Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 15:30
Static task
static1
Behavioral task
behavioral1
Sample
8b24e56c64695fcdb74aba6bbb9661c9a217e1310f1162fa7d07ac3e8d9f4043N.exe
Resource
win7-20240903-en
General
-
Target
8b24e56c64695fcdb74aba6bbb9661c9a217e1310f1162fa7d07ac3e8d9f4043N.exe
-
Size
74KB
-
MD5
de14de6865d8b8c4cfd6bdea76cfde70
-
SHA1
b3de13666cc8fb9ea87d57a5ba7877a2a68e99ed
-
SHA256
8b24e56c64695fcdb74aba6bbb9661c9a217e1310f1162fa7d07ac3e8d9f4043
-
SHA512
965b0b640263038c454708e5db2c02d496fe64d6ed338b609c2fcc138a77e8fb368ec01dfd0d6343c5eb31f5ebd90a19e65371a90a17e2581fee0688f9474917
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfot3eTl:ymb3NkkiQ3mdBjFWXkj7afokl
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/1856-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/620-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1856 hbtbhb.exe 2740 pjvvd.exe 2716 llrxflx.exe 2812 7hbbnt.exe 2696 pjdjv.exe 2648 ddppd.exe 840 lxllrxx.exe 1716 nnhntt.exe 2904 jdvpv.exe 2672 xrfrfrf.exe 1936 xxrfrrl.exe 2544 hbthtb.exe 764 btnbhn.exe 760 pdpvp.exe 2760 pjvvv.exe 1092 jjvjv.exe 1852 9xrfrxl.exe 620 7xlxfrf.exe 2348 tbtnhb.exe 2120 nhnnbb.exe 2356 5vpvv.exe 1704 dvpdp.exe 904 1xlrxxr.exe 2212 fxrrxfr.exe 2684 btnbnt.exe 2284 tnnbtt.exe 3012 5dpvd.exe 3016 vpjpp.exe 1636 7xrfxxl.exe 1608 rlxlffx.exe 2192 nnhtth.exe 2112 ddjvv.exe 1584 jjdpv.exe 2792 flxlxrl.exe 2864 xxrrffr.exe 2196 fxrflxr.exe 2584 3bntht.exe 2604 3htttt.exe 2752 jpdpp.exe 280 vjpjd.exe 1604 7vvdd.exe 1720 xrffllf.exe 2564 3rrrrrx.exe 576 ffxrffl.exe 2056 hhhtbh.exe 944 hnnnnn.exe 1184 1vjdd.exe 444 vvjvp.exe 1132 pjppv.exe 1212 ffrxllf.exe 2760 rrflxfr.exe 1092 fxffflx.exe 1592 9btbnt.exe 1056 7nnnnt.exe 2400 btthtb.exe 2088 3vpvv.exe 1292 jvjpv.exe 2356 vpvdd.exe 464 lxrrlrr.exe 3036 1fxxfff.exe 1324 ffxfxxl.exe 1544 hbhnnn.exe 1200 ttbbnh.exe 2416 btbnhn.exe -
resource yara_rule behavioral1/memory/1856-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/620-186-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2192 wrote to memory of 1856 2192 8b24e56c64695fcdb74aba6bbb9661c9a217e1310f1162fa7d07ac3e8d9f4043N.exe 30 PID 2192 wrote to memory of 1856 2192 8b24e56c64695fcdb74aba6bbb9661c9a217e1310f1162fa7d07ac3e8d9f4043N.exe 30 PID 2192 wrote to memory of 1856 2192 8b24e56c64695fcdb74aba6bbb9661c9a217e1310f1162fa7d07ac3e8d9f4043N.exe 30 PID 2192 wrote to memory of 1856 2192 8b24e56c64695fcdb74aba6bbb9661c9a217e1310f1162fa7d07ac3e8d9f4043N.exe 30 PID 1856 wrote to memory of 2740 1856 hbtbhb.exe 31 PID 1856 wrote to memory of 2740 1856 hbtbhb.exe 31 PID 1856 wrote to memory