Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c3d27e9a9d5420bd426760bc08abab77c59a501a7be73542516668bf94e9306cN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c3d27e9a9d5420bd426760bc08abab77c59a501a7be73542516668bf94e9306cN.exe
-
Size
454KB
-
MD5
37d28ec91bb637c17dcd8658f19098d0
-
SHA1
1b106820cc059c92541d00b6bfc058d17bd54cdd
-
SHA256
c3d27e9a9d5420bd426760bc08abab77c59a501a7be73542516668bf94e9306c
-
SHA512
ce70ca99e30e08598f93e2f3feef5f3911c4cf83eb2e65be4fb0a843ce864be66dc2d32ebe58537538d41a1c9ee3196b90b612f2cb12a66b4eb595a7ff65d825
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeB:q7Tc2NYHUrAwfMp3CDB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/772-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-122-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2760-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-268-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1524-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-366-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2744-369-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2860-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-423-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1380-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-475-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1860-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 772 xrflxxf.exe 2288 htnthh.exe 2308 5jvdd.exe 2712 xrflrrx.exe 2732 nbntbb.exe 2660 jdjjj.exe 2664 flxrlfl.exe 2852 hthhnt.exe 2580 lxfffxx.exe 2564 1ntnbb.exe 2584 xfrrrrf.exe 2104 7pddp.exe 2760 nntbnt.exe 2284 bnbbtt.exe 2924 pdvvd.exe 2708 9fxxllx.exe 2904 5dppp.exe 1736 1xlrxff.exe 2920 vvppv.exe 2260 9rlrffl.exe 408 vddvj.exe 3064 rfrlfxl.exe 288 ppppd.exe 1716 5rrllfl.exe 1600 hhbhtb.exe 1272 vpvvv.exe 2124 9lffllx.exe 1052 9nhhhb.exe 1524 xlflrxl.exe 1432 hbnnbh.exe 1888 jjdpj.exe 1544 7rxrrrx.exe 3032 vpvjv.exe 1912 lflrxrx.exe 2868 nhtbbh.exe 2060 dpvvd.exe 2744 fxrrflf.exe 2740 7bhtth.exe 2828 hbnhnt.exe 2872 jdjjj.exe 2860 fffrlff.exe 2588 7lfflfl.exe 2580 tnbbbb.exe 2528 pdjjp.exe 2704 rlrlrlr.exe 1952 nbhnbt.exe 1328 1ttttt.exe 1228 pjpdj.exe 1380 flxlfxr.exe 2052 hbnntt.exe 2948 5nbbhh.exe 2708 dpdjp.exe 2756 pdpjp.exe 1768 9lxflfl.exe 2912 nbnnnt.exe 1860 5jpjp.exe 2096 3xxrlfl.exe 2120 fxfxfxx.exe 2356 nhhhnb.exe 3060 pdpjj.exe 1624 dvjjj.exe 108 rfrlxrx.exe 936 7thbbt.exe 1500 tntttt.exe -
