Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 12:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a181273cbab61f0b2b491cd220320920N.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
120 seconds
General
-
Target
a181273cbab61f0b2b491cd220320920N.exe
-
Size
50KB
-
MD5
a181273cbab61f0b2b491cd220320920
-
SHA1
be97c90acfe719a8605d7221c69b15e30bb4e96e
-
SHA256
5133c6ed9b7fdf2c4a52648f61e44e19e3c32aad5e33fd9b5eee3279ec0a536f
-
SHA512
0212ca5c41b32f1ba4d76782606d955296fff0ad5c41f3b18c77745e6d6f845ed1254bae12a09b2c64b7dc9dfc90b292c2b33d8bc5d6e0dbcf2f5abc4fdbb472
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvWwH:0cdpeeBSHHMHLf9RyIq
Malware Config
Signatures
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2092-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-26-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2780-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-64-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2988-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1000-82-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1000-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-102-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1664-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1164-121-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1912-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-156-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2588-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-179-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2488-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/276-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/952-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-350-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-353-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/3036-358-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-365-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3004-366-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-369-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/480-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/236-419-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/712-510-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-524-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1260-562-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-570-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-602-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-610-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-605-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1788-648-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/684-661-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/532-668-0x0000000000250000-0x0000000000279000-memory.dmp family_blackmoon behavioral1/memory/2984-707-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-710-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2332-763-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/524-770-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2900-1090-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-1141-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2356-1178-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/480-1211-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2508-1244-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2508-1241-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2464 jjjvj.exe 2856 rlfxxxf.exe 2780 nhtbhn.exe 2628 tnbbbt.exe 2764 ddvvd.exe 2616 5lfrflr.exe 2988 hhhntb.exe 1000 1hbhtt.exe 2264 vdjdp.exe 532 lfxllrf.exe 1664 rlflrrl.exe 1164 3nhntt.exe 2508 vvjjv.exe 1912 xxfxlxr.exe 564 rlffrrx.exe 2588 tnbbnh.exe 1328 jdppp.exe 2380 rrlllrx.exe 1652 xxrfflr.exe 2484 tbbhbh.exe 2488 5vpdj.exe 1272 vjddj.exe 3012 rrllxfl.exe 2352 7ttbht.exe 