Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2024 10:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
936906fa2a8175ef38863c74f9adc340N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
936906fa2a8175ef38863c74f9adc340N.exe
-
Size
75KB
-
MD5
936906fa2a8175ef38863c74f9adc340
-
SHA1
d4be1951014fc9889a424732c0ce02e2860ced20
-
SHA256
223760ba2802f9e5d4cff76fb5663492b0b7a2444883de6b20ff88f9b39bfe15
-
SHA512
6ffe3ca13ac44dd4ff6f9bb7159938a406eb2de58c77cc20eaa7063af8ee900f279310c4b2599ae122f3babe3c14aacd9b6e5c75dda94b36220788f13393cb0a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv7+afCD+QsQbKQPESBV:ymb3NkkiQ3mdBjFIfvTfCD+HlQcY
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/1396-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-81-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/876-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2312 nhnnbb.exe 1640 jvjdd.exe 3752 vppjv.exe 3920 nbbttt.exe 1788 1ddvp.exe 2732 lfflfxx.exe 3484 5ttttt.exe 3132 jvpdj.exe 412 dvdvp.exe 4940 9lfxxxr.exe 1824 hhnhhh.exe 4484 pvvvj.exe 4636 1xfrxff.exe 3948 7tnnhh.exe 4976 hbbhbb.exe 1252 lfrrxfx.exe 876 1rlflll.exe 3900 tbbttn.exe 3756 jpjdd.exe 2364 jpvvv.exe 2024 frrlflr.exe 2764 rfllllf.exe 2868 hnhhbt.exe 1496 5vdvv.exe 3172 xrxrlll.exe 980 bnnhhh.exe 2688 bhhntt.exe 1688 djvvv.exe 4136 xlrfxrx.exe 2684 hhtbhn.exe 3212 1hbntt.exe 2196 dpdpd.exe 4632 frrlffx.exe 2632 5tbbtt.exe 384 tnnnhn.exe 3936 vpdvd.exe 1976 rfllxxx.exe 2036 rxrrxll.exe 4928 ttbbht.exe 4428 dpjvv.exe 1872 7vvdv.exe 4080 xflxxxx.exe 2952 nhnhhh.exe 3600 ddvpv.exe 2316 jvvjd.exe 3836 xrrxrxx.exe 224 5flfxxx.exe 2416 ttnnhh.exe 4784 9dvjv.exe 5112 xxflfff.exe 4024 nbttnt.exe 2176 tnnnnn.exe 2840 ddvvj.exe 220 9rxrfxr.exe 1824 rflllrl.exe 540 nhtnht.exe 4532 7pvpp.exe 2324 3jjvp.exe 4088 frlfffx.exe 3656 1nnbbn.exe 3964 nhbtbh.exe 4840 jvvpj.exe 736 lfxxrrl.exe 4620 rflxrrx.exe -
resource yara_rule behavioral2/memory/1396-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/876-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1396 wrote to memory of 2312 1396 936906fa2a8175ef38863c74f9adc340N.exe 83 PID 1396 wrote to memory of 2312 1396 936906fa2a8175ef38863c74f9adc340N.exe 83 PID 1396 wrote to memory of 2312 1396 936906fa2a8175ef38863c74f9adc340N.exe 83 PID 2312 wrote to memory of 1640 2312 nhnnbb.exe 84 PID 2312 wrote to memory of 1640 2312 nhnnbb.exe 84 PID 2312 wrote to memory of 1640 2312 nhnnbb.exe 84 PID 1640 wrote to memory of 3752 1640 jvjdd.exe 86 PID 1640 wrote to memory of 3752 1640 jvjdd.exe 86 PID 1640 wrote to memory of 3752 1640 jvjdd.exe 86 PID 3752 wrote to memory of 3920 3752 vppjv.exe 87 PID 3752 wrote to memory of 3920 3752 vppjv.exe 87 PID 3752 wrote to memory of 3920 3752 vppjv.exe 87 PID 3920 wrote to memory of 1788 3920 nbbttt.exe 88 PID 3920 wrote to memory of 1788 3920 nbbttt.exe 88 PID 3920 wrote to memory of 1788 3920 nbbttt.exe 88 PID 1788 wrote to memory of 2732 1788 1ddvp.exe 89 PID 1788 wrote to memory of 2732 1788 1ddvp.exe 89 PID 1788 wrote to memory of 2732 1788 1ddvp.exe 89 PID 2732 wrote to memory of 3484 2732 lfflfxx.exe 90 PID 2732 wrote to memory of 3484 2732 lfflfxx.exe 90 PID 2732 wrote to memory of 3484 2732 lfflfxx.exe 90 PID 3484 