resource yara_rule behavioral1/memory/772-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-669-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhtb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 772 2348 c3d27e9a9d5420bd426760bc08abab77c59a501a7be73542516668bf94e9306cN.exe 30 PID 2348 wrote to memory of 772 2348 c3d27e9a9d5420bd426760bc08abab77c59a501a7be73542516668bf94e9306cN.exe 30 PID 2348 wrote to memory of 772 2348 c3d27e9a9d5420bd426760bc08abab77c59a501a7be73542516668bf94e9306cN.exe 30 PID 2348 wrote to memory of 772 2348 c3d27e9a9d5420bd426760bc08abab77c59a501a7be73542516668bf94e9306cN.exe 30 PID 772 wrote to memory of 2288 772 xrflxxf.exe 31 PID 772 wrote to memory of 2288 772 xrflxxf.exe 31 PID 772 wrote to memory of 2288 772 xrflxxf.exe 31 PID 772 wrote to memory of 2288 772 xrflxxf.exe 31 PID 2288 wrote to memory of 2308 2288 htnthh.exe 32 PID 2288 wrote to memory of 2308 2288 htnthh.exe 32 PID 2288 wrote to memory of 2308 2288 htnthh.exe 32 PID 2288 wrote to memory of 2308 2288 htnthh.exe 32 PID 2308 wrote to memory of 2712 2308 5jvdd.exe 33 PID 2308 wrote to memory of 2712 2308 5jvdd.exe 33 PID 2308 wrote to memory of 2712 2308 5jvdd.exe 33 PID 2308 wrote to memory of 2712 2308 5jvdd.exe 33 PID 2712 wrote to memory of 2732 2712 xrflrrx.exe 34 PID 2712 wrote to memory of 2732 2712 xrflrrx.exe 34 PID 2712 wrote to memory of 2732 2712 xrflrrx.exe 34 PID 2712 wrote to memory of 2732 2712 xrflrrx.exe 34 PID 2732 wrote to memory of 2660 2732 nbntbb.exe 35 PID 2732 wrote to memory of 2660 2732 nbntbb.exe 35 PID 2732 wrote to memory of 2660 2732 nbntbb.exe 35 PID 2732 wrote to memory of 2660 2732 nbntbb.exe 35 PID 2660 wrote to memory of 2664 2660 jdjjj.exe 36 PID 2660 wrote to memory of 2664 2660 jdjjj.exe 36 PID 2660 wrote to memory of 2664 2660 jdjjj.exe 36 PID 2660 wrote to memory of 2664 2660 jdjjj.exe 36 PID 2664 wrote to memory of 2852 2664 flxrlfl.exe 37 PID 2664 wrote to memory of 2852 2664 flxrlfl.exe 37 PID 2664 wrote to memory of 2852 2664 flxrlfl.exe 37 PID 2664 wrote to memory of 2852 2664 flxrlfl.exe 37 PID 2852 wrote to memory of 2580 2852 hthhnt.exe 38 PID 2852 wrote to memory of 2580 2852 hthhnt.exe 38 PID 2852 wrote to memory of 2580 2852 hthhnt.exe 38 PID 2852 wrote to memory of 2580 2852 hthhnt.exe 38 PID 2580 wrote to memory of 2564 2580 lxfffxx.exe 39 PID 2580 wrote to memory of 2564 2580 lxfffxx.exe 39 PID 2580 wrote to memory of 2564 2580 lxfffxx.exe 39 PID 2580 wrote to memory of 2564 2580 lxfffxx.exe 39 PID 2564 wrote to memory of 2584 2564 1ntnbb.exe 40 PID 2564 wrote to memory of 2584 2564 1ntnbb.exe 40 PID 2564 wrote to memory of 2584 2564 1ntnbb.exe 40 PID 2564 wrote to memory of 2584 2564 1ntnbb.exe 40 PID 2584 wrote to memory of 2104 2584 xfrrrrf.exe 41 PID 2584 wrote to memory of 2104 2584 xfrrrrf.exe 41 PID 2584 wrote to memory of 2104 2584 xfrrrrf.exe 41 PID 2584 wrote to memory of 2104 2584 xfrrrrf.exe 41 PID 2104 wrote to memory of 2760 2104 7pddp.exe 42 PID 2104 wrote to memory of 2760 2104 7pddp.exe 42 PID 2104 