Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
4213f2e773feec566e01edacc062db90d7169a0a61315ea5231eda4c4d27ebd9N.exe
Resource
win7-20240903-en
General
-
Target
4213f2e773feec566e01edacc062db90d7169a0a61315ea5231eda4c4d27ebd9N.exe
-
Size
82KB
-
MD5
4ab96094fb2149abca2ba8b2b6c43b50
-
SHA1
6db1ea7810c4d2e4c0765961fbfd593926ef0d7f
-
SHA256
4213f2e773feec566e01edacc062db90d7169a0a61315ea5231eda4c4d27ebd9
-
SHA512
9650137aa33a598df8340be867a83fd1a5877894b6a1d66ea9d1a37ceda194ff578ec6466d13f2b1e9f532da8c76018ce8e47ce8aed40ae5e39b6dd646f21d28
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmBgRc6ciTu:ymb3NkkiQ3mdBjFo73thgQ/wEkMNTTu
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2780-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/816-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/376-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/356-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2780 hthhnn.exe 2664 bththb.exe 2824 jpvjj.exe 2560 3rflrrx.exe 2536 1nbhnn.exe 2352 bnhbbb.exe 1780 dvjvd.exe 2972 lfrxrrx.exe 2380 thhhnh.exe 2348 tnhbnh.exe 376 7vpvv.exe 1620 jdjjp.exe 1820 xrlrrrf.exe 2596 nbhnbb.exe 2932 pjvvj.exe 668 5vvvj.exe 356 fxffllf.exe 380 rllffff.exe 2060 hbnbhn.exe 3036 9jvdd.exe 1028 1pdpp.exe 2136 rflflfx.exe 1344 nhhnbb.exe 2488 tthhbt.exe 948 9djvj.exe 2172 5xlxlrx.exe 1816 tnbbnn.exe 2184 9thhnh.exe 1212 dpdvj.exe 3028 5xfxffl.exe 2036 9nhthh.exe 3040 1hnnnt.exe 2664 3vpdj.exe 2736 jvppp.exe 2580 xrfllll.exe 2544 5thhnt.exe 2528 7btbtn.exe 2584 dvjpj.exe 1476 dpdjp.exe 2980 3frxrxf.exe 1888 5fxrrlx.exe 2388 7bbbbb.exe 2168 nhtntn.exe 1652 jvddv.exe 1532 rrxfllr.exe 1844 rfllrlx.exe 1856 7ffrrlr.exe 2828 nnhtnn.exe 1776 bthhnn.exe 2744 9vdvp.exe 956 jdpvv.exe 1592 7fxllrx.exe 2088 fflxrrf.exe 380 tnnthb.exe 3024 7jvjv.exe 2196 pjdjj.exe 1656 rxlllxf.exe 1504 fxrffll.exe 2136 5nbttt.exe 912 7tbbhh.exe 1536 1dppd.exe 1044 pjpdv.exe 780 rrffxfr.exe 2016 9frxfll.exe -
resource yara_rule behavioral1/memory/816-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/376-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/356-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-254-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 816 wrote to memory of 2780 816 4213f2e773feec566e01edacc062db90d7169a0a61315ea5231eda4c4d27ebd9N.exe 31 PID 816 wrote to memory of 2780 816 4213f2e773feec566e01edacc062db90d7169a0a61315ea5231eda4c4d27ebd9N.exe 31 PID 816 wrote to memory of 2780 816 4213f2e773feec566e01edacc062db90d7169a0a61315ea5231eda4c4d27ebd9N.exe 31 PID 816 wrote to memory of 2780 816 4213f2e773feec566e01edacc062db90d7169a0a61315ea5231eda4c4d27ebd9N.exe 