Overview
overview
10Static
static
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Berbew.exe
windows11-21h2-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows11-21h2-x64
5out.exe
windows10-2004-x64
3out.exe
windows11-21h2-x64
3RAT/31.exe
windows10-2004-x64
10RAT/31.exe
windows11-21h2-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/XClient.exe
windows11-21h2-x64
10RAT/file.exe
windows10-2004-x64
7RAT/file.exe
windows11-21h2-x64
7Ransomware...-2.exe
windows10-2004-x64
10Ransomware...-2.exe
windows11-21h2-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...01.exe
windows11-21h2-x64
10Ransomware...lt.exe
windows10-2004-x64
10Ransomware...lt.exe
windows11-21h2-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows11-21h2-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/B...on.exe
windows11-21h2-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/Dridex.dll
windows11-21h2-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/M..._2.exe
windows11-21h2-x64
10Stealers/lumma.exe
windows10-2004-x64
10Stealers/lumma.exe
windows11-21h2-x64
3Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows11-21h2-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows11-21h2-x64
10Analysis
- max time kernel
111s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/02/2026, 22:07
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
out.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
out.exe
Resource
win11-20250610-en
Behavioral task
behavioral7
Sample
RAT/31.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral8
Sample
RAT/31.exe
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
RAT/XClient.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral10
Sample
RAT/XClient.exe
Resource
win11-20260130-en
Behavioral task
behavioral11
Sample
RAT/file.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral12
Sample
RAT/file.exe
Resource
win11-20260130-en
Behavioral task
behavioral13
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral14
Sample
Ransomware/Client-2.exe
Resource
win11-20260130-en
Behavioral task
behavioral15
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral16
Sample
Ransomware/criticalupdate01.exe
Resource
win11-20260130-en
Behavioral task
behavioral17
Sample
Ransomware/default.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral18
Sample
Ransomware/default.exe
Resource
win11-20250619-en
Behavioral task
behavioral19
Sample
Stealers/Azorult.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral20
Sample
Stealers/Azorult.exe
Resource
win11-20260130-en
Behavioral task
behavioral21
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral22
Sample
Stealers/BlackMoon.exe
Resource
win11-20260130-en
Behavioral task
behavioral23
Sample
Stealers/Dridex.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral24
Sample
Stealers/Dridex.dll
Resource
win11-20260130-en
Behavioral task
behavioral25
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral26
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win11-20260130-en
Behavioral task
behavioral27
Sample
Stealers/lumma.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral28
Sample
Stealers/lumma.exe
Resource
win11-20260130-en
Behavioral task
behavioral29
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral30
Sample
Trojan/BetaBot.exe
Resource
win11-20260130-en
Behavioral task
behavioral31
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral32
Sample
Trojan/SmokeLoader.exe
Resource
win11-20260130-en
General
- Target Stealers/BlackMoon.exe
- Size 387KB
- Sample260211-112ekaby8c
- SHA256 e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
- MD5 336efa7460c08e3d47f29121742eb010
- SHA1 f41c36cd83879d170309dede056563d35741b87b
- SHA512 e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
- SSDEEP 12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
- TLSH T1B3849E51F6C9A1F5E5A2783026E7DF772876EE214F9044E7D1B03A0D37205C27A3AA1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral21/memory/744-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/4508-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/4784-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/5364-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/1432-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/5352-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/1848-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/1452-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/2972-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/1560-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/6012-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/1656-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/2344-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