276 9hbhnb.exe 952 vvpvj.exe 2032 ffxlxfr.exe 2312 rrlflrx.exe 2556 btnbnt.exe 3028 jdpvv.exe 1660 vvppd.exe 2092 3llrrrx.exe 2704 xxfrxlx.exe 1576 9ttbht.exe 2724 hnhbbn.exe 2436 pdvdp.exe 2636 dvdvj.exe 2824 rxlrrxl.exe 2656 bhnbbh.exe 2632 5nbtbb.exe 3036 pvvpp.exe 3004 3djdp.exe 2164 xxxxffr.exe 2208 flxrffx.exe 480 nnbnbn.exe 1996 ttbhtt.exe 592 jjdvj.exe 2168 xxlrxlx.exe 1164 lxllrfx.exe 236 xxrrlxf.exe 2020 tnhbbh.exe 2884 hhtbnt.exe 1704 vdpjp.exe 1816 jjddd.exe 2268 fflrflx.exe 2496 7lfrffx.exe 1760 hhtntt.exe 2076 bbbttt.exe 2192 djdpd.exe 2176 flxlrfr.exe 1532 llxxfxl.exe 1096 tttttt.exe 2336 thbtbh.exe 712 9pvjv.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2464 2092 a181273cbab61f0b2b491cd220320920N.exe 30 PID 2092 wrote to memory of 2464 2092 a181273cbab61f0b2b491cd220320920N.exe 30 PID 2092 wrote to memory of 2464 2092 a181273cbab61f0b2b491cd220320920N.exe 30 PID 2092 wrote to memory of 2464 2092 a181273cbab61f0b2b491cd220320920N.exe 30 PID 2464 wrote to memory of 2856 2464 jjjvj.exe 31 PID 2464 wrote to memory of 2856 2464 jjjvj.exe 31 PID 2464 wrote to memory of 2856 2464 jjjvj.exe 31 PID 2464 wrote to memory of 2856 2464 jjjvj.exe 31 PID 2856 wrote to memory of 2780 2856 rlfxxxf.exe 32 PID 2856 wrote to memory of 2780 2856 rlfxxxf.exe 32 PID 2856 wrote to memory of 2780 2856 rlfxxxf.exe 32 PID 2856 wrote to memory of 2780 2856 rlfxxxf.exe 32 PID 2780 wrote to memory of 2628 2780 nhtbhn.exe 33 PID 2780 wrote to memory of 2628 2780 nhtbhn.exe 33 PID 2780 wrote to memory of 2628 2780 nhtbhn.exe 33 PID 2780 wrote to memory of 2628 2780 nhtbhn.exe 33 PID 2628 wrote to memory of 2764 2628 tnbbbt.exe 34 PID 2628 wrote to memory of 2764 2628 tnbbbt.exe 34 PID 2628 wrote to memory of 2764 2628 tnbbbt.exe 34 PID 2628 wrote to memory of 2764 2628 tnbbbt.exe 34 PID 2764 wrote to memory of 2616 2764 ddvvd.exe 35 PID 2764 wrote to memory of 2616 2764 ddvvd.exe 35 PID 2764 wrote to memory of 2616 2764 ddvvd.exe 35 PID 2764 wrote to memory of 2616 2764 ddvvd.exe 35 PID 2616 wrote to memory of 2988 2616 5lfrflr.exe 36 PID 2616 wrote to memory of 2988 2616 5lfrflr.exe 36 PID 2616 wrote to memory of 2988 2616 5lfrflr.exe 36 PID 2616 wrote to memory of 2988 2616 5lfrflr.exe 36 PID 2988 wrote to memory of 1000 2988 hhhntb.exe 37 PID 2988 wrote to memory of 1000 2988 hhhntb.exe 37 PID 2988 wrote to memory of 1000 2988 hhhntb.exe 37 PID 2988 wrote to memory of 1000 2988 hhhntb.exe 37 PID 1000 wrote to memory of 2264 1000 1hbhtt.exe 38 PID 1000 wrote to memory of 2264 1000 1hbhtt.exe 38 PID 1000 wrote to memory of 2264 1000 1hbhtt.exe 38 PID 1000 wrote to memory of 2264 1000 1hbhtt.exe 38 PID 2264 wrote to memory of 532 2264 vdjdp.exe 39 PID 2264 wrote to memory of 532 2264 vdjdp.exe 39 PID 2264 wrote to memory of 532 2264 vdjdp.exe 39 PID 2264 wrote to memory of 532 2264 vdjdp.exe 39 PID 532 wrote to memory of 1664 532 lfxllrf.exe 40 PID 532 wrote to memory of 1664 532 lfxllrf.exe 40 PID 532 wrote to memory of 1664 532 lfxllrf.exe 40 PID 532 wrote to memory of 1664 532 lfxllrf.exe 40 PID 1664 wrote to memory of 1164 1664 rlflrrl.exe 41 PID 1664 wrote to memory of 1164 1664 rlflrrl.exe 41 PID 1664 wrote to memory of 1164 1664 rlflrrl.exe 41 PID 1664 wrote to memory of 1164 1664 rlflrrl.exe 41 PID 1164 wrote to memory of 2508 1164 3nhntt.exe 42 PID 1164 wrote to memory of 2508 1164 3nhntt.exe 42 PID 1164 wrote to memory of 2508 1164 3nhntt.exe 42 PID 1164 wrote to memory of 2508 1164 3nhntt.exe 42 PID 2508 wrote to memory of 1912 2508 vvjjv.exe 43 PID 2508 wrote to memory of 1912 2508 vvjjv.exe 43 PID 2508 wrote to memory of 1912 2508 vvjjv.exe 43 PID 2508 wrote to memory of 1912 2508 vvjjv.exe 43 PID 1912 wrote to memory of 564 1912 xxfxlxr.exe 44 PID 1912 wrote to memory of 564 1912 xxfxlxr.exe 44 PID 1912 wrote to memory of 564 1912 xxfxlxr.exe 44 PID 1912 wrote to