Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20-09-2024 19:02
Behavioral task
behavioral1
Sample
5f1b6f010bbe4ad418a4d3f2b1b2ed9918491550512c7ee95dc86eeabfa81994N.exe
Resource
win7-20240729-en
7 signatures
120 seconds
General
-
Target
5f1b6f010bbe4ad418a4d3f2b1b2ed9918491550512c7ee95dc86eeabfa81994N.exe
-
Size
485KB
-
MD5
d7947c6d93a1193713788b43ba85b570
-
SHA1
8b9a3601094a7f4e4a61555f8de0e81973629255
-
SHA256
5f1b6f010bbe4ad418a4d3f2b1b2ed9918491550512c7ee95dc86eeabfa81994
-
SHA512
fa262711e2422042760426fe9d599d0615f32525ebf9a6f300430fa1e9dcbd35d69bce946bc0fd97dba7c191453b570b4ea1a92a45fce74071ffd7a69e60017a
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkUo7tvnJ9oH0IiVByq9CPobNVF:n3C9ytvngQjgtvngSV3CPobNVF
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2252-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1324-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1228-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2132 hhbbtn.exe 2148 1bbhnt.exe 2796 3lfxxlx.exe 2748 nhbhbh.exe 2804 hhhbtt.exe 2888 hnnbnh.exe 2632 ppdjv.exe 2824 9vppd.exe 2728 jddjp.exe 2196 djdvp.exe 1796 llxlxfr.exe 2512 djvpv.exe 1324 5xxxflf.exe 1228 hnthht.exe 2516 pjdpj.exe 1984 dvpdp.exe 1772 rllxrfx.exe 2676 hbnbtb.exe 2476 vppdp.exe 2488 tnhtbn.exe 2588 3djpp.exe 2976 btnhtt.exe 1928 jjdjp.exe 1444 nnhtht.exe 2328 9jddv.exe 3012 3vpdd.exe 1408 3pdjd.exe 2000 vvvpj.exe 900 pvvpp.exe 1596 hbthtb.exe 2368 ddjdp.exe 2552 hhhnth.exe 1168 jpdjv.exe 1624 lrllrxf.exe 2744 5tnbnb.exe 2832 jjppv.exe 2836 dvpjv.exe 2724 fllrffx.exe 2784 5thbht.exe 2876 jvpjv.exe 2660 ppvjj.exe 2400 9lflrfl.exe 536 nbthtn.exe 3032 pjjjp.exe 1672 9vvdp.exe 2044 xrflrrl.exe 1916 7bnbbb.exe 2500 vdvdv.exe 1324 xlrlflf.exe 780 9llrflf.exe 1760 nbtnnh.exe 1632 pjjpd.exe 2852 xffxrlr.exe 1772 tnnbnh.exe 1724 9pvdv.exe 2088 jvjjp.exe 1976 lxrxllx.exe 2788 ntnhtb.exe 2964 jjvvp.exe 2976 3jvdj.exe 940 fxxxrlr.exe 2244 tthbhn.exe 816 vdjdd.exe 2040 djjdd.exe -
resource yara_rule behavioral1/memory/2252-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1324-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1228-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-250-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2132 2252 5f1b6f010bbe4ad418a4d3f2b1b2ed9918491550512c7ee95dc86eeabfa81994N.exe 30 PID 2252 wrote to memory of 2132 2252 5f1b6f010bbe4ad418a4d3f2b1b2ed9918491550512c7ee95dc86eeabfa81994N.exe 30 PID 2252 wrote to memory of 2132 2252 5f1b6f010bbe4ad418a4d3f2b1b2ed9918491550512c7ee95dc86eeabfa81994N.exe 30 PID 2252 wrote to memory of 2132 2252 5f1b6f010bbe4ad418a4d3f2b1b2ed9918491550512c7ee95dc86eeabfa81994N.exe 30 PID 2132 wrote to memory of 2148 2132 hhbbtn.exe 31 PID 2132 wrote to memory of 2148 2132 hhbbtn.exe 31 PID 2132 wrote to memory of 2148 2132 hhbbtn.exe 31 PID 2132 wrote to memory of 2148 2132 hhbbtn.exe 31 PID 2148 wrote to memory of 2796 2148 1bbhnt.exe 32 PID 2148 wrote to memory of 2796 2148 1bbhnt.exe 32 PID 2148 wrote to memory of 2796 2148 1bbhnt.exe 32 PID 2148 wrote to memory of 2796 2148 1bbhnt.exe 32 PID 2796 wrote to memory of 2748 2796 3lfxxlx.exe 33 PID 2796 wrote to memory of 2748 2796 3lfxxlx.exe 33 PID 2796 wrote to memory of 2748 2796 3lfxxlx.exe 33 PID 2796 wrote to memory of 2748 2796 3lfxxlx.exe 33 PID 2748 wrote to memory of 2804 2748 nhbhbh.exe 34 PID 