Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 19:30
Static task
static1
Behavioral task
behavioral1
Sample
805528b6f5b6337c28330e16993a7c5171c05eb23bed65155e774296b2e12d50N.exe
Resource
win7-20240903-en
General
-
Target
805528b6f5b6337c28330e16993a7c5171c05eb23bed65155e774296b2e12d50N.exe
-
Size
82KB
-
MD5
8646c1bee72794efede31252b58c2910
-
SHA1
94cc318ffdfaf98a951610b4d6c7d9f4fd7506ef
-
SHA256
805528b6f5b6337c28330e16993a7c5171c05eb23bed65155e774296b2e12d50
-
SHA512
59f5a040f4d94d0788881165ef224ae46b89c25f10a8c419022a26e83d404d70bb98ebd4395b0e9589e42d1772df81d46a4d894cd135bf186dc5709d37f15779
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Qo2:ymb3NkkiQ3mdBjFIIp9L9QrrA8l2
Malware Config
Signatures
-
Detect Blackmoon payload 17 IoCs
resource yara_rule behavioral1/memory/2600-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1220-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1100 dvjjd.exe 2920 lfrfxlx.exe 2480 9frxflr.exe 2892 nhthht.exe 2852 vpdvj.exe 2760 vpddp.exe 2676 xlrrxlx.exe 2648 1tnbbh.exe 2056 vdddj.exe 1720 dddpd.exe 1560 xrxflll.exe 3004 bthbhn.exe 560 5bnthn.exe 484 dddpd.exe 1664 dvdvj.exe 2984 xrrrxfl.exe 1220 rfxffrf.exe 1644 nnbhhn.exe 2052 hhttbt.exe 2072 vvpdj.exe 1840 ppddd.exe 860 rfrllfr.exe 1808 rrrffrf.exe 3048 nhbbht.exe 1632 hhhbhn.exe 2220 vpvvv.exe 1756 ddvdj.exe 2396 xrxxllr.exe 2444 rllrrxl.exe 3040 tthntb.exe 1736 1vpvv.exe 1712 dvjpp.exe 2924 5lrxrrx.exe 2508 flrlrll.exe 2748 hbhnhn.exe 1620 nbnhhb.exe 2792 jdpvd.exe 2644 rlrlfxf.exe 2224 rfllxxf.exe 2760 tbhbbn.exe 1992 5nnnhh.exe 2676 3jvdv.exe 2012 dvjvp.exe 2456 lfxfrrf.exe 1316 5lflxfr.exe 1492 bttnbt.exe 1536 bnhhhb.exe 536 jvddv.exe 976 1dppd.exe 2712 xlxfffl.exe 2964 rfllrxf.exe 1356 bhhthh.exe 1940 nbbtnh.exe 1200 7djjp.exe 2128 vvddj.exe 2416 xlfrlrx.exe 2072 xlllrll.exe 2420 bbhntb.exe 2348 nbhtbh.exe 1708 vjppv.exe 448 dpdvp.exe 3060 lfrlrrr.exe 2408 fxfffxr.exe 2240 9hbbhh.exe -
resource yara_rule behavioral1/memory/2600-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1220-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-238-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2600 wrote to memory of 1100 2600 805528b6f5b6337c28330e16993a7c5171c05eb23bed65155e774296b2e12d50N.exe 30 PID 2600 wrote to memory of 1100 2600 805528b6f5b6337c28330e16993a7c5171c05eb23bed65155e774296b2e12d50N.exe 30 PID 2600 wrote to memory of 1100 2600 805528b6f5b6337c28330e16993a7c5171c05eb23bed65155e774296b2e12d50N.exe 30 PID 2600 wrote to memory of 1100 2600 805528b6f5b6337c28330e16993a7c5171c05eb23bed65155e774296b2e12d50N.exe 30 PID 1100 wrote to memory of 2920 1100 dvjjd.exe 31 PID 1100 wrote to