Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29-08-2024 02:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
089d461b37fd8382b3214b7c6bc011b0N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
089d461b37fd8382b3214b7c6bc011b0N.exe
-
Size
64KB
-
MD5
089d461b37fd8382b3214b7c6bc011b0
-
SHA1
1809bc045b06c5149530576ffd8843d20a87b17d
-
SHA256
b040e91da0a0d0001c459cf5d112ccb4d0aa1d43764de2bcedca92cc69e6a7e8
-
SHA512
31c8cde993ab775efc03d007e2b71dcea1abbfd249741c99e6dc39912c54ac9d49923c9ef49b76d8f2d346c87d776b6005fc33aa0a25d132e96af2c79fbd0034
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxe:ymb3NkkiQ3mdBjF0y7kbI
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2116-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/684-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2356 1frxrrx.exe 2540 ntbtth.exe 3032 1pjdd.exe 2744 xlfxfrx.exe 2704 ttbnnt.exe 2876 vjjjp.exe 2904 7llfrfl.exe 2712 1tbtbb.exe 2664 bnhnbh.exe 2144 dpvjp.exe 684 pjjjv.exe 2780 3xfrllr.exe 1624 7tbhnn.exe 2916 ddjpv.exe 2504 1jdjj.exe 1984 5xlxlrx.exe 2044 3nhtnn.exe 2300 nhhhhn.exe 580 pjppp.exe 1856 vpvjp.exe 800 lxfxxff.exe 952 btnbht.exe 2984 ttbbhb.exe 1572 pdvjd.exe 304 ppvvd.exe 352 fxllrrx.exe 2952 ttbtbb.exe 2244 tnbnhh.exe 2280 dvddd.exe 1752 rlxrxrr.exe 2392 xlxffll.exe 2512 bbbbhn.exe 2068 hbbnnb.exe 1812 vpvpv.exe 1704 rlxfrxr.exe 2552 3xxlrrx.exe 2728 3fxfrxr.exe 2868 nhthnn.exe 2704 nhntbb.exe 2912 dvddj.exe 2764 xrffffl.exe 1652 1xllxxf.exe 1948 9bnbtt.exe 2184 btbbnh.exe 2144 dvvpp.exe 1080 jdpdp.exe 2936 xlxrllr.exe 596 xrxxxxl.exe 2128 5htbht.exe 1732 jdddd.exe 1932 ddppd.exe 1216 rlrrrxx.exe 584 bnbhnt.exe 1768 tntttb.exe 2396 pdpjj.exe 2932 vjppv.exe 2248 frxrxrf.exe 2484 xrlrxxl.exe 800 3hnbnn.exe 440 5hhnbh.exe 1160 dvvdv.exe 1540 1jjvv.exe 2196 3xrlrlx.exe 2256 xxfrfxx.exe -
resource yara_rule behavioral1/memory/2116-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/684-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffllr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2356 2116 089d461b37fd8382b3214b7c6bc011b0N.exe 30 PID 2116 wrote to memory of 2356 2116 089d461b37fd8382b3214b7c6bc011b0N.exe 30 PID 2116 wrote to memory of 2356 2116 089d461b37fd8382b3214b7c6bc011b0N.exe 30 PID 2116 wrote to memory of 2356 2116 089d461b37fd8382b3214b7c6bc011b0N.exe 30 PID 2356 wrote to memory of 2540 2356 1frxrrx.exe 31 PID 2356 wrote to memory of 2540 2356 1frxrrx.exe 31 PID 2356 wrote to memory of 2540 2356 1frxrrx.exe 31 PID 2356 wrote to memory of 2540 2356 1frxrrx.exe 31 PID 2540 wrote to memory of 3032 2540 ntbtth.exe 32 PID 2540 wrote to memory of 3032 2540 ntbtth.exe 32 PID 2540 wrote to memory of 3032 2540 ntbtth.exe 32 PID 2540 wrote to memory of 3032 2540 ntbtth.exe 32 PID 3032 wrote to memory of 2744 3032 1pjdd.exe 33 PID 3032 wrote to memory of 2744 3032 1pjdd.exe 33 PID 3032 wrote to memory of 2744 3032 1pjdd.exe 33 PID 3032 wrote to memory of 2744 3032 1pjdd.exe 33 PID 2744 wrote to memory of 2704 2744 xlfxfrx.exe 34 PID 2744 wrote to memory of 2704 2744 xlfxfrx.exe 34 PID 2744 wrote to memory of 2704 2744 xlfxfrx.exe 34 PID 2744 wrote to memory of 2704 2744 xlfxfrx.exe 34 PID 2704 wrote to memory of 2876 2704 ttbnnt.exe 35 PID 2704 