of 2740 1856 hbtbhb.exe 31 PID 1856 wrote to memory of 2740 1856 hbtbhb.exe 31 PID 2740 wrote to memory of 2716 2740 pjvvd.exe 32 PID 2740 wrote to memory of 2716 2740 pjvvd.exe 32 PID 2740 wrote to memory of 2716 2740 pjvvd.exe 32 PID 2740 wrote to memory of 2716 2740 pjvvd.exe 32 PID 2716 wrote to memory of 2812 2716 llrxflx.exe 33 PID 2716 wrote to memory of 2812 2716 llrxflx.exe 33 PID 2716 wrote to memory of 2812 2716 llrxflx.exe 33 PID 2716 wrote to memory of 2812 2716 llrxflx.exe 33 PID 2812 wrote to memory of 2696 2812 7hbbnt.exe 34 PID 2812 wrote to memory of 2696 2812 7hbbnt.exe 34 PID 2812 wrote to memory of 2696 2812 7hbbnt.exe 34 PID 2812 wrote to memory of 2696 2812 7hbbnt.exe 34 PID 2696 wrote to memory of 2648 2696 pjdjv.exe 35 PID 2696 wrote to memory of 2648 2696 pjdjv.exe 35 PID 2696 wrote to memory of 2648 2696 pjdjv.exe 35 PID 2696 wrote to memory of 2648 2696 pjdjv.exe 35 PID 2648 wrote to memory of 840 2648 ddppd.exe 36 PID 2648 wrote to memory of 840 2648 ddppd.exe 36 PID 2648 wrote to memory of 840 2648 ddppd.exe 36 PID 2648 wrote to memory of 840 2648 ddppd.exe 36 PID 840 wrote to memory of 1716 840 lxllrxx.exe 37 PID 840 wrote to memory of 1716 840 lxllrxx.exe 37 PID 840 wrote to memory of 1716 840 lxllrxx.exe 37 PID 840 wrote to memory of 1716 840 lxllrxx.exe 37 PID 1716 wrote to memory of 2904 1716 nnhntt.exe 38 PID 1716 wrote to memory of 2904 1716 nnhntt.exe 38 PID 1716 wrote to memory of 2904 1716 nnhntt.exe 38 PID 1716 wrote to memory of 2904 1716 nnhntt.exe 38 PID 2904 wrote to memory of 2672 2904 jdvpv.exe 39 PID 2904 wrote to memory of 2672 2904 jdvpv.exe 39 PID 2904 wrote to memory of 2672 2904 jdvpv.exe 39 PID 2904 wrote to memory of 2672 2904 jdvpv.exe 39 PID 2672 wrote to memory of 1936 2672 xrfrfrf.exe 40 PID 2672 wrote to memory of 1936 2672 xrfrfrf.exe 40 PID 2672 wrote to memory of 1936 2672 xrfrfrf.exe 40 PID 2672 wrote to memory of 1936 2672 xrfrfrf.exe 40 PID 1936 wrote to memory of 2544 1936 xxrfrrl.exe 41 PID 1936 wrote to memory of 2544 1936 xxrfrrl.exe 41 PID 1936 wrote to memory of 2544 1936 xxrfrrl.exe 41 PID 1936 wrote to memory of 2544 1936 xxrfrrl.exe 41 PID 2544 wrote to memory of 764 2544 hbthtb.exe 42 PID 2544 wrote to memory of 764 2544 hbthtb.exe 42 PID 2544 wrote to memory of 764 2544 hbthtb.exe 42 PID 2544 wrote to memory of 764 2544 hbthtb.exe 42 PID 764 wrote to memory of 760 764 btnbhn.exe 43 PID 764 wrote to memory of 760 764 btnbhn.exe 43 PID 764 wrote to memory of 760 764 btnbhn.exe 43 PID 764 wrote to memory of 760 764 btnbhn.exe 43 PID 760 wrote to memory of 2760 760 pdpvp.exe 44 PID 760 wrote to memory of 2760 760 pdpvp.exe 44 PID 760 wrote to memory of 2760 760 pdpvp.exe 44 PID 760 wrote to memory of 2760 760 pdpvp.exe 44 PID 2760 wrote to memory of 1092 2760 pjvvv.exe 81 PID 2760 wrote to memory of 1092 2760 pjvvv.exe 81 PID 2760 wrote to memory of 1092 2760 pjvvv.exe 81 PID 2760 wrote to memory of 1092 2760 pjvvv.