Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 00:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a1d101f004cb9f664df7868ce64a2530N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
a1d101f004cb9f664df7868ce64a2530N.exe
-
Size
375KB
-
MD5
a1d101f004cb9f664df7868ce64a2530
-
SHA1
2a835710eee2634b0945c90266da38e091fec3f8
-
SHA256
1d3fa556d01d134b5155cbd1721738d767705828b9986c6a7ed2eec30cdaddfb
-
SHA512
4e964e53dce6d8d2728426533eee987adb083cd183959784cd3f197184d0845b5bb43dda946988d869b493a97271792b2d62601a08dda8de9ee994451a64b3dd
-
SSDEEP
6144:n3C9BRIG0asYFm71mJl3/X8mak5gNv9rC8IwLaYNUvtTxTKMMI:n3C9uYA7i3/stR9HGYyvtTxTKMD
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2468-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/336-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2728 btbhtb.exe 2812 1jddj.exe 2304 bbnhth.exe 2676 3bhbnn.exe 2588 xrxfflx.exe 1556 tnbhtt.exe 2036 lfxxffx.exe 2280 thntbh.exe 532 vpvvp.exe 2072 nbnbbh.exe 2496 vjppd.exe 1868 xlxxfff.exe 2008 ppvdj.exe 712 jjjpv.exe 2888 bthntb.exe 840 dpdjp.exe 2988 rfrxxxf.exe 2248 hbttht.exe 2260 vvpvd.exe 2488 1rxffll.exe 2984 9bbbhh.exe 1088 vvvjp.exe 444 bnhbht.exe 1944 3jpjd.exe 876 bnhbbt.exe 2060 5dvdp.exe 1760 rlflrfl.exe 336 bbnntt.exe 872 pvvjd.exe 2808 rfrrxfx.exe 2868 nnttbh.exe 2864 1bhhhb.exe 2960 7xrlxll.exe 2624 nnnbnb.exe 2088 vvjvv.exe 2584 1vjvp.exe 2640 lfxxffr.exe 1948 3fxfrfx.exe 1876 tnhhnt.exe 3056 ddvvv.exe 2012 1dpdd.exe 2200 ffxxrlx.exe 2440 xxrlxlx.exe 2408 1bbhth.exe 1672 ppppd.exe 2496 7fxxxfx.exe 1712 bntbhn.exe 2576 dvpdd.exe 2656 9lrxflr.exe 712 1hbhnt.exe 2888 vdpvj.exe 1300 3vvpv.exe 1560 lflxfrf.exe 2256 bnbbhh.exe 2248 tnhntt.exe 2260 pjpjj.exe 1016 lflrflr.exe 1480 rrlrxlf.exe 1804 nhhntt.exe 1088 vpppd.exe 1160 dvpdv.exe 552 3fllxxf.exe 1808 tnbbnh.exe 604 1jddd.exe -
resource yara_rule behavioral1/memory/2468-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/336-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2728 2468 a1d101f004cb9f664df7868ce64a2530N.exe 30 PID 2468 wrote to memory of 2728 2468 a1d101f004cb9f664df7868ce64a2530N.exe 30 PID 2468 wrote to memory of 2728 2468 a1d101f004cb9f664df7868ce64a2530N.exe 30 PID 2468 wrote to memory of 2728 2468 a1d101f004cb9f664df7868ce64a2530N.exe 30 PID 2728 wrote to memory of 2812 2728 btbhtb.exe 31 PID 2728 wrote to memory of 2812 2728 btbhtb.exe 31 PID 2728 wrote to memory of 2812 2728 btbhtb.exe 31 PID 2728 wrote to memory of 2812 2728 btbhtb.exe 31 PID 2812 wrote to memory of 2304 2812 1jddj.exe 32 PID 2812 wrote to memory of 2304 2812 1jddj.exe 32 PID 2812 wrote to memory of 2304 2812 1jddj.exe 32 PID 2812 wrote to memory of 2304 2812 1jddj.exe 32 PID 2304 wrote to memory of 2676 2304 bbnhth.exe 33 PID 2304 wrote to memory of 2676 2304 bbnhth.exe 33 PID 2304 wrote to memory of 2676 2304 bbnhth.exe 33 PID 2304 wrote to memory of 2676 2304 bbnhth.exe 33 PID 2676 wrote to memory of 2588 2676 3bhbnn.exe 34 PID 2676 wrote to memory of 2588 2676 3bhbnn.exe 34 PID 2676 wrote to memory of 2588 2676 3bhbnn.exe 34 PID 2676 wrote to memory of 2588 2676 3bhbnn.exe 34 PID 2588 wrote to memory of 1556 2588 xrxfflx.exe 35 PID 2588 wrote to memory of 