Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 17:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe
-
Size
453KB
-
MD5
5371c3a06b6d83729c37424b9e530779
-
SHA1
20437b26ae33536fa4a6ed40a3fde9daedf11d4a
-
SHA256
8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051
-
SHA512
9ce002f23ee512d45eac1003c9fddffef9cf1471771985248d9bc88556099de427362e4e23bbe0d358624570d438384e85229f42bc82417dc86516a4a4b08972
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2348-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-123-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2880-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/712-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-482-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2020-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-519-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2132-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-539-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/812-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/712-553-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2132-560-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1920-576-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1660-586-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2976-590-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/848-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 772 3pddd.exe 2288 xrffrrf.exe 2024 5bbttn.exe 2276 djdvd.exe 2736 lflfxll.exe 756 nbtnnh.exe 536 vpddd.exe 2932 rfrrrlr.exe 2580 hbnbnn.exe 2564 jvdvv.exe 2584 xrflrxl.exe 1952 xrrrxll.exe 2880 htbbbb.exe 1228 rflllll.exe 2436 bhtntn.exe 2716 hbttnn.exe 1976 lfrxffx.exe 1940 hthhhh.exe 2964 vjpvv.exe 2260 3rxrlfl.exe 2100 xlllrxx.exe 1540 3pjjp.exe 2136 rfrxfxx.exe 2120 hthhnh.exe 2356 vpddj.exe 2132 frxxffl.exe 1052 pdpvv.exe 712 ffxxfff.exe 1456 vpddj.exe 1760 lffrxxf.exe 1652 jdpjp.exe 2472 frxxfxf.exe 2308 djpjj.exe 2000 llrrffl.exe 2676 htbbhh.exe 2868 nnhhnt.exe 2712 9nnbbt.exe 2140 jdvvv.exe 2660 rfxffxf.exe 2560 btbbbt.exe 2696 5nttnn.exe 2588 pdpdj.exe 2652 llrlrlx.exe 1028 lfxfrxx.exe 2584 hthbnh.exe 1952 pdjpv.exe 1948 jdppp.exe 1288 lfxrlxl.exe 2592 tnnhtt.exe 1380 hhnnbb.exe 2788 vvvpj.exe 1724 7xfxlrx.exe 1528 ttttth.exe 1940 nbhbbt.exe 1368 jpdjj.exe 1896 lxlxrxx.exe 2252 xrflrrr.exe 2020 hbnthn.exe 408 7vvdd.exe 2240 3djdd.exe 2136 flrrxlr.exe 880 3bbtbt.exe 956 nhnhnh.exe 1500 dppvd.exe -
resource yara_rule behavioral1/memory/2348-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/712-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-590-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2804-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-689-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflflr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 772 2348 8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe 30 PID 2348 wrote to memory of 772 2348 8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe 30 PID 2348 wrote to memory of 772 2348 8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe 30 PID 2348 wrote to memory of 772 2348 8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe 30 PID 772 wrote to memory of 2288 772 3pddd.exe 31 PID 772 wrote to memory of 2288 772 3pddd.exe 31 PID 772 wrote to memory of 2288 772 3pddd.exe 31 PID 772 wrote to memory of 2288 772 3pddd.exe 31 PID 2288 wrote to memory of 2024 2288 xrffrrf.exe 32 