memory of 2920 1100 dvjjd.exe 31 PID 1100 wrote to memory of 2920 1100 dvjjd.exe 31 PID 1100 wrote to memory of 2920 1100 dvjjd.exe 31 PID 2920 wrote to memory of 2480 2920 lfrfxlx.exe 32 PID 2920 wrote to memory of 2480 2920 lfrfxlx.exe 32 PID 2920 wrote to memory of 2480 2920 lfrfxlx.exe 32 PID 2920 wrote to memory of 2480 2920 lfrfxlx.exe 32 PID 2480 wrote to memory of 2892 2480 9frxflr.exe 33 PID 2480 wrote to memory of 2892 2480 9frxflr.exe 33 PID 2480 wrote to memory of 2892 2480 9frxflr.exe 33 PID 2480 wrote to memory of 2892 2480 9frxflr.exe 33 PID 2892 wrote to memory of 2852 2892 nhthht.exe 34 PID 2892 wrote to memory of 2852 2892 nhthht.exe 34 PID 2892 wrote to memory of 2852 2892 nhthht.exe 34 PID 2892 wrote to memory of 2852 2892 nhthht.exe 34 PID 2852 wrote to memory of 2760 2852 vpdvj.exe 35 PID 2852 wrote to memory of 2760 2852 vpdvj.exe 35 PID 2852 wrote to memory of 2760 2852 vpdvj.exe 35 PID 2852 wrote to memory of 2760 2852 vpdvj.exe 35 PID 2760 wrote to memory of 2676 2760 vpddp.exe 36 PID 2760 wrote to memory of 2676 2760 vpddp.exe 36 PID 2760 wrote to memory of 2676 2760 vpddp.exe 36 PID 2760 wrote to memory of 2676 2760 vpddp.exe 36 PID 2676 wrote to memory of 2648 2676 xlrrxlx.exe 37 PID 2676 wrote to memory of 2648 2676 xlrrxlx.exe 37 PID 2676 wrote to memory of 2648 2676 xlrrxlx.exe 37 PID 2676 wrote to memory of 2648 2676 xlrrxlx.exe 37 PID 2648 wrote to memory of 2056 2648 1tnbbh.exe 38 PID 2648 wrote to memory of 2056 2648 1tnbbh.exe 38 PID 2648 wrote to memory of 2056 2648 1tnbbh.exe 38 PID 2648 wrote to memory of 2056 2648 1tnbbh.exe 38 PID 2056 wrote to memory of 1720 2056 vdddj.exe 39 PID 2056 wrote to memory of 1720 2056 vdddj.exe 39 PID 2056 wrote to memory of 1720 2056 vdddj.exe 39 PID 2056 wrote to memory of 1720 2056 vdddj.exe 39 PID 1720 wrote to memory of 1560 1720 dddpd.exe 40 PID 1720 wrote to memory of 1560 1720 dddpd.exe 40 PID 1720 wrote to memory of 1560 1720 dddpd.exe 40 PID 1720 wrote to memory of 1560 1720 dddpd.exe 40 PID 1560 wrote to memory of 3004 1560 xrxflll.exe 41 PID 1560 wrote to memory of 3004 1560 xrxflll.exe 41 PID 1560 wrote to memory of 3004 1560 xrxflll.exe 41 PID 1560 wrote to memory of 3004 1560 xrxflll.exe 41 PID 3004 wrote to memory of 560 3004 bthbhn.exe 42 PID 3004 wrote to memory of 560 3004 bthbhn.exe 42 PID 3004 wrote to memory of 560 3004 bthbhn.exe 42 PID 3004 wrote to memory of 560 3004 bthbhn.exe 42 PID 560 wrote to memory of 484 560 5bnthn.exe 43 PID 560 wrote to memory of 484 560 5bnthn.exe 43 PID 560 wrote to memory of 484 560 5bnthn.exe 43 PID 560 wrote to memory of 484 560 5bnthn.exe 43 PID 484 wrote to memory of 1664 484 