Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/11/2024, 21:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9.exe
-
Size
61KB
-
MD5
82fb189d757d46b906dee1dd955dee97
-
SHA1
581519de4e1328684fe445a51d857cf60052910e
-
SHA256
0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9
-
SHA512
572ddb2a2ad4294d4a21665164a819012b22983de6a7db02474bff4619a65be24c3768e4a3759e849a2ae3c1a645754420112aa811f403748dea96c5d4f83efb
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+byu:ymb3NkkiQ3mdBjF+3TpL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2420-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1844-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/788-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/816-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2372 nthbbn.exe 2812 ddpjj.exe 2980 3bttbh.exe 2680 dddpv.exe 2732 3frxfxf.exe 2580 7tthnn.exe 2392 vpdjp.exe 2028 bnbttt.exe 2524 hhhtbn.exe 2020 pvppv.exe 2300 xlrffxx.exe 2792 hthnnh.exe 1844 bbtbnn.exe 2932 djppd.exe 1652 fxrflrf.exe 788 9hnhth.exe 2200 ppppv.exe 2176 1vdvj.exe 3024 7jjpd.exe 2068 5htbth.exe 3048 btntnn.exe 972 pdvdp.exe 1644 7vpdp.exe 816 lfxrlfx.exe 1796 9hbbbh.exe 2052 tttbtb.exe 640 vpjvj.exe 696 3rrrrll.exe 1304 nnbhbt.exe 2532 jdvvd.exe 2216 pjvvv.exe 2668 lflfflf.exe 2832 nnbnbn.exe 2688 nhhttb.exe 2696 jdvdp.exe 2880 vpjpd.exe 2728 ffrxlrl.exe 2564 5nnnnb.exe 2628 hhbnth.exe 3068 jjjvd.exe 764 jdpdj.exe 2604 rlflrrf.exe 2028 thnttt.exe 2316 tbhttn.exe 2772 jpdvp.exe 2020 9xxfllr.exe 2300 xrlfrrl.exe 1348 nnnthh.exe 1248 tbnhbt.exe 1616 ppdpv.exe 1688 xxrrlxr.exe 1036 1tbnhn.exe 2236 djpdd.exe 2256 vpjvp.exe 2208 lfrrxlf.exe 2036 fxrlffr.exe 3016 hthhnh.exe 3036 tbhntn.exe 852 pdppp.exe 1044 vvpvj.exe 1016 7lflflx.exe 920 fflrrlf.exe 1556 bnbhnn.exe 2460 5tnbnt.exe -
resource yara_rule behavioral1/memory/2420-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/788-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-304-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2372 2420 0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9.exe 30 PID 2420 wrote to memory of 2372 2420 0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9.exe 30 PID 2420 wrote to memory of 2372 2420 0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9.exe 30 PID 2420 wrote to memory of 2372 2420 0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9.exe 30 PID 2372 wrote to memory of 2812 2372 nthbbn.exe 31 PID 2372 wrote to memory of 2812 2372 nthbbn.exe 31 PID 2372 wrote to memory of 2812 2372 nthbbn.exe 31 PID 2372 wrote to memory of 2812 2372 nthbbn.exe 31 PID 2812 wrote to memory of 2980 2812 ddpjj.exe 32 PID 2812 wrote to memory of 2980 2812 ddpjj.exe 32 PID 2812 wrote to memory of 2980 2812 ddpjj.exe 32 PID 2812 wrote to memory of 2980 2812 ddpjj.exe 32 PID 2980 wrote to memory of 2680 2980 3bttbh.exe 33 PID 2980 wrote to memory of 2680 2980 3bttbh.exe 33 PID 2980 wrote to memory of 2680 2980 3bttbh.exe 33 PID 2980 wrote to memory of 2680 2980 3bttbh.exe 33 PID 2680 wrote to memory of 2732 2680 dddpv.exe 34 PID 2680 wrote to memory of 2732 2680 dddpv.exe 34 PID 2680 wrote to memory of 2732 2680 dddpv.exe 34 PID 2680 wrote to memory of 2732 2680 dddpv.exe 