Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 14:11
Static task
static1
Behavioral task
behavioral1
Sample
b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe
Resource
win7-20241010-en
General
-
Target
b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe
-
Size
69KB
-
MD5
4a8039cf581bbec82ee1fd8d9743cc77
-
SHA1
1cb69dd2513e70ae1f0644007ac9343e350df2da
-
SHA256
b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a
-
SHA512
23b61816860e13ba4b573bce98cdfa21437d5b051547d43215ac154b32a37094c64aacbdde9881eefb6142da861c2f1b061c69143561ec68956d05beaba561f7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAch:ymb3NkkiQ3mdBjFIsIVch
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/4996-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3352-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lrfrllf.exerlllffx.exenhbbtt.exetnttnb.exe9vjdd.exeflxxlll.exepddpd.exerlxlfff.exenbntnn.exevjdjd.exehhtnbb.exedvvpp.exepjvvv.exe5xfxllf.exebthbtb.exexxlxrlf.exettnhbb.exe7vdvp.exeflfxrrl.exethbtnn.exe7dvpd.exejpjjd.exe5xxrlll.exerfrxrrl.exebtnnnn.exehbhhbh.exejjppv.exexlxxxxr.exennhhhh.exebbbtnn.exejddvp.exellfxllx.exerflfxrl.exetbbbtn.exettnnhb.exepjjjd.exefxlfllr.exelffxrrr.exetbhhbb.exehbtbtb.exejpjdv.exefrxfxxx.exexrffxxf.exehnhhbb.exepddpd.exepjpjv.exexlrrlll.exebnnhbt.exehbtnbb.exevppdv.exevjdpd.exe7rxlrlx.exebtbnbt.exehbhbbt.exejjppd.exedddpj.exexrflrfx.exehtnhbb.exenhtnnn.exepvjdv.exe3xlflll.exexlllfxr.exehbnhtt.exetntthn.exepid Process 4724 lrfrllf.exe 3352 rlllffx.exe 3248 nhbbtt.exe 1080 tnttnb.exe 3672 9vjdd.exe 4012 flxxlll.exe 2068 pddpd.exe 1340 rlxlfff.exe 3152 nbntnn.exe 4764 vjdjd.exe 2696 hhtnbb.exe 3112 dvvpp.exe 3396 pjvvv.exe 4524 5xfxllf.exe 116 bthbtb.exe 2476 xxlxrlf.exe 1852 ttnhbb.exe 2328 7vdvp.exe 2904 flfxrrl.exe 736 thbtnn.exe 5104 7dvpd.exe 1656 jpjjd.exe 4164 5xxrlll.exe 3648 rfrxrrl.exe 4756 btnnnn.exe 5000 hbhhbh.exe 2064 jjppv.exe 920 xlxxxxr.exe 4520 nnhhhh.exe 3192 bbbtnn.exe 4916 jddvp.exe 4964 llfxllx.exe 3264 rflfxrl.exe 3024 tbbbtn.exe 3952 ttnnhb.exe 2008 pjjjd.exe 372 fxlfllr.exe 4416 lffxrrr.exe 244 tbhhbb.exe 400 hbtbtb.exe 4948 jpjdv.exe 2376 frxfxxx.exe 1792 xrffxxf.exe 4744 hnhhbb.exe 2444 pddpd.exe 1436 pjpjv.exe 2468 xlrrlll.exe 4976 bnnhbt.exe 5068 hbtnbb.exe 1724 vppdv.exe 3224 vjdpd.exe 3928 7rxlrlx.exe 4508 btbnbt.exe 2572 hbhbbt.exe 2976 jjppd.exe 2372 dddpj.exe 2336 xrflrfx.exe 3500 htnhbb.exe 2512 nhtnnn.exe 4040 pvjdv.exe 2316 3xlflll.exe 3824 xlllfxr.exe 2696 hbnhtt.exe 3112 tntthn.exe -
Processes:
resource yara_rule behavioral2/memory/4996-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3352-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1fxxxxx.exebbnntt.exexffxlrf.exexfxxfrf.exehnntnn.exettnhbt.exepjdvj.exeffffxrl.exexrrxllx.exetnnnnn.exetttnht.exexlllfxr.exeppvdp.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exelrfrllf.exerlllffx.exenhbbtt.exetnttnb.exe9vjdd.exeflxxlll.exepddpd.exerlxlfff.exenbntnn.exevjdjd.exehhtnbb.exedvvpp.exepjvvv.exe5xfxllf.exebthbtb.exexxlxrlf.exettnhbb.exe7vdvp.exeflfxrrl.exethbtnn.exe7dvpd.exedescription pid Process procid_target PID 4996 wrote to memory of 4724 4996 b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe 84 PID 4996 wrote to memory of 4724 4996 b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe 84 PID 4996 wrote to memory of 4724 4996 b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe 84 PID 4724 wrote to memory of 3352 4724 lrfrllf.exe 85 PID 4724 wrote to memory of 3352 4724 lrfrllf.exe 85 PID 4724 wrote to memory of 3352 4724 lrfrllf.exe 85 PID 3352 wrote to memory of 3248 3352 rlllffx.exe 86 PID 3352 wrote to memory of 3248 3352 rlllffx.exe 86 PID 3352 wrote to memory of 3248 3352 rlllffx.exe 86 PID 3248 wrote to memory of 1080 3248 nhbbtt.exe 87 PID 3248 wrote to memory of 1080 3248 nhbbtt.exe 87 PID 3248 wrote to memory of 1080 3248 nhbbtt.exe 87 PID 1080 wrote to memory of 3672 1080 tnttnb.exe 88 PID 1080 wrote to memory of 3672 1080 tnttnb.exe 88 PID 1080 wrote to memory of 3672 1080 tnttnb.exe 88 PID 3672 wrote to memory of 4012 3672 9vjdd.exe 89 PID 3672 wrote to memory of 4012 3672 9vjdd.exe 89 PID 3672 wrote to memory of 4012 3672 9vjdd.exe 89 PID 4012 wrote to memory of 2068 4012 flxxlll.exe 90 PID 4012 wrote to memory of 2068 4012 flxxlll.exe 90 PID 4012 wrote to memory of 2068 4012 flxxlll.exe 90 PID 2068 wrote to memory of 1340 2068 pddpd.exe 91 PID 2068 wrote to memory of 1340 2068 pddpd.exe 91 PID 2068 wrote to memory of 1340 2068 pddpd.exe 91 PID 1340 wrote to memory of 3152 1340 rlxlfff.exe 92 PID 1340 wrote to memory of 3152 1340 rlxlfff.exe 92 PID 1340 wrote to memory of 3152 1340 rlxlfff.exe 92 PID 3152 wrote to memory of 4764 3152 nbntnn.exe 93 PID 3152 wrote to memory of 4764 3152 nbntnn.exe 93 PID 3152 wrote to memory of 4764 3152 nbntnn.exe 93 PID 4764 wrote to memory of 2696 4764 vjdjd.exe 94 PID 4764 wrote to memory of 2696 4764 vjdjd.exe 94 PID 4764 wrote to memory of 2696 4764 vjdjd.exe 94 PID 2696 wrote to memory of 3112 2696 hhtnbb.exe 95 PID 2696 wrote to memory of 3112 2696 hhtnbb.exe 95 PID 2696 wrote to memory of 3112 2696 hhtnbb.exe 95 PID 3112 wrote to memory of 3396 3112 dvvpp.exe 96 PID 3112 wrote to memory of 3396 3112 dvvpp.exe 96 PID 3112 wrote to memory of 3396 3112 dvvpp.exe 96 PID 3396 wrote to memory of 4524 3396 pjvvv.exe 97 PID 3396 wrote to memory of 4524 3396 pjvvv.exe 97 PID 3396 wrote to memory of 4524 3396 pjvvv.exe 97 PID 4524 wrote to memory of 116 4524 5xfxllf.exe 98 PID 4524 wrote to memory of 116 4524 5xfxllf.exe 98 PID 4524 wrote to memory