wrote to memory of 2876 2704 ttbnnt.exe 35 PID 2704 wrote to memory of 2876 2704 ttbnnt.exe 35 PID 2704 wrote to memory of 2876 2704 ttbnnt.exe 35 PID 2876 wrote to memory of 2904 2876 vjjjp.exe 36 PID 2876 wrote to memory of 2904 2876 vjjjp.exe 36 PID 2876 wrote to memory of 2904 2876 vjjjp.exe 36 PID 2876 wrote to memory of 2904 2876 vjjjp.exe 36 PID 2904 wrote to memory of 2712 2904 7llfrfl.exe 37 PID 2904 wrote to memory of 2712 2904 7llfrfl.exe 37 PID 2904 wrote to memory of 2712 2904 7llfrfl.exe 37 PID 2904 wrote to memory of 2712 2904 7llfrfl.exe 37 PID 2712 wrote to memory of 2664 2712 1tbtbb.exe 38 PID 2712 wrote to memory of 2664 2712 1tbtbb.exe 38 PID 2712 wrote to memory of 2664 2712 1tbtbb.exe 38 PID 2712 wrote to memory of 2664 2712 1tbtbb.exe 38 PID 2664 wrote to memory of 2144 2664 bnhnbh.exe 39 PID 2664 wrote to memory of 2144 2664 bnhnbh.exe 39 PID 2664 wrote to memory of 2144 2664 bnhnbh.exe 39 PID 2664 wrote to memory of 2144 2664 bnhnbh.exe 39 PID 2144 wrote to memory of 684 2144 dpvjp.exe 40 PID 2144 wrote to memory of 684 2144 dpvjp.exe 40 PID 2144 wrote to memory of 684 2144 dpvjp.exe 40 PID 2144 wrote to memory of 684 2144 dpvjp.exe 40 PID 684 wrote to memory of 2780 684 pjjjv.exe 41 PID 684 wrote to memory of 2780 684 pjjjv.exe 41 PID 684 wrote to memory of 2780 684 pjjjv.exe 41 PID 684 wrote to memory of 2780 684 pjjjv.exe 41 PID 2780 wrote to memory of 1624 2780 3xfrllr.exe 42 PID 2780 wrote to memory of 1624 2780 3xfrllr.exe 42 PID 2780 wrote to memory of 1624 2780 3xfrllr.exe 42 PID 2780 wrote to memory of 1624 2780 3xfrllr.exe 42 PID 1624 wrote to memory of 2916 1624 7tbhnn.exe 43 PID 1624 wrote to memory of 2916 1624 7tbhnn.exe 43 PID 1624 wrote to memory of 2916 1624 7tbhnn.exe 43 PID 1624 wrote to memory of 2916 1624 7tbhnn.exe 43 PID 2916 wrote to memory of 2504 2916 ddjpv.exe 44 PID 2916 wrote to memory of 2504 2916 ddjpv.exe 44 PID 2916 wrote to memory of 2504 2916 ddjpv.exe 44 PID 2916 wrote to memory of 2504 2916 ddjpv.exe 44 PID 2504 wrote to memory of 1984 2504 1jdjj.exe 45 PID 2504 wrote to memory of 1984 2504 1jdjj.exe 45 PID 2504 wrote to memory of 1984 2504 1jdjj.exe 45 PID 2504 wrote to memory of 1984 2504 1jdjj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\089d461b37fd8382b3214b7c6bc011b0N.exe"C:\Users\Admin\AppData\Local\Temp\089d461b37fd8382b3214b7c6bc011b0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\1frxrrx.exec:\1frxrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\ntbtth.exec:\ntbtth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\1pjdd.exec:\1pjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\xlfxfrx.exec:\xlfxfrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\ttbnnt.exec:\ttbnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\vjjjp.exec:\vjjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\7llfrfl.exec:\7llfrfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\1tbtbb.exec:\1tbtbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\bnhnbh.exec:\bnhnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\dpvjp.exec:\dpvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\pjjjv.exec:\pjjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\3xfrllr.exec:\3xfrllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\7tbhnn.exec:\7tbhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\ddjpv.exec:\ddjpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\1jdjj.exec:\1jdjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\5xlxlrx.exec:\5xlxlrx.exe17⤵
