Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 20:15
Static task
static1
Behavioral task
behavioral1
Sample
4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893N.exe
Resource
win7-20240903-en
General
-
Target
4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893N.exe
-
Size
132KB
-
MD5
cd4a651584f8cad238529e6fc5a7d8e0
-
SHA1
cd3da1994f4c6b70a34f598bb895d6d81db5d847
-
SHA256
4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893
-
SHA512
bd09f771f7f4b1c00ad8726600990c2b80efc8ace4cfe18951f074d2084ffdcc20bacb478354ecb075dadfb4ffbf9e3cee496d0e56eb7d8842cec49383f220b7
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9gFb8kSv3v1Jgs7hMw8s5bBZf1B:n3C9BRo7tvnJ9oLSvv1FhMVIfn
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1524-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/796-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/112-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/860-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/904-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2724 nnnhnb.exe 2728 jjjdp.exe 2736 llfxrfx.exe 3052 htntbb.exe 2580 hnthhn.exe 1628 ddjvd.exe 2620 hnthhb.exe 2488 7dvjv.exe 2124 3rrlxfx.exe 2556 tbtnbn.exe 2888 1bthht.exe 2868 7jvvv.exe 2220 1lrxrlx.exe 2644 nnhbnh.exe 2128 nnnbtb.exe 796 vvjdv.exe 592 xxxrfrr.exe 2196 rrlfrfr.exe 1980 nnbhtb.exe 2140 1pjjv.exe 2996 xxfrrfr.exe 1624 hhbhtb.exe 112 ttnbnb.exe 1764 vpjpd.exe 860 llflxll.exe 2500 xxfrxlf.exe 2080 5nnntb.exe 1688 vdvvp.exe 904 flflxlx.exe 896 9nhthb.exe 1524 5hnhnh.exe 1576 vpjpv.exe 2960 llfllxx.exe 2780 hnnhnh.exe 2840 1hhntb.exe 2772 1pdvd.exe 2592 pvvvv.exe 2576 9xlrxxl.exe 2572 rrlllff.exe 1628 ttnbth.exe 3044 hnhnbn.exe 2452 jdpvd.exe 2872 jjdjv.exe 2988 5rrxlrx.exe 2932 llrffff.exe 2408 hnnnhb.exe 2892 ppjvj.exe 2896 jdjvj.exe 1748 lrlfxxx.exe 2068 flxlrrf.exe 560 9nhthb.exe 692 bbntht.exe 908 jpjjd.exe 2384 jppdv.exe 2364 9fflxfx.exe 928 ffxlxfx.exe 2140 hhhthh.exe 2256 hbbhnt.exe 1952 ppjdj.exe 1616 jvdpp.exe 1976 xxlrlfx.exe 1540 llxfrxl.exe 860 ttnthn.exe 2656 9hbbth.exe -
resource yara_rule behavioral1/memory/1524-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/112-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/860-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/904-280-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfflflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1524 wrote to memory of 2724 1524 4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893N.exe 30 PID 1524 wrote to memory of 2724 1524 4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893N.exe 30 PID 1524 wrote to memory of 2724 1524 4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893N.exe 30 PID 1524 wrote to memory of 2724 1524 4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893N.exe 30 PID 2724 wrote to memory of 2728 2724 nnnhnb.exe 31 PID 2724 wrote to memory of 2728 2724 nnnhnb.exe 31 PID 2724 wrote to memory of 2728 2724 nnnhnb.exe 31 PID 2724 wrote to memory of 2728 2724 nnnhnb.exe 31 PID 2728 wrote to memory of 2736 2728 jjjdp.exe 32 PID 2728 wrote to memory of 2736 2728 jjjdp.exe 32 PID 2728 wrote to memory of 2736 2728 jjjdp.exe 32 PID 2728 wrote to memory of 2736 2728 jjjdp.exe 32 PID 2736 wrote to memory of 3052 2736 llfxrfx.exe 33 PID 2736 wrote to memory of 3052 2736 llfxrfx.exe 33 PID 2736 wrote