Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 23:44
Behavioral task
behavioral1
Sample
91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe
Resource
win7-20240903-en
General
-
Target
91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe
-
Size
126KB
-
MD5
32e21ef7ad24d5c20d6312c1c5b6d771
-
SHA1
c00a42c402dd4c29a5f1b62e85da7959810d847e
-
SHA256
91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11
-
SHA512
16ee05c1d0ace474d918e3ff3249df75ec89e821ef913153d151ddb4c720740cf6a58ec4c2f8e3683422b98abd8c96e0cb1a3dbe255a6d7b1cc8bbb428c08d04
-
SSDEEP
3072:ohOmTsF93UYfwC6GIoutX8KiUcPB77k9YFvjB:ocm4FmowdHoSHqPkYFbB
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2900-24-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2780-15-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2716-8-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2480-32-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2632-54-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2256-70-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2256-67-0x0000000000220000-0x000000000025B000-memory.dmp family_blackmoon behavioral1/memory/2428-98-0x0000000000220000-0x000000000025B000-memory.dmp family_blackmoon behavioral1/memory/1776-109-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2904-128-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2860-156-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/1148-202-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2072-305-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/1480-395-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/476-422-0x0000000000220000-0x000000000025B000-memory.dmp family_blackmoon behavioral1/memory/2068-531-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2728-578-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2548-557-0x0000000000440000-0x000000000047B000-memory.dmp family_blackmoon behavioral1/memory/2104-478-0x00000000002A0000-0x00000000002DB000-memory.dmp family_blackmoon behavioral1/memory/2836-456-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2064-449-0x00000000001B0000-0x00000000001EB000-memory.dmp family_blackmoon behavioral1/memory/2408-430-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/1036-415-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2180-362-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/1652-329-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2480-315-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2780-296-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/684-280-0x00000000002A0000-0x00000000002DB000-memory.dmp family_blackmoon behavioral1/memory/1224-268-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2376-211-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2056-191-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2136-183-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/476-166-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2452-145-0x0000000000270000-0x00000000002AB000-memory.dmp family_blackmoon behavioral1/memory/2928-137-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2904-126-0x0000000000220000-0x000000000025B000-memory.dmp family_blackmoon behavioral1/memory/2940-117-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2200-89-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2680-43-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2480-39-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/1432-692-0x0000000000220000-0x000000000025B000-memory.dmp family_blackmoon