Analysis
-
max time kernel
150s -
max time network
79s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2025 08:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe
-
Size
52KB
-
MD5
7c714b0617dad817c42df4d2241f4ee8
-
SHA1
3c82ee424a84c05339e8cd205b341c44aa376117
-
SHA256
ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308
-
SHA512
cf4278e4168267a9d84ed128000c7dcc54d64017ebe47b1b3b5241f0ba547965139226fa4e790c7422de3967c1550e5de44d71c026ed6fff0ba7954d1c3fa137
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0ysbe:ymb3NkkiQ3mdBjF0yee
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3700-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/900-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/656-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1204-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 456 rrrxlfr.exe 1316 pjdjj.exe 3556 llxlxrf.exe 1408 lxlrfxl.exe 900 lrxfrfr.exe 3020 ttnhnh.exe 4320 djvjv.exe 5080 lffxlfr.exe 4204 nhbbth.exe 3000 thhtbt.exe 4640 vjddp.exe 3912 flfrffr.exe 4808 nbnbnh.exe 1896 nbthtn.exe 4512 ppvjv.exe 2104 9vvjv.exe 2180 rfrxlxl.exe 2204 rxfrrll.exe 3488 tbthth.exe 3500 thhtnb.exe 2128 pdvjp.exe 4588 5rxlrlx.exe 1440 rffrfrr.exe 656 htbnhb.exe 4012 vvpjv.exe 440 vjdvj.exe 4992 3lxlrlx.exe 2588 rxrlxrl.exe 1204 nbthth.exe 4884 nbbhtn.exe 1520 vpdpv.exe 3532 xrrrxrf.exe 3088 xlrrfrl.exe 4628 hbntht.exe 2836 pjvjv.exe 1996 dvvjp.exe 3568 fxrfrlf.exe 2584 7flflxf.exe 840 xfrlxxr.exe 2432 htbthn.exe 2192 tbhhbt.exe 2032 jpdpv.exe 4380 dpdpv.exe 3460 flflrxl.exe 4956 lxrlffr.exe 4692 tnntht.exe 4300 bnthnb.exe 2780 jvdpv.exe 4900 djvpd.exe 2828 thbnbt.exe 3320 bhnhbn.exe 2164 pppjj.exe 3680 vjdjj.exe 4564 7frlrlx.exe 4416 lrfxlfr.exe 4856 9nbthb.exe 900 vjdvd.exe 2472 3vjjp.exe 3968 xflfrxr.exe 5096 htbbbn.exe 632 vjjdd.exe 4216 vppvj.exe 1628 xlxrrrr.exe 4624 nntnbh.exe -
resource yara_rule behavioral2/memory/3700-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/900-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/900-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/900-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/900-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1204-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-214-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3700 wrote to memory of 456 3700 ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe 83 PID 3700 wrote to memory of 456 3700 ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe 83 PID 3700 wrote to memory of 456 3700 ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe 83 PID 456 wrote to memory of 1316 456 rrrxlfr.exe 84 PID 456 wrote to memory of 1316 456 rrrxlfr.exe 84 PID 456 wrote to memory of 1316 456 rrrxlfr.exe 84 PID 1316 wrote to memory of 3556 1316 pjdjj.exe 85 PID 1316 wrote to memory of 3556 1316 pjdjj.exe 85 PID 1316 wrote to memory of 3556 1316 pjdjj.exe 85 PID 3556 wrote to memory of 1408 3556 llxlxrf.exe 86 PID 3556 wrote to memory of 1408 3556 llxlxrf.exe 86 PID 3556 wrote to memory of 1408 3556 llxlxrf.exe 86 PID 1408 wrote to memory of 900 1408 lxlrfxl.exe 87 PID 1408 wrote to memory of 900 1408 lxlrfxl.exe 87 PID 1408 wrote to memory of 900 1408 lxlrfxl.exe 87 PID 900 wrote to memory of 3020 900 lrxfrfr.exe 