wrote to memory of 2760 2104 7pddp.exe 42 PID 2104 wrote to memory of 2760 2104 7pddp.exe 42 PID 2760 wrote to memory of 2284 2760 nntbnt.exe 43 PID 2760 wrote to memory of 2284 2760 nntbnt.exe 43 PID 2760 wrote to memory of 2284 2760 nntbnt.exe 43 PID 2760 wrote to memory of 2284 2760 nntbnt.exe 43 PID 2284 wrote to memory of 2924 2284 bnbbtt.exe 44 PID 2284 wrote to memory of 2924 2284 bnbbtt.exe 44 PID 2284 wrote to memory of 2924 2284 bnbbtt.exe 44 PID 2284 wrote to memory of 2924 2284 bnbbtt.exe 44 PID 2924 wrote to memory of 2708 2924 pdvvd.exe 45 PID 2924 wrote to memory of 2708 2924 pdvvd.exe 45 PID 2924 wrote to memory of 2708 2924 pdvvd.exe 45 PID 2924 wrote to memory of 2708 2924 pdvvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3d27e9a9d5420bd426760bc08abab77c59a501a7be73542516668bf94e9306cN.exe"C:\Users\Admin\AppData\Local\Temp\c3d27e9a9d5420bd426760bc08abab77c59a501a7be73542516668bf94e9306cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\xrflxxf.exec:\xrflxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\htnthh.exec:\htnthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\5jvdd.exec:\5jvdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\xrflrrx.exec:\xrflrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nbntbb.exec:\nbntbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\jdjjj.exec:\jdjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\flxrlfl.exec:\flxrlfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\hthhnt.exec:\hthhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\lxfffxx.exec:\lxfffxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\1ntnbb.exec:\1ntnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\xfrrrrf.exec:\xfrrrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\7pddp.exec:\7pddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\nntbnt.exec:\nntbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\bnbbtt.exec:\bnbbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\pdvvd.exec:\pdvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\9fxxllx.exec:\9fxxllx.exe17⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5dppp.exec:\5dppp.exe18⤵
- Executes dropped EXE
PID:2904 -
\??\c:\1xlrxff.exec:\1xlrxff.exe19⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vvppv.exec:\vvppv.exe20⤵
- Executes dropped EXE
PID:2920 -
\??\c:\9rlrffl.exec:\9rlrffl.exe21⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vddvj.exec:\vddvj.exe22⤵
- Executes dropped EXE
PID:408 -
\??\c:\rfrlfxl.exec:\rfrlfxl.exe23⤵
- Executes dropped EXE
PID:3064 -
\??\c:\ppppd.exec:\ppppd.exe24⤵
- Executes dropped EXE
PID:288 -
\??\c:\5rrllfl.exec:\5rrllfl.exe25⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hhbhtb.exec:\hhbhtb.exe26⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vpvvv.exec:\vpvvv.exe27⤵
