Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 20:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe.exe
-
Size
229KB
-
MD5
b240f0f6af18f3761944e747427a0a4d
-
SHA1
c2a19c8eb6fc2b6693a39f7857df3dabb0c7bf2c
-
SHA256
33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe
-
SHA512
a7d8f82f1bc519bf4cce946ce24835f2b617f48728ab95b4fc76bb13e22ad2ff738e06546cdfabd9d9586ba0560a85ec0ca5a1b9bdc174ddf6279761ad73d43c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLjBeGdE:n3C9BRo7MlrWKo+lxK4
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4524-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/708-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1992-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1056 bhhbnb.exe 2388 pvdpv.exe 4504 nhhtnh.exe 3708 5vvpd.exe 1396 5rllrrf.exe 708 pdvpj.exe 1524 tbhhnt.exe 5036 vvpjp.exe 1296 nthbnh.exe 5044 9vpdp.exe 4812 pdvpd.exe 4560 9tbtnh.exe 2560 ppddj.exe 1992 pvvjp.exe 4128 htnhnn.exe 1560 bhnnhb.exe 4728 djjdp.exe 3364 frxlxrf.exe 4148 ththbt.exe 4716 7ddvp.exe 1660 xxxllfx.exe 4792 ntnhbt.exe 4012 tnhtnh.exe 4572 xrlxrfx.exe 3284 thnbtn.exe 888 7nnbtn.exe 3104 jjvjd.exe 4844 1bthtn.exe 5108 7hnttn.exe 1924 jdpdd.exe 4036 rxxlxxl.exe 3420 nbbbtn.exe 824 nbntbt.exe 2520 pjppd.exe 3712 5lrffxx.exe 1136 lxxxrll.exe 4588 3nhtnh.exe 3744 nnnbnn.exe 1856 7pjvd.exe 1476 pvdvd.exe 2176 fxrrfrl.exe 228 bbnhbt.exe 3476 hbhtnh.exe 3392 7ddpv.exe 4308 rfrlrlf.exe 3624 xflllrx.exe 4756 tbbthb.exe 4272 jvjjv.exe 4216 jvdvp.exe 4676 3llxffr.exe 1956 tbbnht.exe 4860 ttnbhn.exe 3708 dddpd.exe 408 lrxlffl.exe 1972 lrlfrlf.exe 3840 9btnbb.exe 3052 jjjdv.exe 4828 dpdvj.exe 4144 pdvjv.exe 2124 lrflrrl.exe 1376 nbtthb.exe 1156 tnbttn.exe 5044 djvjv.exe 4020 1vdpv.exe -
resource yara_rule behavioral2/memory/4524-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/708-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/708-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/708-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1992-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xfxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4524 wrote to memory of 1056 4524 33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe.exe 85 PID 4524 wrote to memory of 1056 4524 33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe.exe 85 PID 4524 wrote to memory of 1056 4524 33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe.exe 85 PID 1056 wrote to memory of 2388 1056 bhhbnb.exe 86 PID 1056 wrote to memory of 2388 1056 bhhbnb.exe 86 PID 1056 wrote to memory of 2388 1056 bhhbnb.exe 86 PID 2388 wrote to memory of 4504 2388 pvdpv.exe 87 PID 2388 wrote to memory of 4504 2388 pvdpv.exe 87 PID 2388 wrote to memory of 4504 2388 pvdpv.exe 87 PID 4504 wrote to memory of 3708 4504 nhhtnh.exe 88 PID 4504 wrote to memory of 3708 4504 nhhtnh.exe 88 PID 4504 wrote to memory of 3708 4504 nhhtnh.exe 88 PID 3708 wrote to memory of 1396 3708 5vvpd.exe 89 PID 3708 wrote to memory of 1396 3708 5vvpd.exe 89 PID 3708 wrote to memory of 1396 3708 5vvpd.exe 89 PID 1396 wrote to memory of 708 1396 5rllrrf.exe 90 PID 1396 wrote to memory of 708 1396 5rllrrf.exe 90 PID 1396 wrote to memory of 708 1396 5rllrrf.exe 90 PID 708 wrote to memory