PID 2288 wrote to memory of 2024 2288 xrffrrf.exe 32 PID 2288 wrote to memory of 2024 2288 xrffrrf.exe 32 PID 2288 wrote to memory of 2024 2288 xrffrrf.exe 32 PID 2024 wrote to memory of 2276 2024 5bbttn.exe 33 PID 2024 wrote to memory of 2276 2024 5bbttn.exe 33 PID 2024 wrote to memory of 2276 2024 5bbttn.exe 33 PID 2024 wrote to memory of 2276 2024 5bbttn.exe 33 PID 2276 wrote to memory of 2736 2276 djdvd.exe 34 PID 2276 wrote to memory of 2736 2276 djdvd.exe 34 PID 2276 wrote to memory of 2736 2276 djdvd.exe 34 PID 2276 wrote to memory of 2736 2276 djdvd.exe 34 PID 2736 wrote to memory of 756 2736 lflfxll.exe 35 PID 2736 wrote to memory of 756 2736 lflfxll.exe 35 PID 2736 wrote to memory of 756 2736 lflfxll.exe 35 PID 2736 wrote to memory of 756 2736 lflfxll.exe 35 PID 756 wrote to memory of 536 756 nbtnnh.exe 36 PID 756 wrote to memory of 536 756 nbtnnh.exe 36 PID 756 wrote to memory of 536 756 nbtnnh.exe 36 PID 756 wrote to memory of 536 756 nbtnnh.exe 36 PID 536 wrote to memory of 2932 536 vpddd.exe 37 PID 536 wrote to memory of 2932 536 vpddd.exe 37 PID 536 wrote to memory of 2932 536 vpddd.exe 37 PID 536 wrote to memory of 2932 536 vpddd.exe 37 PID 2932 wrote to memory of 2580 2932 rfrrrlr.exe 38 PID 2932 wrote to memory of 2580 2932 rfrrrlr.exe 38 PID 2932 wrote to memory of 2580 2932 rfrrrlr.exe 38 PID 2932 wrote to memory of 2580 2932 rfrrrlr.exe 38 PID 2580 wrote to memory of 2564 2580 hbnbnn.exe 39 PID 2580 wrote to memory of 2564 2580 hbnbnn.exe 39 PID 2580 wrote to memory of 2564 2580 hbnbnn.exe 39 PID 2580 wrote to memory of 2564 2580 hbnbnn.exe 39 PID 2564 wrote to memory of 2584 2564 jvdvv.exe 40 PID 2564 wrote to memory of 2584 2564 jvdvv.exe 40 PID 2564 wrote to memory of 2584 2564 jvdvv.exe 40 PID 2564 wrote to memory of 2584 2564 jvdvv.exe 40 PID 2584 wrote to memory of 1952 2584 xrflrxl.exe 41 PID 2584 wrote to memory of 1952 2584 xrflrxl.exe 41 PID 2584 wrote to memory of 1952 2584 xrflrxl.exe 41 PID 2584 wrote to memory of 1952 2584 xrflrxl.exe 41 PID 1952 wrote to memory of 2880 1952 xrrrxll.exe 42 PID 1952 wrote to memory of 2880 1952 xrrrxll.exe 42 PID 1952 wrote to memory of 2880 1952 xrrrxll.exe 42 PID 1952 wrote to memory of 2880 1952 xrrrxll.exe 42 PID 2880 wrote to memory of 1228 2880 htbbbb.exe 43 PID 2880 wrote to memory of 1228 2880 htbbbb.exe 43 PID 2880 wrote to memory of 1228 2880 htbbbb.exe 43 PID 2880 wrote to memory of 1228 2880 htbbbb.exe 43 PID 1228 wrote to memory of 2436 1228 rflllll.exe 44 PID 1228 wrote to memory of 2436 1228 rflllll.exe 44 PID 1228 wrote to memory of 2436 1228 rflllll.exe 44 PID 1228 wrote to memory of 2436 1228 rflllll.exe 44 PID 2436 wrote to memory of 2716 2436 bhtntn.exe 45 PID 2436 wrote to memory of 2716 2436 bhtntn.exe 45 PID 2436 wrote to memory of 2716 2436 bhtntn.exe 45 PID 2436 wrote to memory of 2716 2436 bhtntn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe"C:\Users\Admin\AppData\Local\Temp\8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\3pddd.exec:\3pddd.