dddpd.exe 44 PID 484 wrote to memory of 1664 484 dddpd.exe 44 PID 484 wrote to memory of 1664 484 dddpd.exe 44 PID 484 wrote to memory of 1664 484 dddpd.exe 44 PID 1664 wrote to memory of 2984 1664 dvdvj.exe 45 PID 1664 wrote to memory of 2984 1664 dvdvj.exe 45 PID 1664 wrote to memory of 2984 1664 dvdvj.exe 45 PID 1664 wrote to memory of 2984 1664 dvdvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\805528b6f5b6337c28330e16993a7c5171c05eb23bed65155e774296b2e12d50N.exe"C:\Users\Admin\AppData\Local\Temp\805528b6f5b6337c28330e16993a7c5171c05eb23bed65155e774296b2e12d50N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\dvjjd.exec:\dvjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\lfrfxlx.exec:\lfrfxlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\9frxflr.exec:\9frxflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\nhthht.exec:\nhthht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\vpdvj.exec:\vpdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\vpddp.exec:\vpddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\xlrrxlx.exec:\xlrrxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\1tnbbh.exec:\1tnbbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\vdddj.exec:\vdddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\dddpd.exec:\dddpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\xrxflll.exec:\xrxflll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\bthbhn.exec:\bthbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\5bnthn.exec:\5bnthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\dddpd.exec:\dddpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\dvdvj.exec:\dvdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\xrrrxfl.exec:\xrrrxfl.exe17⤵
- Executes dropped EXE
PID:2984 -
\??\c:\rfxffrf.exec:\rfxffrf.exe18⤵
- Executes dropped EXE
PID:1220 -
\??\c:\nnbhhn.exec:\nnbhhn.exe19⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hhttbt.exec:\hhttbt.exe20⤵
- Executes dropped EXE
PID:2052 -
\??\c:\vvpdj.exec:\vvpdj.exe21⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ppddd.exec:\ppddd.exe22⤵
- Executes dropped EXE
PID:1840 -
\??\c:\rfrllfr.exec:\rfrllfr.exe23⤵
- Executes dropped EXE
PID:860 -
\??\c:\rrrffrf.exec:\rrrffrf.exe24⤵
- Executes dropped EXE
PID:1808 -
\??\c:\nhbbht.exec:\nhbbht.exe25⤵
- Executes dropped EXE
PID:3048 -
\??\c:\hhhbhn.exec:\hhhbhn.exe26⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vpvvv.exec:\vpvvv.exe27⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ddvdj.exec:\ddvdj.exe28⤵
- Executes dropped EXE
PID:1756 -
\??\c:\xrxxllr.exec:\xrxxllr.exe29⤵
- Executes dropped EXE
PID:2396 -
\??\c:\rllrrxl.exec:\rllrrxl.exe30⤵