1556 2588 xrxfflx.exe 35 PID 2588 wrote to memory of 1556 2588 xrxfflx.exe 35 PID 2588 wrote to memory of 1556 2588 xrxfflx.exe 35 PID 1556 wrote to memory of 2036 1556 tnbhtt.exe 36 PID 1556 wrote to memory of 2036 1556 tnbhtt.exe 36 PID 1556 wrote to memory of 2036 1556 tnbhtt.exe 36 PID 1556 wrote to memory of 2036 1556 tnbhtt.exe 36 PID 2036 wrote to memory of 2280 2036 lfxxffx.exe 37 PID 2036 wrote to memory of 2280 2036 lfxxffx.exe 37 PID 2036 wrote to memory of 2280 2036 lfxxffx.exe 37 PID 2036 wrote to memory of 2280 2036 lfxxffx.exe 37 PID 2280 wrote to memory of 532 2280 thntbh.exe 38 PID 2280 wrote to memory of 532 2280 thntbh.exe 38 PID 2280 wrote to memory of 532 2280 thntbh.exe 38 PID 2280 wrote to memory of 532 2280 thntbh.exe 38 PID 532 wrote to memory of 2072 532 vpvvp.exe 39 PID 532 wrote to memory of 2072 532 vpvvp.exe 39 PID 532 wrote to memory of 2072 532 vpvvp.exe 39 PID 532 wrote to memory of 2072 532 vpvvp.exe 39 PID 2072 wrote to memory of 2496 2072 nbnbbh.exe 40 PID 2072 wrote to memory of 2496 2072 nbnbbh.exe 40 PID 2072 wrote to memory of 2496 2072 nbnbbh.exe 40 PID 2072 wrote to memory of 2496 2072 nbnbbh.exe 40 PID 2496 wrote to memory of 1868 2496 vjppd.exe 41 PID 2496 wrote to memory of 1868 2496 vjppd.exe 41 PID 2496 wrote to memory of 1868 2496 vjppd.exe 41 PID 2496 wrote to memory of 1868 2496 vjppd.exe 41 PID 1868 wrote to memory of 2008 1868 xlxxfff.exe 42 PID 1868 wrote to memory of 2008 1868 xlxxfff.exe 42 PID 1868 wrote to memory of 2008 1868 xlxxfff.exe 42 PID 1868 wrote to memory of 2008 1868 xlxxfff.exe 42 PID 2008 wrote to memory of 712 2008 ppvdj.exe 43 PID 2008 wrote to memory of 712 2008 ppvdj.exe 43 PID 2008 wrote to memory of 712 2008 ppvdj.exe 43 PID 2008 wrote to memory of 712 2008 ppvdj.exe 43 PID 712 wrote to memory of 2888 712 jjjpv.exe 44 PID 712 wrote to memory of 2888 712 jjjpv.exe 44 PID 712 wrote to memory of 2888 712 jjjpv.exe 44 PID 712 wrote to memory of 2888 712 jjjpv.exe 44 PID 2888 wrote to memory of 840 2888 bthntb.exe 45 PID 2888 wrote to memory of 840 2888 bthntb.exe 45 PID 2888 wrote to memory of 840 2888 bthntb.exe 45 PID 2888 wrote to memory of 840 2888 bthntb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1d101f004cb9f664df7868ce64a2530N.exe"C:\Users\Admin\AppData\Local\Temp\a1d101f004cb9f664df7868ce64a2530N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\btbhtb.exec:\btbhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\1jddj.exec:\1jddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\bbnhth.exec:\bbnhth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\3bhbnn.exec:\3bhbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xrxfflx.exec:\xrxfflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\tnbhtt.exec:\tnbhtt.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\lfxxffx.exec:\lfxxffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\thntbh.exec:\thntbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\vpvvp.exec:\vpvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\nbnbbh.exec:\nbnbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\vjppd.exec:\vjppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\xlxxfff.exec:\xlxxfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\ppvdj.exec:\ppvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\jjjpv.exec:\jjjpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\bthntb.exec:\bthntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\dpdjp.exec:\dpdjp.exe17⤵