/1056-333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/2604-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/2632-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/5432-693-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/3632-929-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/2480-1045-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/2492-1713-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/6488-2494-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/6188-3346-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/4780-1793-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/6024-1097-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/3792-637-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/4868-613-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/4296-585-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/3288-546-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/980-540-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/5068-465-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/2372-453-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/5440-389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/4880-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/4228-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/2908-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/6052-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/3788-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/1908-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/1580-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/5148-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/2264-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/2196-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/5368-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/516-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/2868-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/3320-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/3744-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/3836-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/6016-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/704-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/1600-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/5272-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/6000-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/4204-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/1676-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/4628-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/1996-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/4752-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/4312-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/5476-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/4508-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/4800-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/968-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral21/memory/744-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 968 xxxrffl.exe 4800 7bttnn.exe 4784 1vdvp.exe 4508 ffxlxlf.exe 5364 bnnhbn.exe 5476 hhbthb.exe 4312 vdjjp.exe 4496 1lxrrrx.exe 1432 tnbttt.exe 4752 hbnhnh.exe 1996 jdjjd.exe 4628 llrlfrf.exe 1676 lllfrrl.exe 4204 5hbnhh.exe 6000 vvjjp.exe 5272 pdjdv.exe 5352 xrffrff.exe 1600 rrrllff.exe 3264 hhbhbb.exe 704 3djdv.exe 6016 lfrlflf.exe 1848 tntnhh.exe 1452 lllfxrl.exe 3836 3bthbt.exe 3744 jpvpd.exe 3320 llfxfxl.exe 2712 bhnbtt.exe 2868 vpvpd.exe 2200 3rxrlff.exe 2472 tnbbbt.exe 516 hntnhh.exe 3824 pjdvp.exe 5368 jjvvv.exe 2972 lfffxll.exe 1560 3nthnh.exe 2196 djppv.exe 6012 rxfxxrr.exe 2264 fxflllf.exe 228 hbtttn.exe 3284 tnnhhh.exe 5584 pppjj.exe 4484 7xrlffx.exe 5148 xrxxxrr.exe 1332 bhtnnh.exe 2876 nbhhbn.exe 1580 1jdvp.exe 1908 lfxrlxr.exe 1656 rrfxlff.exe 3992 tbnhbh.exe 3788 bbtnhn.exe 1628 3ppdp.exe 5992 xxrlfff.exe 6052 lfffrrl.exe 4432 nhnbnn.exe 4108 ttnhbb.exe 2908 djpjd.exe 2344 3fxxrrl.exe 4920 rxfrllf.exe 1512 nhtnhb.exe 2612 bnhbtn.exe 1056 dvvpd.exe 1864 vdjjd.exe 4228 lfrlrrx.exe 4232 rxrxrxr.exe -