to memory of 3052 2736 llfxrfx.exe 33 PID 2736 wrote to memory of 3052 2736 llfxrfx.exe 33 PID 3052 wrote to memory of 2580 3052 htntbb.exe 34 PID 3052 wrote to memory of 2580 3052 htntbb.exe 34 PID 3052 wrote to memory of 2580 3052 htntbb.exe 34 PID 3052 wrote to memory of 2580 3052 htntbb.exe 34 PID 2580 wrote to memory of 1628 2580 hnthhn.exe 35 PID 2580 wrote to memory of 1628 2580 hnthhn.exe 35 PID 2580 wrote to memory of 1628 2580 hnthhn.exe 35 PID 2580 wrote to memory of 1628 2580 hnthhn.exe 35 PID 1628 wrote to memory of 2620 1628 ddjvd.exe 36 PID 1628 wrote to memory of 2620 1628 ddjvd.exe 36 PID 1628 wrote to memory of 2620 1628 ddjvd.exe 36 PID 1628 wrote to memory of 2620 1628 ddjvd.exe 36 PID 2620 wrote to memory of 2488 2620 hnthhb.exe 37 PID 2620 wrote to memory of 2488 2620 hnthhb.exe 37 PID 2620 wrote to memory of 2488 2620 hnthhb.exe 37 PID 2620 wrote to memory of 2488 2620 hnthhb.exe 37 PID 2488 wrote to memory of 2124 2488 7dvjv.exe 38 PID 2488 wrote to memory of 2124 2488 7dvjv.exe 38 PID 2488 wrote to memory of 2124 2488 7dvjv.exe 38 PID 2488 wrote to memory of 2124 2488 7dvjv.exe 38 PID 2124 wrote to memory of 2556 2124 3rrlxfx.exe 39 PID 2124 wrote to memory of 2556 2124 3rrlxfx.exe 39 PID 2124 wrote to memory of 2556 2124 3rrlxfx.exe 39 PID 2124 wrote to memory of 2556 2124 3rrlxfx.exe 39 PID 2556 wrote to memory of 2888 2556 tbtnbn.exe 40 PID 2556 wrote to memory of 2888 2556 tbtnbn.exe 40 PID 2556 wrote to memory of 2888 2556 tbtnbn.exe 40 PID 2556 wrote to memory of 2888 2556 tbtnbn.exe 40 PID 2888 wrote to memory of 2868 2888 1bthht.exe 41 PID 2888 wrote to memory of 2868 2888 1bthht.exe 41 PID 2888 wrote to memory of 2868 2888 1bthht.exe 41 PID 2888 wrote to memory of 2868 2888 1bthht.exe 41 PID 2868 wrote to memory of 2220 2868 7jvvv.exe 42 PID 2868 wrote to memory of 2220 2868 7jvvv.exe 42 PID 2868 wrote to memory of 2220 2868 7jvvv.exe 42 PID 2868 wrote to memory of 2220 2868 7jvvv.exe 42 PID 2220 wrote to memory of 2644 2220 1lrxrlx.exe 43 PID 2220 wrote to memory of 2644 2220 1lrxrlx.exe 43 PID 2220 wrote to memory of 2644 2220 1lrxrlx.exe 43 PID 2220 wrote to memory of 2644 2220 1lrxrlx.exe 43 PID 2644 wrote to memory of 2128 2644 nnhbnh.exe 44 PID 2644 wrote to memory of 2128 2644 nnhbnh.exe 44 PID 2644 wrote to memory of 2128 2644 nnhbnh.exe 44 PID 2644 wrote to memory of 2128 2644 nnhbnh.exe 44 PID 2128 wrote to memory of 796 2128 nnnbtb.exe 45 PID 2128 wrote to memory of 796 2128 nnnbtb.exe 45 PID 2128 wrote to memory of 796 2128 nnnbtb.exe 45 PID 2128 wrote to memory of 796 2128 nnnbtb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893N.exe"C:\Users\Admin\AppData\Local\Temp\4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\nnnhnb.exec:\nnnhnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\jjjdp.exec:\jjjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\llfxrfx.exec:\llfxrfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\htntbb.exec:\htntbb.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\hnthhn.exec:\hnthhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\ddjvd.exec:\ddjvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\hnthhb.exec:\hnthhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\7dvjv.exec:\7dvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\3rrlxfx.exec:\3rrlxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\tbtnbn.exec:\tbtnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\1bthht.exec:\1bthht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\7jvvv.exec:\7jvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\1lrxrlx.exec:\1lrxrlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\nnhbnh.exec:\nnhbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\nnnbtb.exec:\nnnbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\vvjdv.exec:\vvjdv.exe17⤵