34 PID 2732 wrote to memory of 2580 2732 3frxfxf.exe 35 PID 2732 wrote to memory of 2580 2732 3frxfxf.exe 35 PID 2732 wrote to memory of 2580 2732 3frxfxf.exe 35 PID 2732 wrote to memory of 2580 2732 3frxfxf.exe 35 PID 2580 wrote to memory of 2392 2580 7tthnn.exe 36 PID 2580 wrote to memory of 2392 2580 7tthnn.exe 36 PID 2580 wrote to memory of 2392 2580 7tthnn.exe 36 PID 2580 wrote to memory of 2392 2580 7tthnn.exe 36 PID 2392 wrote to memory of 2028 2392 vpdjp.exe 37 PID 2392 wrote to memory of 2028 2392 vpdjp.exe 37 PID 2392 wrote to memory of 2028 2392 vpdjp.exe 37 PID 2392 wrote to memory of 2028 2392 vpdjp.exe 37 PID 2028 wrote to memory of 2524 2028 bnbttt.exe 38 PID 2028 wrote to memory of 2524 2028 bnbttt.exe 38 PID 2028 wrote to memory of 2524 2028 bnbttt.exe 38 PID 2028 wrote to memory of 2524 2028 bnbttt.exe 38 PID 2524 wrote to memory of 2020 2524 hhhtbn.exe 39 PID 2524 wrote to memory of 2020 2524 hhhtbn.exe 39 PID 2524 wrote to memory of 2020 2524 hhhtbn.exe 39 PID 2524 wrote to memory of 2020 2524 hhhtbn.exe 39 PID 2020 wrote to memory of 2300 2020 pvppv.exe 40 PID 2020 wrote to memory of 2300 2020 pvppv.exe 40 PID 2020 wrote to memory of 2300 2020 pvppv.exe 40 PID 2020 wrote to memory of 2300 2020 pvppv.exe 40 PID 2300 wrote to memory of 2792 2300 xlrffxx.exe 41 PID 2300 wrote to memory of 2792 2300 xlrffxx.exe 41 PID 2300 wrote to memory of 2792 2300 xlrffxx.exe 41 PID 2300 wrote to memory of 2792 2300 xlrffxx.exe 41 PID 2792 wrote to memory of 1844 2792 hthnnh.exe 42 PID 2792 wrote to memory of 1844 2792 hthnnh.exe 42 PID 2792 wrote to memory of 1844 2792 hthnnh.exe 42 PID 2792 wrote to memory of 1844 2792 hthnnh.exe 42 PID 1844 wrote to memory of 2932 1844 bbtbnn.exe 43 PID 1844 wrote to memory of 2932 1844 bbtbnn.exe 43 PID 1844 wrote to memory of 2932 1844 bbtbnn.exe 43 PID 1844 wrote to memory of 2932 1844 bbtbnn.exe 43 PID 2932 wrote to memory of 1652 2932 djppd.exe 44 PID 2932 wrote to memory of 1652 2932 djppd.exe 44 PID 2932 wrote to memory of 1652 2932 djppd.exe 44 PID 2932 wrote to memory of 1652 2932 djppd.exe 44 PID 1652 wrote to memory of 788 1652 fxrflrf.exe 45 PID 1652 wrote to memory of 788 1652 fxrflrf.exe 45 PID 1652 wrote to memory of 788 1652 fxrflrf.exe 45 PID 1652 wrote to memory of 788 1652 fxrflrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9.exe"C:\Users\Admin\AppData\Local\Temp\0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\nthbbn.exec:\nthbbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\ddpjj.exec:\ddpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\3bttbh.exec:\3bttbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\dddpv.exec:\dddpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\3frxfxf.exec:\3frxfxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\7tthnn.exec:\7tthnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\vpdjp.exec:\vpdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\bnbttt.exec:\bnbttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\hhhtbn.exec:\hhhtbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\pvppv.exec:\pvppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\xlrffxx.exec:\xlrffxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\hthnnh.exec:\hthnnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\bbtbnn.exec:\bbtbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\djppd.exec:\djppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\fxrflrf.exec:\fxrflrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\9hnhth.exec:\9hnhth.exe17⤵