memory of 564 1912 xxfxlxr.exe 44 PID 564 wrote to memory of 2588 564 rlffrrx.exe 45 PID 564 wrote to memory of 2588 564 rlffrrx.exe 45 PID 564 wrote to memory of 2588 564 rlffrrx.exe 45 PID 564 wrote to memory of 2588 564 rlffrrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a181273cbab61f0b2b491cd220320920N.exe"C:\Users\Admin\AppData\Local\Temp\a181273cbab61f0b2b491cd220320920N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\jjjvj.exec:\jjjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\rlfxxxf.exec:\rlfxxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\nhtbhn.exec:\nhtbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\tnbbbt.exec:\tnbbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\ddvvd.exec:\ddvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\5lfrflr.exec:\5lfrflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\hhhntb.exec:\hhhntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\1hbhtt.exec:\1hbhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\vdjdp.exec:\vdjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\lfxllrf.exec:\lfxllrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\rlflrrl.exec:\rlflrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\3nhntt.exec:\3nhntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\vvjjv.exec:\vvjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\xxfxlxr.exec:\xxfxlxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\rlffrrx.exec:\rlffrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\tnbbnh.exec:\tnbbnh.exe17⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jdppp.exec:\jdppp.exe18⤵
- Executes dropped EXE
PID:1328 -
\??\c:\rrlllrx.exec:\rrlllrx.exe19⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xxrfflr.exec:\xxrfflr.exe20⤵
- Executes dropped EXE
PID:1652 -
\??\c:\tbbhbh.exec:\tbbhbh.exe21⤵
- Executes dropped EXE
PID:2484 -
\??\c:\5vpdj.exec:\5vpdj.exe22⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vjddj.exec:\vjddj.exe23⤵
- Executes dropped EXE
PID:1272 -
\??\c:\rrllxfl.exec:\rrllxfl.exe24⤵
- Executes dropped EXE
PID:3012 -
\??\c:\7ttbht.exec:\7ttbht.exe25⤵
- Executes dropped EXE
PID:2352 -
\??\c:\9hbhnb.exec:\9hbhnb.exe26⤵
- Executes dropped EXE
PID:276 -
\??\c:\vvpvj.exec:\vvpvj.exe27⤵
- Executes dropped EXE
PID:952 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe28⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rrlflrx.exec:\rrlflrx.exe29⤵
- Executes dropped EXE
PID:2312 -
\??\c:\btnbnt.exec:\btnbnt.exe30⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jdpvv.exec:\jdpvv.exe31⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vvppd.exec:\vvppd.exe32⤵
- Executes dropped EXE
PID:1660 -
\??\c:\3llrrrx.exec:\3llrrrx.exe33⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xxfrxlx.exec:\xxfrxlx.exe34⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9ttbht.exec:\9ttbht.exe35⤵
- Executes dropped EXE
PID:1576 -
\??\c:\hnhbbn.exec:\hnhbbn.exe36⤵
- Executes dropped EXE
PID:2724 -
\??\c:\pdvdp.exec:\pdvdp.exe37⤵
- Executes dropped EXE
PID:2436 -
\??\c:\dvdvj.exec:\dvdvj.exe38⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rxlrrxl.exec:\rxlrrxl.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bhnbbh.exec:\bhnbbh.exe40⤵
- Executes dropped EXE
PID:2656 -
\??\c:\5nbtbb.exec:\5nbtbb.exe41⤵
- Executes dropped EXE
PID:2632 -
\??\c:\pvvpp.exec:\pvvpp.exe42⤵
- Executes dropped EXE
PID:3036 -
\??\c:\3djdp.exec:\3djdp.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3004 -
\??\c:\xxxxffr.exec:\xxxxffr.exe44⤵
- Executes dropped EXE
PID:2164 -
\??\c:\flxrffx.exec:\flxrffx.exe45⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nnbnbn.exec:\nnbnbn.exe46⤵
- Executes dropped EXE
PID:480 -
\??\c:\ttbhtt.exec:\ttbhtt.exe47⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jjdvj.exec:\jjdvj.exe48⤵
- Executes dropped EXE