31 PID 2780 wrote to memory of 2664 2780 hthhnn.exe 32 PID 2780 wrote to memory of 2664 2780 hthhnn.exe 32 PID 2780 wrote to memory of 2664 2780 hthhnn.exe 32 PID 2780 wrote to memory of 2664 2780 hthhnn.exe 32 PID 2664 wrote to memory of 2824 2664 bththb.exe 33 PID 2664 wrote to memory of 2824 2664 bththb.exe 33 PID 2664 wrote to memory of 2824 2664 bththb.exe 33 PID 2664 wrote to memory of 2824 2664 bththb.exe 33 PID 2824 wrote to memory of 2560 2824 jpvjj.exe 34 PID 2824 wrote to memory of 2560 2824 jpvjj.exe 34 PID 2824 wrote to memory of 2560 2824 jpvjj.exe 34 PID 2824 wrote to memory of 2560 2824 jpvjj.exe 34 PID 2560 wrote to memory of 2536 2560 3rflrrx.exe 35 PID 2560 wrote to memory of 2536 2560 3rflrrx.exe 35 PID 2560 wrote to memory of 2536 2560 3rflrrx.exe 35 PID 2560 wrote to memory of 2536 2560 3rflrrx.exe 35 PID 2536 wrote to memory of 2352 2536 1nbhnn.exe 36 PID 2536 wrote to memory of 2352 2536 1nbhnn.exe 36 PID 2536 wrote to memory of 2352 2536 1nbhnn.exe 36 PID 2536 wrote to memory of 2352 2536 1nbhnn.exe 36 PID 2352 wrote to memory of 1780 2352 bnhbbb.exe 37 PID 2352 wrote to memory of 1780 2352 bnhbbb.exe 37 PID 2352 wrote to memory of 1780 2352 bnhbbb.exe 37 PID 2352 wrote to memory of 1780 2352 bnhbbb.exe 37 PID 1780 wrote to memory of 2972 1780 dvjvd.exe 38 PID 1780 wrote to memory of 2972 1780 dvjvd.exe 38 PID 1780 wrote to memory of 2972 1780 dvjvd.exe 38 PID 1780 wrote to memory of 2972 1780 dvjvd.exe 38 PID 2972 wrote to memory of 2380 2972 lfrxrrx.exe 39 PID 2972 wrote to memory of 2380 2972 lfrxrrx.exe 39 PID 2972 wrote to memory of 2380 2972 lfrxrrx.exe 39 PID 2972 wrote to memory of 2380 2972 lfrxrrx.exe 39 PID 2380 wrote to memory of 2348 2380 thhhnh.exe 40 PID 2380 wrote to memory of 2348 2380 thhhnh.exe 40 PID 2380 wrote to memory of 2348 2380 thhhnh.exe 40 PID 2380 wrote to memory of 2348 2380 thhhnh.exe 40 PID 2348 wrote to memory of 376 2348 tnhbnh.exe 41 PID 2348 wrote to memory of 376 2348 tnhbnh.exe 41 PID 2348 wrote to memory of 376 2348 tnhbnh.exe 41 PID 2348 wrote to memory of 376 2348 tnhbnh.exe 41 PID 376 wrote to memory of 1620 376 7vpvv.exe 42 PID 376 wrote to memory of 1620 376 7vpvv.exe 42 PID 376 wrote to memory of 1620 376 7vpvv.exe 42 PID 376 wrote to memory of 1620 376 7vpvv.exe 42 PID 1620 wrote to memory of 1820 1620 jdjjp.exe 43 PID 1620 wrote to memory of 1820 1620 jdjjp.exe 43 PID 1620 wrote to memory of 1820 1620 jdjjp.exe 43 PID 1620 wrote to memory of 1820 1620 jdjjp.exe 43 PID 1820 wrote to memory of 2596 1820 xrlrrrf.exe 44 PID 1820 wrote to memory of 2596 1820 xrlrrrf.exe 44 PID 1820 wrote to memory