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b24e56c64695fcdb74aba6bbb9661c9a217e1310f1162fa7d07ac3e8d9f4043N.exe"C:\Users\Admin\AppData\Local\Temp\8b24e56c64695fcdb74aba6bbb9661c9a217e1310f1162fa7d07ac3e8d9f4043N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\hbtbhb.exec:\hbtbhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\pjvvd.exec:\pjvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\llrxflx.exec:\llrxflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\7hbbnt.exec:\7hbbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\pjdjv.exec:\pjdjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\ddppd.exec:\ddppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\lxllrxx.exec:\lxllrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\nnhntt.exec:\nnhntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\jdvpv.exec:\jdvpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\xrfrfrf.exec:\xrfrfrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\xxrfrrl.exec:\xxrfrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\hbthtb.exec:\hbthtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\btnbhn.exec:\btnbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\pdpvp.exec:\pdpvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\pjvvv.exec:\pjvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\jjvjv.exec:\jjvjv.exe17⤵
- Executes dropped EXE
PID:1092 -
\??\c:\9xrfrxl.exec:\9xrfrxl.exe18⤵
- Executes dropped EXE
PID:1852 -
\??\c:\7xlxfrf.exec:\7xlxfrf.exe19⤵
- Executes dropped EXE
PID:620 -
\??\c:\tbtnhb.exec:\tbtnhb.exe20⤵
- Executes dropped EXE
PID:2348 -
\??\c:\nhnnbb.exec:\nhnnbb.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5vpvv.exec:\5vpvv.exe22⤵
- Executes dropped EXE
PID:2356 -
\??\c:\dvpdp.exec:\dvpdp.exe23⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1xlrxxr.exec:\1xlrxxr.exe24⤵
- Executes dropped EXE
PID:904 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe25⤵
- Executes dropped EXE
PID:2212 -
\??\c:\btnbnt.exec:\btnbnt.exe26⤵
- Executes dropped EXE
PID:2684 -
\??\c:\tnnbtt.exec:\tnnbtt.exe27⤵
- Executes dropped EXE
PID:2284 -
\??\c:\5dpvd.exec:\5dpvd.exe28⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vpjpp.exec:\vpjpp.exe29⤵
- Executes dropped EXE
PID:3016 -
