Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01/09/2024, 01:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b2486a61bb2827531ceb80a5b42f145b923a13bf809376a9345dd3e88b8af44d.exe
Resource
win7-20240708-en
6 signatures
150 seconds
General
-
Target
b2486a61bb2827531ceb80a5b42f145b923a13bf809376a9345dd3e88b8af44d.exe
-
Size
489KB
-
MD5
4655b9c81cd3d8a5d98971806f09bf1b
-
SHA1
13788fc3b33bc0189cd4c37285208347506277cf
-
SHA256
b2486a61bb2827531ceb80a5b42f145b923a13bf809376a9345dd3e88b8af44d
-
SHA512
02910f7fe0f34ac510d157338073d7b93004e9f2bb1590c4ac4154fbab4cb68c2f523b75838b3207c329f3e488ba7a498da1059dc98dff39dee75a49521b1eb1
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93svqTbWL5wE+:n3C9yMo+S0L9xRnoq7H9QYcmB
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/3008-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1124-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1680-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/572-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1696 tbthtt.exe 2828 lrffxrr.exe 2744 xfxfrff.exe 2696 1xlrrfx.exe 2668 rflllrl.exe 2456 hhttnb.exe 2564 7fxxlxr.exe 2600 hnhhbb.exe 1748 ddvdd.exe 2448 tbtttt.exe 872 pvvjj.exe 992 lfllrfl.exe 2020 lxflxfl.exe 1124 ffflffx.exe 1952 tbthbh.exe 1720 djvpv.exe 2788 rrlxrxr.exe 1680 bbthtb.exe 2892 vvjdj.exe 316 bhnttt.exe 1660 nntntn.exe 1252 jjvdj.exe 572 1bnthn.exe 2936 3vpvp.exe 2156 tnbhtb.exe 3052 3jdpv.exe 712 hhhbbb.exe 1800 pjpjd.exe 2008 tnhtbt.exe 3024 pjvjd.exe 2296 rffxrrx.exe 2736 bnbttb.exe 2316 1xlxlxf.exe 2828 9tthbt.exe 2744 hhbtht.exe 2556 jjjvj.exe 2200 fxrfxrl.exe 2728 nbhhht.exe 2560 1jjvv.exe 2616 rfllxfx.exe 2460 3nbnnt.exe 496 ntthht.exe 2004 jppjj.exe 580 lrfxxrr.exe 376 hhntnb.exe 1600 7pjpp.exe 320 ffxfrxr.exe 2040 lfflxxf.exe 2036 bhhtht.exe 1484 vvjvj.exe 2536 9frfrrx.exe 1720 nnnbnh.exe 2416 1ppdp.exe 2180 7pjvd.exe 2964 lrfrlrr.exe 996 bhbbbn.exe 1668 ddjpp.exe 1000 flfrrxl.exe 2384 bbttbh.exe 2388 vddjv.exe 2408 1jpjd.exe 2264 llrfrxl.exe 2916 jpvvd.exe 3064 flxfllx.exe -
resource yara_rule behavioral1/memory/3008-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3008 wrote to memory of 1696 3008 b2486a61bb2827531ceb80a5b42f145b923a13bf809376a9345dd3e88b8af44d.exe 31 PID 3008 wrote to memory of 1696 3008 b2486a61bb2827531ceb80a5b42f145b923a13bf809376a9345dd3e88b8af44d.exe 31 PID 3008 wrote to memory of 1696 3008 b2486a61bb2827531ceb80a5b42f145b923a13bf809376a9345dd3e88b8af44d.exe 31 PID 3008 wrote to memory of 1696 3008 b2486a61bb2827531ceb80a5b42f145b923a13bf809376a9345dd3e88b8af44d.exe 31 PID 1696 wrote to memory of 2828 1696 tbthtt.exe 32 PID 1696 