Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 12:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
830828fc55b9dd518a221e81d80c08c0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
830828fc55b9dd518a221e81d80c08c0N.exe
-
Size
64KB
-
MD5
830828fc55b9dd518a221e81d80c08c0
-
SHA1
184dd47840911eff449d91aeb5b6a6b85f407ef6
-
SHA256
c5b57d09803241e934c7e720d7f1b3da33f11a99c482693f9545d3660f9b414a
-
SHA512
fee7a90399b626710541498e452ed7bfa41b0b9d607a02c71bce2627cbe463342d68b993bc04a04b99bd7661f194cde47868e589bbe414cfca67ee4e36211634
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B1g:ymb3NkkiQ3mdBjFI9cW
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2676-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1164-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/644-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/340-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2796 tnbhtt.exe 2940 nhnttt.exe 2764 3rrfrrf.exe 2704 xrfrrlr.exe 2572 btbhhn.exe 3016 dvdjp.exe 2056 fxrfxxl.exe 2896 9hbnbt.exe 2240 jvdjj.exe 1692 1xllrlr.exe 1164 9llxllx.exe 2004 nhbhnn.exe 1684 pvddj.exe 1972 vvdpd.exe 2332 7lxffrx.exe 644 9tnthh.exe 2440 hbtnbb.exe 2264 pvppv.exe 2352 dpjvv.exe 2428 rlxxrxf.exe 764 hbtbnt.exe 1520 7thhhn.exe 968 ppdjd.exe 340 pjvjp.exe 1960 frllrxl.exe 2992 3btnhn.exe 1040 7hthht.exe 2864 jjjpv.exe 2648 rrlfrfl.exe 2816 ntttnh.exe 1720 pjvpj.exe 2700 lfxlxfx.exe 2596 lfrxlrf.exe 2732 ttnnhn.exe 2892 hnnbbt.exe 2612 pjvpp.exe 1976 rlxxxxl.exe 2500 rllrflr.exe 3024 nbbhbb.exe 2056 3hbtnn.exe 524 9dpvv.exe 2260 pvjvd.exe 2012 rlrfrrx.exe 2036 bbbthn.exe 1584 7hbthn.exe 1052 pdvjp.exe 2160 ddjvj.exe 2280 xrxxlxr.exe 1712 rfrlxfl.exe 1284 tbbtnh.exe 1036 1dppp.exe 2316 dpvdp.exe 2528 xrrflrf.exe 1988 fxlxflr.exe 2352 thhhbb.exe 1060 3dvjj.exe 2008 vjvdd.exe 1620 5rlrxxx.exe 1636 rrrxfrf.exe 2996 hbnbtb.exe 340 7nbnbn.exe 1628 jjddp.exe 2156 9pjvd.exe 2920 xlfllfr.exe -
resource yara_rule behavioral1/memory/2676-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/644-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/340-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-293-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2676 wrote to memory of 2796 2676 830828fc55b9dd518a221e81d80c08c0N.exe 30 PID 2676 wrote to memory of 2796 2676 830828fc55b9dd518a221e81d80c08c0N.exe 30 PID 2676 wrote to memory of 2796 2676 830828fc55b9dd518a221e81d80c08c0N.exe 30 PID 2676 wrote to memory of 2796 2676 830828fc55b9dd518a221e81d80c08c0N.exe 30 PID 2796 wrote to memory of 2940 2796 tnbhtt.exe 31 PID 2796 wrote to memory of 2940 2796 tnbhtt.exe 31 PID 2796 wrote to memory of 2940 2796 tnbhtt.exe 31 PID 2796 wrote to memory of 2940 2796 tnbhtt.exe 31 PID 2940 wrote to memory of 2764 2940 nhnttt.exe 32 PID 2940 wrote to memory of 2764 2940 nhnttt.exe 32 PID 2940 wrote to memory of 2764 2940 nhnttt.exe 32 PID 2940 wrote to memory of 2764 2940 nhnttt.exe 32 PID 2764 wrote to memory of 2704 2764 3rrfrrf.exe 33 PID 2764 wrote to memory of 2704 2764 3rrfrrf.exe 33 PID 2764 wrote to memory of 2704 2764 3rrfrrf.exe 33 PID 2764 wrote to memory of 2704 2764 3rrfrrf.exe 33 PID 2704 wrote to memory of 2572 2704 xrfrrlr.exe 34 PID 2704 wrote to memory of 2572 2704 xrfrrlr.exe 34 PID 2704 wrote