- Executes dropped EXE
PID:2444 -
\??\c:\tthntb.exec:\tthntb.exe31⤵
- Executes dropped EXE
PID:3040 -
\??\c:\1vpvv.exec:\1vpvv.exe32⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvjpp.exec:\dvjpp.exe33⤵
- Executes dropped EXE
PID:1712 -
\??\c:\5lrxrrx.exec:\5lrxrrx.exe34⤵
- Executes dropped EXE
PID:2924 -
\??\c:\flrlrll.exec:\flrlrll.exe35⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hbhnhn.exec:\hbhnhn.exe36⤵
- Executes dropped EXE
PID:2748 -
\??\c:\nbnhhb.exec:\nbnhhb.exe37⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jdpvd.exec:\jdpvd.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\rlrlfxf.exec:\rlrlfxf.exe39⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rfllxxf.exec:\rfllxxf.exe40⤵
- Executes dropped EXE
PID:2224 -
\??\c:\tbhbbn.exec:\tbhbbn.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5nnnhh.exec:\5nnnhh.exe42⤵
- Executes dropped EXE
PID:1992 -
\??\c:\3jvdv.exec:\3jvdv.exe43⤵
- Executes dropped EXE
PID:2676 -
\??\c:\dvjvp.exec:\dvjvp.exe44⤵
- Executes dropped EXE
PID:2012 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe45⤵
- Executes dropped EXE
PID:2456 -
\??\c:\5lflxfr.exec:\5lflxfr.exe46⤵
- Executes dropped EXE
PID:1316 -
\??\c:\bttnbt.exec:\bttnbt.exe47⤵
- Executes dropped EXE
PID:1492 -
\??\c:\bnhhhb.exec:\bnhhhb.exe48⤵
- Executes dropped EXE
PID:1536 -
\??\c:\jvddv.exec:\jvddv.exe49⤵
- Executes dropped EXE
PID:536 -
\??\c:\1dppd.exec:\1dppd.exe50⤵
- Executes dropped EXE
PID:976 -
\??\c:\xlxfffl.exec:\xlxfffl.exe51⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rfllrxf.exec:\rfllrxf.exe52⤵
- Executes dropped EXE
PID:2964 -
\??\c:\bhhthh.exec:\bhhthh.exe53⤵
- Executes dropped EXE
PID:1356 -
\??\c:\nbbtnh.exec:\nbbtnh.exe54⤵
- Executes dropped EXE
PID:1940 -
\??\c:\7djjp.exec:\7djjp.exe55⤵
- Executes dropped EXE
PID:1200 -
\??\c:\vvddj.exec:\vvddj.exe56⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xlfrlrx.exec:\xlfrlrx.exe57⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xlllrll.exec:\xlllrll.exe58⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bbhntb.exec:\bbhntb.exe59⤵
- Executes dropped EXE
PID:2420 -
\??\c:\nbhtbh.exec:\nbhtbh.exe60⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vjppv.exec:\vjppv.exe61⤵
- Executes dropped EXE
PID:1708 -
\??\c:\dpdvp.exec:\dpdvp.exe62⤵
- Executes dropped EXE
PID:448 -
\??\c:\lfrlrrr.exec:\lfrlrrr.exe63⤵
- Executes dropped EXE
PID:3060 -
\??\c:\fxfffxr.exec:\fxfffxr.exe64⤵
- Executes dropped EXE
PID:2408 -
\??\c:\9hbbhh.exec:\9hbbhh.exe65⤵
- Executes dropped EXE
PID:2240 -
\??\c:\hthbbb.exec:\hthbbb.exe66⤵PID:2980
-
\??\c:\vvpdd.exec:\vvpdd.exe67⤵PID:2544
-