2748 wrote to memory of 2804 2748 nhbhbh.exe 34 PID 2748 wrote to memory of 2804 2748 nhbhbh.exe 34 PID 2748 wrote to memory of 2804 2748 nhbhbh.exe 34 PID 2804 wrote to memory of 2888 2804 hhhbtt.exe 35 PID 2804 wrote to memory of 2888 2804 hhhbtt.exe 35 PID 2804 wrote to memory of 2888 2804 hhhbtt.exe 35 PID 2804 wrote to memory of 2888 2804 hhhbtt.exe 35 PID 2888 wrote to memory of 2632 2888 hnnbnh.exe 36 PID 2888 wrote to memory of 2632 2888 hnnbnh.exe 36 PID 2888 wrote to memory of 2632 2888 hnnbnh.exe 36 PID 2888 wrote to memory of 2632 2888 hnnbnh.exe 36 PID 2632 wrote to memory of 2824 2632 ppdjv.exe 37 PID 2632 wrote to memory of 2824 2632 ppdjv.exe 37 PID 2632 wrote to memory of 2824 2632 ppdjv.exe 37 PID 2632 wrote to memory of 2824 2632 ppdjv.exe 37 PID 2824 wrote to memory of 2728 2824 9vppd.exe 38 PID 2824 wrote to memory of 2728 2824 9vppd.exe 38 PID 2824 wrote to memory of 2728 2824 9vppd.exe 38 PID 2824 wrote to memory of 2728 2824 9vppd.exe 38 PID 2728 wrote to memory of 2196 2728 jddjp.exe 39 PID 2728 wrote to memory of 2196 2728 jddjp.exe 39 PID 2728 wrote to memory of 2196 2728 jddjp.exe 39 PID 2728 wrote to memory of 2196 2728 jddjp.exe 39 PID 2196 wrote to memory of 1796 2196 djdvp.exe 40 PID 2196 wrote to memory of 1796 2196 djdvp.exe 40 PID 2196 wrote to memory of 1796 2196 djdvp.exe 40 PID 2196 wrote to memory of 1796 2196 djdvp.exe 40 PID 1796 wrote to memory of 2512 1796 llxlxfr.exe 41 PID 1796 wrote to memory of 2512 1796 llxlxfr.exe 41 PID 1796 wrote to memory of 2512 1796 llxlxfr.exe 41 PID 1796 wrote to memory of 2512 1796 llxlxfr.exe 41 PID 2512 wrote to memory of 1324 2512 djvpv.exe 42 PID 2512 wrote to memory of 1324 2512 djvpv.exe 42 PID 2512 wrote to memory of 1324 2512 djvpv.exe 42 PID 2512 wrote to memory of 1324 2512 djvpv.exe 42 PID 1324 wrote to memory of 1228 1324 5xxxflf.exe 43 PID 1324 wrote to memory of 1228 1324 5xxxflf.exe 43 PID 1324 wrote to memory of 1228 1324 5xxxflf.exe 43 PID 1324 wrote to memory of 1228 1324 5xxxflf.exe 43 PID 1228 wrote to memory of 2516 1228 hnthht.exe 44 PID 1228 wrote to memory of 2516 1228 hnthht.exe 44 PID 1228 wrote to memory of 2516 1228 hnthht.exe 44 PID 1228 wrote to memory of 2516 1228 hnthht.exe 44 PID 2516 wrote to memory of 1984 2516 pjdpj.exe 45 PID 2516 wrote to memory of 1984 2516 pjdpj.exe 45 PID 2516 wrote to memory of 1984 2516 pjdpj.exe 45 PID 2516 wrote to memory of 1984 2516 pjdpj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f1b6f010bbe4ad418a4d3f2b1b2ed9918491550512c7ee95dc86eeabfa81994N.exe"C:\Users\Admin\AppData\Local\Temp\5f1b6f010bbe4ad418a4d3f2b1b2ed9918491550512c7ee95dc86eeabfa81994N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\hhbbtn.exec:\hhbbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\1bbhnt.exec:\1bbhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\3lfxxlx.exec:\3lfxxlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\nhbhbh.exec:\nhbhbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\hhhbtt.exec:\hhhbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\hnnbnh.exec:\hnnbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\ppdjv.exec:\ppdjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\9vppd.exec:\9vppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\jddjp.exec:\jddjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\djdvp.exec:\djdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\llxlxfr.exec:\llxlxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\djvpv.exec:\djvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\5xxxflf.exec:\5xxxflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\hnthht.exec:\hnthht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\pjdpj.exec:\pjdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\dvpdp.exec:\dvpdp.exe17⤵