of 2596 1820 xrlrrrf.exe 44 PID 1820 wrote to memory of 2596 1820 xrlrrrf.exe 44 PID 2596 wrote to memory of 2932 2596 nbhnbb.exe 45 PID 2596 wrote to memory of 2932 2596 nbhnbb.exe 45 PID 2596 wrote to memory of 2932 2596 nbhnbb.exe 45 PID 2596 wrote to memory of 2932 2596 nbhnbb.exe 45 PID 2932 wrote to memory of 668 2932 pjvvj.exe 46 PID 2932 wrote to memory of 668 2932 pjvvj.exe 46 PID 2932 wrote to memory of 668 2932 pjvvj.exe 46 PID 2932 wrote to memory of 668 2932 pjvvj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\4213f2e773feec566e01edacc062db90d7169a0a61315ea5231eda4c4d27ebd9N.exe"C:\Users\Admin\AppData\Local\Temp\4213f2e773feec566e01edacc062db90d7169a0a61315ea5231eda4c4d27ebd9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\hthhnn.exec:\hthhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\bththb.exec:\bththb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\jpvjj.exec:\jpvjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\3rflrrx.exec:\3rflrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\1nbhnn.exec:\1nbhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\bnhbbb.exec:\bnhbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\dvjvd.exec:\dvjvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\lfrxrrx.exec:\lfrxrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\thhhnh.exec:\thhhnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\tnhbnh.exec:\tnhbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\7vpvv.exec:\7vpvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\jdjjp.exec:\jdjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\xrlrrrf.exec:\xrlrrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\nbhnbb.exec:\nbhnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\pjvvj.exec:\pjvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\5vvvj.exec:\5vvvj.exe17⤵
- Executes dropped EXE
PID:668 -
\??\c:\fxffllf.exec:\fxffllf.exe18⤵
- Executes dropped EXE
PID:356 -
\??\c:\rllffff.exec:\rllffff.exe19⤵
- Executes dropped EXE
PID:380 -
\??\c:\hbnbhn.exec:\hbnbhn.exe20⤵
- Executes dropped EXE
PID:2060 -
\??\c:\9jvdd.exec:\9jvdd.exe21⤵
- Executes dropped EXE
PID:3036 -
\??\c:\1pdpp.exec:\1pdpp.exe22⤵
- Executes dropped EXE
PID:1028 -
\??\c:\rflflfx.exec:\rflflfx.exe23⤵
- Executes dropped EXE
PID:2136 -
\??\c:\nhhnbb.exec:\nhhnbb.exe24⤵
- Executes dropped EXE
PID:1344 -
\??\c:\tthhbt.exec:\tthhbt.exe25⤵
- Executes dropped EXE
PID:2488 -
\??\c:\9djvj.exec:\9djvj.exe26⤵
- Executes dropped EXE
PID:948 -
\??\c:\5xlxlrx.exec:\5xlxlrx.exe27⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tnbbnn.exec:\tnbbnn.exe28⤵
- Executes dropped EXE