wrote to memory of 2828 1696 tbthtt.exe 32 PID 1696 wrote to memory of 2828 1696 tbthtt.exe 32 PID 1696 wrote to memory of 2828 1696 tbthtt.exe 32 PID 2828 wrote to memory of 2744 2828 lrffxrr.exe 33 PID 2828 wrote to memory of 2744 2828 lrffxrr.exe 33 PID 2828 wrote to memory of 2744 2828 lrffxrr.exe 33 PID 2828 wrote to memory of 2744 2828 lrffxrr.exe 33 PID 2744 wrote to memory of 2696 2744 xfxfrff.exe 34 PID 2744 wrote to memory of 2696 2744 xfxfrff.exe 34 PID 2744 wrote to memory of 2696 2744 xfxfrff.exe 34 PID 2744 wrote to memory of 2696 2744 xfxfrff.exe 34 PID 2696 wrote to memory of 2668 2696 1xlrrfx.exe 35 PID 2696 wrote to memory of 2668 2696 1xlrrfx.exe 35 PID 2696 wrote to memory of 2668 2696 1xlrrfx.exe 35 PID 2696 wrote to memory of 2668 2696 1xlrrfx.exe 35 PID 2668 wrote to memory of 2456 2668 rflllrl.exe 36 PID 2668 wrote to memory of 2456 2668 rflllrl.exe 36 PID 2668 wrote to memory of 2456 2668 rflllrl.exe 36 PID 2668 wrote to memory of 2456 2668 rflllrl.exe 36 PID 2456 wrote to memory of 2564 2456 hhttnb.exe 37 PID 2456 wrote to memory of 2564 2456 hhttnb.exe 37 PID 2456 wrote to memory of 2564 2456 hhttnb.exe 37 PID 2456 wrote to memory of 2564 2456 hhttnb.exe 37 PID 2564 wrote to memory of 2600 2564 7fxxlxr.exe 38 PID 2564 wrote to memory of 2600 2564 7fxxlxr.exe 38 PID 2564 wrote to memory of 2600 2564 7fxxlxr.exe 38 PID 2564 wrote to memory of 2600 2564 7fxxlxr.exe 38 PID 2600 wrote to memory of 1748 2600 hnhhbb.exe 39 PID 2600 wrote to memory of 1748 2600 hnhhbb.exe 39 PID 2600 wrote to memory of 1748 2600 hnhhbb.exe 39 PID 2600 wrote to memory of 1748 2600 hnhhbb.exe 39 PID 1748 wrote to memory of 2448 1748 ddvdd.exe 40 PID 1748 wrote to memory of 2448 1748 ddvdd.exe 40 PID 1748 wrote to memory of 2448 1748 ddvdd.exe 40 PID 1748 wrote to memory of 2448 1748 ddvdd.exe 40 PID 2448 wrote to memory of 872 2448 tbtttt.exe 41 PID 2448 wrote to memory of 872 2448 tbtttt.exe 41 PID 2448 wrote to memory of 872 2448 tbtttt.exe 41 PID 2448 wrote to memory of 872 2448 tbtttt.exe 41 PID 872 wrote to memory of 992 872 pvvjj.exe 42 PID 872 wrote to memory of 992 872 pvvjj.exe 42 PID 872 wrote to memory of 992 872 pvvjj.exe 42 PID 872 wrote to memory of 992 872 pvvjj.exe 42 PID 992 wrote to memory of 2020 992 lfllrfl.exe 43 PID 992 wrote to memory of 2020 992 lfllrfl.exe 43 PID 992 wrote to memory of 2020 992 lfllrfl.exe 43 PID 992 wrote to memory of 2020 992 lfllrfl.exe 43 PID 2020 wrote to memory of 1124 2020 lxflxfl.exe 44 PID 2020 wrote to memory of 1124 2020 lxflxfl.exe 44 PID 2020 wrote to memory of 1124 2020 lxflxfl.exe 44 PID 2020 wrote to memory of 1124 2020 lxflxfl.exe 