\??\c:\jdjdd.exec:\jdjdd.exe68⤵PID:2396
-
\??\c:\lflllff.exec:\lflllff.exe69⤵PID:1516
-
\??\c:\1rxrrxx.exec:\1rxrrxx.exe70⤵PID:2212
-
\??\c:\xlxfffl.exec:\xlxfffl.exe71⤵PID:2600
-
\??\c:\1hbtnh.exec:\1hbtnh.exe72⤵PID:1736
-
\??\c:\nhnttb.exec:\nhnttb.exe73⤵PID:1284
-
\??\c:\jvjpp.exec:\jvjpp.exe74⤵PID:2276
-
\??\c:\dpdjv.exec:\dpdjv.exe75⤵PID:2796
-
\??\c:\lxlllfl.exec:\lxlllfl.exe76⤵PID:2200
-
\??\c:\xrfxffr.exec:\xrfxffr.exe77⤵PID:2772
-
\??\c:\thtbnh.exec:\thtbnh.exe78⤵PID:2776
-
\??\c:\bthbbt.exec:\bthbbt.exe79⤵
- System Location Discovery: System Language Discovery
PID:2916 -
\??\c:\dpddd.exec:\dpddd.exe80⤵PID:1360
-
\??\c:\vjdvv.exec:\vjdvv.exe81⤵PID:2780
-
\??\c:\7jdpv.exec:\7jdpv.exe82⤵PID:2656
-
\??\c:\fxllllr.exec:\fxllllr.exe83⤵PID:2652
-
\??\c:\rfxflfl.exec:\rfxflfl.exe84⤵PID:2604
-
\??\c:\fxrxrxx.exec:\fxrxrxx.exe85⤵PID:2624
-
\??\c:\tnhbnt.exec:\tnhbnt.exe86⤵PID:1168
-
\??\c:\nttnnh.exec:\nttnnh.exe87⤵PID:980
-
\??\c:\pdvvj.exec:\pdvvj.exe88⤵PID:2744
-
\??\c:\pjpvd.exec:\pjpvd.exe89⤵PID:1336
-
\??\c:\lxlxxrr.exec:\lxlxxrr.exe90⤵PID:588
-
\??\c:\5rffffx.exec:\5rffffx.exe91⤵PID:2732
-
\??\c:\hbtnnt.exec:\hbtnnt.exe92⤵PID:1664
-
\??\c:\httbbh.exec:\httbbh.exe93⤵PID:2984
-
\??\c:\hhbbhn.exec:\hhbbhn.exe94⤵
- System Location Discovery: System Language Discovery
PID:1220 -
\??\c:\vpvdd.exec:\vpvdd.exe95⤵PID:1932
-
\??\c:\7dpjd.exec:\7dpjd.exe96⤵PID:2068
-
\??\c:\xrflflf.exec:\xrflflf.exe97⤵PID:784
-
\??\c:\xlxxfll.exec:\xlxxfll.exe98⤵PID:2404
-
\??\c:\bthhnn.exec:\bthhnn.exe99⤵PID:1652
-
\??\c:\hbnhtt.exec:\hbnhtt.exe100⤵PID:828
-
\??\c:\3htnnh.exec:\3htnnh.exe101⤵PID:2540
-
\??\c:\1ppvj.exec:\1ppvj.exe102⤵PID:1944
-
\??\c:\pjpvv.exec:\pjpvv.exe103⤵PID:1364
-
\??\c:\rlffrxx.exec:\rlffrxx.exe104⤵PID:2524
-
\??\c:\rlrrfxr.exec:\rlrrfxr.exe105⤵PID:1824
-
\??\c:\hhnbhh.exec:\hhnbhh.exe106⤵PID:2236
-
\??\c:\5hthnn.exec:\5hthnn.exe107⤵PID:1376
-
\??\c:\hbtbhh.exec:\hbtbhh.exe108⤵
- System Location Discovery: System Language Discovery
PID:1668 -
\??\c:\vvddv.exec:\vvddv.exe109⤵PID:2412
-
\??\c:\pdvjp.exec:\pdvjp.exe110⤵PID:1628
-
\??\c:\rfrrrxf.exec:\rfrrrxf.exe111⤵PID:2728
-
\??\c:\lxllllx.exec:\lxllllx.exe112⤵PID:1120
-
\??\c:\xrxffxf.exec:\xrxffxf.exe113⤵PID:2084
-
\??\c:\bnbhhn.exec:\bnbhhn.exe114⤵PID:3044
-
\??\c:\vvpvp.exec:\vvpvp.exe115⤵PID:1624
-
\??\c:\pjvdj.exec:\pjvdj.exe116⤵PID:2784
-
\??\c:\frxfxlr.exec:\frxfxlr.exe117⤵PID:3036
-
\??\c:\xrflrxl.exec:\xrflrxl.exe118⤵PID:2468
-
\??\c:\lxrxfrr.exec:\lxrxfrr.exe119⤵PID:2836
-
\??\c:\nhtbnh.exec:\nhtbnh.exe120⤵PID:2664
-
\??\c:\hbtbhb.exec:\hbtbhb.exe121⤵PID:2640
-
\??\c:\jdvvv.exec:\jdvvv.exe122⤵PID:1996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-