behavioral1/memory/1508-697-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/1728-737-0x0000000000440000-0x000000000047B000-memory.dmp family_blackmoon behavioral1/memory/1752-765-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon behavioral1/memory/2532-792-0x0000000000220000-0x000000000025B000-memory.dmp family_blackmoon behavioral1/memory/2852-913-0x0000000000400000-0x000000000043B000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2780 btnthb.exe 2900 lrrflxf.exe 2480 xrflffr.exe 2680 nttbbn.exe 2632 bnhnht.exe 2256 jdpdv.exe 820 rxfrxrr.exe 2200 htnbtt.exe 2428 1jdpd.exe 1776 frlrlxl.exe 2940 lxrfxlx.exe 2904 nbbnnn.exe 2928 9hbtnn.exe 2452 vdjpd.exe 2860 fxrxllr.exe 476 1rxflxx.exe 2132 bnnttt.exe 2136 djvpd.exe 2056 xxrllrl.exe 1148 1xrlffl.exe 2376 hntnhn.exe 2448 3pvjd.exe 2524 5ppdv.exe 904 xrflfrr.exe 1740 fxrfxxf.exe 684 thhtnb.exe 2116 ddjvd.exe 1224 lfxlfrf.exe 2052 rlxlxfr.exe 2812 nthnnh.exe 2780 3thnbn.exe 2072 vvpvp.exe 2480 vjvvv.exe 2844 frfrrfr.exe 1652 bnnthh.exe 2732 btnhhb.exe 2600 pjdjp.exe 2324 vvddj.exe 2588 rfrrllr.exe 2180 llxxxxf.exe 2016 hbhnht.exe 2972 btnbnb.exe 2940 ddvjd.exe 2904 vvpvj.exe 1480 flxfffl.exe 2168 5xrxrrf.exe 988 hbhbnt.exe 1036 9thntn.exe 476 thnnnt.exe 2408 jddjv.exe 1976 jvjpd.exe 2176 fxrxrxl.exe 2064 7rrxrxr.exe 2836 flrxlxx.exe 680 hbhttb.exe 1816 bnbbtb.exe 2104 jdjvp.exe 3000 9pjjd.exe 1088 fffflfr.exe 2032 xrlxlrx.exe 1996 nnttbh.exe 992 7nhtbn.exe 2116 vppdv.exe 444 7jvvj.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2672-0-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2900-24-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0007000000015fa6-22.dat upx behavioral1/files/0x000d00000001277d-2.dat upx behavioral1/memory/2716-1-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2780-15-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2716-8-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2480-32-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x00080000000164de-60.dat upx behavioral1/memory/2632-54-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/820-71-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2256-70-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000016de9-80.dat upx behavioral1/files/0x0008000000016dd9-72.dat upx behavioral1/files/0x0006000000016df8-101.dat upx behavioral1/memory/1776-109-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000016f02-118.dat upx behavioral1/memory/2904-128-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x000600000001707f-129.dat upx behavioral1/files/0x00060000000174f8-147.dat upx behavioral1/files/0x0006000000017570-155.dat upx behavioral1/memory/2860-156-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x00060000000175f7-175.dat upx behavioral1/files/0x0005000000018697-193.dat upx behavioral1/memory/1148-202-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0005000000018745-226.dat upx behavioral1/files/0x0006000000018d7b-243.dat upx behavioral1/files/0x0005000000019237-289.dat upx behavioral1/memory/2072-305-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2844-316-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1480-395-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2408-423-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2068-531-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2728-578-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2836-456-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2408-430-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1036-415-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2180-362-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1652-329-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2480-315-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x000500000001924f-298.dat