of 1524 708 pdvpj.exe 91 PID 708 wrote to memory of 1524 708 pdvpj.exe 91 PID 708 wrote to memory of 1524 708 pdvpj.exe 91 PID 1524 wrote to memory of 5036 1524 tbhhnt.exe 92 PID 1524 wrote to memory of 5036 1524 tbhhnt.exe 92 PID 1524 wrote to memory of 5036 1524 tbhhnt.exe 92 PID 5036 wrote to memory of 1296 5036 vvpjp.exe 93 PID 5036 wrote to memory of 1296 5036 vvpjp.exe 93 PID 5036 wrote to memory of 1296 5036 vvpjp.exe 93 PID 1296 wrote to memory of 5044 1296 nthbnh.exe 94 PID 1296 wrote to memory of 5044 1296 nthbnh.exe 94 PID 1296 wrote to memory of 5044 1296 nthbnh.exe 94 PID 5044 wrote to memory of 4812 5044 9vpdp.exe 95 PID 5044 wrote to memory of 4812 5044 9vpdp.exe 95 PID 5044 wrote to memory of 4812 5044 9vpdp.exe 95 PID 4812 wrote to memory of 4560 4812 pdvpd.exe 96 PID 4812 wrote to memory of 4560 4812 pdvpd.exe 96 PID 4812 wrote to memory of 4560 4812 pdvpd.exe 96 PID 4560 wrote to memory of 2560 4560 9tbtnh.exe 97 PID 4560 wrote to memory of 2560 4560 9tbtnh.exe 97 PID 4560 wrote to memory of 2560 4560 9tbtnh.exe 97 PID 2560 wrote to memory of 1992 2560 ppddj.exe 98 PID 2560 wrote to memory of 1992 2560 ppddj.exe 98 PID 2560 wrote to memory of 1992 2560 ppddj.exe 98 PID 1992 wrote to memory of 4128 1992 pvvjp.exe 99 PID 1992 wrote to memory of 4128 1992 pvvjp.exe 99 PID 1992 wrote to memory of 4128 1992 pvvjp.exe 99 PID 4128 wrote to memory of 1560 4128 htnhnn.exe 100 PID 4128 wrote to memory of 1560 4128 htnhnn.exe 100 PID 4128 wrote to memory of 1560 4128 htnhnn.exe 100 PID 1560 wrote to memory of 4728 1560 bhnnhb.exe 101 PID 1560 wrote to memory of 4728 1560 bhnnhb.exe 101 PID 1560 wrote to memory of 4728 1560 bhnnhb.exe 101 PID 4728 wrote to memory of 3364 4728 djjdp.exe 102 PID 4728 wrote to memory of 3364 4728 djjdp.exe 102 PID 4728 wrote to memory of 3364 4728 djjdp.exe 102 PID 3364 wrote to memory of 4148 3364 frxlxrf.exe 103 PID 3364 wrote to memory of 4148 3364 frxlxrf.exe 103 PID 3364 wrote to memory of 4148 3364 frxlxrf.exe 103 PID 4148 wrote to memory of 4716 4148 ththbt.exe 104 PID 4148 wrote to memory of 4716 4148 ththbt.exe 104 PID 4148 wrote to memory of 4716 4148 ththbt.exe 104 PID 4716 wrote to memory of 1660 4716 7ddvp.exe 105 PID 4716 wrote to memory of 1660 4716 7ddvp.exe 105 PID 4716 wrote to memory of 1660 4716 7ddvp.exe 105 PID 1660 wrote to memory of 4792 1660 xxxllfx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe.exe"C:\Users\Admin\AppData\Local\Temp\33f409535391e681d01b2a9808bfafd990b5d62328aa9383b8a5b673874482fe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\bhhbnb.exec:\bhhbnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\pvdpv.exec:\pvdpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\nhhtnh.exec:\nhhtnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\5vvpd.exec:\5vvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\5rllrrf.exec:\5rllrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\pdvpj.exec:\pdvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
