Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 11:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72.exe
-
Size
66KB
-
MD5
7dc2efe69bce3e7b63a16301849e3114
-
SHA1
ae2ba113fca0dfab484e570cb7f6682aff94846f
-
SHA256
f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72
-
SHA512
66a36f6ea9106c5aa220f78b3da9dcc535f6f351364b8275c898ffe17d4b984736ffd065977ef79ad8ccd3ebf994bba8b75782808f10870ee5cd4c3f7704d55f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzNM+:ymb3NkkiQ3mdBjFIvlpM+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/4120-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2660-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1664 ttbttn.exe 3340 3djdp.exe 3940 jvddj.exe 3728 lxxrxrf.exe 3656 bthnbh.exe 1020 pjvpv.exe 1060 llrffxl.exe 1080 nbnhhb.exe 2904 1pjvj.exe 1544 rrxrrrx.exe 1628 btbbtt.exe 4012 9ttttt.exe 2660 dvvdv.exe 2832 lllllfl.exe 3592 1nbtth.exe 3664 ddddv.exe 3368 7frlffx.exe 8 xlrrlll.exe 2776 nbnnhh.exe 2188 dvddv.exe 4896 pdjdj.exe 1340 lfffffr.exe 1224 bhbntn.exe 1868 dddvj.exe 2064 pjdvv.exe 3912 frrxfll.exe 4776 nbnhbh.exe 4708 vvvvj.exe 4880 jdddd.exe 4584 rrfxfxf.exe 548 bhnhhb.exe 944 bntnhb.exe 2244 3jpjj.exe 1488 jjjdv.exe 3748 frxrllf.exe 3612 frxrrrf.exe 216 bntnnb.exe 2788 djdjd.exe 3852 fxflxxx.exe 756 btthtn.exe 1516 ddjjj.exe 404 xlrlfxr.exe 2228 btntnn.exe 3668 bbbbhb.exe 4424 rfrlfrl.exe 4404 bnnhhb.exe 2512 nnbbht.exe 3448 dvjpv.exe 1028 rlrrffx.exe 2980 xrfffll.exe 2220 hbbtnn.exe 2628 bbbhbb.exe 1212 ppjvp.exe 3864 xxrlrrl.exe 3656 1xfrllf.exe 2932 tntntb.exe 2348 vjjpp.exe 3928 jdpjv.exe 3700 llfxxxx.exe 964 tnbbbb.exe 2120 bbhbnn.exe 1996 dpvpj.exe 4428 jdvvp.exe 3088 fxrxrff.exe -
resource yara_rule behavioral2/memory/4120-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2660-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1868-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4120 wrote to memory of 1664 4120 f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72.exe 83 PID 4120 wrote to memory of 1664 4120 f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72.exe 83 PID 4120 wrote to memory of 1664 4120 f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72.exe 83 PID 1664 wrote to memory of 3340 1664 ttbttn.exe 84 PID 1664 wrote to memory of 3340 1664 ttbttn.exe 84 PID 1664 wrote to memory of 3340 1664 ttbttn.exe 84 PID 3340 wrote to memory of 3940 3340 3djdp.exe 85 PID 3340 wrote to memory of 3940 3340 3djdp.exe 85 PID 3340 wrote to memory of 3940 3340 3djdp.exe 85 PID 3940 wrote to memory of 3728 3940 jvddj.exe 86 PID 3940 wrote to memory of 3728 3940 jvddj.exe 86 PID 3940 wrote to memory of 3728 3940 jvddj.exe 86 PID 3728 wrote to memory of 3656 3728 lxxrxrf.exe 87 PID 3728 wrote to memory of 3656 3728 lxxrxrf.exe 87 PID 3728 wrote to memory of 3656 3728 lxxrxrf.exe 87 PID 3656 wrote to memory of 1020 3656 bthnbh.exe 88 PID 3656 wrote to memory of 1020 3656 bthnbh.exe 88 PID 3656 wrote to memory of 1020 3656 bthnbh.exe 88 PID 1020 wrote to memory of 1060 1020 pjvpv.exe 89 PID 1020 wrote to memory of 1060 1020 pjvpv.exe 89 PID 1020 wrote to memory of 1060 1020 pjvpv.exe 89 PID 1060 wrote to memory