to memory of 2572 2704 xrfrrlr.exe 34 PID 2704 wrote to memory of 2572 2704 xrfrrlr.exe 34 PID 2572 wrote to memory of 3016 2572 btbhhn.exe 35 PID 2572 wrote to memory of 3016 2572 btbhhn.exe 35 PID 2572 wrote to memory of 3016 2572 btbhhn.exe 35 PID 2572 wrote to memory of 3016 2572 btbhhn.exe 35 PID 3016 wrote to memory of 2056 3016 dvdjp.exe 36 PID 3016 wrote to memory of 2056 3016 dvdjp.exe 36 PID 3016 wrote to memory of 2056 3016 dvdjp.exe 36 PID 3016 wrote to memory of 2056 3016 dvdjp.exe 36 PID 2056 wrote to memory of 2896 2056 fxrfxxl.exe 37 PID 2056 wrote to memory of 2896 2056 fxrfxxl.exe 37 PID 2056 wrote to memory of 2896 2056 fxrfxxl.exe 37 PID 2056 wrote to memory of 2896 2056 fxrfxxl.exe 37 PID 2896 wrote to memory of 2240 2896 9hbnbt.exe 38 PID 2896 wrote to memory of 2240 2896 9hbnbt.exe 38 PID 2896 wrote to memory of 2240 2896 9hbnbt.exe 38 PID 2896 wrote to memory of 2240 2896 9hbnbt.exe 38 PID 2240 wrote to memory of 1692 2240 jvdjj.exe 39 PID 2240 wrote to memory of 1692 2240 jvdjj.exe 39 PID 2240 wrote to memory of 1692 2240 jvdjj.exe 39 PID 2240 wrote to memory of 1692 2240 jvdjj.exe 39 PID 1692 wrote to memory of 1164 1692 1xllrlr.exe 40 PID 1692 wrote to memory of 1164 1692 1xllrlr.exe 40 PID 1692 wrote to memory of 1164 1692 1xllrlr.exe 40 PID 1692 wrote to memory of 1164 1692 1xllrlr.exe 40 PID 1164 wrote to memory of 2004 1164 9llxllx.exe 41 PID 1164 wrote to memory of 2004 1164 9llxllx.exe 41 PID 1164 wrote to memory of 2004 1164 9llxllx.exe 41 PID 1164 wrote to memory of 2004 1164 9llxllx.exe 41 PID 2004 wrote to memory of 1684 2004 nhbhnn.exe 42 PID 2004 wrote to memory of 1684 2004 nhbhnn.exe 42 PID 2004 wrote to memory of 1684 2004 nhbhnn.exe 42 PID 2004 wrote to memory of 1684 2004 nhbhnn.exe 42 PID 1684 wrote to memory of 1972 1684 pvddj.exe 43 PID 1684 wrote to memory of 1972 1684 pvddj.exe 43 PID 1684 wrote to memory of 1972 1684 pvddj.exe 43 PID 1684 wrote to memory of 1972 1684 pvddj.exe 43 PID 1972 wrote to memory of 2332 1972 vvdpd.exe 44 PID 1972 wrote to memory of 2332 1972 vvdpd.exe 44 PID 1972 wrote to memory of 2332 1972 vvdpd.exe 44 PID 1972 wrote to memory of 2332 1972 vvdpd.exe 44 PID 2332 wrote to memory of 644 2332 7lxffrx.exe 45 PID 2332 wrote to memory of 644 2332 7lxffrx.exe 45 PID 2332 wrote to memory of 644 2332 7lxffrx.exe 45 PID 2332 wrote to memory of 644 2332 7lxffrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\830828fc55b9dd518a221e81d80c08c0N.exe"C:\Users\Admin\AppData\Local\Temp\830828fc55b9dd518a221e81d80c08c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\tnbhtt.exec:\tnbhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\nhnttt.exec:\nhnttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\3rrfrrf.exec:\3rrfrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\xrfrrlr.exec:\xrfrrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\btbhhn.exec:\btbhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\dvdjp.exec:\dvdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\fxrfxxl.exec:\fxrfxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\9hbnbt.exec:\9hbnbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\jvdjj.exec:\jvdjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\1xllrlr.exec:\1xllrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\9llxllx.exec:\9llxllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\nhbhnn.exec:\nhbhnn.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\pvddj.exec:\pvddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\vvdpd.exec:\vvdpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\7lxffrx.exec:\7lxffrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\9tnthh.exec:\9tnthh.exe17⤵