\??\c:\7xrfxxl.exec:\7xrfxxl.exe30⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rlxlffx.exec:\rlxlffx.exe31⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nnhtth.exec:\nnhtth.exe32⤵
- Executes dropped EXE
PID:2192 -
\??\c:\ddjvv.exec:\ddjvv.exe33⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jjdpv.exec:\jjdpv.exe34⤵
- Executes dropped EXE
PID:1584 -
\??\c:\flxlxrl.exec:\flxlxrl.exe35⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xxrrffr.exec:\xxrrffr.exe36⤵
- Executes dropped EXE
PID:2864 -
\??\c:\fxrflxr.exec:\fxrflxr.exe37⤵
- Executes dropped EXE
PID:2196 -
\??\c:\3bntht.exec:\3bntht.exe38⤵
- Executes dropped EXE
PID:2584 -
\??\c:\3htttt.exec:\3htttt.exe39⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jpdpp.exec:\jpdpp.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2752 -
\??\c:\vjpjd.exec:\vjpjd.exe41⤵
- Executes dropped EXE
PID:280 -
\??\c:\7vvdd.exec:\7vvdd.exe42⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xrffllf.exec:\xrffllf.exe43⤵
- Executes dropped EXE
PID:1720 -
\??\c:\3rrrrrx.exec:\3rrrrrx.exe44⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ffxrffl.exec:\ffxrffl.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:576 -
\??\c:\hhhtbh.exec:\hhhtbh.exe46⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hnnnnn.exec:\hnnnnn.exe47⤵
- Executes dropped EXE
PID:944 -
\??\c:\1vjdd.exec:\1vjdd.exe48⤵
- Executes dropped EXE
PID:1184 -
\??\c:\vvjvp.exec:\vvjvp.exe49⤵
- Executes dropped EXE
PID:444 -
\??\c:\pjppv.exec:\pjppv.exe50⤵
- Executes dropped EXE
PID:1132 -
\??\c:\ffrxllf.exec:\ffrxllf.exe51⤵
- Executes dropped EXE
PID:1212 -
\??\c:\rrflxfr.exec:\rrflxfr.exe52⤵
- Executes dropped EXE
PID:2760 -
\??\c:\fxffflx.exec:\fxffflx.exe53⤵
- Executes dropped EXE
PID:1092 -
\??\c:\9btbnt.exec:\9btbnt.exe54⤵
- Executes dropped EXE
PID:1592 -
\??\c:\7nnnnt.exec:\7nnnnt.exe55⤵
- Executes dropped EXE
PID:1056 -
\??\c:\btthtb.exec:\btthtb.exe56⤵
- Executes dropped EXE
PID:2400 -
\??\c:\3vpvv.exec:\3vpvv.exe57⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jvjpv.exec:\jvjpv.exe58⤵
- Executes dropped EXE
PID:1292 -
\??\c:\vpvdd.exec:\vpvdd.exe59⤵
- Executes dropped EXE
PID:2356 -
\??\c:\lxrrlrr.exec:\lxrrlrr.exe60⤵
- Executes dropped EXE
PID:464 -
\??\c:\1fxxfff.exec:\1fxxfff.exe61⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ffxfxxl.exec:\ffxfxxl.exe62⤵
- Executes dropped EXE
PID:1324 -
\??\c:\hbhnnn.exec:\hbhnnn.exe63⤵
- Executes dropped EXE
PID:1544 -
\??\c:\ttbbnh.exec:\ttbbnh.exe64⤵
- Executes dropped EXE
PID:1200 -
\??\c:\btbnhn.exec:\btbnhn.exe65⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vvjdd.exec:\vvjdd.exe66⤵PID:2040