- Executes dropped EXE
PID:788 -
\??\c:\ppppv.exec:\ppppv.exe18⤵
- Executes dropped EXE
PID:2200 -
\??\c:\1vdvj.exec:\1vdvj.exe19⤵
- Executes dropped EXE
PID:2176 -
\??\c:\7jjpd.exec:\7jjpd.exe20⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5htbth.exec:\5htbth.exe21⤵
- Executes dropped EXE
PID:2068 -
\??\c:\btntnn.exec:\btntnn.exe22⤵
- Executes dropped EXE
PID:3048 -
\??\c:\pdvdp.exec:\pdvdp.exe23⤵
- Executes dropped EXE
PID:972 -
\??\c:\7vpdp.exec:\7vpdp.exe24⤵
- Executes dropped EXE
PID:1644 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe25⤵
- Executes dropped EXE
PID:816 -
\??\c:\9hbbbh.exec:\9hbbbh.exe26⤵
- Executes dropped EXE
PID:1796 -
\??\c:\tttbtb.exec:\tttbtb.exe27⤵
- Executes dropped EXE
PID:2052 -
\??\c:\vpjvj.exec:\vpjvj.exe28⤵
- Executes dropped EXE
PID:640 -
\??\c:\3rrrrll.exec:\3rrrrll.exe29⤵
- Executes dropped EXE
PID:696 -
\??\c:\nnbhbt.exec:\nnbhbt.exe30⤵
- Executes dropped EXE
PID:1304 -
\??\c:\jdvvd.exec:\jdvvd.exe31⤵
- Executes dropped EXE
PID:2532 -
\??\c:\pjvvv.exec:\pjvvv.exe32⤵
- Executes dropped EXE
PID:2216 -
\??\c:\lflfflf.exec:\lflfflf.exe33⤵
- Executes dropped EXE
PID:2668 -
\??\c:\nnbnbn.exec:\nnbnbn.exe34⤵
- Executes dropped EXE
PID:2832 -
\??\c:\nhhttb.exec:\nhhttb.exe35⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jdvdp.exec:\jdvdp.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vpjpd.exec:\vpjpd.exe37⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ffrxlrl.exec:\ffrxlrl.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\5nnnnb.exec:\5nnnnb.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\hhbnth.exec:\hhbnth.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jjjvd.exec:\jjjvd.exe41⤵
- Executes dropped EXE
PID:3068 -
\??\c:\jdpdj.exec:\jdpdj.exe42⤵
- Executes dropped EXE
PID:764 -
\??\c:\rlflrrf.exec:\rlflrrf.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\thnttt.exec:\thnttt.exe44⤵
- Executes dropped EXE
PID:2028 -
\??\c:\tbhttn.exec:\tbhttn.exe45⤵
- Executes dropped EXE
PID:2316 -
\??\c:\jpdvp.exec:\jpdvp.exe46⤵
- Executes dropped EXE
PID:2772 -
\??\c:\9xxfllr.exec:\9xxfllr.exe47⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe48⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nnnthh.exec:\nnnthh.exe49⤵
- Executes dropped EXE
PID:1348 -
\??\c:\tbnhbt.exec:\tbnhbt.exe50⤵
- Executes dropped EXE
PID:1248 -
\??\c:\ppdpv.exec:\ppdpv.exe51⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xxrrlxr.exec:\xxrrlxr.exe52⤵
- Executes dropped EXE
PID:1688 -
\??\c:\1tbnhn.exec:\1tbnhn.exe53⤵
- Executes dropped EXE
PID:1036 -
\??\c:\djpdd.exec:\djpdd.exe54⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vpjvp.exec:\vpjvp.exe55⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lfrrxlf.exec:\lfrrxlf.exe56⤵
- Executes dropped EXE
PID:2208 -
\??\c:\fxrlffr.exec:\fxrlffr.exe57⤵
- Executes dropped EXE
PID:2036 -