upx behavioral1/memory/2780-296-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0005000000019203-281.dat upx behavioral1/memory/684-280-0x00000000002A0000-0x00000000002DB000-memory.dmp upx behavioral1/files/0x0006000000019056-272.dat upx behavioral1/memory/1224-268-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000018fdf-261.dat upx behavioral1/files/0x0006000000018d83-253.dat upx behavioral1/files/0x0006000000018be7-236.dat upx behavioral1/files/0x000500000001871c-220.dat upx behavioral1/files/0x000500000001870c-212.dat upx behavioral1/memory/2376-211-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0005000000018706-203.dat upx behavioral1/memory/2056-191-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x000d000000018683-184.dat upx behavioral1/memory/2136-183-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/476-166-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x00060000000175f1-167.dat upx behavioral1/files/0x00060000000174b4-138.dat upx behavioral1/memory/2928-137-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2940-117-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000016edc-110.dat upx behavioral1/memory/1776-100-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x0006000000016df5-91.dat upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Serverx = "C:\\Windows\\system32\\Serverx.exe" 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened (read-only) \??\M: 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened (read-only) \??\N: 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened (read-only) \??\G: 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened (read-only) \??\H: 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened (read-only) \??\P: 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened (read-only) \??\R: 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened (read-only) \??\S: 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened (read-only) \??\T: 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened (read-only) \??\J: 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened (read-only) \??\O: 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened (read-only) \??\E: 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened (read-only) \??\Q: 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened (read-only) \??\K: 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened (read-only) \??\L: 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Serverx.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Windows\SysWOW64\Serverx.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2716 2672 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe 31 PID 2672 wrote to memory of 2716 2672 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe 31 PID 2672 wrote to memory of 2716 2672 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe 31 PID 2672 wrote to memory of 2716 2672 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe 31 PID 2716 wrote to memory of 2780 2716 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe 62 PID 2716 wrote to memory of 2780 2716 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe 62 PID 2716 wrote to memory of 2780 2716 