of 116 4524 5xfxllf.exe 98 PID 116 wrote to memory of 2476 116 bthbtb.exe 99 PID 116 wrote to memory of 2476 116 bthbtb.exe 99 PID 116 wrote to memory of 2476 116 bthbtb.exe 99 PID 2476 wrote to memory of 1852 2476 xxlxrlf.exe 100 PID 2476 wrote to memory of 1852 2476 xxlxrlf.exe 100 PID 2476 wrote to memory of 1852 2476 xxlxrlf.exe 100 PID 1852 wrote to memory of 2328 1852 ttnhbb.exe 101 PID 1852 wrote to memory of 2328 1852 ttnhbb.exe 101 PID 1852 wrote to memory of 2328 1852 ttnhbb.exe 101 PID 2328 wrote to memory of 2904 2328 7vdvp.exe 102 PID 2328 wrote to memory of 2904 2328 7vdvp.exe 102 PID 2328 wrote to memory of 2904 2328 7vdvp.exe 102 PID 2904 wrote to memory of 736 2904 flfxrrl.exe 103 PID 2904 wrote to memory of 736 2904 flfxrrl.exe 103 PID 2904 wrote to memory of 736 2904 flfxrrl.exe 103 PID 736 wrote to memory of 5104 736 thbtnn.exe 104 PID 736 wrote to memory of 5104 736 thbtnn.exe 104 PID 736 wrote to memory of 5104 736 thbtnn.exe 104 PID 5104 wrote to memory of 1656 5104 7dvpd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe"C:\Users\Admin\AppData\Local\Temp\b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\lrfrllf.exec:\lrfrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\rlllffx.exec:\rlllffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\nhbbtt.exec:\nhbbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\tnttnb.exec:\tnttnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\9vjdd.exec:\9vjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\flxxlll.exec:\flxxlll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\pddpd.exec:\pddpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\rlxlfff.exec:\rlxlfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\nbntnn.exec:\nbntnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\vjdjd.exec:\vjdjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\hhtnbb.exec:\hhtnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\dvvpp.exec:\dvvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\pjvvv.exec:\pjvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\5xfxllf.exec:\5xfxllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\bthbtb.exec:\bthbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\xxlxrlf.exec:\xxlxrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\ttnhbb.exec:\ttnhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\7vdvp.exec:\7vdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\flfxrrl.exec:\flfxrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\thbtnn.exec:\thbtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\7dvpd.exec:\7dvpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\jpjjd.exec:\jpjjd.exe23⤵
- Executes dropped EXE
PID:1656 -
\??\c:\5xxrlll.exec:\5xxrlll.exe24⤵
- Executes dropped EXE