- Executes dropped EXE
PID:840 -
\??\c:\rfrxxxf.exec:\rfrxxxf.exe18⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hbttht.exec:\hbttht.exe19⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vvpvd.exec:\vvpvd.exe20⤵
- Executes dropped EXE
PID:2260 -
\??\c:\1rxffll.exec:\1rxffll.exe21⤵
- Executes dropped EXE
PID:2488 -
\??\c:\9bbbhh.exec:\9bbbhh.exe22⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vvvjp.exec:\vvvjp.exe23⤵
- Executes dropped EXE
PID:1088 -
\??\c:\bnhbht.exec:\bnhbht.exe24⤵
- Executes dropped EXE
PID:444 -
\??\c:\3jpjd.exec:\3jpjd.exe25⤵
- Executes dropped EXE
PID:1944 -
\??\c:\bnhbbt.exec:\bnhbbt.exe26⤵
- Executes dropped EXE
PID:876 -
\??\c:\5dvdp.exec:\5dvdp.exe27⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rlflrfl.exec:\rlflrfl.exe28⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bbnntt.exec:\bbnntt.exe29⤵
- Executes dropped EXE
PID:336 -
\??\c:\pvvjd.exec:\pvvjd.exe30⤵
- Executes dropped EXE
PID:872 -
\??\c:\rfrrxfx.exec:\rfrrxfx.exe31⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nnttbh.exec:\nnttbh.exe32⤵
- Executes dropped EXE
PID:2868 -
\??\c:\1bhhhb.exec:\1bhhhb.exe33⤵
- Executes dropped EXE
PID:2864 -
\??\c:\7xrlxll.exec:\7xrlxll.exe34⤵
- Executes dropped EXE
PID:2960 -
\??\c:\nnnbnb.exec:\nnnbnb.exe35⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vvjvv.exec:\vvjvv.exe36⤵
- Executes dropped EXE
PID:2088 -
\??\c:\1vjvp.exec:\1vjvp.exe37⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lfxxffr.exec:\lfxxffr.exe38⤵
- Executes dropped EXE
PID:2640 -
\??\c:\3fxfrfx.exec:\3fxfrfx.exe39⤵
- Executes dropped EXE
PID:1948 -
\??\c:\tnhhnt.exec:\tnhhnt.exe40⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ddvvv.exec:\ddvvv.exe41⤵
- Executes dropped EXE
PID:3056 -
\??\c:\1dpdd.exec:\1dpdd.exe42⤵
- Executes dropped EXE
PID:2012 -
\??\c:\ffxxrlx.exec:\ffxxrlx.exe43⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xxrlxlx.exec:\xxrlxlx.exe44⤵
- Executes dropped EXE
PID:2440 -
\??\c:\1bbhth.exec:\1bbhth.exe45⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ppppd.exec:\ppppd.exe46⤵
- Executes dropped EXE
PID:1672 -
\??\c:\7fxxxfx.exec:\7fxxxfx.exe47⤵
- Executes dropped EXE
PID:2496 -
\??\c:\bntbhn.exec:\bntbhn.exe48⤵
- Executes dropped EXE
PID:1712 -
\??\c:\dvpdd.exec:\dvpdd.exe49⤵
- Executes dropped EXE
PID:2576 -
\??\c:\9lrxflr.exec:\9lrxflr.exe50⤵
- Executes dropped EXE
PID:2656 -
\??\c:\1hbhnt.exec:\1hbhnt.exe51⤵
- Executes dropped EXE
PID:712 -
\??\c:\vdpvj.exec:\vdpvj.exe52⤵
- Executes dropped EXE
PID:2888 -
\??\c:\3vvpv.exec:\3vvpv.exe53⤵
- Executes dropped EXE
PID:1300 -
\??\c:\lflxfrf.exec:\lflxfrf.exe54⤵
- Executes dropped EXE
PID:1560 -
\??\c:\bnbbhh.exec:\bnbbhh.exe55⤵
- Executes dropped EXE
PID:2256 -
\??\c:\tnhntt.exec:\tnhntt.exe56⤵
- Executes dropped EXE
PID:2248 -
\??\c:\pjpjj.exec:\pjpjj.exe57⤵
- Executes dropped EXE
PID:2260 -