88 PID 900 wrote to memory of 3020 900 lrxfrfr.exe 88 PID 900 wrote to memory of 3020 900 lrxfrfr.exe 88 PID 3020 wrote to memory of 4320 3020 ttnhnh.exe 89 PID 3020 wrote to memory of 4320 3020 ttnhnh.exe 89 PID 3020 wrote to memory of 4320 3020 ttnhnh.exe 89 PID 4320 wrote to memory of 5080 4320 djvjv.exe 90 PID 4320 wrote to memory of 5080 4320 djvjv.exe 90 PID 4320 wrote to memory of 5080 4320 djvjv.exe 90 PID 5080 wrote to memory of 4204 5080 lffxlfr.exe 91 PID 5080 wrote to memory of 4204 5080 lffxlfr.exe 91 PID 5080 wrote to memory of 4204 5080 lffxlfr.exe 91 PID 4204 wrote to memory of 3000 4204 nhbbth.exe 92 PID 4204 wrote to memory of 3000 4204 nhbbth.exe 92 PID 4204 wrote to memory of 3000 4204 nhbbth.exe 92 PID 3000 wrote to memory of 4640 3000 thhtbt.exe 93 PID 3000 wrote to memory of 4640 3000 thhtbt.exe 93 PID 3000 wrote to memory of 4640 3000 thhtbt.exe 93 PID 4640 wrote to memory of 3912 4640 vjddp.exe 94 PID 4640 wrote to memory of 3912 4640 vjddp.exe 94 PID 4640 wrote to memory of 3912 4640 vjddp.exe 94 PID 3912 wrote to memory of 4808 3912 flfrffr.exe 95 PID 3912 wrote to memory of 4808 3912 flfrffr.exe 95 PID 3912 wrote to memory of 4808 3912 flfrffr.exe 95 PID 4808 wrote to memory of 1896 4808 nbnbnh.exe 96 PID 4808 wrote to memory of 1896 4808 nbnbnh.exe 96 PID 4808 wrote to memory of 1896 4808 nbnbnh.exe 96 PID 1896 wrote to memory of 4512 1896 nbthtn.exe 97 PID 1896 wrote to memory of 4512 1896 nbthtn.exe 97 PID 1896 wrote to memory of 4512 1896 nbthtn.exe 97 PID 4512 wrote to memory of 2104 4512 ppvjv.exe 98 PID 4512 wrote to memory of 2104 4512 ppvjv.exe 98 PID 4512 wrote to memory of 2104 4512 ppvjv.exe 98 PID 2104 wrote to memory of 2180 2104 9vvjv.exe 99 PID 2104 wrote to memory of 2180 2104 9vvjv.exe 99 PID 2104 wrote to memory of 2180 2104 9vvjv.exe 99 PID 2180 wrote to memory of 2204 2180 rfrxlxl.exe 100 PID 2180 wrote to memory of 2204 2180 rfrxlxl.exe 100 PID 2180 wrote to memory of 2204 2180 rfrxlxl.exe 100 PID 2204 wrote to memory of 3488 2204 rxfrrll.exe 101 PID 2204 wrote to memory of 3488 2204 rxfrrll.exe 101 PID 2204 wrote to memory of 3488 2204 rxfrrll.exe 101 PID 3488 wrote to memory of 3500 3488 tbthth.exe 102 PID 3488 wrote to memory of 3500 3488 tbthth.exe 102 PID 3488 wrote to memory of 3500 3488 tbthth.exe 102 PID 3500 wrote to memory of 2128 3500 thhtnb.exe 103 PID 3500 wrote to memory of 2128 3500 thhtnb.exe 103 PID 3500 wrote to memory of 2128 3500 thhtnb.exe 103 PID 2128 wrote to memory of 4588 2128 pdvjp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe"C:\Users\Admin\AppData\Local\Temp\ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\rrrxlfr.exec:\rrrxlfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\pjdjj.exec:\pjdjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\llxlxrf.exec:\llxlxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\lxlrfxl.exec:\lxlrfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\lrxfrfr.exec:\lrxfrfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\ttnhnh.exec:\ttnhnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\djvjv.exec:\djvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\lffxlfr.exec:\lffxlfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\nhbbth.exec:\nhbbth