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe 62 PID 2716 wrote to memory of 2780 2716 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe 62 PID 2672 wrote to memory of 1200 2672 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe 21 PID 2672 wrote to memory of 1200 2672 91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe 21 PID 2780 wrote to memory of 2900 2780 btnthb.exe 33 PID 2780 wrote to memory of 2900 2780 btnthb.exe 33 PID 2780 wrote to memory of 2900 2780 btnthb.exe 33 PID 2780 wrote to memory of 2900 2780 btnthb.exe 33 PID 2900 wrote to memory of 2480 2900 lrrflxf.exe 64 PID 2900 wrote to memory of 2480 2900 lrrflxf.exe 64 PID 2900 wrote to memory of 2480 2900 lrrflxf.exe 64 PID 2900 wrote to memory of 2480 2900 lrrflxf.exe 64 PID 2480 wrote to memory of 2680 2480 xrflffr.exe 35 PID 2480 wrote to memory of 2680 2480 xrflffr.exe 35 PID 2480 wrote to memory of 2680 2480 xrflffr.exe 35 PID 2480 wrote to memory of 2680 2480 xrflffr.exe 35 PID 2680 wrote to memory of 2632 2680 nttbbn.exe 36 PID 2680 wrote to memory of 2632 2680 nttbbn.exe 36 PID 2680 wrote to memory of 2632 2680 nttbbn.exe 36 PID 2680 wrote to memory of 2632 2680 nttbbn.exe 36 PID 2632 wrote to memory of 2256 2632 bnhnht.exe 37 PID 2632 wrote to memory of 2256 2632 bnhnht.exe 37 PID 2632 wrote to memory of 2256 2632 bnhnht.exe 37 PID 2632 wrote to memory of 2256 2632 bnhnht.exe 37 PID 2256 wrote to memory of 820 2256 jdpdv.exe 38 PID 2256 wrote to memory of 820 2256 jdpdv.exe 38 PID 2256 wrote to memory of 820 2256 jdpdv.exe 38 PID 2256 wrote to memory of 820 2256 jdpdv.exe 38 PID 820 wrote to memory of 2200 820 rxfrxrr.exe 39 PID 820 wrote to memory of 2200 820 rxfrxrr.exe 39 PID 820 wrote to memory of 2200 820 rxfrxrr.exe 39 PID 820 wrote to memory of 2200 820 rxfrxrr.exe 39 PID 2200 wrote to memory of 2428 2200 htnbtt.exe 40 PID 2200 wrote to memory of 2428 2200 htnbtt.exe 40 PID 2200 wrote to memory of 2428 2200 htnbtt.exe 40 PID 2200 wrote to memory of 2428 2200 htnbtt.exe 40 PID 2428 wrote to memory of 1776 2428 1jdpd.exe 41 PID 2428 wrote to memory of 1776 2428 1jdpd.exe 41 PID 2428 wrote to memory of 1776 2428 1jdpd.exe 41 PID 2428 wrote to memory of 1776 2428 1jdpd.exe 41 PID 1776 wrote to memory of 2940 1776 frlrlxl.exe 42 PID 1776 wrote to memory of 2940 1776 frlrlxl.exe 42 PID 1776 wrote to memory of 2940 1776 frlrlxl.exe 42 PID 1776 wrote to memory of 2940 1776 frlrlxl.exe 42 PID 2940 wrote to memory of 2904 2940 lxrfxlx.exe 43 PID 2940 wrote to memory of 2904 2940 lxrfxlx.exe 43 PID 2940 wrote to memory of 2904 2940 lxrfxlx.exe 43 PID 2940 wrote to memory of 2904 2940 lxrfxlx.exe 43 PID 2904 wrote to memory of 2928 2904 nbbnnn.exe 44 PID 2904 wrote to memory of 2928 2904 nbbnnn.exe 44 PID 2904 wrote to memory of 2928 2904 nbbnnn.exe 44 PID 2904 wrote to memory of 2928 2904 nbbnnn.exe 44 PID 2928 wrote to memory of 2452 2928 9hbtnn.exe 45 PID 2928 wrote to memory of 2452 2928 9hbtnn.exe 45 PID 2928 wrote to memory of 2452 2928 9hbtnn.exe 45 PID 2928 wrote to memory of 2452 2928 9hbtnn.exe 45 PID 2452 wrote to memory of 2860 2452 vdjpd.exe 46 PID 2452 wrote to memory of 2860 2452 vdjpd.exe 46