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\xrffrrf.exec:\xrffrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\5bbttn.exec:\5bbttn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\djdvd.exec:\djdvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\lflfxll.exec:\lflfxll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\nbtnnh.exec:\nbtnnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\vpddd.exec:\vpddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\rfrrrlr.exec:\rfrrrlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\hbnbnn.exec:\hbnbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\jvdvv.exec:\jvdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\xrflrxl.exec:\xrflrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\xrrrxll.exec:\xrrrxll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\htbbbb.exec:\htbbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\rflllll.exec:\rflllll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\bhtntn.exec:\bhtntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\hbttnn.exec:\hbttnn.exe17⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lfrxffx.exec:\lfrxffx.exe18⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hthhhh.exec:\hthhhh.exe19⤵
- Executes dropped EXE
PID:1940 -
\??\c:\vjpvv.exec:\vjpvv.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2964 -
\??\c:\3rxrlfl.exec:\3rxrlfl.exe21⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xlllrxx.exec:\xlllrxx.exe22⤵
- Executes dropped EXE
PID:2100 -
\??\c:\3pjjp.exec:\3pjjp.exe23⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rfrxfxx.exec:\rfrxfxx.exe24⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hthhnh.exec:\hthhnh.exe25⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vpddj.exec:\vpddj.exe26⤵
- Executes dropped EXE
PID:2356 -
\??\c:\frxxffl.exec:\frxxffl.exe27⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pdpvv.exec:\pdpvv.exe28⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ffxxfff.exec:\ffxxfff.exe29⤵
- Executes dropped EXE
PID:712 -
\??\c:\vpddj.exec:\vpddj.exe30⤵
- Executes dropped EXE
PID:1456 -
\??\c:\lffrxxf.exec:\lffrxxf.exe31⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jdpjp.exec:\jdpjp.exe32⤵
- Executes dropped EXE
PID:1652 -
\??\c:\frxxfxf.exec:\frxxfxf.exe33⤵
- Executes dropped EXE
PID:2472 -
\??\c:\djpjj.exec:\djpjj.exe34⤵
- Executes dropped EXE
PID:2308 -
\??\c:\llrrffl.exec:\llrrffl.exe35⤵
- Executes dropped EXE
PID:2000 -
\??\c:\htbbhh.exec:\htbbhh.exe36⤵
- Executes dropped EXE
PID:2676 -
\??\c:\nnhhnt.exec:\nnhhnt.exe37⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9nnbbt.exec:\9nnbbt.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\jdvvv.exec:\jdvvv.exe39⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rfxffxf.exec:\rfxffxf.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\btbbbt.exec:\btbbbt.exe41⤵
- Executes dropped EXE
PID:2560 -
\??\c:\5nttnn.exec:\5nttnn.exe42⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pdpdj.exec:\pdpdj.exe43⤵
- Executes dropped EXE
PID:2588 -
\??\c:\llrlrlx.exec:\llrlrlx.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\lfxfrxx.exec:\lfxfrxx.exe45⤵
- Executes dropped EXE
PID:1028 -
\??\c:\hthbnh.exec:\hthbnh.exe46⤵
- Executes dropped EXE
PID:2584 -
\??\c:\pdjpv.exec:\pdjpv.exe47⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jdppp.exec:\jdppp.exe48⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lfxrlxl.exec:\lfxrlxl.exe49⤵
- Executes dropped EXE
PID:1288 -
\??\c:\tnnhtt.exec:\tnnhtt.exe50⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hhnnbb.exec:\hhnnbb.exe51⤵
- Executes dropped EXE
PID:1380 -
\??\c:\vvvpj.exec:\vvvpj.exe52⤵
- Executes dropped EXE
PID:2788 -
\??\c:\7xfxlrx.exec:\7xfxlrx.exe53⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ttttth.exec:\ttttth.exe54⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nbhbbt.exec:\nbhbbt.exe55⤵