wrote to memory of 3132 3484 5ttttt.exe 92 PID 3484 wrote to memory of 3132 3484 5ttttt.exe 92 PID 3484 wrote to memory of 3132 3484 5ttttt.exe 92 PID 3132 wrote to memory of 412 3132 jvpdj.exe 93 PID 3132 wrote to memory of 412 3132 jvpdj.exe 93 PID 3132 wrote to memory of 412 3132 jvpdj.exe 93 PID 412 wrote to memory of 4940 412 dvdvp.exe 94 PID 412 wrote to memory of 4940 412 dvdvp.exe 94 PID 412 wrote to memory of 4940 412 dvdvp.exe 94 PID 4940 wrote to memory of 1824 4940 9lfxxxr.exe 95 PID 4940 wrote to memory of 1824 4940 9lfxxxr.exe 95 PID 4940 wrote to memory of 1824 4940 9lfxxxr.exe 95 PID 1824 wrote to memory of 4484 1824 hhnhhh.exe 96 PID 1824 wrote to memory of 4484 1824 hhnhhh.exe 96 PID 1824 wrote to memory of 4484 1824 hhnhhh.exe 96 PID 4484 wrote to memory of 4636 4484 pvvvj.exe 97 PID 4484 wrote to memory of 4636 4484 pvvvj.exe 97 PID 4484 wrote to memory of 4636 4484 pvvvj.exe 97 PID 4636 wrote to memory of 3948 4636 1xfrxff.exe 98 PID 4636 wrote to memory of 3948 4636 1xfrxff.exe 98 PID 4636 wrote to memory of 3948 4636 1xfrxff.exe 98 PID 3948 wrote to memory of 4976 3948 7tnnhh.exe 99 PID 3948 wrote to memory of 4976 3948 7tnnhh.exe 99 PID 3948 wrote to memory of 4976 3948 7tnnhh.exe 99 PID 4976 wrote to memory of 1252 4976 hbbhbb.exe 100 PID 4976 wrote to memory of 1252 4976 hbbhbb.exe 100 PID 4976 wrote to memory of 1252 4976 hbbhbb.exe 100 PID 1252 wrote to memory of 876 1252 lfrrxfx.exe 101 PID 1252 wrote to memory of 876 1252 lfrrxfx.exe 101 PID 1252 wrote to memory of 876 1252 lfrrxfx.exe 101 PID 876 wrote to memory of 3900 876 1rlflll.exe 102 PID 876 wrote to memory of 3900 876 1rlflll.exe 102 PID 876 wrote to memory of 3900 876 1rlflll.exe 102 PID 3900 wrote to memory of 3756 3900 tbbttn.exe 103 PID 3900 wrote to memory of 3756 3900 tbbttn.exe 103 PID 3900 wrote to memory of 3756 3900 tbbttn.exe 103 PID 3756 wrote to memory of 2364 3756 jpjdd.exe 105 PID 3756 wrote to memory of 2364 3756 jpjdd.exe 105 PID 3756 wrote to memory of 2364 3756 jpjdd.exe 105 PID 2364 wrote to memory of 2024 2364 jpvvv.exe 106 PID 2364 wrote to memory of 2024 2364 jpvvv.exe 106 PID 2364 wrote to memory of 2024 2364 jpvvv.exe 106 PID 2024 wrote to memory of 2764 2024 frrlflr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\936906fa2a8175ef38863c74f9adc340N.exe"C:\Users\Admin\AppData\Local\Temp\936906fa2a8175ef38863c74f9adc340N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\nhnnbb.exec:\nhnnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\jvjdd.exec:\jvjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\vppjv.exec:\vppjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\nbbttt.exec:\nbbttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\1ddvp.exec:\1ddvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\lfflfxx.exec:\lfflfxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\5ttttt.exec:\5ttttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\jvpdj.exec:\jvpdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\dvdvp.exec:\dvdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\9lfxxxr.exec:\9lfxxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\hhnhhh.exec:\hhnhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\pvvvj.exec:\pvvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\1xfrxff.exec:\1xfrxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\7tnnhh.exec:\7tnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\hbbhbb.exec:\hbbhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\lfrrxfx.exec:\lfrrxfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\1rlflll.exec:\1rlflll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\tbbttn.exec:\tbbttn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\jpjdd.exec:\jpjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\jpvvv.exec:\jpvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\frrlflr.exec:\frrlflr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\rfllllf.exec:\rfllllf.exe23⤵
- Executes dropped EXE
PID:2764 -
\??\c:\hnhhbt.exec:\hnhhbt.exe24⤵
- Executes dropped EXE
PID:2868 -
\??\c:\5vdvv.exec:\5vdvv.exe25⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xrxrlll.exec:\xrxrlll.exe26⤵
- Executes dropped EXE
PID:3172 -
\??\c:\bnnhhh.exec:\bnnhhh.exe27⤵
- Executes dropped EXE
PID:980 -
\??\c:\bhhntt.exec:\bhhntt.exe28⤵
- Executes dropped EXE
PID:2688 -
\??\c:\djvvv.exec:\djvvv.exe29⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xlrfxrx.exec:\xlrfxrx.exe30⤵
- Executes dropped EXE
PID:4136 -
\??\c:\hhtbhn.exec:\hhtbhn.exe31⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1hbntt.exec:\1hbntt.exe32⤵
- Executes dropped EXE
PID:3212 -
\??\c:\dpdpd.exec:\dpdpd.exe33⤵
- Executes dropped EXE
PID:2196 -
\??\c:\frrlffx.exec:\frrlffx.exe34⤵
- Executes dropped EXE
PID:4632 -
\??\c:\5tbbtt.exec:\5tbbtt.exe35⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tnnnhn.exec:\tnnnhn.exe36⤵
- Executes dropped EXE
PID:384 -
\??\c:\vpdvd.exec:\vpdvd.exe37⤵
- Executes dropped EXE
PID:3936 -
\??\c:\rfllxxx.exec:\rfllxxx.exe38⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rxrrxll.exec:\rxrrxll.exe39⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ttbbht.exec:\ttbbht.exe40⤵
- Executes dropped EXE
PID:4928 -
\??\c:\dpjvv.exec:\dpjvv.exe41⤵
- Executes dropped EXE
PID:4428 -
\??\c:\7vvdv.exec:\7vvdv.exe42⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xflxxxx.exec:\xflxxxx.exe43⤵
- Executes dropped EXE
PID:4080 -
\??\c:\nhnhhh.exec:\nhnhhh.exe44⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ddvpv.exec:\ddvpv.exe45⤵
- Executes dropped EXE
PID:3600 -
\??\c:\jvvjd.exec:\jvvjd.exe46⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xrrxrxx.exec:\xrrxrxx.exe47⤵
- Executes dropped EXE
PID:3836 -
\??\c:\5flfxxx.exec:\5flfxxx.exe48⤵
- Executes dropped EXE
PID:224 -
\??\c:\ttnnhh.exec:\ttnnhh.exe49⤵
- Executes dropped EXE
PID:2416 -
\??\c:\9dvjv.exec:\9dvjv.exe50⤵
- Executes dropped EXE
PID:4784 -
\??\c:\xxflfff.exec:\xxflfff.exe51⤵
- Executes dropped EXE
PID:5112 -
\??\c:\nbttnt.exec:\nbttnt.exe52⤵
- Executes dropped EXE
PID:4024 -
\??\c:\tnnnnn.exec:\tnnnnn.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ddvvj.exec:\ddvvj.exe54⤵
- Executes dropped EXE
PID:2840 -
\??\c:\9rxrfxr.exec:\9rxrfxr.exe55⤵
- Executes dropped EXE
PID:220 -
\??\c:\rflllrl.exec:\rflllrl.exe56⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nhtnht.exec:\nhtnht.exe57⤵
- Executes dropped EXE
PID:540 -
\??\c:\7pvpp.exec:\7pvpp.exe58⤵