resource yara_rule behavioral21/memory/744-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4800-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4800-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4508-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4508-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4508-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4784-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/5364-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/1432-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/5352-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/1848-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/1452-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/2972-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/1560-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/6012-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/1656-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/2344-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/1056-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/2604-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/2632-433-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/5432-693-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/3632-929-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/2480-1045-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/2492-1713-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/6488-2494-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/6188-3346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4780-1793-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/6024-1097-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/3792-637-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4868-613-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4296-585-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/3288-546-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/980-540-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/5068-465-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/2372-453-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/5440-389-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4880-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4228-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/2908-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/6052-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/3788-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/1908-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/1580-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/5148-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/2264-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/2196-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/5368-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/516-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/2868-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/3320-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/3744-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/3836-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/6016-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/704-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/1600-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/5272-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/6000-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4204-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/1676-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4628-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/1996-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4752-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4496-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral21/memory/4496-67-0x0000000000400000-0x0000000000429000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 744 wrote to memory of 968 744 BlackMoon.exe 85 PID 968 wrote to memory of 4800 968 xxxrffl.exe 86 PID 4800 wrote to memory of 4784 4800 7bttnn.exe 87 PID 4784 wrote to memory of 4508 4784 1vdvp.exe 88 PID 4508 wrote to memory of 5364 4508 ffxlxlf.exe 89 PID 5364 wrote to memory of 5476 5364 bnnhbn.exe 90 PID 5476 wrote to memory of 4312 5476 hhbthb.exe 91 PID 4312 wrote to memory of 4496 4312 vdjjp.exe 92 PID 4496 wrote to memory of 1432 4496 1lxrrrx.exe 94 PID 1432 wrote to memory of 4752 1432 tnbttt.exe 95 PID 4752 wrote to memory of 1996 4752 hbnhnh.exe 96 PID 1996 wrote to memory of 4628 1996 jdjjd.exe 97 PID 4628 wrote to memory of 1676 4628 llrlfrf.exe 99 PID 1676 wrote to memory of 4204 1676 lllfrrl.exe 100 PID 4204 wrote to memory of 6000 4204 5hbnhh.exe 101 PID 6000 wrote to memory of 5272 6000 vvjjp.exe 102 PID 5272 wrote to memory of 5352 5272 pdjdv.exe 103 PID 5352 wrote to memory of 1600 5352 xrffrff.exe 105 PID 1600 wrote to memory of 3264 1600 rrrllff.exe 106 PID 3264 wrote to memory of 704 3264 hhbhbb.exe 107 PID 704 wrote to memory of 6016 704 3djdv.exe 108 PID 6016 wrote to memory of 1848 6016 lfrlflf.exe 109 PID 1848 wrote to memory of 1452 1848 tntnhh.exe 110 PID 1452 wrote to memory of 3836 1452 lllfxrl.exe 111 PID 3836 wrote to memory of 3744 3836 3bthbt.exe 112 PID 3744 wrote to memory of 