- Executes dropped EXE
PID:1940 -
\??\c:\jpdjj.exec:\jpdjj.exe56⤵
- Executes dropped EXE
PID:1368 -
\??\c:\lxlxrxx.exec:\lxlxrxx.exe57⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xrflrrr.exec:\xrflrrr.exe58⤵
- Executes dropped EXE
PID:2252 -
\??\c:\hbnthn.exec:\hbnthn.exe59⤵
- Executes dropped EXE
PID:2020 -
\??\c:\7vvdd.exec:\7vvdd.exe60⤵
- Executes dropped EXE
PID:408 -
\??\c:\3djdd.exec:\3djdd.exe61⤵
- Executes dropped EXE
PID:2240 -
\??\c:\flrrxlr.exec:\flrrxlr.exe62⤵
- Executes dropped EXE
PID:2136 -
\??\c:\3bbtbt.exec:\3bbtbt.exe63⤵
- Executes dropped EXE
PID:880 -
\??\c:\nhnhnh.exec:\nhnhnh.exe64⤵
- Executes dropped EXE
PID:956 -
\??\c:\dppvd.exec:\dppvd.exe65⤵
- Executes dropped EXE
PID:1500 -
\??\c:\lfxxrxx.exec:\lfxxrxx.exe66⤵PID:2132
-
\??\c:\7rrfflr.exec:\7rrfflr.exe67⤵PID:812
-
\??\c:\btbbhh.exec:\btbbhh.exe68⤵PID:712
-
\??\c:\dpdvd.exec:\dpdvd.exe69⤵
- System Location Discovery: System Language Discovery
PID:884 -
\??\c:\3ppjj.exec:\3ppjj.exe70⤵PID:3028
-
\??\c:\fflfxlr.exec:\fflfxlr.exe71⤵PID:1156
-
\??\c:\bthnnh.exec:\bthnnh.exe72⤵PID:1920
-
\??\c:\5jpjj.exec:\5jpjj.exe73⤵PID:1660
-
\??\c:\djppp.exec:\djppp.exe74⤵PID:2976
-
\??\c:\lfrrxrl.exec:\lfrrxrl.exe75⤵PID:2440
-
\??\c:\hntbbt.exec:\hntbbt.exe76⤵PID:3056
-
\??\c:\nbhbbt.exec:\nbhbbt.exe77⤵PID:2864
-
\??\c:\3pppd.exec:\3pppd.exe78⤵PID:768
-
\??\c:\3frrrrx.exec:\3frrrrx.exe79⤵PID:2640
-
\??\c:\lfxxflx.exec:\lfxxflx.exe80⤵PID:536
-
\??\c:\3hhhtb.exec:\3hhhtb.exe81⤵PID:2660
-
\??\c:\djjdj.exec:\djjdj.exe82⤵PID:2804
-
\??\c:\dvjjj.exec:\dvjjj.exe83⤵PID:2824
-
\??\c:\rlfflrf.exec:\rlfflrf.exe84⤵PID:2576
-
\??\c:\thttbn.exec:\thttbn.exe85⤵PID:1864
-
\??\c:\7ntbbh.exec:\7ntbbh.exe86⤵PID:2704
-
\??\c:\9pjvj.exec:\9pjvj.exe87⤵PID:2584
-
\??\c:\fxlllff.exec:\fxlllff.exe88⤵PID:2036
-
\??\c:\1rflrrr.exec:\1rflrrr.exe89⤵PID:2888
-
\??\c:\9bbttn.exec:\9bbttn.exe90⤵PID:848
-
\??\c:\hthttt.exec:\hthttt.exe91⤵PID:2436
-
\??\c:\dvjjp.exec:\dvjjp.exe92⤵PID:1232
-
\??\c:\5rfxrrr.exec:\5rfxrrr.exe93⤵PID:2600
-
\??\c:\1lxrlll.exec:\1lxrlll.exe94⤵PID:1752
-
\??\c:\hnntbt.exec:\hnntbt.exe95⤵PID:2956
-
\??\c:\1tnnth.exec:\1tnnth.exe96⤵PID:1840
-
\??\c:\vjvdp.exec:\vjvdp.exe97⤵PID:1916
-
\??\c:\lxllfff.exec:\lxllfff.exe98⤵PID:2372
-
\??\c:\5nnnbt.exec:\5nnnbt.exe99⤵PID:1420
-
\??\c:\bnbbnh.exec:\bnbbnh.exe100⤵PID:1768
-
\??\c:\ddppj.exec:\ddppj.exe101⤵PID:1980
-
\??\c:\jdjvd.exec:\jdjvd.exe102⤵PID:1844
-
\??\c:\lfllrrx.exec:\lfllrrx.exe103⤵PID:3004
-
\??\c:\hbnbnh.exec:\hbnbnh.exe104⤵PID:1692
-
\??\c:\thbthh.exec:\thbthh.exe105⤵PID:1496
-
\??\c:\vpjpp.exec:\vpjpp.exe106⤵PID:956
-
\??\c:\rrxffxr.exec:\rrxffxr.exe107⤵PID:1500
-
\??\c:\5lfrxxx.exec:\5lfrxxx.exe108⤵PID:1524
-
\??\c:\hhhthn.exec:\hhhthn.exe109⤵PID:812
-
\??\c:\1htbtt.exec:\1htbtt.exe110⤵PID:1432
-
\??\c:\pjvdj.exec:\pjvdj.exe111⤵PID:1444
-
\??\c:\5pvvp.exec:\5pvvp.exe112⤵PID:1552
-
\??\c:\rlxxfxl.exec:\rlxxfxl.exe113⤵PID:3036
-
\??\c:\5bhttn.exec:\5bhttn.exe114⤵PID:1920
-
\??\c:\tnhnnn.exec:\tnhnnn.exe115⤵PID:2460
-
\??\c:\djpjj.exec:\djpjj.exe116⤵PID:2976
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe117⤵PID:3040
-
\??\c:\3xfflff.exec:\3xfflff.exe118⤵PID:2808
-
\??\c:\ntbnbb.exec:\ntbnbb.exe119⤵PID:2112
-
\??\c:\3bnttn.exec:\3bnttn.exe120⤵PID:2860
-
\??\c:\7jvdj.exec:\7jvdj.exe121⤵PID:2988
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe122⤵PID:536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-