PID:4164 -
\??\c:\rfrxrrl.exec:\rfrxrrl.exe25⤵
- Executes dropped EXE
PID:3648 -
\??\c:\btnnnn.exec:\btnnnn.exe26⤵
- Executes dropped EXE
PID:4756 -
\??\c:\hbhhbh.exec:\hbhhbh.exe27⤵
- Executes dropped EXE
PID:5000 -
\??\c:\jjppv.exec:\jjppv.exe28⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xlxxxxr.exec:\xlxxxxr.exe29⤵
- Executes dropped EXE
PID:920 -
\??\c:\nnhhhh.exec:\nnhhhh.exe30⤵
- Executes dropped EXE
PID:4520 -
\??\c:\bbbtnn.exec:\bbbtnn.exe31⤵
- Executes dropped EXE
PID:3192 -
\??\c:\jddvp.exec:\jddvp.exe32⤵
- Executes dropped EXE
PID:4916 -
\??\c:\llfxllx.exec:\llfxllx.exe33⤵
- Executes dropped EXE
PID:4964 -
\??\c:\rflfxrl.exec:\rflfxrl.exe34⤵
- Executes dropped EXE
PID:3264 -
\??\c:\tbbbtn.exec:\tbbbtn.exe35⤵
- Executes dropped EXE
PID:3024 -
\??\c:\ttnnhb.exec:\ttnnhb.exe36⤵
- Executes dropped EXE
PID:3952 -
\??\c:\pjjjd.exec:\pjjjd.exe37⤵
- Executes dropped EXE
PID:2008 -
\??\c:\fxlfllr.exec:\fxlfllr.exe38⤵
- Executes dropped EXE
PID:372 -
\??\c:\lffxrrr.exec:\lffxrrr.exe39⤵
- Executes dropped EXE
PID:4416 -
\??\c:\tbhhbb.exec:\tbhhbb.exe40⤵
- Executes dropped EXE
PID:244 -
\??\c:\hbtbtb.exec:\hbtbtb.exe41⤵
- Executes dropped EXE
PID:400 -
\??\c:\jpjdv.exec:\jpjdv.exe42⤵
- Executes dropped EXE
PID:4948 -
\??\c:\frxfxxx.exec:\frxfxxx.exe43⤵
- Executes dropped EXE
PID:2376 -
\??\c:\xrffxxf.exec:\xrffxxf.exe44⤵
- Executes dropped EXE
PID:1792 -
\??\c:\hnhhbb.exec:\hnhhbb.exe45⤵
- Executes dropped EXE
PID:4744 -
\??\c:\pddpd.exec:\pddpd.exe46⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pjpjv.exec:\pjpjv.exe47⤵
- Executes dropped EXE
PID:1436 -
\??\c:\xlrrlll.exec:\xlrrlll.exe48⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bnnhbt.exec:\bnnhbt.exe49⤵
- Executes dropped EXE
PID:4976 -
\??\c:\hbtnbb.exec:\hbtnbb.exe50⤵
- Executes dropped EXE
PID:5068 -
\??\c:\vppdv.exec:\vppdv.exe51⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vjdpd.exec:\vjdpd.exe52⤵
- Executes dropped EXE
PID:3224 -
\??\c:\7rxlrlx.exec:\7rxlrlx.exe53⤵
- Executes dropped EXE
PID:3928 -
\??\c:\btbnbt.exec:\btbnbt.exe54⤵
- Executes dropped EXE
PID:4508 -
\??\c:\hbhbbt.exec:\hbhbbt.exe55⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jjppd.exec:\jjppd.exe56⤵
- Executes dropped EXE
PID:2976 -
\??\c:\dddpj.exec:\dddpj.exe57⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xrflrfx.exec:\xrflrfx.exe58⤵
- Executes dropped EXE
PID:2336 -
\??\c:\htnhbb.exec:\htnhbb.exe59⤵
- Executes dropped EXE
PID:3500 -
\??\c:\nhtnnn.exec:\nhtnnn.exe60⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pvjdv.exec:\pvjdv.exe61⤵
- Executes dropped EXE
PID:4040 -
\??\c:\3xlflll.exec:\3xlflll.exe62⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xlllfxr.exec:\xlllfxr.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3824 -