- Executes dropped EXE
PID:1984 -
\??\c:\3nhtnn.exec:\3nhtnn.exe18⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nhhhhn.exec:\nhhhhn.exe19⤵
- Executes dropped EXE
PID:2300 -
\??\c:\pjppp.exec:\pjppp.exe20⤵
- Executes dropped EXE
PID:580 -
\??\c:\vpvjp.exec:\vpvjp.exe21⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lxfxxff.exec:\lxfxxff.exe22⤵
- Executes dropped EXE
PID:800 -
\??\c:\btnbht.exec:\btnbht.exe23⤵
- Executes dropped EXE
PID:952 -
\??\c:\ttbbhb.exec:\ttbbhb.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2984 -
\??\c:\pdvjd.exec:\pdvjd.exe25⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ppvvd.exec:\ppvvd.exe26⤵
- Executes dropped EXE
PID:304 -
\??\c:\fxllrrx.exec:\fxllrrx.exe27⤵
- Executes dropped EXE
PID:352 -
\??\c:\ttbtbb.exec:\ttbtbb.exe28⤵
- Executes dropped EXE
PID:2952 -
\??\c:\tnbnhh.exec:\tnbnhh.exe29⤵
- Executes dropped EXE
PID:2244 -
\??\c:\dvddd.exec:\dvddd.exe30⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rlxrxrr.exec:\rlxrxrr.exe31⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xlxffll.exec:\xlxffll.exe32⤵
- Executes dropped EXE
PID:2392 -
\??\c:\bbbbhn.exec:\bbbbhn.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2512 -
\??\c:\hbbnnb.exec:\hbbnnb.exe34⤵
- Executes dropped EXE
PID:2068 -
\??\c:\vpvpv.exec:\vpvpv.exe35⤵
- Executes dropped EXE
PID:1812 -
\??\c:\rlxfrxr.exec:\rlxfrxr.exe36⤵
- Executes dropped EXE
PID:1704 -
\??\c:\3xxlrrx.exec:\3xxlrrx.exe37⤵
- Executes dropped EXE
PID:2552 -
\??\c:\3fxfrxr.exec:\3fxfrxr.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nhthnn.exec:\nhthnn.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nhntbb.exec:\nhntbb.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dvddj.exec:\dvddj.exe41⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xrffffl.exec:\xrffffl.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\1xllxxf.exec:\1xllxxf.exe43⤵
- Executes dropped EXE
PID:1652 -
\??\c:\9bnbtt.exec:\9bnbtt.exe44⤵
- Executes dropped EXE
PID:1948 -
\??\c:\btbbnh.exec:\btbbnh.exe45⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dvvpp.exec:\dvvpp.exe46⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jdpdp.exec:\jdpdp.exe47⤵
- Executes dropped EXE
PID:1080 -
\??\c:\xlxrllr.exec:\xlxrllr.exe48⤵
- Executes dropped EXE
PID:2936 -
\??\c:\xrxxxxl.exec:\xrxxxxl.exe49⤵
- Executes dropped EXE
PID:596 -
\??\c:\5htbht.exec:\5htbht.exe50⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jdddd.exec:\jdddd.exe51⤵
- Executes dropped EXE
PID:1732 -
\??\c:\ddppd.exec:\ddppd.exe52⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe53⤵
- Executes dropped EXE
PID:1216 -
\??\c:\bnbhnt.exec:\bnbhnt.exe54⤵
- Executes dropped EXE
PID:584 -
\??\c:\tntttb.exec:\tntttb.exe55⤵
- Executes dropped EXE
PID:1768 -
\??\c:\pdpjj.exec:\pdpjj.exe56⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vjppv.exec:\vjppv.exe57⤵
- Executes dropped EXE
PID:2932 -