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe"C:\Users\Admin\AppData\Local\Temp\91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe"2⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe"C:\Users\Admin\AppData\Local\Temp\91dbf9e6fa04c54fb811b4980414c15fd5727b9b055a844cf8e4f3d6cd7b5e11.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\btnthb.exec:\btnthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\lrrflxf.exec:\lrrflxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\xrflffr.exec:\xrflffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\nttbbn.exec:\nttbbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\bnhnht.exec:\bnhnht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\jdpdv.exec:\jdpdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\rxfrxrr.exec:\rxfrxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\htnbtt.exec:\htnbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\1jdpd.exec:\1jdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\frlrlxl.exec:\frlrlxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\lxrfxlx.exec:\lxrfxlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\nbbnnn.exec:\nbbnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\9hbtnn.exec:\9hbtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\vdjpd.exec:\vdjpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\fxrxllr.exec:\fxrxllr.exe18⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1rxflxx.exec:\1rxflxx.exe19⤵
- Executes dropped EXE
PID:476 -
\??\c:\bnnttt.exec:\bnnttt.exe20⤵
- Executes dropped EXE
PID:2132 -
\??\c:\djvpd.exec:\djvpd.exe21⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xxrllrl.exec:\xxrllrl.exe22⤵
- Executes dropped EXE
PID:2056 -
\??\c:\1xrlffl.exec:\1xrlffl.exe23⤵
- Executes dropped EXE
PID:1148 -
\??\c:\hntnhn.exec:\hntnhn.exe24⤵
- Executes dropped EXE
PID:2376 -
\??\c:\3pvjd.exec:\3pvjd.exe25⤵
- Executes dropped EXE
PID:2448 -
\??\c:\5ppdv.exec:\5ppdv.exe26⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xrflfrr.exec:\xrflfrr.exe27⤵
- Executes dropped EXE
PID:904 -
\??\c:\fxrfxxf.exec:\fxrfxxf.exe28⤵
- Executes dropped EXE
PID:1740 -
\??\c:\thhtnb.exec:\thhtnb.exe29⤵
- Executes dropped EXE
PID:684 -
\??\c:\ddjvd.exec:\ddjvd.exe30⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lfxlfrf.exec:\lfxlfrf.exe31⤵
- Executes dropped EXE
PID:1224 -
\??\c:\rlxlxfr.exec:\rlxlxfr.exe32⤵
- Executes dropped EXE
PID:2052 -
\??\c:\nthnnh.exec:\nthnnh.exe33⤵
- Executes dropped EXE
PID:2812 -
\??\c:\3thnbn.exec:\3thnbn.exe34⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vvpvp.exec:\vvpvp.exe35⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vjvvv.exec:\vjvvv.exe36⤵
- Executes dropped EXE
PID:2480 -
\??\c:\frfrrfr.exec:\frfrrfr.exe37⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bnnthh.exec:\bnnthh.exe38⤵
- Executes dropped EXE
PID:1652 -
\??\c:\btnhhb.exec:\btnhhb.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\pjdjp.exec:\pjdjp.exe40⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vvddj.exec:\vvddj.exe41⤵
- Executes dropped EXE
PID:2324 -
\??\c:\rfrrllr.exec:\rfrrllr.exe42⤵
- Executes dropped EXE
PID:2588 -
\??\c:\llxxxxf.exec:\llxxxxf.exe43⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hbhnht.exec:\hbhnht.exe44⤵
- Executes dropped EXE
PID:2016 -
\??\c:\btnbnb.exec:\btnbnb.exe45⤵
- Executes dropped EXE
PID:2972 -
\??\c:\ddvjd.exec:\ddvjd.exe46⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vvpvj.exec:\vvpvj.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\flxfffl.exec:\flxfffl.exe48⤵
- Executes dropped EXE
PID:1480 -
\??\c:\5xrxrrf.exec:\5xrxrrf.exe49⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hbhbnt.exec:\hbhbnt.exe50⤵
- Executes dropped EXE
PID:988 -
\??\c:\9thntn.exec:\9thntn.exe51⤵
- Executes dropped EXE
PID:1036 -
\??\c:\thnnnt.exec:\thnnnt.exe52⤵
- Executes dropped EXE
PID:476 -