- Executes dropped EXE
PID:644 -
\??\c:\hbtnbb.exec:\hbtnbb.exe18⤵
- Executes dropped EXE
PID:2440 -
\??\c:\pvppv.exec:\pvppv.exe19⤵
- Executes dropped EXE
PID:2264 -
\??\c:\dpjvv.exec:\dpjvv.exe20⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rlxxrxf.exec:\rlxxrxf.exe21⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hbtbnt.exec:\hbtbnt.exe22⤵
- Executes dropped EXE
PID:764 -
\??\c:\7thhhn.exec:\7thhhn.exe23⤵
- Executes dropped EXE
PID:1520 -
\??\c:\ppdjd.exec:\ppdjd.exe24⤵
- Executes dropped EXE
PID:968 -
\??\c:\pjvjp.exec:\pjvjp.exe25⤵
- Executes dropped EXE
PID:340 -
\??\c:\frllrxl.exec:\frllrxl.exe26⤵
- Executes dropped EXE
PID:1960 -
\??\c:\3btnhn.exec:\3btnhn.exe27⤵
- Executes dropped EXE
PID:2992 -
\??\c:\7hthht.exec:\7hthht.exe28⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jjjpv.exec:\jjjpv.exe29⤵
- Executes dropped EXE
PID:2864 -
\??\c:\rrlfrfl.exec:\rrlfrfl.exe30⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ntttnh.exec:\ntttnh.exe31⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pjvpj.exec:\pjvpj.exe32⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lfxlxfx.exec:\lfxlxfx.exe33⤵
- Executes dropped EXE
PID:2700 -
\??\c:\lfrxlrf.exec:\lfrxlrf.exe34⤵
- Executes dropped EXE
PID:2596 -
\??\c:\ttnnhn.exec:\ttnnhn.exe35⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hnnbbt.exec:\hnnbbt.exe36⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pjvpp.exec:\pjvpp.exe37⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rlxxxxl.exec:\rlxxxxl.exe38⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rllrflr.exec:\rllrflr.exe39⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nbbhbb.exec:\nbbhbb.exe40⤵
- Executes dropped EXE
PID:3024 -
\??\c:\3hbtnn.exec:\3hbtnn.exe41⤵
- Executes dropped EXE
PID:2056 -
\??\c:\9dpvv.exec:\9dpvv.exe42⤵
- Executes dropped EXE
PID:524 -
\??\c:\pvjvd.exec:\pvjvd.exe43⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rlrfrrx.exec:\rlrfrrx.exe44⤵
- Executes dropped EXE
PID:2012 -
\??\c:\bbbthn.exec:\bbbthn.exe45⤵
- Executes dropped EXE
PID:2036 -
\??\c:\7hbthn.exec:\7hbthn.exe46⤵
- Executes dropped EXE
PID:1584 -
\??\c:\pdvjp.exec:\pdvjp.exe47⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ddjvj.exec:\ddjvj.exe48⤵
- Executes dropped EXE
PID:2160 -
\??\c:\xrxxlxr.exec:\xrxxlxr.exe49⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rfrlxfl.exec:\rfrlxfl.exe50⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tbbtnh.exec:\tbbtnh.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1284 -
\??\c:\1dppp.exec:\1dppp.exe52⤵
- Executes dropped EXE
PID:1036 -
\??\c:\dpvdp.exec:\dpvdp.exe53⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xrrflrf.exec:\xrrflrf.exe54⤵
- Executes dropped EXE
PID:2528 -
\??\c:\fxlxflr.exec:\fxlxflr.exe55⤵
- Executes dropped EXE
PID:1988 -
\??\c:\thhhbb.exec:\thhhbb.exe56⤵