PID:592 -
\??\c:\xxlrxlx.exec:\xxlrxlx.exe49⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lxllrfx.exec:\lxllrfx.exe50⤵
- Executes dropped EXE
PID:1164 -
\??\c:\xxrrlxf.exec:\xxrrlxf.exe51⤵
- Executes dropped EXE
PID:236 -
\??\c:\tnhbbh.exec:\tnhbbh.exe52⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hhtbnt.exec:\hhtbnt.exe53⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vdpjp.exec:\vdpjp.exe54⤵
- Executes dropped EXE
PID:1704 -
\??\c:\jjddd.exec:\jjddd.exe55⤵
- Executes dropped EXE
PID:1816 -
\??\c:\fflrflx.exec:\fflrflx.exe56⤵
- Executes dropped EXE
PID:2268 -
\??\c:\7lfrffx.exec:\7lfrffx.exe57⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hhtntt.exec:\hhtntt.exe58⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bbbttt.exec:\bbbttt.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2076 -
\??\c:\djdpd.exec:\djdpd.exe60⤵
- Executes dropped EXE
PID:2192 -
\??\c:\flxlrfr.exec:\flxlrfr.exe61⤵
- Executes dropped EXE
PID:2176 -
\??\c:\llxxfxl.exec:\llxxfxl.exe62⤵
- Executes dropped EXE
PID:1532 -
\??\c:\tttttt.exec:\tttttt.exe63⤵
- Executes dropped EXE
PID:1096 -
\??\c:\thbtbh.exec:\thbtbh.exe64⤵
- Executes dropped EXE
PID:2336 -
\??\c:\9pvjv.exec:\9pvjv.exe65⤵
- Executes dropped EXE
PID:712 -
\??\c:\pvdjv.exec:\pvdjv.exe66⤵PID:2096
-
\??\c:\fffrxxf.exec:\fffrxxf.exe67⤵PID:2956
-
\??\c:\xxlrxxf.exec:\xxlrxxf.exe68⤵PID:952
-
\??\c:\bbtbhb.exec:\bbtbhb.exe69⤵PID:996
-
\??\c:\3hbntt.exec:\3hbntt.exe70⤵PID:1616
-
\??\c:\jdppv.exec:\jdppv.exe71⤵PID:2680
-
\??\c:\pdvvd.exec:\pdvvd.exe72⤵PID:816
-
\??\c:\7rrrxll.exec:\7rrrxll.exe73⤵PID:1260
-
\??\c:\xfrxrxf.exec:\xfrxrxf.exe74⤵PID:2944
-
\??\c:\tnthnh.exec:\tnthnh.exe75⤵PID:2800
-
\??\c:\hnbnhh.exec:\hnbnhh.exe76⤵PID:2464
-
\??\c:\jpppp.exec:\jpppp.exe77⤵PID:1608
-
\??\c:\jpdpv.exec:\jpdpv.exe78⤵PID:2880
-
\??\c:\lrxlrxr.exec:\lrxlrxr.exe79⤵PID:2788
-
\??\c:\9ffrfxf.exec:\9ffrfxf.exe80⤵PID:2820
-
\??\c:\hnbhnt.exec:\hnbhnt.exe81⤵PID:2688
-
\??\c:\3dpjj.exec:\3dpjj.exe82⤵PID:2604
-
\??\c:\ddjpd.exec:\ddjpd.exe83⤵PID:2416
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe84⤵PID:3000
-
\??\c:\9fxllrx.exec:\9fxllrx.exe85⤵PID:648
-
\??\c:\3ffrxxf.exec:\3ffrxxf.exe86⤵PID:1788
-
\??\c:\ttbbhh.exec:\ttbbhh.exe87⤵PID:2696
-
\??\c:\nnbbbb.exec:\nnbbbb.exe88⤵PID:684
-
\??\c:\jdddj.exec:\jdddj.exe89⤵PID:532
-
\??\c:\jjvpv.exec:\jjvpv.exe90⤵PID:1308
-
\??\c:\ffffflr.exec:\ffffflr.exe91⤵PID:2140
-
\??\c:\hhntbh.exec:\hhntbh.exe92⤵PID:1936
-
\??\c:\bhbhnt.exec:\bhbhnt.exe93⤵PID:1980
-
\??\c:\9ppjp.exec:\9ppjp.exe94⤵PID:2020
-
\??\c:\vdjjp.exec:\vdjjp.exe95⤵PID:2984
-
\??\c:\7rrxflx.exec:\7rrxflx.exe96⤵PID:1748
-
\??\c:\hbhhhb.exec:\hbhhhb.exe97⤵PID:1928
-
\??\c:\ttntbb.exec:\ttntbb.exe98⤵PID:1160
-
\??\c:\ddvdv.exec:\ddvdv.exe99⤵PID:2584
-
\??\c:\jdvjp.exec:\jdvjp.exe100⤵PID:2472
-
\??\c:\lfxxffl.exec:\lfxxffl.exe101⤵PID:2260
-
\??\c:\rxlrlxf.exec:\rxlrlxf.exe102⤵PID:2076
-
\??\c:\hhhtbb.exec:\hhhtbb.exe103⤵PID:2444
-
\??\c:\nhthtb.exec:\nhthtb.exe104⤵PID:2332
-
\??\c:\ppjdd.exec:\ppjdd.exe105⤵PID:524
-
\??\c:\jjvdd.exec:\jjvdd.exe106⤵PID:1096
-
\??\c:\1llxxlr.exec:\1llxxlr.exe107⤵PID:1956
-
\??\c:\3fxxllr.exec:\3fxxllr.exe108⤵PID:2272
-
\??\c:\hhnbth.exec:\hhnbth.exe109⤵PID:848
-
\??\c:\nnhnth.exec:\nnhnth.exe110⤵PID:876
-
\??\c:\9tbnhh.exec:\9tbnhh.exe111⤵PID:2056
-
\??\c:\pppvj.exec:\pppvj.exe112⤵PID:852
-
\??\c:\flfrffx.exec:\flfrffx.exe113⤵PID:2900
-
\??\c:\9llrxfr.exec:\9llrxfr.exe114⤵PID:2440
-
\??\c:\5rrxflx.exec:\5rrxflx.exe115⤵PID:884
-
\??\c:\1nbnbn.exec:\1nbnbn.exe116⤵PID:2540
-
\??\c:\jpjdj.exec:\jpjdj.exe117⤵PID:2812
-
\??\c:\5dvpv.exec:\5dvpv.exe118⤵PID:2092
-
\??\c:\9fflxfx.exec:\9fflxfx.exe119⤵PID:1716
-
\??\c:\frxlrfr.exec:\frxlrfr.exe120⤵PID:2844
-
\??\c:\1nhnbh.exec:\1nhnbh.exe121⤵PID:2608
-
\??\c:\nnbnbb.exec:\nnbnbb.exe122⤵PID:2860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-