-
\??\c:\dddvd.exec:\dddvd.exe67⤵PID:952
-
\??\c:\xlxfxxr.exec:\xlxfxxr.exe68⤵PID:1048
-
\??\c:\xrfrffr.exec:\xrfrffr.exe69⤵PID:3000
-
\??\c:\lfxfxfl.exec:\lfxfxfl.exe70⤵PID:2732
-
\??\c:\hnhhtn.exec:\hnhhtn.exe71⤵PID:2208
-
\??\c:\tthbtb.exec:\tthbtb.exe72⤵PID:2824
-
\??\c:\dvjpv.exec:\dvjpv.exe73⤵PID:2788
-
\??\c:\vjdjv.exec:\vjdjv.exe74⤵PID:1224
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe75⤵PID:2876
-
\??\c:\btnttt.exec:\btnttt.exe76⤵PID:2700
-
\??\c:\3nhtbh.exec:\3nhtbh.exe77⤵PID:2608
-
\??\c:\7dppd.exec:\7dppd.exe78⤵PID:2696
-
\??\c:\7vdvp.exec:\7vdvp.exe79⤵PID:3052
-
\??\c:\3ddjj.exec:\3ddjj.exe80⤵PID:2128
-
\??\c:\fxrxlxf.exec:\fxrxlxf.exe81⤵PID:2648
-
\??\c:\ffxrflr.exec:\ffxrflr.exe82⤵PID:1188
-
\??\c:\htbtth.exec:\htbtth.exe83⤵PID:2136
-
\??\c:\hbnhtb.exec:\hbnhtb.exe84⤵PID:2900
-
\??\c:\vdpdd.exec:\vdpdd.exe85⤵PID:2968
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe86⤵PID:1964
-
\??\c:\tnbntb.exec:\tnbntb.exe87⤵PID:2976
-
\??\c:\3pddj.exec:\3pddj.exe88⤵PID:1328
-
\??\c:\nbhhtt.exec:\nbhhtt.exe89⤵PID:1184
-
\??\c:\vppjp.exec:\vppjp.exe90⤵PID:444
-
\??\c:\1xrrxxl.exec:\1xrrxxl.exe91⤵PID:1132
-
\??\c:\5fffrxl.exec:\5fffrxl.exe92⤵PID:1212
-
\??\c:\hbthnt.exec:\hbthnt.exe93⤵PID:2760
-
\??\c:\fxlflrx.exec:\fxlflrx.exe94⤵PID:1092
-
\??\c:\btbbhn.exec:\btbbhn.exe95⤵PID:1592
-
\??\c:\vjppv.exec:\vjppv.exe96⤵PID:1056
-
\??\c:\jdddj.exec:\jdddj.exe97⤵PID:2400
-
\??\c:\bthhtb.exec:\bthhtb.exe98⤵PID:2088
-
\??\c:\tnnbhh.exec:\tnnbhh.exe99⤵PID:1292
-
\??\c:\9jdjj.exec:\9jdjj.exe100⤵PID:2356
-
\??\c:\ddppp.exec:\ddppp.exe101⤵PID:880
-
\??\c:\1frfxlx.exec:\1frfxlx.exe102⤵PID:3036
-
\??\c:\nnttht.exec:\nnttht.exe103⤵PID:1324
-
\??\c:\vvpdd.exec:\vvpdd.exe104⤵PID:1544
-
\??\c:\djjjd.exec:\djjjd.exe105⤵PID:1200
-
\??\c:\lfxrlfr.exec:\lfxrlfr.exe106⤵PID:2416
-
\??\c:\ntthhb.exec:\ntthhb.exe107⤵PID:3016
-
\??\c:\7vpdp.exec:\7vpdp.exe108⤵PID:952
-
\??\c:\lfllllr.exec:\lfllllr.exe109⤵PID:872
-
\??\c:\3lffrxf.exec:\3lffrxf.exe110⤵PID:3000
-
\??\c:\bbtbbb.exec:\bbtbbb.exe111⤵PID:2732
-
\??\c:\hbhbtt.exec:\hbhbtt.exe112⤵PID:2208
-
\??\c:\7djdj.exec:\7djdj.exe113⤵PID:2824
-
\??\c:\xffffxx.exec:\xffffxx.exe114⤵PID:2788
-
\??\c:\1nhtbh.exec:\1nhtbh.exe115⤵PID:1224
-
\??\c:\tntntt.exec:\tntntt.exe116⤵PID:2920
-
\??\c:\dpdjj.exec:\dpdjj.exe117⤵PID:2700
-
\??\c:\xrfxffx.exec:\xrfxffx.exe118⤵PID:2608
-
\??\c:\httnnt.exec:\httnnt.exe119⤵PID:2696
-
\??\c:\pjpvd.exec:\pjpvd.exe120⤵PID:3052
-
\??\c:\frllllr.exec:\frllllr.exe121⤵PID:2128
-
\??\c:\bbtnbn.exec:\bbtnbn.exe122⤵PID:2648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-