- Executes dropped EXE
PID:2352 -
\??\c:\3dvjj.exec:\3dvjj.exe57⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vjvdd.exec:\vjvdd.exe58⤵
- Executes dropped EXE
PID:2008 -
\??\c:\5rlrxxx.exec:\5rlrxxx.exe59⤵
- Executes dropped EXE
PID:1620 -
\??\c:\rrrxfrf.exec:\rrrxfrf.exe60⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hbnbtb.exec:\hbnbtb.exe61⤵
- Executes dropped EXE
PID:2996 -
\??\c:\7nbnbn.exec:\7nbnbn.exe62⤵
- Executes dropped EXE
PID:340 -
\??\c:\jjddp.exec:\jjddp.exe63⤵
- Executes dropped EXE
PID:1628 -
\??\c:\9pjvd.exec:\9pjvd.exe64⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xlfllfr.exec:\xlfllfr.exe65⤵
- Executes dropped EXE
PID:2920 -
\??\c:\fxxxrxl.exec:\fxxxrxl.exe66⤵PID:3000
-
\??\c:\1nnhnt.exec:\1nnhnt.exe67⤵PID:2420
-
\??\c:\nbbbnt.exec:\nbbbnt.exe68⤵PID:2212
-
\??\c:\9jjjd.exec:\9jjjd.exe69⤵PID:2576
-
\??\c:\5ddjp.exec:\5ddjp.exe70⤵PID:2776
-
\??\c:\lfrxrxf.exec:\lfrxrxf.exe71⤵PID:2840
-
\??\c:\bnthbb.exec:\bnthbb.exe72⤵PID:2940
-
\??\c:\3htbbb.exec:\3htbbb.exe73⤵PID:2800
-
\??\c:\nbhnbh.exec:\nbhnbh.exe74⤵PID:2916
-
\??\c:\7dpdd.exec:\7dpdd.exe75⤵PID:2680
-
\??\c:\jjdpj.exec:\jjdpj.exe76⤵PID:2772
-
\??\c:\7xlfffr.exec:\7xlfffr.exe77⤵PID:2688
-
\??\c:\lflxrfl.exec:\lflxrfl.exe78⤵PID:2124
-
\??\c:\3thnbt.exec:\3thnbt.exe79⤵PID:2452
-
\??\c:\pdvjj.exec:\pdvjj.exe80⤵PID:2016
-
\??\c:\ppvvd.exec:\ppvvd.exe81⤵PID:1996
-
\??\c:\rrllfrr.exec:\rrllfrr.exe82⤵PID:2256
-
\??\c:\5xxfxff.exec:\5xxfxff.exe83⤵PID:1732
-
\??\c:\1bbnht.exec:\1bbnht.exe84⤵PID:1332
-
\??\c:\hhhnbh.exec:\hhhnbh.exe85⤵PID:1704
-
\??\c:\vvvvp.exec:\vvvvp.exe86⤵PID:1880
-
\??\c:\3rrrlrf.exec:\3rrrlrf.exe87⤵PID:2148
-
\??\c:\ffflxff.exec:\ffflxff.exe88⤵PID:1972
-
\??\c:\rrrrflx.exec:\rrrrflx.exe89⤵PID:2512
-
\??\c:\hhbnbn.exec:\hhbnbn.exe90⤵PID:2288
-
\??\c:\btnthh.exec:\btnthh.exe91⤵PID:1768
-
\??\c:\dddpj.exec:\dddpj.exe92⤵PID:2468
-
\??\c:\3lllrrx.exec:\3lllrrx.exe93⤵PID:2344
-
\??\c:\5lflrfx.exec:\5lflrfx.exe94⤵PID:2340
-
\??\c:\5hbbhn.exec:\5hbbhn.exe95⤵PID:376
-
\??\c:\1bnhtb.exec:\1bnhtb.exe96⤵PID:316
-
\??\c:\3jjdj.exec:\3jjdj.exe97⤵PID:764
-
\??\c:\dvdjv.exec:\dvdjv.exe98⤵PID:956
-
\??\c:\9rlrxxf.exec:\9rlrxxf.exe99⤵PID:968
-
\??\c:\rfflrrr.exec:\rfflrrr.exe100⤵PID:1236
-
\??\c:\bnbbhn.exec:\bnbbhn.exe101⤵PID:328
-
\??\c:\hbnttt.exec:\hbnttt.exe102⤵PID:2536
-
\??\c:\pjvpv.exec:\pjvpv.exe103⤵PID:1920
-
\??\c:\7vvdv.exec:\7vvdv.exe104⤵PID:1940
-
\??\c:\rflfxff.exec:\rflfxff.exe105⤵PID:2976
-
\??\c:\hthnnt.exec:\hthnnt.exe106⤵PID:2480
-
\??\c:\3thntb.exec:\3thntb.exe107⤵PID:2784
-
\??\c:\vppvv.exec:\vppvv.exe108⤵PID:2712
-
\??\c:\jdpjp.exec:\jdpjp.exe109⤵PID:2812
-
\??\c:\vjvdj.exec:\vjvdj.exe110⤵PID:2684
-
\??\c:\rlffrlx.exec:\rlffrlx.exe111⤵PID:2672
-
\??\c:\xrfrxff.exec:\xrfrxff.exe112⤵PID:2768
-
\??\c:\5hhtnt.exec:\5hhtnt.exe113⤵PID:3032
-
\??\c:\dpjpd.exec:\dpjpd.exe114⤵PID:2572
-
\??\c:\3fxllrf.exec:\3fxllrf.exe115⤵PID:2644
-
\??\c:\ffrxflr.exec:\ffrxflr.exe116⤵PID:1344
-
\??\c:\xrrxfrx.exec:\xrrxfrx.exe117⤵PID:2964
-
\??\c:\bnbnnn.exec:\bnbnnn.exe118⤵PID:876
-
\??\c:\vpjpd.exec:\vpjpd.exe119⤵PID:2968
-
\??\c:\jjdpp.exec:\jjdpp.exe120⤵PID:1688
-
\??\c:\xrrxxfl.exec:\xrrxxfl.exe121⤵PID:296
-
\??\c:\xxrfrfl.exec:\xxrfrfl.exe122⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-