44 PID 1124 wrote to memory of 1952 1124 ffflffx.exe 45 PID 1124 wrote to memory of 1952 1124 ffflffx.exe 45 PID 1124 wrote to memory of 1952 1124 ffflffx.exe 45 PID 1124 wrote to memory of 1952 1124 ffflffx.exe 45 PID 1952 wrote to memory of 1720 1952 tbthbh.exe 46 PID 1952 wrote to memory of 1720 1952 tbthbh.exe 46 PID 1952 wrote to memory of 1720 1952 tbthbh.exe 46 PID 1952 wrote to memory of 1720 1952 tbthbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2486a61bb2827531ceb80a5b42f145b923a13bf809376a9345dd3e88b8af44d.exe"C:\Users\Admin\AppData\Local\Temp\b2486a61bb2827531ceb80a5b42f145b923a13bf809376a9345dd3e88b8af44d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\tbthtt.exec:\tbthtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\lrffxrr.exec:\lrffxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\xfxfrff.exec:\xfxfrff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\1xlrrfx.exec:\1xlrrfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\rflllrl.exec:\rflllrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\hhttnb.exec:\hhttnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\7fxxlxr.exec:\7fxxlxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\hnhhbb.exec:\hnhhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\ddvdd.exec:\ddvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\tbtttt.exec:\tbtttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\pvvjj.exec:\pvvjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\lfllrfl.exec:\lfllrfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\lxflxfl.exec:\lxflxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\ffflffx.exec:\ffflffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\tbthbh.exec:\tbthbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\djvpv.exec:\djvpv.exe17⤵
- Executes dropped EXE
PID:1720 -
\??\c:\rrlxrxr.exec:\rrlxrxr.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2788 -
\??\c:\bbthtb.exec:\bbthtb.exe19⤵
- Executes dropped EXE
PID:1680 -
\??\c:\vvjdj.exec:\vvjdj.exe20⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bhnttt.exec:\bhnttt.exe21⤵
- Executes dropped EXE
PID:316 -
\??\c:\nntntn.exec:\nntntn.exe22⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jjvdj.exec:\jjvdj.exe23⤵
- Executes dropped EXE
PID:1252 -
\??\c:\1bnthn.exec:\1bnthn.exe24⤵
- Executes dropped EXE
PID:572 -
\??\c:\3vpvp.exec:\3vpvp.exe25⤵
- Executes dropped EXE
PID:2936 -
\??\c:\tnbhtb.exec:\tnbhtb.exe26⤵
- Executes dropped EXE
PID:2156 -
\??\c:\3jdpv.exec:\3jdpv.exe27⤵
- Executes dropped EXE
PID:3052 -
\??\c:\hhhbbb.exec:\hhhbbb.exe28⤵
- Executes dropped EXE
PID:712 -
