Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2024, 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677.exe
-
Size
71KB
-
MD5
c7316804de7cf76091d3a4a3bfc358e0
-
SHA1
a996bf13abde64bbd49a410ea20cbb7c090a1b76
-
SHA256
24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677
-
SHA512
32d83e3f3d4f15766a7d23c2638eb5fe53280f254d6faab4a04be74b2ea7824728e80d1db694e6953693230fb2a2f55b5504c35326fa341af19aa96e93d0ac2c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJ/RWPqBr4:ymb3NkkiQ3mdBjFIqsr4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/1556-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-55-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1136-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/460-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1096-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3468 1hnbbt.exe 1316 9nbthh.exe 3824 dppjv.exe 1556 pvdvd.exe 3612 lrfrffl.exe 1096 3xrxlrx.exe 460 7ttnbt.exe 3812 nhbnbn.exe 2844 jdjvj.exe 1136 9pvpv.exe 972 xfrfxlr.exe 2428 thbntt.exe 1540 vvpjj.exe 432 flxxxxx.exe 1184 nththn.exe 5044 djdjp.exe 3000 lxrffxx.exe 744 bbbtbt.exe 956 tththb.exe 4416 lxlrfrl.exe 620 fflfrlx.exe 2336 thbbtn.exe 2340 dvvpv.exe 4148 rxxrfxr.exe 1060 nbnnbn.exe 5008 bntttt.exe 4544 jddvv.exe 3084 rrflxlr.exe 4660 5htnnh.exe 3360 pjdvj.exe 3472 vvjpv.exe 968 ffxrfxl.exe 4608 3hbttn.exe 2248 thnhtt.exe 1712 dvpdv.exe 4484 ntthnn.exe 2468 hbhtbt.exe 1944 dvdpp.exe 3336 ffrllrr.exe 3488 bhtttt.exe 1948 djdpj.exe 4920 lfxlxxl.exe 2140 hbhntb.exe 3892 hnnhbb.exe 3184 ddjdv.exe 2568 vpvpv.exe 3644 rfxrfxl.exe 5060 5nnnnn.exe 2864 ddppj.exe 900 xlxlfff.exe 3956 nthhbt.exe 4896 nnhbhb.exe 4848 ppjdj.exe 856 ffxrlfx.exe 1064 5hhhbb.exe 4536 bntnhh.exe 2996 pdvpd.exe 2812 5jpdv.exe 4552 llrxrxx.exe 2676 ttbbbb.exe 1328 9htnbb.exe 828 vjjjd.exe 4572 rlxxrff.exe 4748 xrfffrr.exe -
resource yara_rule behavioral2/memory/2372-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/460-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/460-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/460-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/460-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1096-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 3468 2372 24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677.exe 81 PID 2372 wrote to memory of 3468 2372 24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677.exe 81 PID 2372 wrote to memory of 3468 2372 24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677.exe 81 PID 3468 wrote to memory of 1316 3468 1hnbbt.exe 82 PID 3468 wrote to memory of 1316 3468 1hnbbt.exe 82 PID 3468 wrote to memory of 1316 3468 1hnbbt.exe 82 PID 1316 wrote to memory of 3824 1316 9nbthh.exe 83 PID 1316 wrote to memory of 3824 1316 9nbthh.exe 83 PID 1316 wrote to memory of 3824 1316 9nbthh.exe 83 PID 3824 wrote to memory of 1556 3824 dppjv.exe 84 PID 3824 wrote to memory of 1556 3824 dppjv.exe 84 PID 3824 wrote to memory of 1556 3824 dppjv.exe 84 PID 1556 wrote to memory of 3612 1556 pvdvd.exe 85 PID 1556 wrote to memory of 3612 1556 pvdvd.exe 85 PID 1556 wrote to memory of 3612 1556 pvdvd.exe 85 PID 3612 wrote to memory of 1096 3612 lrfrffl.exe 86 PID 3612 wrote to memory of 1096 3612 