- Executes dropped EXE
PID:1984 -
\??\c:\rllxrfx.exec:\rllxrfx.exe18⤵
- Executes dropped EXE
PID:1772 -
\??\c:\hbnbtb.exec:\hbnbtb.exe19⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vppdp.exec:\vppdp.exe20⤵
- Executes dropped EXE
PID:2476 -
\??\c:\tnhtbn.exec:\tnhtbn.exe21⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3djpp.exec:\3djpp.exe22⤵
- Executes dropped EXE
PID:2588 -
\??\c:\btnhtt.exec:\btnhtt.exe23⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jjdjp.exec:\jjdjp.exe24⤵
- Executes dropped EXE
PID:1928 -
\??\c:\nnhtht.exec:\nnhtht.exe25⤵
- Executes dropped EXE
PID:1444 -
\??\c:\9jddv.exec:\9jddv.exe26⤵
- Executes dropped EXE
PID:2328 -
\??\c:\3vpdd.exec:\3vpdd.exe27⤵
- Executes dropped EXE
PID:3012 -
\??\c:\3pdjd.exec:\3pdjd.exe28⤵
- Executes dropped EXE
PID:1408 -
\??\c:\vvvpj.exec:\vvvpj.exe29⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pvvpp.exec:\pvvpp.exe30⤵
- Executes dropped EXE
PID:900 -
\??\c:\hbthtb.exec:\hbthtb.exe31⤵
- Executes dropped EXE
PID:1596 -
\??\c:\ddjdp.exec:\ddjdp.exe32⤵
- Executes dropped EXE
PID:2368 -
\??\c:\hhhnth.exec:\hhhnth.exe33⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jpdjv.exec:\jpdjv.exe34⤵
- Executes dropped EXE
PID:1168 -
\??\c:\lrllrxf.exec:\lrllrxf.exe35⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5tnbnb.exec:\5tnbnb.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jjppv.exec:\jjppv.exe37⤵
- Executes dropped EXE
PID:2832 -
\??\c:\dvpjv.exec:\dvpjv.exe38⤵
- Executes dropped EXE
PID:2836 -
\??\c:\fllrffx.exec:\fllrffx.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\5thbht.exec:\5thbht.exe40⤵
- Executes dropped EXE
PID:2784 -
\??\c:\jvpjv.exec:\jvpjv.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ppvjj.exec:\ppvjj.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\9lflrfl.exec:\9lflrfl.exe43⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nbthtn.exec:\nbthtn.exe44⤵
- Executes dropped EXE
PID:536 -
\??\c:\pjjjp.exec:\pjjjp.exe45⤵
- Executes dropped EXE
PID:3032 -
\??\c:\9vvdp.exec:\9vvdp.exe46⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xrflrrl.exec:\xrflrrl.exe47⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7bnbbb.exec:\7bnbbb.exe48⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vdvdv.exec:\vdvdv.exe49⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xlrlflf.exec:\xlrlflf.exe50⤵
- Executes dropped EXE
PID:1324 -
\??\c:\9llrflf.exec:\9llrflf.exe51⤵
- Executes dropped EXE
PID:780 -
\??\c:\nbtnnh.exec:\nbtnnh.exe52⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pjjpd.exec:\pjjpd.exe53⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xffxrlr.exec:\xffxrlr.exe54⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tnnbnh.exec:\tnnbnh.exe55⤵
- Executes dropped EXE
PID:1772 -
\??\c:\9pvdv.exec:\9pvdv.exe56⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jvjjp.exec:\jvjjp.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2088 -