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\thhtbt.exec:\thhtbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\vjddp.exec:\vjddp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\flfrffr.exec:\flfrffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\nbnbnh.exec:\nbnbnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\nbthtn.exec:\nbthtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\ppvjv.exec:\ppvjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\9vvjv.exec:\9vvjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\rfrxlxl.exec:\rfrxlxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\rxfrrll.exec:\rxfrrll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\tbthth.exec:\tbthth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\thhtnb.exec:\thhtnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\pdvjp.exec:\pdvjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\5rxlrlx.exec:\5rxlrlx.exe23⤵
- Executes dropped EXE
PID:4588 -
\??\c:\rffrfrr.exec:\rffrfrr.exe24⤵
- Executes dropped EXE
PID:1440 -
\??\c:\htbnhb.exec:\htbnhb.exe25⤵
- Executes dropped EXE
PID:656 -
\??\c:\vvpjv.exec:\vvpjv.exe26⤵
- Executes dropped EXE
PID:4012 -
\??\c:\vjdvj.exec:\vjdvj.exe27⤵
- Executes dropped EXE
PID:440 -
\??\c:\3lxlrlx.exec:\3lxlrlx.exe28⤵
- Executes dropped EXE
PID:4992 -
\??\c:\rxrlxrl.exec:\rxrlxrl.exe29⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nbthth.exec:\nbthth.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1204 -
\??\c:\nbbhtn.exec:\nbbhtn.exe31⤵
- Executes dropped EXE
PID:4884 -
\??\c:\vpdpv.exec:\vpdpv.exe32⤵
- Executes dropped EXE
PID:1520 -
\??\c:\xrrrxrf.exec:\xrrrxrf.exe33⤵
- Executes dropped EXE
PID:3532 -
\??\c:\xlrrfrl.exec:\xlrrfrl.exe34⤵
- Executes dropped EXE
PID:3088 -
\??\c:\hbntht.exec:\hbntht.exe35⤵
- Executes dropped EXE
PID:4628 -
\??\c:\pjvjv.exec:\pjvjv.exe36⤵
- Executes dropped EXE
PID:2836 -
\??\c:\dvvjp.exec:\dvvjp.exe37⤵
- Executes dropped EXE
PID:1996 -
\??\c:\fxrfrlf.exec:\fxrfrlf.exe38⤵
- Executes dropped EXE
PID:3568 -
\??\c:\7flflxf.exec:\7flflxf.exe39⤵
- Executes dropped EXE
PID:2584 -
\??\c:\xfrlxxr.exec:\xfrlxxr.exe40⤵
- Executes dropped EXE
PID:840 -
\??\c:\htbthn.exec:\htbthn.exe41⤵
- Executes dropped EXE
PID:2432 -
\??\c:\tbhhbt.exec:\tbhhbt.exe42⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jpdpv.exec:\jpdpv.exe43⤵
- Executes dropped EXE
PID:2032 -
\??\c:\dpdpv.exec:\dpdpv.exe44⤵
- Executes dropped EXE
PID:4380 -
\??\c:\flflrxl.exec:\flflrxl.exe45⤵
- Executes dropped EXE
PID:3460 -
\??\c:\lxrlffr.exec:\lxrlffr.exe46⤵
- Executes dropped EXE
PID:4956 -
\??\c:\tnntht.exec:\tnntht.exe47⤵
- Executes dropped EXE
PID:4692 -
\??\c:\bnthnb.exec:\bnthnb.exe48⤵
- Executes dropped EXE
PID:4300 -
\??\c:\jvdpv.exec:\jvdpv.exe49⤵
- Executes dropped EXE
PID:2780 -
\??\c:\djvpd.exec:\djvpd.exe50⤵
- Executes dropped EXE
PID:4900 -
\??\c:\thbnbt.exec:\thbnbt.exe51⤵
- Executes dropped EXE
PID:2828 -
\??\c:\bhnhbn.exec:\bhnhbn.exe52⤵
- Executes dropped EXE
PID:3320 -
\??\c:\pppjj.exec:\pppjj.exe53⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vjdjj.exec:\vjdjj.exe54⤵
- Executes dropped EXE
PID:3680 -
\??\c:\7frlrlx.exec:\7frlrlx.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4564 -
\??\c:\lrfxlfr.exec:\lrfxlfr.exe56⤵