PID:1816 -
\??\c:\9thhnh.exec:\9thhnh.exe29⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dpdvj.exec:\dpdvj.exe30⤵
- Executes dropped EXE
PID:1212 -
\??\c:\5xfxffl.exec:\5xfxffl.exe31⤵
- Executes dropped EXE
PID:3028 -
\??\c:\9nhthh.exec:\9nhthh.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2036 -
\??\c:\1hnnnt.exec:\1hnnnt.exe33⤵
- Executes dropped EXE
PID:3040 -
\??\c:\3vpdj.exec:\3vpdj.exe34⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jvppp.exec:\jvppp.exe35⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xrfllll.exec:\xrfllll.exe36⤵
- Executes dropped EXE
PID:2580 -
\??\c:\5thhnt.exec:\5thhnt.exe37⤵
- Executes dropped EXE
PID:2544 -
\??\c:\7btbtn.exec:\7btbtn.exe38⤵
- Executes dropped EXE
PID:2528 -
\??\c:\dvjpj.exec:\dvjpj.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2584 -
\??\c:\dpdjp.exec:\dpdjp.exe40⤵
- Executes dropped EXE
PID:1476 -
\??\c:\3frxrxf.exec:\3frxrxf.exe41⤵
- Executes dropped EXE
PID:2980 -
\??\c:\5fxrrlx.exec:\5fxrrlx.exe42⤵
- Executes dropped EXE
PID:1888 -
\??\c:\7bbbbb.exec:\7bbbbb.exe43⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nhtntn.exec:\nhtntn.exe44⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jvddv.exec:\jvddv.exe45⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rrxfllr.exec:\rrxfllr.exe46⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rfllrlx.exec:\rfllrlx.exe47⤵
- Executes dropped EXE
PID:1844 -
\??\c:\7ffrrlr.exec:\7ffrrlr.exe48⤵
- Executes dropped EXE
PID:1856 -
\??\c:\nnhtnn.exec:\nnhtnn.exe49⤵
- Executes dropped EXE
PID:2828 -
\??\c:\bthhnn.exec:\bthhnn.exe50⤵
- Executes dropped EXE
PID:1776 -
\??\c:\9vdvp.exec:\9vdvp.exe51⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jdpvv.exec:\jdpvv.exe52⤵
- Executes dropped EXE
PID:956 -
\??\c:\7fxllrx.exec:\7fxllrx.exe53⤵
- Executes dropped EXE
PID:1592 -
\??\c:\fflxrrf.exec:\fflxrrf.exe54⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tnnthb.exec:\tnnthb.exe55⤵
- Executes dropped EXE
PID:380 -
\??\c:\7jvjv.exec:\7jvjv.exe56⤵
- Executes dropped EXE
PID:3024 -
\??\c:\pjdjj.exec:\pjdjj.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rxlllxf.exec:\rxlllxf.exe58⤵
- Executes dropped EXE
PID:1656 -
\??\c:\fxrffll.exec:\fxrffll.exe59⤵
- Executes dropped EXE
PID:1504 -
\??\c:\5nbttt.exec:\5nbttt.exe60⤵
- Executes dropped EXE
PID:2136 -
\??\c:\7tbbhh.exec:\7tbbhh.exe61⤵
- Executes dropped EXE
PID:912 -
\??\c:\1dppd.exec:\1dppd.exe62⤵
- Executes dropped EXE
PID:1536 -
\??\c:\pjpdv.exec:\pjpdv.exe63⤵
- Executes dropped EXE
PID:1044 -
\??\c:\rrffxfr.exec:\rrffxfr.exe64⤵
- Executes dropped EXE
PID:780 -
\??\c:\9frxfll.exec:\9frxfll.exe65⤵