- Executes dropped EXE
PID:1272 -
\??\c:\9lffllx.exec:\9lffllx.exe28⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9nhhhb.exec:\9nhhhb.exe29⤵
- Executes dropped EXE
PID:1052 -
\??\c:\xlflrxl.exec:\xlflrxl.exe30⤵
- Executes dropped EXE
PID:1524 -
\??\c:\hbnnbh.exec:\hbnnbh.exe31⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jjdpj.exec:\jjdpj.exe32⤵
- Executes dropped EXE
PID:1888 -
\??\c:\7rxrrrx.exec:\7rxrrrx.exe33⤵
- Executes dropped EXE
PID:1544 -
\??\c:\vpvjv.exec:\vpvjv.exe34⤵
- Executes dropped EXE
PID:3032 -
\??\c:\lflrxrx.exec:\lflrxrx.exe35⤵
- Executes dropped EXE
PID:1912 -
\??\c:\nhtbbh.exec:\nhtbbh.exe36⤵
- Executes dropped EXE
PID:2868 -
\??\c:\dpvvd.exec:\dpvvd.exe37⤵
- Executes dropped EXE
PID:2060 -
\??\c:\fxrrflf.exec:\fxrrflf.exe38⤵
- Executes dropped EXE
PID:2744 -
\??\c:\7bhtth.exec:\7bhtth.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\hbnhnt.exec:\hbnhnt.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jdjjj.exec:\jdjjj.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\fffrlff.exec:\fffrlff.exe42⤵
- Executes dropped EXE
PID:2860 -
\??\c:\7lfflfl.exec:\7lfflfl.exe43⤵
- Executes dropped EXE
PID:2588 -
\??\c:\tnbbbb.exec:\tnbbbb.exe44⤵
- Executes dropped EXE
PID:2580 -
\??\c:\pdjjp.exec:\pdjjp.exe45⤵
- Executes dropped EXE
PID:2528 -
\??\c:\rlrlrlr.exec:\rlrlrlr.exe46⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nbhnbt.exec:\nbhnbt.exe47⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1ttttt.exec:\1ttttt.exe48⤵
- Executes dropped EXE
PID:1328 -
\??\c:\pjpdj.exec:\pjpdj.exe49⤵
- Executes dropped EXE
PID:1228 -
\??\c:\flxlfxr.exec:\flxlfxr.exe50⤵
- Executes dropped EXE
PID:1380 -
\??\c:\hbnntt.exec:\hbnntt.exe51⤵
- Executes dropped EXE
PID:2052 -
\??\c:\5nbbhh.exec:\5nbbhh.exe52⤵
- Executes dropped EXE
PID:2948 -
\??\c:\dpdjp.exec:\dpdjp.exe53⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pdpjp.exec:\pdpjp.exe54⤵
- Executes dropped EXE
PID:2756 -
\??\c:\9lxflfl.exec:\9lxflfl.exe55⤵
- Executes dropped EXE
PID:1768 -
\??\c:\nbnnnt.exec:\nbnnnt.exe56⤵
- Executes dropped EXE
PID:2912 -
\??\c:\5jpjp.exec:\5jpjp.exe57⤵
- Executes dropped EXE
PID:1860 -
\??\c:\3xxrlfl.exec:\3xxrlfl.exe58⤵
- Executes dropped EXE
PID:2096 -
\??\c:\fxfxfxx.exec:\fxfxfxx.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2120 -
\??\c:\nhhhnb.exec:\nhhhnb.exe60⤵
- Executes dropped EXE
PID:2356 -
\??\c:\pdpjj.exec:\pdpjj.exe61⤵
- Executes dropped EXE
PID:3060 -
\??\c:\dvjjj.exec:\dvjjj.exe62⤵
- Executes dropped EXE
PID:1624 -
\??\c:\rfrlxrx.exec:\rfrlxrx.exe63⤵
- Executes dropped EXE
PID:108 -
\??\c:\7thbbt.exec:\7thbbt.exe64⤵
- Executes dropped EXE