- Executes dropped EXE
PID:4416 -
\??\c:\9nbthb.exec:\9nbthb.exe57⤵
- Executes dropped EXE
PID:4856 -
\??\c:\vjdvd.exec:\vjdvd.exe58⤵
- Executes dropped EXE
PID:900 -
\??\c:\3vjjp.exec:\3vjjp.exe59⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xflfrxr.exec:\xflfrxr.exe60⤵
- Executes dropped EXE
PID:3968 -
\??\c:\htbbbn.exec:\htbbbn.exe61⤵
- Executes dropped EXE
PID:5096 -
\??\c:\vjjdd.exec:\vjjdd.exe62⤵
- Executes dropped EXE
PID:632 -
\??\c:\vppvj.exec:\vppvj.exe63⤵
- Executes dropped EXE
PID:4216 -
\??\c:\xlxrrrr.exec:\xlxrrrr.exe64⤵
- Executes dropped EXE
PID:1628 -
\??\c:\nntnbh.exec:\nntnbh.exe65⤵
- Executes dropped EXE
PID:4624 -
\??\c:\ttnhnh.exec:\ttnhnh.exe66⤵PID:4636
-
\??\c:\vvddd.exec:\vvddd.exe67⤵PID:916
-
\??\c:\pdpdp.exec:\pdpdp.exe68⤵PID:3912
-
\??\c:\vjvjp.exec:\vjvjp.exe69⤵PID:3212
-
\??\c:\flfrxlf.exec:\flfrxlf.exe70⤵PID:3200
-
\??\c:\nhnhtt.exec:\nhnhtt.exe71⤵PID:4680
-
\??\c:\nbnhbt.exec:\nbnhbt.exe72⤵PID:1804
-
\??\c:\jvvjp.exec:\jvvjp.exe73⤵PID:220
-
\??\c:\vpdpp.exec:\vpdpp.exe74⤵PID:5004
-
\??\c:\llxrxrf.exec:\llxrxrf.exe75⤵PID:1108
-
\??\c:\xrrllxr.exec:\xrrllxr.exe76⤵PID:3440
-
\??\c:\frrlfxx.exec:\frrlfxx.exe77⤵PID:1476
-
\??\c:\thbbtt.exec:\thbbtt.exe78⤵PID:2352
-
\??\c:\djvpv.exec:\djvpv.exe79⤵PID:2604
-
\??\c:\vjjvd.exec:\vjjvd.exe80⤵PID:3528
-
\??\c:\ppdvd.exec:\ppdvd.exe81⤵PID:4588
-
\??\c:\9llfrlx.exec:\9llfrlx.exe82⤵PID:380
-
\??\c:\5lfrfxr.exec:\5lfrfxr.exe83⤵PID:1592
-
\??\c:\nhhhbb.exec:\nhhhbb.exe84⤵PID:4400
-
\??\c:\thnhhb.exec:\thnhhb.exe85⤵PID:3388
-
\??\c:\pjjdj.exec:\pjjdj.exe86⤵PID:4048
-
\??\c:\xfxxrrr.exec:\xfxxrrr.exe87⤵PID:1924
-
\??\c:\9rllffr.exec:\9rllffr.exe88⤵PID:5056
-
\??\c:\tnnbbt.exec:\tnnbbt.exe89⤵PID:696
-
\??\c:\9tthth.exec:\9tthth.exe90⤵PID:1600
-
\??\c:\5jdpd.exec:\5jdpd.exe91⤵PID:1824
-
\??\c:\ppvvj.exec:\ppvvj.exe92⤵PID:1520
-
\??\c:\rlfrxrr.exec:\rlfrxrr.exe93⤵PID:3608
-
\??\c:\lxxrfxr.exec:\lxxrfxr.exe94⤵PID:3584
-
\??\c:\xxxxrll.exec:\xxxxrll.exe95⤵PID:4180
-
\??\c:\nbtnbt.exec:\nbtnbt.exe96⤵PID:1964
-
\??\c:\dvpjj.exec:\dvpjj.exe97⤵PID:1996
-
\??\c:\jdvjv.exec:\jdvjv.exe98⤵PID:2572
-
\??\c:\flfrxrf.exec:\flfrxrf.exe99⤵PID:468
-
\??\c:\tbttnh.exec:\tbttnh.exe100⤵PID:840
-
\??\c:\nhbnbt.exec:\nhbnbt.exe101⤵PID:4520
-
\??\c:\7nbnht.exec:\7nbnht.exe102⤵PID:2192
-
\??\c:\dpvdj.exec:\dpvdj.exe103⤵PID:452
-
\??\c:\xllxfxl.exec:\xllxfxl.exe104⤵PID:4608
-
\??\c:\rxflfff.exec:\rxflfff.exe105⤵PID:224
-
\??\c:\tbthtn.exec:\tbthtn.exe106⤵PID:4956
-
\??\c:\htnnbt.exec:\htnnbt.exe107⤵PID:4284
-
\??\c:\1pjvj.exec:\1pjvj.exe108⤵PID:2580
-
\??\c:\pjdvj.exec:\pjdvj.exe109⤵PID:640
-
\??\c:\rlllxxr.exec:\rlllxxr.exe110⤵PID:4900
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe111⤵PID:2760
-
\??\c:\nhthbt.exec:\nhthbt.exe112⤵PID:1316
-
\??\c:\hnbthb.exec:\hnbthb.exe113⤵PID:2164
-
\??\c:\jvpjv.exec:\jvpjv.exe114⤵PID:836
-
\??\c:\djddd.exec:\djddd.exe115⤵PID:2160
-
\??\c:\xrrrlll.exec:\xrrrlll.exe116⤵PID:3748
-
\??\c:\rrrrrxl.exec:\rrrrrxl.exe117⤵PID:312
-
\??\c:\ntnhbn.exec:\ntnhbn.exe118⤵PID:4964
-
\??\c:\jpppp.exec:\jpppp.exe119⤵PID:1072
-
\??\c:\jdvvp.exec:\jdvvp.exe120⤵PID:832
-
\??\c:\lxxlfxl.exec:\lxxlfxl.exe121⤵PID:1612
-
\??\c:\frrffxr.exec:\frrffxr.exe122⤵PID:4816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-