3320 3744 jpvpd.exe 113 PID 3320 wrote to memory of 2712 3320 llfxfxl.exe 114 PID 2712 wrote to memory of 2868 2712 bhnbtt.exe 115 PID 2868 wrote to memory of 2200 2868 vpvpd.exe 116 PID 2200 wrote to memory of 2472 2200 3rxrlff.exe 117 PID 2472 wrote to memory of 516 2472 tnbbbt.exe 118 PID 516 wrote to memory of 3824 516 hntnhh.exe 119 PID 3824 wrote to memory of 5368 3824 pjdvp.exe 120 PID 5368 wrote to memory of 2972 5368 jjvvv.exe 121 PID 2972 wrote to memory of 1560 2972 lfffxll.exe 122 PID 1560 wrote to memory of 2196 1560 3nthnh.exe 123 PID 2196 wrote to memory of 6012 2196 djppv.exe 124 PID 6012 wrote to memory of 2264 6012 rxfxxrr.exe 125 PID 2264 wrote to memory of 228 2264 fxflllf.exe 126 PID 228 wrote to memory of 3284 228 hbtttn.exe 127 PID 3284 wrote to memory of 5584 3284 tnnhhh.exe 128 PID 5584 wrote to memory of 4484 5584 pppjj.exe 129 PID 4484 wrote to memory of 5148 4484 7xrlffx.exe 130 PID 5148 wrote to memory of 1332 5148 xrxxxrr.exe 131 PID 1332 wrote to memory of 2876 1332 bhtnnh.exe 132 PID 2876 wrote to memory of 1580 2876 nbhhbn.exe 133 PID 1580 wrote to memory of 1908 1580 1jdvp.exe 134 PID 1908 wrote to memory of 1656 1908 lfxrlxr.exe 135 PID 1656 wrote to memory of 3992 1656 rrfxlff.exe 136 PID 3992 wrote to memory of 3788 3992 tbnhbh.exe 137 PID 3788 wrote to memory of 1628 3788 bbtnhn.exe 138 PID 1628 wrote to memory of 5992 1628 3ppdp.exe 139 PID 5992 wrote to memory of 6052 5992 xxrlfff.exe 140 PID 6052 wrote to memory of 4432 6052 lfffrrl.exe 141 PID 4432 wrote to memory of 4108 4432 nhnbnn.exe 142 PID 4108 wrote to memory of 2908 4108 ttnhbb.exe 143 PID 2908 wrote to memory of 2344 2908 djpjd.exe 144 PID 2344 wrote to memory of 4920 2344 3fxxrrl.exe 145 PID 4920 wrote to memory of 1512 4920 rxfrllf.exe 146 PID 1512 wrote to memory of 2612 1512 nhtnhb.exe 147 PID 2612 wrote to memory of 1056 2612 bnhbtn.exe 148 PID 1056 wrote to memory of 1864 1056 dvvpd.exe 149 PID 1864 wrote to memory of 4228 1864 vdjjd.exe 150 PID 4228 wrote to memory of 4232 4228 lfrlrrx.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\xxxrffl.exec:\xxxrffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\7bttnn.exec:\7bttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\1vdvp.exec:\1vdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\ffxlxlf.exec:\ffxlxlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\bnnhbn.exec:\bnnhbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
\??\c:\hhbthb.exec:\hhbthb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
\??\c:\vdjjp.exec:\vdjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\1lxrrrx.exec:\1lxrrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\tnbttt.exec:\tnbttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\hbnhnh.exec:\hbnhnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\jdjjd.exec:\jdjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\llrlfrf.exec:\llrlfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\lllfrrl.exec:\lllfrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\5hbnhh.exec:\5hbnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\vvjjp.exec:\vvjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
\??\c:\pdjdv.exec:\pdjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
\??\c:\xrffrff.exec:\xrffrff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
\??\c:\rrrllff.exec:\rrrllff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\hhbhbb.exec:\hhbhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\3djdv.exec:\3djdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\lfrlflf.exec:\lfrlflf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
\??\c:\tntnhh.exec:\tntnhh.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\lllfxrl.exec:\lllfxrl.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\3bthbt.exec:\3bthbt.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\jpvpd.exec:\jpvpd.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\llfxfxl.exec:\llfxfxl.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\bhnbtt.exec:\bhnbtt.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\vpvpd.exec:\vpvpd.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\3rxrlff.exec:\3rxrlff.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\tnbbbt.exec:\tnbbbt.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\hntnhh.exec:\hntnhh.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\pjdvp.exec:\pjdvp.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\jjvvv.exec:\jjvvv.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
\??\c:\lfffxll.exec:\lfffxll.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\3nthnh.exec:\3nthnh.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\djppv.exec:\djppv.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\rxfxxrr.exec:\rxfxxrr.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