\??\c:\pjpjd.exec:\pjpjd.exe29⤵
- Executes dropped EXE
PID:1800 -
\??\c:\tnhtbt.exec:\tnhtbt.exe30⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pjvjd.exec:\pjvjd.exe31⤵
- Executes dropped EXE
PID:3024 -
\??\c:\rffxrrx.exec:\rffxrrx.exe32⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bnbttb.exec:\bnbttb.exe33⤵
- Executes dropped EXE
PID:2736 -
\??\c:\1xlxlxf.exec:\1xlxlxf.exe34⤵
- Executes dropped EXE
PID:2316 -
\??\c:\9tthbt.exec:\9tthbt.exe35⤵
- Executes dropped EXE
PID:2828 -
\??\c:\hhbtht.exec:\hhbtht.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jjjvj.exec:\jjjvj.exe37⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2200 -
\??\c:\nbhhht.exec:\nbhhht.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\1jjvv.exec:\1jjvv.exe40⤵
- Executes dropped EXE
PID:2560 -
\??\c:\rfllxfx.exec:\rfllxfx.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\3nbnnt.exec:\3nbnnt.exe42⤵
- Executes dropped EXE
PID:2460 -
\??\c:\ntthht.exec:\ntthht.exe43⤵
- Executes dropped EXE
PID:496 -
\??\c:\jppjj.exec:\jppjj.exe44⤵
- Executes dropped EXE
PID:2004 -
\??\c:\lrfxxrr.exec:\lrfxxrr.exe45⤵
- Executes dropped EXE
PID:580 -
\??\c:\hhntnb.exec:\hhntnb.exe46⤵
- Executes dropped EXE
PID:376 -
\??\c:\7pjpp.exec:\7pjpp.exe47⤵
- Executes dropped EXE
PID:1600 -
\??\c:\ffxfrxr.exec:\ffxfrxr.exe48⤵
- Executes dropped EXE
PID:320 -
\??\c:\lfflxxf.exec:\lfflxxf.exe49⤵
- Executes dropped EXE
PID:2040 -
\??\c:\bhhtht.exec:\bhhtht.exe50⤵
- Executes dropped EXE
PID:2036 -
\??\c:\vvjvj.exec:\vvjvj.exe51⤵
- Executes dropped EXE
PID:1484 -
\??\c:\9frfrrx.exec:\9frfrrx.exe52⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nnnbnh.exec:\nnnbnh.exe53⤵
- Executes dropped EXE
PID:1720 -
\??\c:\1ppdp.exec:\1ppdp.exe54⤵
- Executes dropped EXE
PID:2416 -
\??\c:\7pjvd.exec:\7pjvd.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2180 -
\??\c:\lrfrlrr.exec:\lrfrlrr.exe56⤵
- Executes dropped EXE
PID:2964 -
\??\c:\bhbbbn.exec:\bhbbbn.exe57⤵
- Executes dropped EXE
PID:996 -
\??\c:\ddjpp.exec:\ddjpp.exe58⤵
- Executes dropped EXE
PID:1668 -
\??\c:\flfrrxl.exec:\flfrrxl.exe59⤵
- Executes dropped EXE
PID:1000 -
\??\c:\bbttbh.exec:\bbttbh.exe60⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vddjv.exec:\vddjv.exe61⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1jpjd.exec:\1jpjd.exe62⤵
- Executes dropped EXE
PID:2408 -
\??\c:\llrfrxl.exec:\llrfrxl.exe63⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jpvvd.exec:\jpvvd.exe64⤵
- Executes dropped EXE
PID:2916 -
\??\c:\flxfllx.exec:\flxfllx.exe65⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xfrxffr.exec:\xfrxffr.exe66⤵PID:1972
-