lrfrffl.exe 86 PID 3612 wrote to memory of 1096 3612 lrfrffl.exe 86 PID 1096 wrote to memory of 460 1096 3xrxlrx.exe 87 PID 1096 wrote to memory of 460 1096 3xrxlrx.exe 87 PID 1096 wrote to memory of 460 1096 3xrxlrx.exe 87 PID 460 wrote to memory of 3812 460 7ttnbt.exe 88 PID 460 wrote to memory of 3812 460 7ttnbt.exe 88 PID 460 wrote to memory of 3812 460 7ttnbt.exe 88 PID 3812 wrote to memory of 2844 3812 nhbnbn.exe 89 PID 3812 wrote to memory of 2844 3812 nhbnbn.exe 89 PID 3812 wrote to memory of 2844 3812 nhbnbn.exe 89 PID 2844 wrote to memory of 1136 2844 jdjvj.exe 90 PID 2844 wrote to memory of 1136 2844 jdjvj.exe 90 PID 2844 wrote to memory of 1136 2844 jdjvj.exe 90 PID 1136 wrote to memory of 972 1136 9pvpv.exe 91 PID 1136 wrote to memory of 972 1136 9pvpv.exe 91 PID 1136 wrote to memory of 972 1136 9pvpv.exe 91 PID 972 wrote to memory of 2428 972 xfrfxlr.exe 92 PID 972 wrote to memory of 2428 972 xfrfxlr.exe 92 PID 972 wrote to memory of 2428 972 xfrfxlr.exe 92 PID 2428 wrote to memory of 1540 2428 thbntt.exe 93 PID 2428 wrote to memory of 1540 2428 thbntt.exe 93 PID 2428 wrote to memory of 1540 2428 thbntt.exe 93 PID 1540 wrote to memory of 432 1540 vvpjj.exe 94 PID 1540 wrote to memory of 432 1540 vvpjj.exe 94 PID 1540 wrote to memory of 432 1540 vvpjj.exe 94 PID 432 wrote to memory of 1184 432 flxxxxx.exe 95 PID 432 wrote to memory of 1184 432 flxxxxx.exe 95 PID 432 wrote to memory of 1184 432 flxxxxx.exe 95 PID 1184 wrote to memory of 5044 1184 nththn.exe 96 PID 1184 wrote to memory of 5044 1184 nththn.exe 96 PID 1184 wrote to memory of 5044 1184 nththn.exe 96 PID 5044 wrote to memory of 3000 5044 djdjp.exe 97 PID 5044 wrote to memory of 3000 5044 djdjp.exe 97 PID 5044 wrote to memory of 3000 5044 djdjp.exe 97 PID 3000 wrote to memory of 744 3000 lxrffxx.exe 98 PID 3000 wrote to memory of 744 3000 lxrffxx.exe 98 PID 3000 wrote to memory of 744 3000 lxrffxx.exe 98 PID 744 wrote to memory of 956 744 bbbtbt.exe 99 PID 744 wrote to memory of 956 744 bbbtbt.exe 99 PID 744 wrote to memory of 956 744 bbbtbt.exe 99 PID 956 wrote to memory of 4416 956 tththb.exe 100 PID 956 wrote to memory of 4416 956 tththb.exe 100 PID 956 wrote to memory of 4416 956 tththb.exe 100 PID 4416 wrote to memory of 620 4416 lxlrfrl.exe 101 PID 4416 wrote to memory of 620 4416 lxlrfrl.exe 101 PID 4416 wrote to memory of 620 4416 lxlrfrl.exe 101 PID 620 wrote to memory of 2336 620 fflfrlx.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677.exe"C:\Users\Admin\AppData\Local\Temp\24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\1hnbbt.exec:\1hnbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\9nbthh.exec:\9nbthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\dppjv.exec:\dppjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\pvdvd.exec:\pvdvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\lrfrffl.exec:\lrfrffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\3xrxlrx.exec:\3xrxlrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\7ttnbt.exec:\7ttnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\nhbnbn.exec:\nhbnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\jdjvj.exec:\jdjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\9pvpv.exec:\9pvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\xfrfxlr.exec:\xfrfxlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\thbntt.exec:\thbntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\vvpjj.exec:\vvpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\flxxxxx.exec:\flxxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\nththn.exec:\nththn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\djdjp.exec:\djdjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\lxrffxx.exec:\lxrffxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\bbbtbt.exec:\bbbtbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\tththb.exec:\tththb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\lxlrfrl.exec:\lxlrfrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\fflfrlx.exec:\fflfrlx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\thbbtn.exec:\thbbtn.exe23⤵
- Executes dropped EXE
PID:2336 -
\??\c:\dvvpv.exec:\dvvpv.exe24⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rxxrfxr.exec:\rxxrfxr.exe25⤵
- Executes dropped EXE
PID:4148 -
\??\c:\nbnnbn.exec:\nbnnbn.exe26⤵
- Executes dropped EXE
PID:1060 -
\??\c:\bntttt.exec:\bntttt.exe27⤵
- Executes dropped EXE
PID:5008 -
\??\c:\jddvv.exec:\jddvv.exe28⤵
- Executes dropped EXE
PID:4544 -
\??\c:\rrflxlr.exec:\rrflxlr.exe29⤵
- Executes dropped EXE
PID:3084 -
\??\c:\5htnnh.exec:\5htnnh.exe30⤵
- Executes dropped EXE
PID:4660 -
\??\c:\pjdvj.exec:\pjdvj.exe31⤵
- Executes dropped EXE
PID:3360 -
\??\c:\vvjpv.exec:\vvjpv.exe32⤵
- Executes dropped EXE
PID:3472 -
\??\c:\ffxrfxl.exec:\ffxrfxl.exe33⤵
- Executes dropped EXE
PID:968 -
\??\c:\3hbttn.exec:\3hbttn.exe34⤵
- Executes dropped EXE
PID:4608 -
\??\c:\thnhtt.exec:\thnhtt.exe35⤵
- Executes dropped EXE
PID:2248 -
\??\c:\dvpdv.exec:\dvpdv.exe36⤵
- Executes dropped EXE
PID:1712 -
\??\c:\ntthnn.exec:\ntthnn.exe37⤵
- Executes dropped EXE
PID:4484 -
\??\c:\hbhtbt.exec:\hbhtbt.exe38⤵
- Executes dropped EXE
PID:2468 -
\??\c:\dvdpp.exec:\dvdpp.exe39⤵
- Executes dropped EXE
PID:1944 -
\??\c:\ffrllrr.exec:\ffrllrr.exe40⤵
- Executes dropped EXE
PID:3336 -
\??\c:\bhtttt.exec:\bhtttt.exe41⤵
- Executes dropped EXE
PID:3488 -
\??\c:\djdpj.exec:\djdpj.exe42⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lfxlxxl.exec:\lfxlxxl.exe43⤵
- Executes dropped EXE
PID:4920 -
\??\c:\hbhntb.exec:\hbhntb.exe44⤵
- Executes dropped EXE
PID:2140 -
\??\c:\hnnhbb.exec:\hnnhbb.exe45⤵
- Executes dropped EXE
PID:3892 -
\??\c:\ddjdv.exec:\ddjdv.exe46⤵
- Executes dropped EXE
PID:3184 -
\??\c:\vpvpv.exec:\vpvpv.exe47⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rfxrfxl.exec:\rfxrfxl.exe48⤵
- Executes dropped EXE
PID:3644 -
\??\c:\5nnnnn.exec:\5nnnnn.exe49⤵
- Executes dropped EXE
PID:5060 -
\??\c:\9ttnhn.exec:\9ttnhn.exe50⤵PID:4592
-
\??\c:\ddppj.exec:\ddppj.exe51⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xlxlfff.exec:\xlxlfff.exe52⤵
- Executes dropped EXE
PID:900 -
\??\c:\nthhbt.exec:\nthhbt.exe53⤵
- Executes dropped EXE
PID:3956 -
\??\c:\nnhbhb.exec:\nnhbhb.exe54⤵
- Executes dropped EXE
PID:4896 -
\??\c:\ppjdj.exec:\ppjdj.exe55⤵
- Executes dropped EXE
PID:4848 -
\??\c:\ffxrlfx.exec:\ffxrlfx.exe56⤵
- Executes dropped EXE
PID:856 -
\??\c:\5hhhbb.exec:\5hhhbb.exe57⤵
- Executes dropped EXE
PID:1064 -
\??\c:\bntnhh.exec:\bntnhh.exe58⤵