\??\c:\jddjv.exec:\jddjv.exe53⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jvjpd.exec:\jvjpd.exe54⤵
- Executes dropped EXE
PID:1976 -
\??\c:\fxrxrxl.exec:\fxrxrxl.exe55⤵
- Executes dropped EXE
PID:2176 -
\??\c:\7rrxrxr.exec:\7rrxrxr.exe56⤵
- Executes dropped EXE
PID:2064 -
\??\c:\flrxlxx.exec:\flrxlxx.exe57⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hbhttb.exec:\hbhttb.exe58⤵
- Executes dropped EXE
PID:680 -
\??\c:\bnbbtb.exec:\bnbbtb.exe59⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jdjvp.exec:\jdjvp.exe60⤵
- Executes dropped EXE
PID:2104 -
\??\c:\9pjjd.exec:\9pjjd.exe61⤵
- Executes dropped EXE
PID:3000 -
\??\c:\fffflfr.exec:\fffflfr.exe62⤵
- Executes dropped EXE
PID:1088 -
\??\c:\xrlxlrx.exec:\xrlxlrx.exe63⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nnttbh.exec:\nnttbh.exe64⤵
- Executes dropped EXE
PID:1996 -
\??\c:\7nhtbn.exec:\7nhtbn.exe65⤵
- Executes dropped EXE
PID:992 -
\??\c:\vppdv.exec:\vppdv.exe66⤵
- Executes dropped EXE
PID:2116 -
\??\c:\7jvvj.exec:\7jvvj.exe67⤵
- Executes dropped EXE
PID:444 -
\??\c:\pdvdp.exec:\pdvdp.exe68⤵PID:2068
-
\??\c:\5rflxlx.exec:\5rflxlx.exe69⤵PID:2052
-
\??\c:\xrlrrrf.exec:\xrlrrrf.exe70⤵PID:2812
-
\??\c:\nththh.exec:\nththh.exe71⤵PID:2244
-
\??\c:\5nhtth.exec:\5nhtth.exe72⤵PID:2548
-
\??\c:\1dvpp.exec:\1dvpp.exe73⤵PID:2004
-
\??\c:\jdvpp.exec:\jdvpp.exe74⤵PID:2768
-
\??\c:\3rlrfff.exec:\3rlrfff.exe75⤵PID:2728
-
\??\c:\frrxxfl.exec:\frrxxfl.exe76⤵PID:2604
-
\??\c:\tnhnhb.exec:\tnhnhb.exe77⤵PID:1812
-
\??\c:\ttnhbh.exec:\ttnhbh.exe78⤵PID:2620
-
\??\c:\jdvdv.exec:\jdvdv.exe79⤵PID:1560
-
\??\c:\jvvjj.exec:\jvvjj.exe80⤵PID:2224
-
\??\c:\rfxxrfl.exec:\rfxxrfl.exe81⤵PID:2988
-
\??\c:\fxfrlxr.exec:\fxfrlxr.exe82⤵PID:2180
-
\??\c:\3nbbtn.exec:\3nbbtn.exe83⤵PID:3040
-
\??\c:\9httbn.exec:\9httbn.exe84⤵PID:544
-
\??\c:\7ppvd.exec:\7ppvd.exe85⤵PID:3004
-
\??\c:\9jjdp.exec:\9jjdp.exe86⤵PID:3036
-
\??\c:\lxrffff.exec:\lxrffff.exe87⤵PID:1980
-
\??\c:\fffrxrx.exec:\fffrxrx.exe88⤵PID:2008
-
\??\c:\lfrlrfr.exec:\lfrlrfr.exe89⤵PID:2860
-
\??\c:\hbhbth.exec:\hbhbth.exe90⤵PID:2000
-
\??\c:\nbtnnn.exec:\nbtnnn.exe91⤵PID:2344
-
\??\c:\vjdjv.exec:\vjdjv.exe92⤵PID:332
-
\??\c:\5xfxxll.exec:\5xfxxll.exe93⤵PID:1432
-
\??\c:\5rfrxfx.exec:\5rfrxfx.exe94⤵PID:1508
-
\??\c:\tttbhn.exec:\tttbhn.exe95⤵PID:2432
-
\??\c:\7nhtnb.exec:\7nhtnb.exe96⤵PID:952
-
\??\c:\jdpvv.exec:\jdpvv.exe97⤵PID:1848
-
\??\c:\rfxfxll.exec:\rfxfxll.exe98⤵PID:1808
-
\??\c:\bbbhbn.exec:\bbbhbn.exe99⤵PID:1728
-
\??\c:\jdjpd.exec:\jdjpd.exe100⤵PID:1540
-
\??\c:\7xfllxr.exec:\7xfllxr.exe101⤵PID:2464
-
\??\c:\bntbtt.exec:\bntbtt.exe102⤵PID:1140
-
\??\c:\pjvjp.exec:\pjvjp.exe103⤵PID:1752
-
\??\c:\bnhhtb.exec:\bnhhtb.exe104⤵PID:3064
-
\??\c:\vpdjp.exec:\vpdjp.exe105⤵PID:1880
-
\??\c:\pjjpv.exec:\pjjpv.exe106⤵PID:1232
-
\??\c:\5xfflll.exec:\5xfflll.exe107⤵PID:2532
-
\??\c:\nbtbnt.exec:\nbtbnt.exe108⤵PID:612
-
\??\c:\vjvpj.exec:\vjvpj.exe109⤵PID:2760
-
\??\c:\fxrlrxr.exec:\fxrlrxr.exe110⤵PID:2876
-
\??\c:\btbbnh.exec:\btbbnh.exe111⤵PID:2208
-
\??\c:\9jvdd.exec:\9jvdd.exe112⤵PID:1612
-
\??\c:\vpvpv.exec:\vpvpv.exe113⤵PID:2844
-
\??\c:\thnthh.exec:\thnthh.exe114⤵PID:2748
-
\??\c:\jpjdj.exec:\jpjdj.exe115⤵PID:1108
-
\??\c:\vjpvj.exec:\vjpvj.exe116⤵PID:2692
-
\??\c:\9xxfxlf.exec:\9xxfxlf.exe117⤵PID:2640
-
\??\c:\nbhnhn.exec:\nbhnhn.exe118⤵PID:2324
-
\??\c:\dpvvp.exec:\dpvvp.exe119⤵PID:2700
-
\??\c:\rfrrlfl.exec:\rfrrlfl.exe120⤵PID:2912
-
\??\c:\llfrlrf.exec:\llfrlrf.exe121⤵PID:2948
-
\??\c:\thbnhb.exec:\thbnhb.exe122⤵PID:2688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-