:\7vpjv.exec:\7vpjv.exe117⤵PID:1420
-
\??\c:\pjdvp.exec:\pjdvp.exe118⤵PID:3576
-
\??\c:\bhbnhb.exec:\bhbnhb.exe119⤵PID:208
-
\??\c:\tnnbnh.exec:\tnnbnh.exe120⤵PID:3044
-
\??\c:\pdvjv.exec:\pdvjv.exe121⤵PID:3572
-
\??\c:\vdvjd.exec:\vdvjd.exe122⤵PID:2112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-