Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 23:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
89f81ca5f384095efec8ff147497940c4e6c85d63773cdd93ddfe454143aa01e.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
89f81ca5f384095efec8ff147497940c4e6c85d63773cdd93ddfe454143aa01e.exe
-
Size
106KB
-
MD5
a9fef259bf6707af4556a971f49da838
-
SHA1
7110f28c7165719be22c121d2ea4f36b7bcf381c
-
SHA256
89f81ca5f384095efec8ff147497940c4e6c85d63773cdd93ddfe454143aa01e
-
SHA512
a1614ee069888f31906a49bce89253cfe0de00278062b9f9432db8ce0ad0c5507234b8c066320b80e41163559c989077d2094f0ba17f36aa082d85e78475e0f6
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3CAj:n3C9BRo7MlrWKVT+buBGu3PX
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2508-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1352-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2368 1dppv.exe 2120 5bbhth.exe 2056 pjppv.exe 2712 rfrrrlr.exe 2908 bnnhbt.exe 2860 htntbb.exe 2148 5pdjv.exe 2732 ffxfxlf.exe 2612 ttbhtn.exe 2292 9bhhhn.exe 1636 pjppp.exe 484 ddppd.exe 1352 rfllrfr.exe 2272 nhnbhh.exe 332 5dvvv.exe 1268 5pddj.exe 1756 1lllrxx.exe 376 lrlrllr.exe 2192 3nbhhb.exe 2268 dvjvj.exe 1592 ddjdd.exe 1208 7xllxrl.exe 844 hthnbn.exe 1620 tbbntn.exe 1700 vjpjj.exe 2304 lxllfff.exe 2932 frxfxrr.exe 792 hnttnh.exe 1500 5bntbh.exe 2060 9vjdj.exe 1720 xxxxrlx.exe 2240 rlxfrrl.exe 2484 btbttt.exe 2748 5ntttt.exe 2716 9tbhhb.exe 2092 5pvjd.exe 2720 ddvdd.exe 2700 3fxrxrr.exe 2220 9lrrrlr.exe 2860 5hnnnn.exe 1708 bnbbbh.exe 2592 vjpjj.exe 2732 jpppp.exe 2980 7rllxll.exe 1972 rfrfxlf.exe 1560 hbbttb.exe 1728 pjpjd.exe 356 jdpjj.exe 1308 rfrrlfx.exe 1248 lfrxlrf.exe 380 btnntb.exe 1160 9nbnbt.exe 1268 dppvj.exe 1756 vpddd.exe 2164 frffrrx.exe 2392 1nbbhb.exe 2376 bnbbhn.exe 2248 7tbhnh.exe 1588 vpdpv.exe 664 vpvvp.exe 1336 llxxllx.exe 1508 xrlxrxr.exe 1692 3lxxxfr.exe 2304 7thhtn.exe -
resource yara_rule behavioral1/memory/2508-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-265-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2368 2508 89f81ca5f384095efec8ff147497940c4e6c85d63773cdd93ddfe454143aa01e.exe 30 PID 2508 wrote to memory of 2368 2508 89f81ca5f384095efec8ff147497940c4e6c85d63773cdd93ddfe454143aa01e.exe 30 PID 2508 wrote to memory of 2368 2508 89f81ca5f384095efec8ff147497940c4e6c85d63773cdd93ddfe454143aa01e.exe 30 PID 2508 wrote to memory of 2368 2508 89f81ca5f384095efec8ff147497940c4e6c85d63773cdd93ddfe454143aa01e.exe 30 PID 2368 wrote to memory of 2120 2368 1dppv.exe 31 PID 2368 wrote to memory of 2120 2368 1dppv.exe 31 PID 2368 wrote to memory of 2120 2368 1dppv.exe 31 PID 2368 wrote to memory of 2120 2368 1dppv.exe 31 PID 2120 wrote to memory of 2056 2120 5bbhth.exe 32 PID 2120 wrote to memory of 2056 2120 5bbhth.exe 32 PID 2120 wrote to memory of 2056 2120 5bbhth.exe 32 PID 2120 wrote to memory of 2056 2120 5bbhth.exe 32 PID 2056 wrote to memory of 2712 2056 pjppv.exe 33 PID 2056 wrote to memory of 2712 2056 pjppv.exe 33 PID 2056 wrote to memory of 2712 2056 pjppv.exe 33 PID 2056 wrote to memory of 2712 2056 pjppv.exe 33 PID 2712 wrote to memory of 2908 2712 rfrrrlr.exe 34 PID 2712 wrote to memory of 2908 2712 rfrrrlr.exe 34 PID 2712 wrote to memory of 2908 2712 rfrrrlr.exe 34 PID 2712 wrote to memory