\??\c:\tbhhnt.exec:\tbhhnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\vvpjp.exec:\vvpjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\nthbnh.exec:\nthbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\9vpdp.exec:\9vpdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\pdvpd.exec:\pdvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\9tbtnh.exec:\9tbtnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\ppddj.exec:\ppddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\pvvjp.exec:\pvvjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\htnhnn.exec:\htnhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\bhnnhb.exec:\bhnnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\djjdp.exec:\djjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\frxlxrf.exec:\frxlxrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\ththbt.exec:\ththbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\7ddvp.exec:\7ddvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\xxxllfx.exec:\xxxllfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\ntnhbt.exec:\ntnhbt.exe23⤵
- Executes dropped EXE
PID:4792 -
\??\c:\tnhtnh.exec:\tnhtnh.exe24⤵
- Executes dropped EXE
PID:4012 -
\??\c:\xrlxrfx.exec:\xrlxrfx.exe25⤵
- Executes dropped EXE
PID:4572 -
\??\c:\thnbtn.exec:\thnbtn.exe26⤵
- Executes dropped EXE
PID:3284 -
\??\c:\7nnbtn.exec:\7nnbtn.exe27⤵
- Executes dropped EXE
PID:888 -
\??\c:\jjvjd.exec:\jjvjd.exe28⤵
- Executes dropped EXE
PID:3104 -
\??\c:\1bthtn.exec:\1bthtn.exe29⤵
- Executes dropped EXE
PID:4844 -
\??\c:\7hnttn.exec:\7hnttn.exe30⤵
- Executes dropped EXE
PID:5108 -
\??\c:\jdpdd.exec:\jdpdd.exe31⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rxxlxxl.exec:\rxxlxxl.exe32⤵
- Executes dropped EXE
PID:4036 -
\??\c:\nbbbtn.exec:\nbbbtn.exe33⤵
- Executes dropped EXE
PID:3420 -
\??\c:\nbntbt.exec:\nbntbt.exe34⤵
- Executes dropped EXE
PID:824 -
\??\c:\pjppd.exec:\pjppd.exe35⤵
- Executes dropped EXE
PID:2520 -
\??\c:\5lrffxx.exec:\5lrffxx.exe36⤵
- Executes dropped EXE
PID:3712 -
\??\c:\lxxxrll.exec:\lxxxrll.exe37⤵
- Executes dropped EXE
PID:1136 -
\??\c:\3nhtnh.exec:\3nhtnh.exe38⤵
- Executes dropped EXE
PID:4588 -
\??\c:\nnnbnn.exec:\nnnbnn.exe39⤵
- Executes dropped EXE
PID:3744 -
\??\c:\7pjvd.exec:\7pjvd.exe40⤵
- Executes dropped EXE
PID:1856 -
\??\c:\pvdvd.exec:\pvdvd.exe41⤵
- Executes dropped EXE
PID:1476 -
\??\c:\fxrrfrl.exec:\fxrrfrl.exe42⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bbnhbt.exec:\bbnhbt.exe43⤵
- Executes dropped EXE
PID:228 -
\??\c:\hbhtnh.exec:\hbhtnh.exe44⤵
- Executes dropped EXE
PID:3476 -
\??\c:\7ddpv.exec:\7ddpv.exe45⤵
- Executes dropped EXE
PID:3392 -
\??\c:\rfrlrlf.exec:\rfrlrlf.exe46⤵
- Executes dropped EXE
PID:4308 -
\??\c:\xflllrx.exec:\xflllrx.exe47⤵
- Executes dropped EXE
PID:3624 -
\??\c:\tbbthb.exec:\tbbthb.exe48⤵
- Executes dropped EXE
PID:4756 -
\??\c:\jvjjv.exec:\jvjjv.exe49⤵
- Executes dropped EXE
PID:4272 -
\??\c:\jvdvp.exec:\jvdvp.exe50⤵
- Executes dropped EXE
PID:4216 -
\??\c:\3llxffr.exec:\3llxffr.exe51⤵
- Executes dropped EXE
PID:4676 -
\??\c:\tbbnht.exec:\tbbnht.exe52⤵
- Executes dropped EXE
PID:1956 -
\??\c:\ttnbhn.exec:\ttnbhn.exe53⤵
- Executes dropped EXE
PID:4860 -
\??\c:\dddpd.exec:\dddpd.exe54⤵
- Executes dropped EXE
PID:3708 -
\??\c:\lrxlffl.exec:\lrxlffl.exe55⤵
- Executes dropped EXE
PID:408 -
\??\c:\lrlfrlf.exec:\lrlfrlf.exe56⤵
- Executes dropped EXE
PID:1972 -
\??\c:\9btnbb.exec:\9btnbb.exe57⤵
- Executes dropped EXE