\??\c:\fxflllf.exec:\fxflllf.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\hbtttn.exec:\hbtttn.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\tnnhhh.exec:\tnnhhh.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\pppjj.exec:\pppjj.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
\??\c:\7xrlffx.exec:\7xrlffx.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\xrxxxrr.exec:\xrxxxrr.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
\??\c:\bhtnnh.exec:\bhtnnh.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\nbhhbn.exec:\nbhhbn.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\1jdvp.exec:\1jdvp.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\lfxrlxr.exec:\lfxrlxr.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\rrfxlff.exec:\rrfxlff.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\tbnhbh.exec:\tbnhbh.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\bbtnhn.exec:\bbtnhn.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\3ppdp.exec:\3ppdp.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\xxrlfff.exec:\xxrlfff.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
\??\c:\lfffrrl.exec:\lfffrrl.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6052 -
\??\c:\nhnbnn.exec:\nhnbnn.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\ttnhbb.exec:\ttnhbb.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\djpjd.exec:\djpjd.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\3fxxrrl.exec:\3fxxrrl.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\rxfrllf.exec:\rxfrllf.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\nhtnhb.exec:\nhtnhb.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\bnhbtn.exec:\bnhbtn.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\dvvpd.exec:\dvvpd.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\vdjjd.exec:\vdjjd.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\rxrxrxr.exec:\rxrxrxr.exe65⤵
- Executes dropped EXE
PID:4232 -
\??\c:\ttbnnb.exec:\ttbnnb.exe66⤵PID:4744
-
\??\c:\nbbnhh.exec:\nbbnhh.exe67⤵PID:5660
-
\??\c:\pppjv.exec:\pppjv.exe68⤵PID:1672
-
\??\c:\3ppdv.exec:\3ppdv.exe69⤵PID:1812
-
\??\c:\7llffxx.exec:\7llffxx.exe70⤵PID:5740
-
\??\c:\ttnbnh.exec:\ttnbnh.exe71⤵PID:4880
-
\??\c:\nhnhtt.exec:\nhnhtt.exe72⤵PID:2604
-
\??\c:\9pjjd.exec:\9pjjd.exe73⤵PID:5772
-
\??\c:\ppppj.exec:\ppppj.exe74⤵PID:4196
-
\??\c:\rlrxfrx.exec:\rlrxfrx.exe75⤵PID:5748
-
\??\c:\bnhttb.exec:\bnhttb.exe76⤵PID:5440
-
\??\c:\bttnhb.exec:\bttnhb.exe77⤵PID:1092
-
\??\c:\5dppj.exec:\5dppj.exe78⤵PID:5696
-
\??\c:\vpvpj.exec:\vpvpj.exe79⤵PID:5036
-
\??\c:\xrfrxll.exec:\xrfrxll.exe80⤵PID:5276
-
\??\c:\xllfxxl.exec:\xllfxxl.exe81⤵PID:4416
-
\??\c:\nbhtnh.exec:\nbhtnh.exe82⤵PID:1272
-
\??\c:\hbbthn.exec:\hbbthn.exe83⤵PID:5040
-
\??\c:\vvvvd.exec:\vvvvd.exe84⤵PID:5284
-
\??\c:\fxlxllr.exec:\fxlxllr.exe85⤵PID:4172
-
\??\c:\frxrrxr.exec:\frxrrxr.exe86⤵PID:3316
-
\??\c:\nhttnn.exec:\nhttnn.exe87⤵PID:2632
-
\??\c:\ntnnhh.exec:\ntnnhh.exe88⤵PID:2496
-
\??\c:\jvvvp.exec:\jvvvp.exe89⤵PID:1364
-
\??\c:\pvdvp.exec:\pvdvp.exe90⤵PID:1768
-
\??\c:\xxxrllf.exec:\xxxrllf.exe91⤵PID:3848
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe92⤵PID:2372
-
\??\c:\bnnhbb.exec:\bnnhbb.exe93⤵PID:4928
-
\??\c:\jjpdj.exec:\jjpdj.exe94⤵PID:716
-
\??\c:\1ppjv.exec:\1ppjv.exe95⤵PID:5068
-
\??\c:\lrxrxxr.exec:\lrxrxxr.exe96⤵PID:1776
-
\??\c:\ffxrffx.exec:\ffxrffx.exe97⤵PID:4504
-
\??\c:\5nbtnn.exec:\5nbtnn.exe98⤵PID:732
-
\??\c:\ttbtbh.exec:\ttbtbh.exe99⤵PID:3628
-
\??\c:\jvjvj.exec:\jvjvj.exe100⤵PID:4648
-
\??\c:\5jjdp.exec:\5jjdp.exe101⤵PID:4768
-
\??\c:\frrrrrx.exec:\frrrrrx.exe102⤵PID:1624
-
\??\c:\flrlffx.exec:\flrlffx.exe103⤵PID:6096
-
\??\c:\htbttt.exec:\htbttt.exe104⤵PID:5828
-
\??\c:\vjdvp.exec:\vjdvp.exe105⤵PID:5648
-
\??\c:\ddvvp.exec:\ddvvp.exe106⤵PID:4116
-
\??\c:\xlfrlxr.exec:\xlfrlxr.exe107⤵PID:1360
-
\??\c:\lxfxrxl.exec:\lxfxrxl.exe108⤵PID:696
-
\??\c:\9tbtnh.exec:\9tbtnh.exe109⤵PID:1180
-
\??\c:\btnhhh.exec:\btnhhh.exe110⤵PID:4124
-
\??\c:\pjpjj.exec:\pjpjj.exe111⤵PID:5176
-
\??\c:\dvdpv.exec:\dvdpv.exe112⤵PID:5184
-
\??\c:\xfxfxlx.exec:\xfxfxlx.exe113⤵PID:980
-
\??\c:\rfrxrrl.exec:\rfrxrrl.exe114⤵PID:5168
-
\??\c:\tttthh.exec:\tttthh.exe115⤵PID:3288
-
\??\c:\bbbnbt.exec:\bbbnbt.exe116⤵PID:4456
-
\??\c:\ppddv.exec:\ppddv.exe117⤵PID:3108
-
\??\c:\ddjdd.exec:\ddjdd.exe118⤵PID:4384
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe119⤵PID:3096
-
\??\c:\rrrrflf.exec:\rrrrflf.exe120⤵PID:712
-
\??\c:\nttnbh.exec:\nttnbh.exe121⤵PID:5308
-
\??\c:\hnhbtb.exec:\hnhbtb.exe122⤵PID:1004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-