of 2908 2712 rfrrrlr.exe 34 PID 2908 wrote to memory of 2860 2908 bnnhbt.exe 35 PID 2908 wrote to memory of 2860 2908 bnnhbt.exe 35 PID 2908 wrote to memory of 2860 2908 bnnhbt.exe 35 PID 2908 wrote to memory of 2860 2908 bnnhbt.exe 35 PID 2860 wrote to memory of 2148 2860 htntbb.exe 36 PID 2860 wrote to memory of 2148 2860 htntbb.exe 36 PID 2860 wrote to memory of 2148 2860 htntbb.exe 36 PID 2860 wrote to memory of 2148 2860 htntbb.exe 36 PID 2148 wrote to memory of 2732 2148 5pdjv.exe 37 PID 2148 wrote to memory of 2732 2148 5pdjv.exe 37 PID 2148 wrote to memory of 2732 2148 5pdjv.exe 37 PID 2148 wrote to memory of 2732 2148 5pdjv.exe 37 PID 2732 wrote to memory of 2612 2732 ffxfxlf.exe 38 PID 2732 wrote to memory of 2612 2732 ffxfxlf.exe 38 PID 2732 wrote to memory of 2612 2732 ffxfxlf.exe 38 PID 2732 wrote to memory of 2612 2732 ffxfxlf.exe 38 PID 2612 wrote to memory of 2292 2612 ttbhtn.exe 39 PID 2612 wrote to memory of 2292 2612 ttbhtn.exe 39 PID 2612 wrote to memory of 2292 2612 ttbhtn.exe 39 PID 2612 wrote to memory of 2292 2612 ttbhtn.exe 39 PID 2292 wrote to memory of 1636 2292 9bhhhn.exe 40 PID 2292 wrote to memory of 1636 2292 9bhhhn.exe 40 PID 2292 wrote to memory of 1636 2292 9bhhhn.exe 40 PID 2292 wrote to memory of 1636 2292 9bhhhn.exe 40 PID 1636 wrote to memory of 484 1636 pjppp.exe 41 PID 1636 wrote to memory of 484 1636 pjppp.exe 41 PID 1636 wrote to memory of 484 1636 pjppp.exe 41 PID 1636 wrote to memory of 484 1636 pjppp.exe 41 PID 484 wrote to memory of 1352 484 ddppd.exe 42 PID 484 wrote to memory of 1352 484 ddppd.exe 42 PID 484 wrote to memory of 1352 484 ddppd.exe 42 PID 484 wrote to memory of 1352 484 ddppd.exe 42 PID 1352 wrote to memory of 2272 1352 rfllrfr.exe 43 PID 1352 wrote to memory of 2272 1352 rfllrfr.exe 43 PID 1352 wrote to memory of 2272 1352 rfllrfr.exe 43 PID 1352 wrote to memory of 2272 1352 rfllrfr.exe 43 PID 2272 wrote to memory of 332 2272 nhnbhh.exe 44 PID 2272 wrote to memory of 332 2272 nhnbhh.exe 44 PID 2272 wrote to memory of 332 2272 nhnbhh.exe 44 PID 2272 wrote to memory of 332 2272 nhnbhh.exe 44 PID 332 wrote to memory of 1268 332 5dvvv.exe 45 PID 332 wrote to memory of 1268 332 5dvvv.exe 45 PID 332 wrote to memory of 1268 332 5dvvv.exe 45 PID 332 wrote to memory of 1268 332 5dvvv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\89f81ca5f384095efec8ff147497940c4e6c85d63773cdd93ddfe454143aa01e.exe"C:\Users\Admin\AppData\Local\Temp\89f81ca5f384095efec8ff147497940c4e6c85d63773cdd93ddfe454143aa01e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\1dppv.exec:\1dppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\5bbhth.exec:\5bbhth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\pjppv.exec:\pjppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\rfrrrlr.exec:\rfrrrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\bnnhbt.exec:\bnnhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\htntbb.exec:\htntbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\5pdjv.exec:\5pdjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\ffxfxlf.exec:\ffxfxlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\ttbhtn.exec:\ttbhtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\9bhhhn.exec:\9bhhhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\pjppp.exec:\pjppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\ddppd.exec:\ddppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\rfllrfr.exec:\rfllrfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\nhnbhh.exec:\nhnbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\5dvvv.exec:\5dvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\5pddj.exec:\5pddj.exe17⤵