PID:3840 -
\??\c:\jjjdv.exec:\jjjdv.exe58⤵
- Executes dropped EXE
PID:3052 -
\??\c:\dpdvj.exec:\dpdvj.exe59⤵
- Executes dropped EXE
PID:4828 -
\??\c:\pdvjv.exec:\pdvjv.exe60⤵
- Executes dropped EXE
PID:4144 -
\??\c:\lrflrrl.exec:\lrflrrl.exe61⤵
- Executes dropped EXE
PID:2124 -
\??\c:\nbtthb.exec:\nbtthb.exe62⤵
- Executes dropped EXE
PID:1376 -
\??\c:\tnbttn.exec:\tnbttn.exe63⤵
- Executes dropped EXE
PID:1156 -
\??\c:\djvjv.exec:\djvjv.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5044 -
\??\c:\1vdpv.exec:\1vdpv.exe65⤵
- Executes dropped EXE
PID:4020 -
\??\c:\xxfxlfx.exec:\xxfxlfx.exe66⤵PID:4428
-
\??\c:\9btnbt.exec:\9btnbt.exe67⤵PID:2160
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe68⤵PID:2396
-
\??\c:\rllxlfr.exec:\rllxlfr.exe69⤵PID:5024
-
\??\c:\nnnhbb.exec:\nnnhbb.exe70⤵PID:640
-
\??\c:\7vvjv.exec:\7vvjv.exe71⤵PID:3160
-
\??\c:\3jdpd.exec:\3jdpd.exe72⤵PID:440
-
\??\c:\rffxxrx.exec:\rffxxrx.exe73⤵PID:3604
-
\??\c:\vdvpd.exec:\vdvpd.exe74⤵PID:3612
-
\??\c:\vppdp.exec:\vppdp.exe75⤵PID:4332
-
\??\c:\frlfrlx.exec:\frlfrlx.exe76⤵PID:2312
-
\??\c:\rflfrll.exec:\rflfrll.exe77⤵PID:1372
-
\??\c:\ntnhtn.exec:\ntnhtn.exe78⤵PID:1660
-
\??\c:\ttthtn.exec:\ttthtn.exe79⤵PID:4484
-
\??\c:\djjvp.exec:\djjvp.exe80⤵PID:3964
-
\??\c:\lxlxlfx.exec:\lxlxlfx.exe81⤵PID:4012
-
\??\c:\lxlxlfx.exec:\lxlxlfx.exe82⤵PID:2452
-
\??\c:\7hbtnh.exec:\7hbtnh.exe83⤵PID:3540
-
\??\c:\hnhhtt.exec:\hnhhtt.exe84⤵PID:4452
-
\??\c:\1dpjj.exec:\1dpjj.exe85⤵PID:3792
-
\??\c:\frrlrrr.exec:\frrlrrr.exe86⤵PID:1628
-
\??\c:\xlfxrlx.exec:\xlfxrlx.exe87⤵PID:1304
-
\??\c:\tnnnnh.exec:\tnnnnh.exe88⤵PID:2084
-
\??\c:\nnnbnh.exec:\nnnbnh.exe89⤵PID:2216
-
\??\c:\djjjj.exec:\djjjj.exe90⤵PID:1780
-
\??\c:\jdvpj.exec:\jdvpj.exe91⤵PID:3048
-
\??\c:\fflfxrl.exec:\fflfxrl.exe92⤵PID:4564
-
\??\c:\hhhbnh.exec:\hhhbnh.exe93⤵PID:4236
-
\??\c:\7ttnhb.exec:\7ttnhb.exe94⤵PID:3456
-
\??\c:\dppdp.exec:\dppdp.exe95⤵PID:3712
-
\??\c:\9lfxrrl.exec:\9lfxrrl.exe96⤵PID:1136
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe97⤵PID:4456
-
\??\c:\hbbthb.exec:\hbbthb.exe98⤵PID:2336
-
\??\c:\hthbhb.exec:\hthbhb.exe99⤵PID:864
-
\??\c:\1djdp.exec:\1djdp.exe100⤵PID:3660
-
\??\c:\xfrlxrf.exec:\xfrlxrf.exe101⤵PID:1164
-
\??\c:\3lfxrlf.exec:\3lfxrlf.exe102⤵PID:1920
-
\??\c:\nbbnbt.exec:\nbbnbt.exe103⤵PID:4300
-
\??\c:\nbnhtt.exec:\nbnhtt.exe104⤵PID:2868
-
\??\c:\pjjjp.exec:\pjjjp.exe105⤵PID:4816
-
\??\c:\rllfffr.exec:\rllfffr.exe106⤵PID:1056
-
\??\c:\xxrfxrl.exec:\xxrfxrl.exe107⤵PID:2300
-
\??\c:\tthbnn.exec:\tthbnn.exe108⤵PID:2388
-
\??\c:\hbthtt.exec:\hbthtt.exe109⤵PID:2564
-
\??\c:\vddvp.exec:\vddvp.exe110⤵PID:2440
-
\??\c:\flfxlfx.exec:\flfxlfx.exe111⤵PID:2732
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe112⤵PID:4960
-
\??\c:\hnthtn.exec:\hnthtn.exe113⤵PID:3532
-
\??\c:\bthtnh.exec:\bthtnh.exe114⤵PID:1684
-
\??\c:\1djdd.exec:\1djdd.exe115⤵PID:3484
-
\??\c:\7lfrffx.exec:\7lfrffx.exe116⤵PID:5064
-
\??\c:\rxfrfxr.exec:\rxfrfxr.exe117⤵PID:2484
-
\??\c:\ttnbbt.exec:\ttnbbt.exe118⤵PID:4932
-
\??\c:\5tttnh.exec:\5tttnh.exe119⤵PID:2888
-
\??\c:\xxxrrfl.exec:\xxxrrfl.exe120⤵PID:1376
-
\??\c:\1llxrfx.exec:\1llxrfx.exe121⤵PID:4552
-
\??\c:\hhnhtn.exec:\hhnhtn.exe122⤵PID:4812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-