of 1080 1060 llrffxl.exe 90 PID 1060 wrote to memory of 1080 1060 llrffxl.exe 90 PID 1060 wrote to memory of 1080 1060 llrffxl.exe 90 PID 1080 wrote to memory of 2904 1080 nbnhhb.exe 91 PID 1080 wrote to memory of 2904 1080 nbnhhb.exe 91 PID 1080 wrote to memory of 2904 1080 nbnhhb.exe 91 PID 2904 wrote to memory of 1544 2904 1pjvj.exe 92 PID 2904 wrote to memory of 1544 2904 1pjvj.exe 92 PID 2904 wrote to memory of 1544 2904 1pjvj.exe 92 PID 1544 wrote to memory of 1628 1544 rrxrrrx.exe 93 PID 1544 wrote to memory of 1628 1544 rrxrrrx.exe 93 PID 1544 wrote to memory of 1628 1544 rrxrrrx.exe 93 PID 1628 wrote to memory of 4012 1628 btbbtt.exe 94 PID 1628 wrote to memory of 4012 1628 btbbtt.exe 94 PID 1628 wrote to memory of 4012 1628 btbbtt.exe 94 PID 4012 wrote to memory of 2660 4012 9ttttt.exe 95 PID 4012 wrote to memory of 2660 4012 9ttttt.exe 95 PID 4012 wrote to memory of 2660 4012 9ttttt.exe 95 PID 2660 wrote to memory of 2832 2660 dvvdv.exe 96 PID 2660 wrote to memory of 2832 2660 dvvdv.exe 96 PID 2660 wrote to memory of 2832 2660 dvvdv.exe 96 PID 2832 wrote to memory of 3592 2832 lllllfl.exe 97 PID 2832 wrote to memory of 3592 2832 lllllfl.exe 97 PID 2832 wrote to memory of 3592 2832 lllllfl.exe 97 PID 3592 wrote to memory of 3664 3592 1nbtth.exe 98 PID 3592 wrote to memory of 3664 3592 1nbtth.exe 98 PID 3592 wrote to memory of 3664 3592 1nbtth.exe 98 PID 3664 wrote to memory of 3368 3664 ddddv.exe 99 PID 3664 wrote to memory of 3368 3664 ddddv.exe 99 PID 3664 wrote to memory of 3368 3664 ddddv.exe 99 PID 3368 wrote to memory of 8 3368 7frlffx.exe 100 PID 3368 wrote to memory of 8 3368 7frlffx.exe 100 PID 3368 wrote to memory of 8 3368 7frlffx.exe 100 PID 8 wrote to memory of 2776 8 xlrrlll.exe 101 PID 8 wrote to memory of 2776 8 xlrrlll.exe 101 PID 8 wrote to memory of 2776 8 xlrrlll.exe 101 PID 2776 wrote to memory of 2188 2776 nbnnhh.exe 102 PID 2776 wrote to memory of 2188 2776 nbnnhh.exe 102 PID 2776 wrote to memory of 2188 2776 nbnnhh.exe 102 PID 2188 wrote to memory of 4896 2188 dvddv.exe 103 PID 2188 wrote to memory of 4896 2188 dvddv.exe 103 PID 2188 wrote to memory of 4896 2188 dvddv.exe 103 PID 4896 wrote to memory of 1340 4896 pdjdj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72.exe"C:\Users\Admin\AppData\Local\Temp\f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\ttbttn.exec:\ttbttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\3djdp.exec:\3djdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\jvddj.exec:\jvddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\lxxrxrf.exec:\lxxrxrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\bthnbh.exec:\bthnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\pjvpv.exec:\pjvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\llrffxl.exec:\llrffxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\nbnhhb.exec:\nbnhhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\1pjvj.exec:\1pjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\rrxrrrx.exec:\rrxrrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\btbbtt.exec:\btbbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\9ttttt.exec:\9ttttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\dvvdv.exec:\dvvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\lllllfl.exec:\lllllfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\1nbtth.exec:\1nbtth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\ddddv.exec:\ddddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\7frlffx.exec:\7frlffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\xlrrlll.exec:\xlrrlll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\nbnnhh.exec:\nbnnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\dvddv.exec:\dvddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\pdjdj.exec:\pdjdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\lfffffr.exec:\lfffffr.exe23⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bhbntn.exec:\bhbntn.exe24⤵
- Executes dropped EXE
PID:1224 -
\??\c:\dddvj.exec:\dddvj.exe25⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pjdvv.exec:\pjdvv.exe26⤵
- Executes dropped EXE
PID:2064 -
\??\c:\frrxfll.exec:\frrxfll.exe27⤵
- Executes dropped EXE
PID:3912 -
\??\c:\nbnhbh.exec:\nbnhbh.exe28⤵
- Executes dropped EXE
PID:4776 -
\??\c:\vvvvj.exec:\vvvvj.exe29⤵
- Executes dropped EXE
PID:4708 -
\??\c:\jdddd.exec:\jdddd.exe30⤵
- Executes dropped EXE
PID:4880 -
\??\c:\rrfxfxf.exec:\rrfxfxf.exe31⤵
- Executes dropped EXE
PID:4584 -
\??\c:\bhnhhb.exec:\bhnhhb.exe32⤵
- Executes dropped EXE
PID:548 -
\??\c:\bntnhb.exec:\bntnhb.exe33⤵
- Executes dropped EXE
PID:944 -
\??\c:\3jpjj.exec:\3jpjj.exe34⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jjjdv.exec:\jjjdv.exe35⤵
- Executes dropped EXE
PID:1488 -
\??\c:\frxrllf.exec:\frxrllf.exe36⤵
- Executes dropped EXE
PID:3748 -
\??\c:\frxrrrf.exec:\frxrrrf.exe37⤵
- Executes dropped EXE
PID:3612 -
\??\c:\bntnnb.exec:\bntnnb.exe38⤵
- Executes dropped EXE
PID:216 -
\??\c:\djdjd.exec:\djdjd.exe39⤵
- Executes dropped EXE
PID:2788 -
\??\c:\fxflxxx.exec:\fxflxxx.exe40⤵
- Executes dropped EXE
PID:3852 -
\??\c:\btthtn.exec:\btthtn.exe41⤵
- Executes dropped EXE
PID:756 -
\??\c:\ddjjj.exec:\ddjjj.exe42⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe43⤵
- Executes dropped EXE
PID:404 -
\??\c:\btntnn.exec:\btntnn.exe44⤵
- Executes dropped EXE
PID:2228 -
\??\c:\bbbbhb.exec:\bbbbhb.exe45⤵
- Executes dropped EXE
PID:3668 -
\??\c:\rfrlfrl.exec:\rfrlfrl.exe46⤵
- Executes dropped EXE
PID:4424 -
\??\c:\bnnhhb.exec:\bnnhhb.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4404 -
\??\c:\nnbbht.exec:\nnbbht.exe48⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dvjpv.exec:\dvjpv.exe49⤵
- Executes dropped EXE
PID:3448 -
\??\c:\rlrrffx.exec:\rlrrffx.exe50⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xrfffll.exec:\xrfffll.exe51⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hbbtnn.exec:\hbbtnn.exe52⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bbbhbb.exec:\bbbhbb.exe53⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ppjvp.exec:\ppjvp.exe54⤵
- Executes dropped EXE
PID:1212 -
\??\c:\xxrlrrl.exec:\xxrlrrl.exe55⤵
- Executes dropped EXE
PID:3864 -
\??\c:\1xfrllf.exec:\1xfrllf.exe56⤵
- Executes dropped EXE
PID:3656 -