- Executes dropped EXE
PID:1268 -
\??\c:\1lllrxx.exec:\1lllrxx.exe18⤵
- Executes dropped EXE
PID:1756 -
\??\c:\lrlrllr.exec:\lrlrllr.exe19⤵
- Executes dropped EXE
PID:376 -
\??\c:\3nbhhb.exec:\3nbhhb.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\dvjvj.exec:\dvjvj.exe21⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ddjdd.exec:\ddjdd.exe22⤵
- Executes dropped EXE
PID:1592 -
\??\c:\7xllxrl.exec:\7xllxrl.exe23⤵
- Executes dropped EXE
PID:1208 -
\??\c:\hthnbn.exec:\hthnbn.exe24⤵
- Executes dropped EXE
PID:844 -
\??\c:\tbbntn.exec:\tbbntn.exe25⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vjpjj.exec:\vjpjj.exe26⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lxllfff.exec:\lxllfff.exe27⤵
- Executes dropped EXE
PID:2304 -
\??\c:\frxfxrr.exec:\frxfxrr.exe28⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hnttnh.exec:\hnttnh.exe29⤵
- Executes dropped EXE
PID:792 -
\??\c:\5bntbh.exec:\5bntbh.exe30⤵
- Executes dropped EXE
PID:1500 -
\??\c:\9vjdj.exec:\9vjdj.exe31⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xxxxrlx.exec:\xxxxrlx.exe32⤵
- Executes dropped EXE
PID:1720 -
\??\c:\rlxfrrl.exec:\rlxfrrl.exe33⤵
- Executes dropped EXE
PID:2240 -
\??\c:\btbttt.exec:\btbttt.exe34⤵
- Executes dropped EXE
PID:2484 -
\??\c:\5ntttt.exec:\5ntttt.exe35⤵
- Executes dropped EXE
PID:2748 -
\??\c:\9tbhhb.exec:\9tbhhb.exe36⤵
- Executes dropped EXE
PID:2716 -
\??\c:\5pvjd.exec:\5pvjd.exe37⤵
- Executes dropped EXE
PID:2092 -
\??\c:\ddvdd.exec:\ddvdd.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3fxrxrr.exec:\3fxrxrr.exe39⤵
- Executes dropped EXE
PID:2700 -
\??\c:\9lrrrlr.exec:\9lrrrlr.exe40⤵
- Executes dropped EXE
PID:2220 -
\??\c:\5hnnnn.exec:\5hnnnn.exe41⤵
- Executes dropped EXE
PID:2860 -
\??\c:\bnbbbh.exec:\bnbbbh.exe42⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vjpjj.exec:\vjpjj.exe43⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jpppp.exec:\jpppp.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\7rllxll.exec:\7rllxll.exe45⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rfrfxlf.exec:\rfrfxlf.exe46⤵
- Executes dropped EXE
PID:1972 -
\??\c:\hbbttb.exec:\hbbttb.exe47⤵
- Executes dropped EXE
PID:1560 -
\??\c:\pjpjd.exec:\pjpjd.exe48⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jdpjj.exec:\jdpjj.exe49⤵
- Executes dropped EXE
PID:356 -
\??\c:\rfrrlfx.exec:\rfrrlfx.exe50⤵
- Executes dropped EXE
PID:1308 -
\??\c:\lfrxlrf.exec:\lfrxlrf.exe51⤵
- Executes dropped EXE
PID:1248 -
\??\c:\btnntb.exec:\btnntb.exe52⤵
- Executes dropped EXE
PID:380 -
\??\c:\9nbnbt.exec:\9nbnbt.exe53⤵
- Executes dropped EXE
PID:1160 -
\??\c:\dppvj.exec:\dppvj.exe54⤵
- Executes dropped EXE
PID:1268 -
\??\c:\vpddd.exec:\vpddd.exe55⤵
- Executes dropped EXE
PID:1756 -
\??\c:\frffrrx.exec:\frffrrx.exe56⤵
- Executes dropped EXE
PID:2164 -
\??\c:\1nbbhb.exec:\1nbbhb.exe57⤵