\??\c:\lflrflr.exec:\lflrflr.exe58⤵
- Executes dropped EXE
PID:1016 -
\??\c:\rrlrxlf.exec:\rrlrxlf.exe59⤵
- Executes dropped EXE
PID:1480 -
\??\c:\nhhntt.exec:\nhhntt.exe60⤵
- Executes dropped EXE
PID:1804 -
\??\c:\vpppd.exec:\vpppd.exe61⤵
- Executes dropped EXE
PID:1088 -
\??\c:\dvpdv.exec:\dvpdv.exe62⤵
- Executes dropped EXE
PID:1160 -
\??\c:\3fllxxf.exec:\3fllxxf.exe63⤵
- Executes dropped EXE
PID:552 -
\??\c:\tnbbnh.exec:\tnbbnh.exe64⤵
- Executes dropped EXE
PID:1808 -
\??\c:\1jddd.exec:\1jddd.exe65⤵
- Executes dropped EXE
PID:604 -
\??\c:\vppvj.exec:\vppvj.exe66⤵PID:1012
-
\??\c:\fxrxffl.exec:\fxrxffl.exe67⤵PID:1748
-
\??\c:\hbtthn.exec:\hbtthn.exe68⤵PID:2344
-
\??\c:\tnnthn.exec:\tnnthn.exe69⤵PID:2024
-
\??\c:\dvjdj.exec:\dvjdj.exe70⤵PID:2316
-
\??\c:\rlxlxxf.exec:\rlxlxxf.exe71⤵PID:1548
-
\??\c:\fxllffl.exec:\fxllffl.exe72⤵PID:2228
-
\??\c:\hbtthh.exec:\hbtthh.exe73⤵PID:2872
-
\??\c:\thbhth.exec:\thbhth.exe74⤵PID:2772
-
\??\c:\dvjpv.exec:\dvjpv.exe75⤵PID:2748
-
\??\c:\xrffrxf.exec:\xrffrxf.exe76⤵PID:1700
-
\??\c:\5bnnbb.exec:\5bnnbb.exe77⤵PID:2608
-
\??\c:\1tnhhh.exec:\1tnhhh.exe78⤵PID:3044
-
\??\c:\9vpvj.exec:\9vpvj.exe79⤵PID:1956
-
\??\c:\dppvd.exec:\dppvd.exe80⤵PID:2940
-
\??\c:\lfffxlr.exec:\lfffxlr.exe81⤵PID:3068
-
\??\c:\lfxxlrr.exec:\lfxxlrr.exe82⤵PID:2684
-
\??\c:\hthhtt.exec:\hthhtt.exe83⤵PID:2432
-
\??\c:\pjvdj.exec:\pjvdj.exe84⤵PID:2144
-
\??\c:\jvdvv.exec:\jvdvv.exe85⤵PID:112
-
\??\c:\rfrrflr.exec:\rfrrflr.exe86⤵PID:652
-
\??\c:\hthbtt.exec:\hthbtt.exe87⤵PID:1996
-
\??\c:\nhttbb.exec:\nhttbb.exe88⤵PID:2832
-
\??\c:\jdvjp.exec:\jdvjp.exe89⤵PID:2004
-
\??\c:\xrrlllr.exec:\xrrlllr.exe90⤵PID:2900
-
\??\c:\rfflxxr.exec:\rfflxxr.exe91⤵PID:1724
-
\??\c:\hbbhbt.exec:\hbbhbt.exe92⤵PID:2976
-
\??\c:\bbbbhh.exec:\bbbbhh.exe93⤵PID:1248
-
\??\c:\7pddj.exec:\7pddj.exe94⤵
- System Location Discovery: System Language Discovery
PID:1992 -
\??\c:\xfrxflx.exec:\xfrxflx.exe95⤵PID:1504
-
\??\c:\xrrrxfl.exec:\xrrrxfl.exe96⤵PID:1912
-
\??\c:\ntntnb.exec:\ntntnb.exe97⤵PID:2196
-
\??\c:\jdjdd.exec:\jdjdd.exe98⤵PID:1308
-
\??\c:\3vdjp.exec:\3vdjp.exe99⤵PID:600
-
\??\c:\lrllxll.exec:\lrllxll.exe100⤵PID:1136
-
\??\c:\7hnthn.exec:\7hnthn.exe101⤵PID:444
-
\??\c:\bnnntt.exec:\bnnntt.exe102⤵PID:1600
-
\??\c:\vpdjp.exec:\vpdjp.exe103⤵PID:2292
-
\??\c:\7xllrxl.exec:\7xllrxl.exe104⤵PID:2084
-
\??\c:\rfrfrxl.exec:\rfrfrxl.exe105⤵PID:2252
-
\??\c:\nbtthn.exec:\nbtthn.exe106⤵PID:1760
-
\??\c:\jdvvv.exec:\jdvvv.exe107⤵PID:1340
-
\??\c:\pjjpj.exec:\pjjpj.exe108⤵PID:2468
-
\??\c:\7xrflrx.exec:\7xrflrx.exe109⤵PID:2736
-
\??\c:\xrfllfl.exec:\xrfllfl.exe110⤵PID:2856
-
\??\c:\nbbhnt.exec:\nbbhnt.exe111⤵PID:2816
-
\??\c:\vpjpp.exec:\vpjpp.exe112⤵PID:2240
-
\??\c:\ppdpv.exec:\ppdpv.exe113⤵PID:2852
-
\??\c:\flxlfrf.exec:\flxlfrf.exe114⤵PID:2780
-
\??\c:\ntthth.exec:\ntthth.exe115⤵PID:2840
-
\??\c:\nhtthb.exec:\nhtthb.exe116⤵PID:2676
-
\??\c:\ppjvj.exec:\ppjvj.exe117⤵PID:2788
-
\??\c:\rrflrrf.exec:\rrflrrf.exe118⤵PID:1720
-
\??\c:\3fllrrx.exec:\3fllrrx.exe119⤵PID:1556
-
\??\c:\btnhnn.exec:\btnhnn.exe120⤵PID:2936
-
\??\c:\9nhntt.exec:\9nhntt.exe121⤵PID:2280
-
\??\c:\dvjpv.exec:\dvjpv.exe122⤵PID:2176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-