PID:936 -
\??\c:\tntttt.exec:\tntttt.exe65⤵
- Executes dropped EXE
PID:1500 -
\??\c:\5ppjp.exec:\5ppjp.exe66⤵PID:2324
-
\??\c:\5lxxrxf.exec:\5lxxrxf.exe67⤵PID:788
-
\??\c:\rfrxffl.exec:\rfrxffl.exe68⤵PID:712
-
\??\c:\9thbtn.exec:\9thbtn.exe69⤵PID:1444
-
\??\c:\dvjdd.exec:\dvjdd.exe70⤵PID:2492
-
\??\c:\xllflff.exec:\xllflff.exe71⤵PID:1520
-
\??\c:\1lfllrr.exec:\1lfllrr.exe72⤵PID:2228
-
\??\c:\tbbbbb.exec:\tbbbbb.exe73⤵PID:2472
-
\??\c:\jdjdp.exec:\jdjdp.exe74⤵PID:2464
-
\??\c:\lfrxlrl.exec:\lfrxlrl.exe75⤵PID:2440
-
\??\c:\nnbhnh.exec:\nnbhnh.exe76⤵PID:1912
-
\??\c:\htnbbh.exec:\htnbbh.exe77⤵PID:2624
-
\??\c:\ppjjp.exec:\ppjjp.exe78⤵PID:2672
-
\??\c:\jvvjd.exec:\jvvjd.exe79⤵PID:1852
-
\??\c:\llllxxf.exec:\llllxxf.exe80⤵PID:536
-
\??\c:\hbnthn.exec:\hbnthn.exe81⤵PID:768
-
\??\c:\9vdjj.exec:\9vdjj.exe82⤵PID:2556
-
\??\c:\3vvdv.exec:\3vvdv.exe83⤵PID:2536
-
\??\c:\ffxxlfr.exec:\ffxxlfr.exe84⤵PID:2852
-
\??\c:\bnhnnn.exec:\bnhnnn.exe85⤵PID:2548
-
\??\c:\9djpj.exec:\9djpj.exe86⤵PID:2576
-
\??\c:\1rfffll.exec:\1rfffll.exe87⤵PID:1028
-
\??\c:\xrflrlr.exec:\xrflrlr.exe88⤵PID:1072
-
\??\c:\9bttbt.exec:\9bttbt.exe89⤵PID:2632
-
\??\c:\3dvvv.exec:\3dvvv.exe90⤵PID:2780
-
\??\c:\pjvvv.exec:\pjvvv.exe91⤵PID:2592
-
\??\c:\lfrlffl.exec:\lfrlffl.exe92⤵PID:2924
-
\??\c:\1rxffff.exec:\1rxffff.exe93⤵PID:848
-
\??\c:\hnbbbb.exec:\hnbbbb.exe94⤵PID:2948
-
\??\c:\9djvv.exec:\9djvv.exe95⤵PID:1724
-
\??\c:\pjppp.exec:\pjppp.exe96⤵PID:1224
-
\??\c:\xrxxlfx.exec:\xrxxlfx.exe97⤵PID:1768
-
\??\c:\htbhhb.exec:\htbhhb.exe98⤵PID:2920
-
\??\c:\bnbbbt.exec:\bnbbbt.exe99⤵PID:2952
-
\??\c:\9dvpp.exec:\9dvpp.exe100⤵
- System Location Discovery: System Language Discovery
PID:2876 -
\??\c:\jdvvv.exec:\jdvvv.exe101⤵PID:1504
-
\??\c:\fxlllrx.exec:\fxlllrx.exe102⤵PID:1804
-
\??\c:\tnbbbb.exec:\tnbbbb.exe103⤵PID:1120
-
\??\c:\jdpjd.exec:\jdpjd.exe104⤵PID:1592
-
\??\c:\ppjjj.exec:\ppjjj.exe105⤵PID:1276
-
\??\c:\frllrrx.exec:\frllrrx.exe106⤵PID:1732
-
\??\c:\rrfflfl.exec:\rrfflfl.exe107⤵PID:624
-
\??\c:\bhbhtt.exec:\bhbhtt.exe108⤵PID:1020
-
\??\c:\5jvpv.exec:\5jvpv.exe109⤵PID:1800
-
\??\c:\dpdjj.exec:\dpdjj.exe110⤵PID:812
-
\??\c:\7xfxffx.exec:\7xfxffx.exe111⤵PID:2216
-
\??\c:\hnhnnn.exec:\hnhnnn.exe112⤵PID:3012
-
\??\c:\7htttb.exec:\7htttb.exe113⤵PID:2360
-
\??\c:\dvddv.exec:\dvddv.exe114⤵PID:1944
-
\??\c:\9xlrrll.exec:\9xlrrll.exe115⤵PID:352
-
\??\c:\lrlrrrx.exec:\lrlrrrx.exe116⤵PID:1660
-
\??\c:\hbtbbb.exec:\hbtbbb.exe117⤵PID:3056
-
\??\c:\pjvvd.exec:\pjvvd.exe118⤵PID:3044
-
\??\c:\lxlffxx.exec:\lxlffxx.exe119⤵PID:700
-
\??\c:\lxrrfxr.exec:\lxrrfxr.exe120⤵PID:2808
-
\??\c:\tntnnh.exec:\tntnnh.exe121⤵PID:2688
-
\??\c:\ddpjv.exec:\ddpjv.exe122⤵PID:2660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-