- Executes dropped EXE
PID:2392 -
\??\c:\bnbbhn.exec:\bnbbhn.exe58⤵
- Executes dropped EXE
PID:2376 -
\??\c:\7tbhnh.exec:\7tbhnh.exe59⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vpdpv.exec:\vpdpv.exe60⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vpvvp.exec:\vpvvp.exe61⤵
- Executes dropped EXE
PID:664 -
\??\c:\llxxllx.exec:\llxxllx.exe62⤵
- Executes dropped EXE
PID:1336 -
\??\c:\xrlxrxr.exec:\xrlxrxr.exe63⤵
- Executes dropped EXE
PID:1508 -
\??\c:\3lxxxfr.exec:\3lxxxfr.exe64⤵
- Executes dropped EXE
PID:1692 -
\??\c:\7thhtn.exec:\7thhtn.exe65⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rrflxrx.exec:\rrflxrx.exe66⤵PID:2964
-
\??\c:\lfrfrlr.exec:\lfrfrlr.exe67⤵PID:3048
-
\??\c:\fxlrrlx.exec:\fxlrrlx.exe68⤵PID:612
-
\??\c:\nhhhnn.exec:\nhhhnn.exe69⤵PID:2352
-
\??\c:\hbnntt.exec:\hbnntt.exe70⤵PID:2496
-
\??\c:\vpddd.exec:\vpddd.exe71⤵PID:2060
-
\??\c:\vvppp.exec:\vvppp.exe72⤵PID:2072
-
\??\c:\frxxxrx.exec:\frxxxrx.exe73⤵PID:2492
-
\??\c:\rrrxrff.exec:\rrrxrff.exe74⤵PID:1624
-
\??\c:\9ffffxf.exec:\9ffffxf.exe75⤵PID:2988
-
\??\c:\hbttbb.exec:\hbttbb.exe76⤵PID:2764
-
\??\c:\1tnbhh.exec:\1tnbhh.exe77⤵PID:2776
-
\??\c:\vjvpp.exec:\vjvpp.exe78⤵PID:2676
-
\??\c:\pdvdv.exec:\pdvdv.exe79⤵PID:2904
-
\??\c:\lfrffxl.exec:\lfrffxl.exe80⤵PID:2728
-
\??\c:\9xxrllr.exec:\9xxrllr.exe81⤵PID:3020
-
\??\c:\hbhhnn.exec:\hbhhnn.exe82⤵PID:2624
-
\??\c:\bttttt.exec:\bttttt.exe83⤵PID:2588
-
\??\c:\jvpdj.exec:\jvpdj.exe84⤵PID:2984
-
\??\c:\jdppd.exec:\jdppd.exe85⤵PID:1532
-
\??\c:\9xflrrf.exec:\9xflrrf.exe86⤵PID:1180
-
\??\c:\7xlrrxf.exec:\7xlrrxf.exe87⤵PID:1636
-
\??\c:\fxxfrrx.exec:\fxxfrrx.exe88⤵PID:1900
-
\??\c:\tnhhnn.exec:\tnhhnn.exe89⤵PID:2000
-
\??\c:\hbnntt.exec:\hbnntt.exe90⤵PID:2476
-
\??\c:\vppvv.exec:\vppvv.exe91⤵PID:2272
-
\??\c:\vjddj.exec:\vjddj.exe92⤵PID:332
-
\??\c:\lfxxllx.exec:\lfxxllx.exe93⤵PID:1780
-
\??\c:\ffrxllr.exec:\ffrxllr.exe94⤵PID:2880
-
\??\c:\frffflr.exec:\frffflr.exe95⤵PID:1776
-
\??\c:\btbbhb.exec:\btbbhb.exe96⤵PID:956
-
\??\c:\hthnbb.exec:\hthnbb.exe97⤵PID:2960
-
\??\c:\dvddv.exec:\dvddv.exe98⤵PID:2784
-
\??\c:\1dpvp.exec:\1dpvp.exe99⤵
- System Location Discovery: System Language Discovery
PID:1132 -
\??\c:\rlrxllx.exec:\rlrxllx.exe100⤵PID:528
-
\??\c:\frflfrl.exec:\frflfrl.exe101⤵PID:912
-
\??\c:\nbntbh.exec:\nbntbh.exe102⤵PID:1640
-
\??\c:\9nntbb.exec:\9nntbb.exe103⤵PID:1620
-
\??\c:\vjvdv.exec:\vjvdv.exe104⤵PID:1584
-
\??\c:\jvjdp.exec:\jvjdp.exe105⤵PID:2952
-
\??\c:\1jddj.exec:\1jddj.exe106⤵PID:996
-
\??\c:\3fxrrxf.exec:\3fxrrxf.exe107⤵PID:552
-
\??\c:\llxflrx.exec:\llxflrx.exe108⤵PID:792
-
\??\c:\bnnnnb.exec:\bnnnnb.exe109⤵PID:2520
-
\??\c:\hthntn.exec:\hthntn.exe110⤵PID:2516
-
\??\c:\jdjjj.exec:\jdjjj.exe111⤵PID:1800
-
\??\c:\pjdvd.exec:\pjdvd.exe112⤵PID:2388
-
\??\c:\9rxrlrx.exec:\9rxrlrx.exe113⤵PID:1812
-
\??\c:\xlrllfl.exec:\xlrllfl.exe114⤵PID:2536
-
\??\c:\9hbtbb.exec:\9hbtbb.exe115⤵PID:2748
-
\??\c:\bthhnn.exec:\bthhnn.exe116⤵PID:2172
-
\??\c:\pdpvv.exec:\pdpvv.exe117⤵PID:2284
-
\??\c:\vjpjj.exec:\vjpjj.exe118⤵PID:2908
-
\??\c:\rflffxf.exec:\rflffxf.exe119⤵PID:2848
-
\??\c:\frfxllx.exec:\frfxllx.exe120⤵PID:2816
-
\??\c:\1nbtbb.exec:\1nbtbb.exe121⤵PID:2860
-
\??\c:\thntbb.exec:\thntbb.exe122⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-