- Executes dropped EXE
PID:796 -
\??\c:\xxxrfrr.exec:\xxxrfrr.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:592 -
\??\c:\rrlfrfr.exec:\rrlfrfr.exe19⤵
- Executes dropped EXE
PID:2196 -
\??\c:\nnbhtb.exec:\nnbhtb.exe20⤵
- Executes dropped EXE
PID:1980 -
\??\c:\1pjjv.exec:\1pjjv.exe21⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xxfrrfr.exec:\xxfrrfr.exe22⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hhbhtb.exec:\hhbhtb.exe23⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ttnbnb.exec:\ttnbnb.exe24⤵
- Executes dropped EXE
PID:112 -
\??\c:\vpjpd.exec:\vpjpd.exe25⤵
- Executes dropped EXE
PID:1764 -
\??\c:\llflxll.exec:\llflxll.exe26⤵
- Executes dropped EXE
PID:860 -
\??\c:\xxfrxlf.exec:\xxfrxlf.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2500 -
\??\c:\5nnntb.exec:\5nnntb.exe28⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vdvvp.exec:\vdvvp.exe29⤵
- Executes dropped EXE
PID:1688 -
\??\c:\flflxlx.exec:\flflxlx.exe30⤵
- Executes dropped EXE
PID:904 -
\??\c:\9nhthb.exec:\9nhthb.exe31⤵
- Executes dropped EXE
PID:896 -
\??\c:\5hnhnh.exec:\5hnhnh.exe32⤵
- Executes dropped EXE
PID:1524 -
\??\c:\vpjpv.exec:\vpjpv.exe33⤵
- Executes dropped EXE
PID:1576 -
\??\c:\llfllxx.exec:\llfllxx.exe34⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hnnhnh.exec:\hnnhnh.exe35⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1hhntb.exec:\1hhntb.exe36⤵
- Executes dropped EXE
PID:2840 -
\??\c:\1pdvd.exec:\1pdvd.exe37⤵
- Executes dropped EXE
PID:2772 -
\??\c:\pvvvv.exec:\pvvvv.exe38⤵
- Executes dropped EXE
PID:2592 -
\??\c:\9xlrxxl.exec:\9xlrxxl.exe39⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rrlllff.exec:\rrlllff.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ttnbth.exec:\ttnbth.exe41⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hnhnbn.exec:\hnhnbn.exe42⤵
- Executes dropped EXE
PID:3044 -
\??\c:\jdpvd.exec:\jdpvd.exe43⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jjdjv.exec:\jjdjv.exe44⤵
- Executes dropped EXE
PID:2872 -
\??\c:\5rrxlrx.exec:\5rrxlrx.exe45⤵
- Executes dropped EXE
PID:2988 -
\??\c:\llrffff.exec:\llrffff.exe46⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hnnnhb.exec:\hnnnhb.exe47⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ppjvj.exec:\ppjvj.exe48⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jdjvj.exec:\jdjvj.exe49⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lrlfxxx.exec:\lrlfxxx.exe50⤵
- Executes dropped EXE
PID:1748 -
\??\c:\flxlrrf.exec:\flxlrrf.exe51⤵
- Executes dropped EXE
PID:2068 -
\??\c:\9nhthb.exec:\9nhthb.exe52⤵
- Executes dropped EXE
PID:560 -
\??\c:\bbntht.exec:\bbntht.exe53⤵
- Executes dropped EXE
PID:692 -
\??\c:\jpjjd.exec:\jpjjd.exe54⤵
- Executes dropped EXE
PID:908 -
\??\c:\jppdv.exec:\jppdv.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2384 -
\??\c:\9fflxfx.exec:\9fflxfx.exe56⤵