\??\c:\tntntb.exec:\tntntb.exe57⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vjjpp.exec:\vjjpp.exe58⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jdpjv.exec:\jdpjv.exe59⤵
- Executes dropped EXE
PID:3928 -
\??\c:\llfxxxx.exec:\llfxxxx.exe60⤵
- Executes dropped EXE
PID:3700 -
\??\c:\tnbbbb.exec:\tnbbbb.exe61⤵
- Executes dropped EXE
PID:964 -
\??\c:\bbhbnn.exec:\bbhbnn.exe62⤵
- Executes dropped EXE
PID:2120 -
\??\c:\dpvpj.exec:\dpvpj.exe63⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jdvvp.exec:\jdvvp.exe64⤵
- Executes dropped EXE
PID:4428 -
\??\c:\fxrxrff.exec:\fxrxrff.exe65⤵
- Executes dropped EXE
PID:3088 -
\??\c:\xlfxrrf.exec:\xlfxrrf.exe66⤵PID:844
-
\??\c:\tnnnnh.exec:\tnnnnh.exe67⤵PID:3416
-
\??\c:\dddpj.exec:\dddpj.exe68⤵PID:4828
-
\??\c:\dddvj.exec:\dddvj.exe69⤵PID:1616
-
\??\c:\5ffxlll.exec:\5ffxlll.exe70⤵PID:3824
-
\??\c:\1frrxxl.exec:\1frrxxl.exe71⤵PID:4616
-
\??\c:\hbhnnn.exec:\hbhnnn.exe72⤵PID:3688
-
\??\c:\tnbtbh.exec:\tnbtbh.exe73⤵PID:5024
-
\??\c:\1dppp.exec:\1dppp.exe74⤵PID:3108
-
\??\c:\rflrlrr.exec:\rflrlrr.exe75⤵PID:4756
-
\??\c:\5pjdv.exec:\5pjdv.exe76⤵PID:4700
-
\??\c:\frrlffl.exec:\frrlffl.exe77⤵PID:2640
-
\??\c:\7fxrlrf.exec:\7fxrlrf.exe78⤵PID:1652
-
\??\c:\tnhhnn.exec:\tnhhnn.exe79⤵PID:4692
-
\??\c:\vjpvv.exec:\vjpvv.exe80⤵PID:624
-
\??\c:\jddjv.exec:\jddjv.exe81⤵PID:3920
-
\??\c:\rfrllff.exec:\rfrllff.exe82⤵PID:1656
-
\??\c:\rlrrllf.exec:\rlrrllf.exe83⤵PID:3912
-
\??\c:\nbbbbb.exec:\nbbbbb.exe84⤵PID:976
-
\??\c:\pjddv.exec:\pjddv.exe85⤵PID:768
-
\??\c:\vjvvj.exec:\vjvvj.exe86⤵PID:4880
-
\??\c:\7llfxrl.exec:\7llfxrl.exe87⤵PID:1124
-
\??\c:\llxffrx.exec:\llxffrx.exe88⤵PID:3164
-
\??\c:\nnnnnn.exec:\nnnnnn.exe89⤵PID:4784
-
\??\c:\nbhbbb.exec:\nbhbbb.exe90⤵PID:3128
-
\??\c:\dvjpd.exec:\dvjpd.exe91⤵PID:780
-
\??\c:\lflrlfr.exec:\lflrlfr.exe92⤵PID:5040
-
\??\c:\3rfxllr.exec:\3rfxllr.exe93⤵PID:1488
-
\??\c:\bbbnnb.exec:\bbbnnb.exe94⤵PID:1832
-
\??\c:\tthnhh.exec:\tthnhh.exe95⤵PID:3488
-
\??\c:\jvvpd.exec:\jvvpd.exe96⤵PID:4372
-
\??\c:\dpvpp.exec:\dpvpp.exe97⤵PID:5020
-
\??\c:\fflfllx.exec:\fflfllx.exe98⤵PID:3852
-
\??\c:\rrllffx.exec:\rrllffx.exe99⤵PID:1764
-
\??\c:\hbnntb.exec:\hbnntb.exe100⤵PID:2936
-
\??\c:\btbtbb.exec:\btbtbb.exe101⤵PID:3468
-
\??\c:\pdjjd.exec:\pdjjd.exe102⤵PID:1692
-
\??\c:\rrfxrrx.exec:\rrfxrrx.exe103⤵PID:1808
-
\??\c:\llrrllf.exec:\llrrllf.exe104⤵PID:4276
-
\??\c:\httntn.exec:\httntn.exe105⤵PID:3444
-
\??\c:\bthhnn.exec:\bthhnn.exe106⤵PID:1664
-
\??\c:\vpdvv.exec:\vpdvv.exe107⤵PID:4332
-
\??\c:\vvvpd.exec:\vvvpd.exe108⤵PID:2028
-
\??\c:\xfxlllf.exec:\xfxlllf.exe109⤵PID:2980
-
\??\c:\btbbtt.exec:\btbbtt.exe110⤵PID:1940
-
\??\c:\5ddjd.exec:\5ddjd.exe111⤵PID:4312
-
\??\c:\vjjdv.exec:\vjjdv.exe112⤵PID:4696
-
\??\c:\xfxrrrl.exec:\xfxrrrl.exe113⤵PID:2576
-
\??\c:\bbbhhh.exec:\bbbhhh.exe114⤵PID:5036
-
\??\c:\bbbnnn.exec:\bbbnnn.exe115⤵PID:2288
-
\??\c:\vdddv.exec:\vdddv.exe116⤵PID:2724
-
\??\c:\pdjdp.exec:\pdjdp.exe117⤵PID:1964
-
\??\c:\rffxrff.exec:\rffxrff.exe118⤵PID:3628
-
\??\c:\ffrlrrx.exec:\ffrlrrx.exe119⤵PID:964
-
\??\c:\bhnnnt.exec:\bhnnnt.exe120⤵PID:1544
-
\??\c:\nnthhh.exec:\nnthhh.exe121⤵PID:2344
-
\??\c:\djvpp.exec:\djvpp.exe122⤵PID:2044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-