\??\c:\hbnhtt.exec:\hbnhtt.exe64⤵
- Executes dropped EXE
PID:2696 -
\??\c:\tntthn.exec:\tntthn.exe65⤵
- Executes dropped EXE
PID:3112 -
\??\c:\pdddp.exec:\pdddp.exe66⤵PID:3492
-
\??\c:\lflxxxr.exec:\lflxxxr.exe67⤵PID:1652
-
\??\c:\vjpjj.exec:\vjpjj.exe68⤵PID:4524
-
\??\c:\vvvjv.exec:\vvvjv.exe69⤵PID:2100
-
\??\c:\1rxrfxr.exec:\1rxrfxr.exe70⤵PID:3176
-
\??\c:\xrrrllf.exec:\xrrrllf.exe71⤵PID:2744
-
\??\c:\vppjv.exec:\vppjv.exe72⤵PID:4736
-
\??\c:\fxrlfff.exec:\fxrlfff.exe73⤵PID:5004
-
\??\c:\btnbnh.exec:\btnbnh.exe74⤵PID:1448
-
\??\c:\bbhbbb.exec:\bbhbbb.exe75⤵PID:1124
-
\??\c:\jjjjp.exec:\jjjjp.exe76⤵PID:1832
-
\??\c:\pddvp.exec:\pddvp.exe77⤵PID:1256
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe78⤵PID:3724
-
\??\c:\rlllfxl.exec:\rlllfxl.exe79⤵PID:3004
-
\??\c:\htnhtn.exec:\htnhtn.exe80⤵PID:4516
-
\??\c:\vjdjd.exec:\vjdjd.exe81⤵PID:3236
-
\??\c:\jdpjd.exec:\jdpjd.exe82⤵PID:4756
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe83⤵PID:3656
-
\??\c:\3tbttn.exec:\3tbttn.exe84⤵PID:1096
-
\??\c:\7bthtn.exec:\7bthtn.exe85⤵PID:3528
-
\??\c:\1jdvj.exec:\1jdvj.exe86⤵PID:4848
-
\??\c:\pvppd.exec:\pvppd.exe87⤵PID:5112
-
\??\c:\xfxrxfx.exec:\xfxrxfx.exe88⤵PID:1056
-
\??\c:\htbtnt.exec:\htbtnt.exe89⤵PID:988
-
\??\c:\nbbthb.exec:\nbbthb.exe90⤵PID:4928
-
\??\c:\dvjdv.exec:\dvjdv.exe91⤵PID:4964
-
\??\c:\dpdvj.exec:\dpdvj.exe92⤵PID:3180
-
\??\c:\xxxrxrl.exec:\xxxrxrl.exe93⤵PID:4444
-
\??\c:\tnbtnh.exec:\tnbtnh.exe94⤵PID:3060
-
\??\c:\9bbtnh.exec:\9bbtnh.exe95⤵PID:2384
-
\??\c:\vjjdv.exec:\vjjdv.exe96⤵PID:372
-
\??\c:\7lfxlfr.exec:\7lfxlfr.exe97⤵PID:2988
-
\??\c:\hbttnt.exec:\hbttnt.exe98⤵PID:916
-
\??\c:\bnhthb.exec:\bnhthb.exe99⤵PID:2872
-
\??\c:\dvpdp.exec:\dvpdp.exe100⤵PID:3588
-
\??\c:\fxxlxlf.exec:\fxxlxlf.exe101⤵PID:1328
-
\??\c:\hbttnh.exec:\hbttnh.exe102⤵PID:4460
-
\??\c:\bbnhbt.exec:\bbnhbt.exe103⤵PID:3036
-
\??\c:\dddvj.exec:\dddvj.exe104⤵PID:2444
-
\??\c:\ddjdv.exec:\ddjdv.exe105⤵PID:4140
-
\??\c:\rllxllx.exec:\rllxllx.exe106⤵PID:4956
-
\??\c:\3tthtn.exec:\3tthtn.exe107⤵PID:3352
-
\??\c:\bbbnbt.exec:\bbbnbt.exe108⤵PID:1080
-
\??\c:\1djdd.exec:\1djdd.exe109⤵PID:4464
-
\??\c:\xfxxffr.exec:\xfxxffr.exe110⤵PID:4228
-
\??\c:\1llfxrf.exec:\1llfxrf.exe111⤵PID:864
-
\??\c:\lrfxllx.exec:\lrfxllx.exe112⤵PID:1540
-
\??\c:\hhhbtt.exec:\hhhbtt.exe113⤵PID:2780
-
\??\c:\tnthnb.exec:\tnthnb.exe114⤵PID:4552
-
\??\c:\pjjdj.exec:\pjjdj.exe115⤵PID:2068
-
\??\c:\frfflff.exec:\frfflff.exe116⤵PID:4268
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe117⤵PID:1076
-
\??\c:\hnbbtn.exec:\hnbbtn.exe118⤵PID:4100
-
\??\c:\jpvdp.exec:\jpvdp.exe119⤵PID:4076
-
\??\c:\djjvj.exec:\djjvj.exe120⤵PID:4884
-
\??\c:\5flxlfr.exec:\5flxlfr.exe121⤵PID:5108
-
\??\c:\lfrfrrl.exec:\lfrfrrl.exe122⤵PID:2696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-