- Executes dropped EXE
PID:4532 -
\??\c:\3jjvp.exec:\3jjvp.exe59⤵
- Executes dropped EXE
PID:2324 -
\??\c:\frlfffx.exec:\frlfffx.exe60⤵
- Executes dropped EXE
PID:4088 -
\??\c:\1nnbbn.exec:\1nnbbn.exe61⤵
- Executes dropped EXE
PID:3656 -
\??\c:\nhbtbh.exec:\nhbtbh.exe62⤵
- Executes dropped EXE
PID:3964 -
\??\c:\jvvpj.exec:\jvvpj.exe63⤵
- Executes dropped EXE
PID:4840 -
\??\c:\lfxxrrl.exec:\lfxxrrl.exe64⤵
- Executes dropped EXE
PID:736 -
\??\c:\rflxrrx.exec:\rflxrrx.exe65⤵
- Executes dropped EXE
PID:4620 -
\??\c:\7nttth.exec:\7nttth.exe66⤵PID:3900
-
\??\c:\xrlxrxf.exec:\xrlxrxf.exe67⤵PID:3756
-
\??\c:\dvjjj.exec:\dvjjj.exe68⤵PID:3360
-
\??\c:\fflxrlf.exec:\fflxrlf.exe69⤵PID:4832
-
\??\c:\btnnnn.exec:\btnnnn.exe70⤵PID:916
-
\??\c:\tbhntn.exec:\tbhntn.exe71⤵PID:2380
-
\??\c:\ddpjd.exec:\ddpjd.exe72⤵PID:3204
-
\??\c:\vpvpj.exec:\vpvpj.exe73⤵PID:2580
-
\??\c:\rxllrff.exec:\rxllrff.exe74⤵PID:2076
-
\??\c:\frfllrr.exec:\frfllrr.exe75⤵PID:2660
-
\??\c:\bnbhhh.exec:\bnbhhh.exe76⤵PID:1916
-
\??\c:\5ntnbh.exec:\5ntnbh.exe77⤵PID:1408
-
\??\c:\jpppj.exec:\jpppj.exe78⤵PID:3508
-
\??\c:\3jppd.exec:\3jppd.exe79⤵PID:3916
-
\??\c:\rrxxlrl.exec:\rrxxlrl.exe80⤵PID:2796
-
\??\c:\hhbnhh.exec:\hhbnhh.exe81⤵PID:2092
-
\??\c:\nhhthh.exec:\nhhthh.exe82⤵PID:4056
-
\??\c:\ddjjd.exec:\ddjjd.exe83⤵PID:3672
-
\??\c:\pjvvv.exec:\pjvvv.exe84⤵PID:3852
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe85⤵PID:3984
-
\??\c:\lxrffff.exec:\lxrffff.exe86⤵PID:4476
-
\??\c:\tbhhhn.exec:\tbhhhn.exe87⤵PID:3932
-
\??\c:\7htnhh.exec:\7htnhh.exe88⤵PID:3404
-
\??\c:\jdjjd.exec:\jdjjd.exe89⤵PID:1200
-
\??\c:\pvvvd.exec:\pvvvd.exe90⤵PID:1452
-
\??\c:\fxrlxfl.exec:\fxrlxfl.exe91⤵PID:856
-
\??\c:\tnnnnn.exec:\tnnnnn.exe92⤵PID:4264
-
\??\c:\bhhhbb.exec:\bhhhbb.exe93⤵PID:3516
-
\??\c:\ddjjj.exec:\ddjjj.exe94⤵PID:2480
-
\??\c:\pjjdd.exec:\pjjdd.exe95⤵PID:464
-
\??\c:\5fllrrx.exec:\5fllrrx.exe96⤵PID:4876
-
\??\c:\5lxxflr.exec:\5lxxflr.exe97⤵PID:452
-
\??\c:\hbbtbb.exec:\hbbtbb.exe98⤵PID:3668
-
\??\c:\ppvvp.exec:\ppvvp.exe99⤵PID:1184
-
\??\c:\5jjdv.exec:\5jjdv.exe100⤵PID:1156
-
\??\c:\fllfxxx.exec:\fllfxxx.exe101⤵
- System Location Discovery: System Language Discovery
PID:1644 -
\??\c:\xrrlflf.exec:\xrrlflf.exe102⤵PID:1984
-
\??\c:\httnnn.exec:\httnnn.exe103⤵PID:4444
-
\??\c:\1httbh.exec:\1httbh.exe104⤵PID:2616
-
\??\c:\1djjj.exec:\1djjj.exe105⤵PID:1616
-
\??\c:\jpppp.exec:\jpppp.exe106⤵PID:4600
-
\??\c:\rxfxrll.exec:\rxfxrll.exe107⤵PID:396
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe108⤵PID:2324
-
\??\c:\bhttnn.exec:\bhttnn.exe109⤵PID:2248
-
\??\c:\jjdvp.exec:\jjdvp.exe110⤵PID:5028
-
\??\c:\jvddp.exec:\jvddp.exe111⤵PID:2672
-
\??\c:\fxlfxff.exec:\fxlfxff.exe112⤵PID:4840
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe113⤵PID:2928
-
\??\c:\hbbttt.exec:\hbbttt.exe114⤵PID:3264
-
\??\c:\hbtnnt.exec:\hbtnnt.exe115⤵PID:4996
-
\??\c:\bntbbh.exec:\bntbbh.exe116⤵PID:4732
-
\??\c:\pdpvp.exec:\pdpvp.exe117⤵PID:1552
-
\??\c:\jdpjj.exec:\jdpjj.exe118⤵PID:2432
-
\??\c:\ffffxxr.exec:\ffffxxr.exe119⤵PID:2508
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe120⤵PID:744
-
\??\c:\7llffff.exec:\7llffff.exe121⤵PID:3108
-
\??\c:\1rxxrxx.exec:\1rxxrxx.exe122⤵PID:4584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-