\??\c:\tntbtn.exec:\tntbtn.exe67⤵PID:1464
-
\??\c:\vjjjj.exec:\vjjjj.exe68⤵PID:2136
-
\??\c:\1xlxxfl.exec:\1xlxxfl.exe69⤵PID:1116
-
\??\c:\bhbhbh.exec:\bhbhbh.exe70⤵PID:1676
-
\??\c:\hnnthh.exec:\hnnthh.exe71⤵PID:2328
-
\??\c:\dvjpd.exec:\dvjpd.exe72⤵PID:1696
-
\??\c:\rxxfrlr.exec:\rxxfrlr.exe73⤵PID:3068
-
\??\c:\9dvjv.exec:\9dvjv.exe74⤵PID:2692
-
\??\c:\vddvj.exec:\vddvj.exe75⤵PID:2764
-
\??\c:\xllflxr.exec:\xllflxr.exe76⤵PID:2816
-
\??\c:\tbnhnn.exec:\tbnhnn.exe77⤵PID:1644
-
\??\c:\vppdv.exec:\vppdv.exe78⤵PID:2820
-
\??\c:\rfxrllf.exec:\rfxrllf.exe79⤵PID:2716
-
\??\c:\5bthnb.exec:\5bthnb.exe80⤵PID:2624
-
\??\c:\dddjv.exec:\dddjv.exe81⤵PID:2980
-
\??\c:\vdjdj.exec:\vdjdj.exe82⤵PID:1964
-
\??\c:\fflxffx.exec:\fflxffx.exe83⤵PID:884
-
\??\c:\hbnthn.exec:\hbnthn.exe84⤵
- System Location Discovery: System Language Discovery
PID:1884 -
\??\c:\jpdpj.exec:\jpdpj.exe85⤵PID:1620
-
\??\c:\xfxlrlx.exec:\xfxlrlx.exe86⤵
- System Location Discovery: System Language Discovery
PID:1760 -
\??\c:\bthntt.exec:\bthntt.exe87⤵PID:1232
-
\??\c:\pdvjv.exec:\pdvjv.exe88⤵PID:320
-
\??\c:\xxxlxll.exec:\xxxlxll.exe89⤵PID:1032
-
\??\c:\bntnnh.exec:\bntnnh.exe90⤵PID:2036
-
\??\c:\vjppj.exec:\vjppj.exe91⤵PID:1712
-
\??\c:\5xffrrr.exec:\5xffrrr.exe92⤵PID:2840
-
\??\c:\nnnbtn.exec:\nnnbtn.exe93⤵PID:3004
-
\??\c:\pvvpj.exec:\pvvpj.exe94⤵PID:1704
-
\??\c:\rrrlrlf.exec:\rrrlrlf.exe95⤵PID:2196
-
\??\c:\nnhbtb.exec:\nnhbtb.exe96⤵PID:2104
-
\??\c:\hbtbbn.exec:\hbtbbn.exe97⤵PID:1900
-
\??\c:\pvjpp.exec:\pvjpp.exe98⤵PID:1672
-
\??\c:\rlxlrrf.exec:\rlxlrrf.exe99⤵PID:2464
-
\??\c:\bbbtnb.exec:\bbbtnb.exe100⤵PID:2384
-
\??\c:\vvjvj.exec:\vvjvj.exe101⤵PID:1632
-
\??\c:\ppvjv.exec:\ppvjv.exe102⤵PID:2408
-
\??\c:\xfxrlxx.exec:\xfxrlxx.exe103⤵PID:2148
-
\??\c:\hhhnbh.exec:\hhhnbh.exe104⤵PID:2916
-
\??\c:\5rlxlrl.exec:\5rlxlrl.exe105⤵PID:1468
-
\??\c:\bnhtbh.exec:\bnhtbh.exe106⤵PID:1972
-
\??\c:\vddvj.exec:\vddvj.exe107⤵PID:1464
-
\??\c:\xlrfflx.exec:\xlrfflx.exe108⤵PID:1584
-
\??\c:\xlfflll.exec:\xlfflll.exe109⤵PID:1904
-
\??\c:\hthhbt.exec:\hthhbt.exe110⤵PID:1676
-
\??\c:\5pvpv.exec:\5pvpv.exe111⤵PID:1396
-
\??\c:\frxxlxx.exec:\frxxlxx.exe112⤵PID:2096
-
\??\c:\frrrxfr.exec:\frrrxfr.exe113⤵PID:2736
-
\??\c:\hhtbnn.exec:\hhtbnn.exe114⤵PID:2692
-
\??\c:\1dvvd.exec:\1dvvd.exe115⤵PID:2828
-
\??\c:\5fxfflx.exec:\5fxfflx.exe116⤵PID:2816
-
\??\c:\hbtbtb.exec:\hbtbtb.exe117⤵PID:1644
-
\??\c:\djdjv.exec:\djdjv.exe118⤵PID:2820
-
\??\c:\dvpjv.exec:\dvpjv.exe119⤵PID:2580
-
\??\c:\9ffxllr.exec:\9ffxllr.exe120⤵PID:3036
-
\??\c:\hbtntn.exec:\hbtntn.exe121⤵PID:2980
-
\??\c:\dvvpv.exec:\dvvpv.exe122⤵PID:1964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-