- Executes dropped EXE
PID:2364 -
\??\c:\ffxlxfx.exec:\ffxlxfx.exe57⤵
- Executes dropped EXE
PID:928 -
\??\c:\hhhthh.exec:\hhhthh.exe58⤵
- Executes dropped EXE
PID:2140 -
\??\c:\hbbhnt.exec:\hbbhnt.exe59⤵
- Executes dropped EXE
PID:2256 -
\??\c:\ppjdj.exec:\ppjdj.exe60⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jvdpp.exec:\jvdpp.exe61⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xxlrlfx.exec:\xxlrlfx.exe62⤵
- Executes dropped EXE
PID:1976 -
\??\c:\llxfrxl.exec:\llxfrxl.exe63⤵
- Executes dropped EXE
PID:1540 -
\??\c:\ttnthn.exec:\ttnthn.exe64⤵
- Executes dropped EXE
PID:860 -
\??\c:\9hbbth.exec:\9hbbth.exe65⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ppdpv.exec:\ppdpv.exe66⤵PID:320
-
\??\c:\vpjvj.exec:\vpjvj.exe67⤵PID:856
-
\??\c:\1rrxrfl.exec:\1rrxrfl.exe68⤵PID:1040
-
\??\c:\7tbthn.exec:\7tbthn.exe69⤵PID:2348
-
\??\c:\7bthtt.exec:\7bthtt.exe70⤵PID:2028
-
\??\c:\jdjvv.exec:\jdjvv.exe71⤵PID:2136
-
\??\c:\ppjdv.exec:\ppjdv.exe72⤵PID:2320
-
\??\c:\5xxflxl.exec:\5xxflxl.exe73⤵PID:2820
-
\??\c:\xffrlfx.exec:\xffrlfx.exe74⤵PID:2808
-
\??\c:\htnhtn.exec:\htnhtn.exe75⤵PID:2612
-
\??\c:\btnhtt.exec:\btnhtt.exe76⤵PID:2624
-
\??\c:\jvddp.exec:\jvddp.exe77⤵PID:3052
-
\??\c:\xrfxlfl.exec:\xrfxlfl.exe78⤵PID:2696
-
\??\c:\rrrfrlx.exec:\rrrfrlx.exe79⤵
- System Location Discovery: System Language Discovery
PID:1632 -
\??\c:\nhbhbh.exec:\nhbhbh.exe80⤵PID:1580
-
\??\c:\nnbtht.exec:\nnbtht.exe81⤵PID:3036
-
\??\c:\jjpjj.exec:\jjpjj.exe82⤵PID:448
-
\??\c:\vvpvj.exec:\vvpvj.exe83⤵PID:1492
-
\??\c:\fxlflll.exec:\fxlflll.exe84⤵PID:2980
-
\??\c:\xxxfrxl.exec:\xxxfrxl.exe85⤵PID:1808
-
\??\c:\hntbbn.exec:\hntbbn.exe86⤵PID:2756
-
\??\c:\hhtntt.exec:\hhtntt.exe87⤵PID:2900
-
\??\c:\pdpjv.exec:\pdpjv.exe88⤵PID:2548
-
\??\c:\fllxlxr.exec:\fllxlxr.exe89⤵PID:864
-
\??\c:\ffxlxlx.exec:\ffxlxlx.exe90⤵PID:2752
-
\??\c:\rlflxfx.exec:\rlflxfx.exe91⤵PID:2068
-
\??\c:\htbnbn.exec:\htbnbn.exe92⤵PID:1872
-
\??\c:\jjvjp.exec:\jjvjp.exe93⤵PID:2216
-
\??\c:\dvppj.exec:\dvppj.exe94⤵PID:1272
-
\??\c:\7fxxflf.exec:\7fxxflf.exe95⤵PID:1776
-
\??\c:\xxxfrll.exec:\xxxfrll.exe96⤵PID:1644
-
\??\c:\9tbhbh.exec:\9tbhbh.exe97⤵PID:2116
-
\??\c:\vjjdd.exec:\vjjdd.exe98⤵PID:2224
-
\??\c:\7vdjv.exec:\7vdjv.exe99⤵PID:2100
-
\??\c:\7xxfrxr.exec:\7xxfrxr.exe100⤵PID:1464
-
\??\c:\rxxfxlx.exec:\rxxfxlx.exe101⤵PID:2012
-
\??\c:\hnbbth.exec:\hnbbth.exe102⤵PID:2432
-
\??\c:\nnttht.exec:\nnttht.exe103⤵PID:1552
-
\??\c:\djdvv.exec:\djdvv.exe104⤵PID:1564
-
\??\c:\vddpd.exec:\vddpd.exe105⤵PID:548
-
\??\c:\rrlxrfx.exec:\rrlxrfx.exe106⤵PID:468
-
\??\c:\5hbhnb.exec:\5hbhnb.exe107⤵PID:340
-
\??\c:\hnbhhn.exec:\hnbhhn.exe108⤵PID:1052
-
\??\c:\9ppvp.exec:\9ppvp.exe109⤵PID:644
-
\??\c:\pjjjv.exec:\pjjjv.exe110⤵PID:2716
-
\??\c:\xxrfxlf.exec:\xxrfxlf.exe111⤵PID:2448
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe112⤵PID:2380
-
\??\c:\7bhhth.exec:\7bhhth.exe113⤵PID:2956
-
\??\c:\ddvdj.exec:\ddvdj.exe114⤵PID:2720
-
\??\c:\pjddp.exec:\pjddp.exe115⤵PID:2920
-
\??\c:\lrffxxf.exec:\lrffxxf.exe116⤵PID:2764
-
\??\c:\9lrflrl.exec:\9lrflrl.exe117⤵PID:2604
-
\??\c:\thnbbt.exec:\thnbbt.exe118⤵PID:3040
-
\??\c:\ddvjv.exec:\ddvjv.exe119⤵PID:3028
-
\??\c:\jvvjp.exec:\jvvjp.exe120⤵PID:2580
-
\??\c:\frxrxrx.exec:\frxrxrx.exe121⤵PID:1628
-
\??\c:\xrffllr.exec:\xrffllr.exe122⤵PID:2488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-