\??\c:\frxrxrf.exec:\frxrxrf.exe58⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe59⤵
- Executes dropped EXE
PID:2484 -
\??\c:\3hnbnn.exec:\3hnbnn.exe60⤵
- Executes dropped EXE
PID:800 -
\??\c:\5hhnbh.exec:\5hhnbh.exe61⤵
- Executes dropped EXE
PID:440 -
\??\c:\dvvdv.exec:\dvvdv.exe62⤵
- Executes dropped EXE
PID:1160 -
\??\c:\1jjvv.exec:\1jjvv.exe63⤵
- Executes dropped EXE
PID:1540 -
\??\c:\3xrlrlx.exec:\3xrlrlx.exe64⤵
- Executes dropped EXE
PID:2196 -
\??\c:\xxfrfxx.exec:\xxfrfxx.exe65⤵
- Executes dropped EXE
PID:2256 -
\??\c:\bthnbh.exec:\bthnbh.exe66⤵PID:1452
-
\??\c:\bbthnt.exec:\bbthnt.exe67⤵PID:2320
-
\??\c:\jjvdp.exec:\jjvdp.exe68⤵PID:1344
-
\??\c:\vdppd.exec:\vdppd.exe69⤵PID:1864
-
\??\c:\3fxlflf.exec:\3fxlflf.exe70⤵PID:804
-
\??\c:\frffllr.exec:\frffllr.exe71⤵PID:2404
-
\??\c:\nhnnnn.exec:\nhnnnn.exe72⤵PID:2400
-
\??\c:\5pjpv.exec:\5pjpv.exe73⤵
- System Location Discovery: System Language Discovery
PID:1680 -
\??\c:\jjdpj.exec:\jjdpj.exe74⤵PID:2576
-
\??\c:\frllrlr.exec:\frllrlr.exe75⤵PID:1716
-
\??\c:\rlfflrf.exec:\rlfflrf.exe76⤵PID:3032
-
\??\c:\9bnthn.exec:\9bnthn.exe77⤵PID:2744
-
\??\c:\7htnbb.exec:\7htnbb.exe78⤵PID:2708
-
\??\c:\9jddv.exec:\9jddv.exe79⤵PID:2608
-
\??\c:\5vpdj.exec:\5vpdj.exe80⤵PID:2500
-
\??\c:\xxllrxf.exec:\xxllrxf.exe81⤵PID:2796
-
\??\c:\1rfxflr.exec:\1rfxflr.exe82⤵PID:2604
-
\??\c:\nhthnt.exec:\nhthnt.exe83⤵PID:2712
-
\??\c:\1tbbhh.exec:\1tbbhh.exe84⤵PID:2828
-
\??\c:\9ddpd.exec:\9ddpd.exe85⤵PID:3052
-
\??\c:\jdjpp.exec:\jdjpp.exe86⤵PID:1100
-
\??\c:\xxxrrxr.exec:\xxxrrxr.exe87⤵PID:1080
-
\??\c:\7thnnb.exec:\7thnnb.exe88⤵PID:1628
-
\??\c:\1nnntt.exec:\1nnntt.exe89⤵PID:2848
-
\??\c:\hbbbhb.exec:\hbbbhb.exe90⤵PID:2376
-
\??\c:\ppjvj.exec:\ppjvj.exe91⤵PID:2148
-
\??\c:\1djpj.exec:\1djpj.exe92⤵PID:768
-
\??\c:\lfrxlxl.exec:\lfrxlxl.exe93⤵PID:1200
-
\??\c:\rlxxrfr.exec:\rlxxrfr.exe94⤵PID:2208
-
\??\c:\hbntbt.exec:\hbntbt.exe95⤵PID:296
-
\??\c:\thhntn.exec:\thhntn.exe96⤵PID:2064
-
\??\c:\dvppd.exec:\dvppd.exe97⤵PID:1608
-
\??\c:\pvpvv.exec:\pvpvv.exe98⤵PID:2928
-
\??\c:\9frrxxf.exec:\9frrxxf.exe99⤵PID:1660
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe100⤵PID:1060
-
\??\c:\htttnh.exec:\htttnh.exe101⤵PID:1128
-
\??\c:\htbtbb.exec:\htbtbb.exe102⤵PID:2984
-
\??\c:\vpvpp.exec:\vpvpp.exe103⤵PID:1620
-
\??\c:\vpdvj.exec:\vpdvj.exe104⤵PID:2192
-
\??\c:\1rfxxxx.exec:\1rfxxxx.exe105⤵PID:1532
-
\??\c:\fxlllfx.exec:\fxlllfx.exe106⤵PID:3008
-
\??\c:\5ttbhh.exec:\5ttbhh.exe107⤵PID:2952
-
\??\c:\hbhntt.exec:\hbhntt.exe108⤵PID:2776
-
\??\c:\7pjpv.exec:\7pjpv.exe109⤵PID:1872
-
\??\c:\7jddd.exec:\7jddd.exe110⤵PID:2112
-
\??\c:\1vvvj.exec:\1vvvj.exe111⤵PID:2188
-
\??\c:\xxlflrx.exec:\xxlflrx.exe112⤵PID:2156
-
\??\c:\5rrflxl.exec:\5rrflxl.exe113⤵PID:2692
-
\??\c:\thttbh.exec:\thttbh.exe114⤵PID:1952
-
\??\c:\hbnntt.exec:\hbnntt.exe115⤵PID:2944
-
\??\c:\ddjjp.exec:\ddjjp.exe116⤵PID:1596
-
\??\c:\5pjdj.exec:\5pjdj.exe117⤵PID:2756
-
\??\c:\9rxlrrl.exec:\9rxlrrl.exe118⤵
- System Location Discovery: System Language Discovery
PID:2724 -
\??\c:\fxrrflr.exec:\fxrrflr.exe119⤵PID:2636
-
\??\c:\nnhhbh.exec:\nnhhbh.exe120⤵PID:2140
-
\??\c:\hbnntn.exec:\hbnntn.exe121⤵PID:2912
-
\??\c:\nhnhhh.exec:\nhnhhh.exe122⤵PID:2656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-