\??\c:\hthhnh.exec:\hthhnh.exe58⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tbhntn.exec:\tbhntn.exe59⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pdppp.exec:\pdppp.exe60⤵
- Executes dropped EXE
PID:852 -
\??\c:\vvpvj.exec:\vvpvj.exe61⤵
- Executes dropped EXE
PID:1044 -
\??\c:\7lflflx.exec:\7lflflx.exe62⤵
- Executes dropped EXE
PID:1016 -
\??\c:\fflrrlf.exec:\fflrrlf.exe63⤵
- Executes dropped EXE
PID:920 -
\??\c:\bnbhnn.exec:\bnbhnn.exe64⤵
- Executes dropped EXE
PID:1556 -
\??\c:\5tnbnt.exec:\5tnbnt.exe65⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jdvjp.exec:\jdvjp.exe66⤵PID:2892
-
\??\c:\9jpjp.exec:\9jpjp.exe67⤵PID:1008
-
\??\c:\5ffffrl.exec:\5ffffrl.exe68⤵PID:2352
-
\??\c:\lfxlffr.exec:\lfxlffr.exe69⤵PID:884
-
\??\c:\bbtbhn.exec:\bbtbhn.exe70⤵PID:1328
-
\??\c:\hbthhn.exec:\hbthhn.exe71⤵
- System Location Discovery: System Language Discovery
PID:1708 -
\??\c:\1jjdj.exec:\1jjdj.exe72⤵PID:1532
-
\??\c:\ddvvd.exec:\ddvvd.exe73⤵PID:2372
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe74⤵PID:1664
-
\??\c:\1fxfrxx.exec:\1fxfrxx.exe75⤵PID:2896
-
\??\c:\hhbthn.exec:\hhbthn.exe76⤵PID:2868
-
\??\c:\5vdvd.exec:\5vdvd.exe77⤵PID:2572
-
\??\c:\5vvpd.exec:\5vvpd.exe78⤵PID:2876
-
\??\c:\llxfxxl.exec:\llxfxxl.exe79⤵PID:2596
-
\??\c:\tnbhnn.exec:\tnbhnn.exe80⤵PID:3064
-
\??\c:\nttnth.exec:\nttnth.exe81⤵PID:3060
-
\??\c:\9ppdj.exec:\9ppdj.exe82⤵PID:588
-
\??\c:\vvppv.exec:\vvppv.exe83⤵PID:2124
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe84⤵PID:2660
-
\??\c:\1llrllr.exec:\1llrllr.exe85⤵PID:1620
-
\??\c:\ttttbh.exec:\ttttbh.exe86⤵PID:1208
-
\??\c:\vjjjd.exec:\vjjjd.exe87⤵PID:2772
-
\??\c:\jvdvd.exec:\jvdvd.exe88⤵PID:2664
-
\??\c:\rlxlxrx.exec:\rlxlxrx.exe89⤵PID:2364
-
\??\c:\ttnbnt.exec:\ttnbnt.exe90⤵PID:1844
-
\??\c:\nnbbhb.exec:\nnbbhb.exe91⤵PID:1660
-
\??\c:\pjvdv.exec:\pjvdv.exe92⤵PID:2948
-
\??\c:\pppvd.exec:\pppvd.exe93⤵PID:2220
-
\??\c:\lfrrfrl.exec:\lfrrfrl.exe94⤵PID:2432
-
\??\c:\5rrxflx.exec:\5rrxflx.exe95⤵PID:1732
-
\??\c:\nthnnh.exec:\nthnnh.exe96⤵PID:2160
-
\??\c:\nhhnhn.exec:\nhhnhn.exe97⤵PID:2436
-
\??\c:\7jpdd.exec:\7jpdd.exe98⤵PID:1148
-
\??\c:\rrrfrlx.exec:\rrrfrlx.exe99⤵PID:3024
-
\??\c:\rrfrllf.exec:\rrfrllf.exe100⤵PID:3048
-
\??\c:\9nhbhn.exec:\9nhbhn.exe101⤵PID:972
-
\??\c:\nntbnb.exec:\nntbnb.exe102⤵PID:672
-
\??\c:\ppjvd.exec:\ppjvd.exe103⤵PID:1704
-
\??\c:\dvppd.exec:\dvppd.exe104⤵PID:3032
-
\??\c:\flxxffl.exec:\flxxffl.exe105⤵PID:1432
-
\??\c:\llxrflf.exec:\llxrflf.exe106⤵PID:2888
-
\??\c:\nhnthn.exec:\nhnthn.exe107⤵PID:372
-
\??\c:\7ntnnb.exec:\7ntnnb.exe108⤵PID:2476
-
\??\c:\vjpjv.exec:\vjpjv.exe109⤵PID:544
-
\??\c:\lfxrxfx.exec:\lfxrxfx.exe110⤵PID:1684
-
\??\c:\fxrxflx.exec:\fxrxflx.exe111⤵PID:2532
-
\??\c:\htnttb.exec:\htnttb.exe112⤵PID:2424
-
\??\c:\hbhbhh.exec:\hbhbhh.exe113⤵PID:2668
-
\??\c:\vvvpv.exec:\vvvpv.exe114⤵PID:1596
-
\??\c:\jvjdj.exec:\jvjdj.exe115⤵PID:2820
-
\??\c:\1xlffxf.exec:\1xlffxf.exe116⤵PID:2444
-
\??\c:\bhbthb.exec:\bhbthb.exe117⤵PID:2868
-
\??\c:\bbtnbh.exec:\bbtnbh.exe118⤵PID:860
-
\??\c:\vvppj.exec:\vvppj.exe119⤵PID:2684
-
\??\c:\vjvjp.exec:\vjvjp.exe120⤵PID:2596
-
\??\c:\rlfrxlr.exec:\rlfrxlr.exe121⤵PID:2164
-
\??\c:\lfflrxr.exec:\lfflrxr.exe122⤵PID:2100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-