- Executes dropped EXE
PID:4536 -
\??\c:\pdvpd.exec:\pdvpd.exe59⤵
- Executes dropped EXE
PID:2996 -
\??\c:\5jpdv.exec:\5jpdv.exe60⤵
- Executes dropped EXE
PID:2812 -
\??\c:\llrxrxx.exec:\llrxrxx.exe61⤵
- Executes dropped EXE
PID:4552 -
\??\c:\ttbbbb.exec:\ttbbbb.exe62⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9htnbb.exec:\9htnbb.exe63⤵
- Executes dropped EXE
PID:1328 -
\??\c:\vjjjd.exec:\vjjjd.exe64⤵
- Executes dropped EXE
PID:828 -
\??\c:\rlxxrff.exec:\rlxxrff.exe65⤵
- Executes dropped EXE
PID:4572 -
\??\c:\xrfffrr.exec:\xrfffrr.exe66⤵
- Executes dropped EXE
PID:4748 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe67⤵PID:4948
-
\??\c:\tnnhhh.exec:\tnnhhh.exe68⤵PID:972
-
\??\c:\fffxrrl.exec:\fffxrrl.exe69⤵PID:2416
-
\??\c:\tbtnnb.exec:\tbtnnb.exe70⤵PID:1904
-
\??\c:\vdjdd.exec:\vdjdd.exe71⤵PID:2024
-
\??\c:\dvpvj.exec:\dvpvj.exe72⤵PID:2724
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe73⤵PID:3852
-
\??\c:\5xlfrlf.exec:\5xlfrlf.exe74⤵PID:408
-
\??\c:\btttbt.exec:\btttbt.exe75⤵PID:796
-
\??\c:\htbttt.exec:\htbttt.exe76⤵PID:3000
-
\??\c:\jppdd.exec:\jppdd.exe77⤵PID:4184
-
\??\c:\xlxrlll.exec:\xlxrlll.exe78⤵PID:1460
-
\??\c:\rffllll.exec:\rffllll.exe79⤵PID:956
-
\??\c:\nnhbbn.exec:\nnhbbn.exe80⤵PID:4424
-
\??\c:\hnnttb.exec:\hnnttb.exe81⤵PID:1172
-
\??\c:\djjdd.exec:\djjdd.exe82⤵PID:1852
-
\??\c:\fffxllx.exec:\fffxllx.exe83⤵PID:1492
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe84⤵PID:5096
-
\??\c:\hhnnhh.exec:\hhnnhh.exe85⤵PID:4012
-
\??\c:\5dvvj.exec:\5dvvj.exe86⤵PID:4720
-
\??\c:\pjjjv.exec:\pjjjv.exe87⤵PID:3864
-
\??\c:\rxfxlfr.exec:\rxfxlfr.exe88⤵PID:4344
-
\??\c:\tbbbnt.exec:\tbbbnt.exe89⤵PID:2648
-
\??\c:\tnnhbb.exec:\tnnhbb.exe90⤵PID:2380
-
\??\c:\pdjpj.exec:\pdjpj.exe91⤵PID:4648
-
\??\c:\5pvvj.exec:\5pvvj.exe92⤵PID:5088
-
\??\c:\fxlffxr.exec:\fxlffxr.exe93⤵PID:1596
-
\??\c:\nbbnth.exec:\nbbnth.exe94⤵PID:3756
-
\??\c:\hnnhbt.exec:\hnnhbt.exe95⤵PID:1512
-
\??\c:\pvvvv.exec:\pvvvv.exe96⤵PID:4700
-
\??\c:\rffxlxl.exec:\rffxlxl.exe97⤵PID:1712
-
\??\c:\rflrrrr.exec:\rflrrrr.exe98⤵PID:1736
-
\??\c:\httnhb.exec:\httnhb.exe99⤵PID:1940
-
\??\c:\btnhtn.exec:\btnhtn.exe100⤵PID:4596
-
\??\c:\jjjjv.exec:\jjjjv.exe101⤵PID:2572
-
\??\c:\ppvpj.exec:\ppvpj.exe102⤵PID:3488
-
\??\c:\xrxrllf.exec:\xrxrllf.exe103⤵PID:1084
-
\??\c:\htnhtn.exec:\htnhtn.exe104⤵PID:2712
-
\??\c:\1ntnhh.exec:\1ntnhh.exe105⤵PID:4672
-
\??\c:\vvdpd.exec:\vvdpd.exe106⤵PID:5004
-
\??\c:\frfxlfx.exec:\frfxlfx.exe107⤵PID:3672
-
\??\c:\tnttnn.exec:\tnttnn.exe108⤵PID:4488
-
\??\c:\btttnn.exec:\btttnn.exe109⤵PID:4472
-
\??\c:\3vjvv.exec:\3vjvv.exe110⤵PID:5060
-
\??\c:\3fffllf.exec:\3fffllf.exe111⤵PID:4620
-
\??\c:\3xfrfxl.exec:\3xfrfxl.exe112⤵PID:4296
-
\??\c:\tnbtht.exec:\tnbtht.exe113⤵PID:2136
-
\??\c:\xrlllff.exec:\xrlllff.exe114⤵
- System Location Discovery: System Language Discovery
PID:2328 -
\??\c:\hhbntt.exec:\hhbntt.exe115⤵PID:3680
-
\??\c:\jjjpv.exec:\jjjpv.exe116⤵PID:3612
-
\??\c:\9jvjd.exec:\9jvjd.exe117⤵PID:3104
-
\??\c:\lffxrrr.exec:\lffxrrr.exe118⤵PID:4584
-
\??\c:\3rxrlfx.exec:\3rxrlfx.exe119⤵PID:3868
-
\??\c:\nbhnnh.exec:\nbhnnh.exe120⤵PID:1580
-
\??\c:\ddpdp.exec:\ddpdp.exe121⤵PID:3528
-
\??\c:\vppjd.exec:\vppjd.exe122⤵PID:4388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-