\??\c:\lxrxllx.exec:\lxrxllx.exe58⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ntnhtb.exec:\ntnhtb.exe59⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jjvvp.exec:\jjvvp.exe60⤵
- Executes dropped EXE
PID:2964 -
\??\c:\3jvdj.exec:\3jvdj.exe61⤵
- Executes dropped EXE
PID:2976 -
\??\c:\fxxxrlr.exec:\fxxxrlr.exe62⤵
- Executes dropped EXE
PID:940 -
\??\c:\tthbhn.exec:\tthbhn.exe63⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vdjdd.exec:\vdjdd.exe64⤵
- Executes dropped EXE
PID:816 -
\??\c:\djjdd.exec:\djjdd.exe65⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xfxlxxl.exec:\xfxlxxl.exe66⤵PID:2380
-
\??\c:\5hbbtb.exec:\5hbbtb.exe67⤵PID:1500
-
\??\c:\dvpvj.exec:\dvpvj.exe68⤵PID:1996
-
\??\c:\fxxxllf.exec:\fxxxllf.exe69⤵PID:1992
-
\??\c:\1rlrxxr.exec:\1rlrxxr.exe70⤵PID:900
-
\??\c:\thtbtn.exec:\thtbtn.exe71⤵PID:2364
-
\??\c:\jpvvv.exec:\jpvvv.exe72⤵PID:2544
-
\??\c:\xrlrxff.exec:\xrlrxff.exe73⤵PID:2216
-
\??\c:\9rllrrf.exec:\9rllrrf.exe74⤵PID:3040
-
\??\c:\hhbhnb.exec:\hhbhnb.exe75⤵PID:2204
-
\??\c:\dvpdd.exec:\dvpdd.exe76⤵PID:2808
-
\??\c:\llflrfl.exec:\llflrfl.exe77⤵PID:2960
-
\??\c:\tnhthh.exec:\tnhthh.exe78⤵PID:2944
-
\??\c:\hhhtbh.exec:\hhhtbh.exe79⤵PID:2804
-
\??\c:\jvvvj.exec:\jvvvj.exe80⤵PID:2756
-
\??\c:\lxlfxrr.exec:\lxlfxrr.exe81⤵PID:2912
-
\??\c:\ttntht.exec:\ttntht.exe82⤵PID:2624
-
\??\c:\djpjd.exec:\djpjd.exe83⤵PID:3068
-
\??\c:\7pjpv.exec:\7pjpv.exe84⤵PID:568
-
\??\c:\fxrxrxr.exec:\fxrxrxr.exe85⤵PID:1592
-
\??\c:\1btnth.exec:\1btnth.exe86⤵PID:284
-
\??\c:\tnhntn.exec:\tnhntn.exe87⤵PID:1732
-
\??\c:\jvppd.exec:\jvppd.exe88⤵PID:1396
-
\??\c:\llffrxl.exec:\llffrxl.exe89⤵PID:1144
-
\??\c:\1hbnth.exec:\1hbnth.exe90⤵PID:2092
-
\??\c:\vpppp.exec:\vpppp.exe91⤵PID:1496
-
\??\c:\vvvdp.exec:\vvvdp.exe92⤵PID:1480
-
\??\c:\3frxflx.exec:\3frxflx.exe93⤵PID:1920
-
\??\c:\xlflrrf.exec:\xlflrrf.exe94⤵PID:2904
-
\??\c:\nththb.exec:\nththb.exe95⤵PID:1608
-
\??\c:\7ddjv.exec:\7ddjv.exe96⤵PID:2068
-
\??\c:\3rfxffl.exec:\3rfxffl.exe97⤵
- System Location Discovery: System Language Discovery
PID:2476 -
\??\c:\lrlxllx.exec:\lrlxllx.exe98⤵PID:112
-
\??\c:\tnbtbb.exec:\tnbtbb.exe99⤵PID:2696
-
\??\c:\vjvdp.exec:\vjvdp.exe100⤵PID:1600
-
\??\c:\rrlfflr.exec:\rrlfflr.exe101⤵PID:652
-
\??\c:\rrrxlrl.exec:\rrrxlrl.exe102⤵PID:2972
-
\??\c:\9hhntt.exec:\9hhntt.exe103⤵PID:2480
-
\??\c:\7vjjv.exec:\7vjjv.exe104⤵PID:3056
-
\??\c:\rxrfrfr.exec:\rxrfrfr.exe105⤵PID:2940
-
\??\c:\hnnnhn.exec:\hnnnhn.exe106⤵PID:3000
-
\??\c:\7bnbhn.exec:\7bnbhn.exe107⤵PID:328
-
\??\c:\pjdjp.exec:\pjdjp.exe108⤵PID:2688
-
\??\c:\9fxlxfr.exec:\9fxlxfr.exe109⤵PID:2424
-
\??\c:\tnbntb.exec:\tnbntb.exe110⤵PID:2084
-
\??\c:\dvpvd.exec:\dvpvd.exe111⤵PID:2132
-
\??\c:\1fllxfr.exec:\1fllxfr.exe112⤵PID:2532
-
\??\c:\fllxxrx.exec:\fllxxrx.exe113⤵PID:2556
-
\??\c:\tbbnbn.exec:\tbbnbn.exe114⤵PID:1628
-
\??\c:\dvpvj.exec:\dvpvj.exe115⤵PID:2900
-
\??\c:\fxflflx.exec:\fxflflx.exe116⤵PID:1208
-
\??\c:\nnthth.exec:\nnthth.exe117⤵PID:2616
-
\??\c:\djdpj.exec:\djdpj.exe118⤵PID:2872
-
\??\c:\9rlxffl.exec:\9rlxffl.exe119⤵PID:2408
-
\??\c:\lxxfxrl.exec:\lxxfxrl.exe120⤵PID:2644
-
\??\c:\nnhnbn.exec:\nnhnbn.exe121⤵PID:2612
-
\??\c:\jdvdj.exec:\jdvdj.exe122⤵
- System Location Discovery: System Language Discovery
PID:3020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-