- Executes dropped EXE
PID:2016 -
\??\c:\hbhthh.exec:\hbhthh.exe66⤵PID:2292
-
\??\c:\hbthnt.exec:\hbthnt.exe67⤵PID:1052
-
\??\c:\dvjjj.exec:\dvjjj.exe68⤵PID:2784
-
\??\c:\ddpvj.exec:\ddpvj.exe69⤵PID:2768
-
\??\c:\1vpdv.exec:\1vpdv.exe70⤵PID:2692
-
\??\c:\lxllllr.exec:\lxllllr.exe71⤵PID:2204
-
\??\c:\rlfllrx.exec:\rlfllrx.exe72⤵PID:2752
-
\??\c:\hbnbtn.exec:\hbnbtn.exe73⤵PID:2888
-
\??\c:\jvdvd.exec:\jvdvd.exe74⤵PID:2332
-
\??\c:\jdvdv.exec:\jdvdv.exe75⤵PID:1068
-
\??\c:\7dppp.exec:\7dppp.exe76⤵PID:2604
-
\??\c:\7rlrflr.exec:\7rlrflr.exe77⤵PID:2964
-
\??\c:\bnbntn.exec:\bnbntn.exe78⤵PID:2352
-
\??\c:\nnnnnn.exec:\nnnnnn.exe79⤵PID:2240
-
\??\c:\dvjdd.exec:\dvjdd.exe80⤵PID:2420
-
\??\c:\vvppv.exec:\vvppv.exe81⤵PID:2972
-
\??\c:\vpjvd.exec:\vpjvd.exe82⤵PID:1812
-
\??\c:\lflfrlr.exec:\lflfrlr.exe83⤵PID:1056
-
\??\c:\xxffrxf.exec:\xxffrxf.exe84⤵PID:2104
-
\??\c:\1bbnnt.exec:\1bbnnt.exe85⤵PID:1832
-
\??\c:\dpvvv.exec:\dpvvv.exe86⤵PID:1764
-
\??\c:\pjvdp.exec:\pjvdp.exe87⤵PID:2340
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe88⤵PID:2832
-
\??\c:\3rrxllr.exec:\3rrxllr.exe89⤵PID:2720
-
\??\c:\hhhbtt.exec:\hhhbtt.exe90⤵PID:696
-
\??\c:\bnbbhb.exec:\bnbbhb.exe91⤵PID:536
-
\??\c:\vdjvj.exec:\vdjvj.exe92⤵PID:1992
-
\??\c:\9jjdj.exec:\9jjdj.exe93⤵PID:2316
-
\??\c:\9rfxfxf.exec:\9rfxfxf.exe94⤵PID:2060
-
\??\c:\frxxfxf.exec:\frxxfxf.exe95⤵PID:2916
-
\??\c:\hhbthb.exec:\hhbthb.exe96⤵PID:448
-
\??\c:\htntbh.exec:\htntbh.exe97⤵PID:2376
-
\??\c:\vjppv.exec:\vjppv.exe98⤵PID:1092
-
\??\c:\jvvpv.exec:\jvvpv.exe99⤵PID:1596
-
\??\c:\3vvvp.exec:\3vvvp.exe100⤵PID:1300
-
\??\c:\lxlxxrf.exec:\lxlxxrf.exe101⤵PID:1364
-
\??\c:\hthnnn.exec:\hthnnn.exe102⤵PID:1648
-
\??\c:\thbttt.exec:\thbttt.exe103⤵PID:2172
-
\??\c:\1dpjj.exec:\1dpjj.exe104⤵PID:2208
-
\??\c:\3jpvj.exec:\3jpvj.exe105⤵PID:2856
-
\??\c:\jvjjp.exec:\jvjjp.exe106⤵PID:2144
-
\??\c:\xrxxlfx.exec:\xrxxlfx.exe107⤵PID:1876
-
\??\c:\rfrrfxx.exec:\rfrrfxx.exe108⤵PID:1548
-
\??\c:\bthntb.exec:\bthntb.exe109⤵PID:2740
-
\??\c:\7nnbbh.exec:\7nnbbh.exe110⤵PID:2800
-
\??\c:\vpdjd.exec:\vpdjd.exe111⤵PID:2764
-
\??\c:\jvddj.exec:\jvddj.exe112⤵PID:2824
-
\??\c:\5fxrxrx.exec:\5fxrxrx.exe113⤵PID:2556
-
\??\c:\frxxfxx.exec:\frxxfxx.exe114⤵PID:2592
-
\??\c:\tbhtbh.exec:\tbhtbh.exe115⤵PID:2496
-
\??\c:\ttttbn.exec:\ttttbn.exe116⤵PID:2660
-
\??\c:\vjvpp.exec:\vjvpp.exe117⤵PID:1780
-
\??\c:\1vpjp.exec:\1vpjp.exe118⤵PID:1896
-
\??\c:\xlrfrxf.exec:\xlrfrxf.exe119⤵PID:2476
-
\??\c:\rlfxxxr.exec:\rlfxxxr.exe120⤵PID:2128
-
\??\c:\nnbbtn.exec:\nnbbtn.exe121⤵PID:808
-
\??\c:\htbbtt.exec:\htbbtt.exe122⤵PID:1268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-