Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-11-2024 06:52
Static task
static1
Behavioral task
behavioral1
Sample
c12ae8483a49f306bad04007a1626814ae1facde5a96a635edb68a30739b1ac1.exe
Resource
win7-20240903-en
General
-
Target
c12ae8483a49f306bad04007a1626814ae1facde5a96a635edb68a30739b1ac1.exe
-
Size
83KB
-
MD5
1c21cdf50457cd171983a389f035eb07
-
SHA1
d77cff2de5dfc2594a6c3fc1b66abdfcd9a2ffc6
-
SHA256
c12ae8483a49f306bad04007a1626814ae1facde5a96a635edb68a30739b1ac1
-
SHA512
e07b8aeeda9728f6f22098ac7db46aa17c718c3682de2bd09ac4fef53ddaea59621b43c0d5244022a9dfe4c0a0222e8d70e90e5eb92acb82aa2e4692f9844dd4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Qc:ymb3NkkiQ3mdBjFIIp9L9QrrA8x
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2532-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1524 1jppp.exe 2988 3llffll.exe 2056 bbnnhh.exe 2908 5vjdj.exe 2756 pjddp.exe 2980 fxlxlrr.exe 2792 bnhtbn.exe 2640 9djjv.exe 2672 3jjjj.exe 2692 fxrxxfl.exe 3024 1fxfllr.exe 2848 thbbhn.exe 3060 ddvjv.exe 2816 vpjjj.exe 2844 lfxlrxl.exe 1824 7ffxfff.exe 788 hhtbnb.exe 2096 dvdjv.exe 2100 9dpvv.exe 2420 3ffrfxr.exe 1764 nbbbnn.exe 2000 bnhbnn.exe 1836 djddj.exe 1052 fffrlxf.exe 2508 1tntbh.exe 2484 tnbbhb.exe 2232 vjjvv.exe 1500 dpvvj.exe 2292 xrllfrx.exe 1524 btbhnt.exe 1572 hhtthh.exe 2084 vpddv.exe 2732 xxrflxf.exe 2904 rlfflfr.exe 2872 9nbhtb.exe 2812 hbtttt.exe 2820 vpdjj.exe 2880 7jjdj.exe 2620 3rflrxf.exe 2696 xrrlrrx.exe 2436 xrlfrxf.exe 1580 bbthnt.exe 1868 3pjpp.exe 2344 7jdvd.exe 2968 lfxffll.exe 2832 tntbbh.exe 2684 nhbnbb.exe 2956 jdvvd.exe 2020 pjppv.exe 2844 lrxffrx.exe 2068 xxlrxxf.exe 2500 htnntt.exe 680 hhhtbb.exe 2372 vjppv.exe 912 jdjdj.exe 992 xflrrrx.exe 1764 ffflrrl.exe 2600 bbtbtb.exe 1684 5xrfffr.exe 2504 xrxflxf.exe 3020 fflfrfx.exe 2540 tthbbh.exe 2276 9hbbbb.exe 2232 ppdjp.exe -
resource yara_rule behavioral1/memory/2532-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lffrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 1524 2532 c12ae8483a49f306bad04007a1626814ae1facde5a96a635edb68a30739b1ac1.exe 31 PID 2532 wrote to memory of 1524 2532 c12ae8483a49f306bad04007a1626814ae1facde5a96a635edb68a30739b1ac1.exe 31 PID 2532 wrote to memory of 1524 2532 c12ae8483a49f306bad04007a1626814ae1facde5a96a635edb68a30739b1ac1.exe 31 PID 2532 wrote to memory of 1524 2532 c12ae8483a49f306bad04007a1626814ae1facde5a96a635edb68a30739b1ac1.exe 31 PID 1524 wrote to memory of 2988 1524 1jppp.exe 32 PID 1524 wrote to memory of 2988 1524 1jppp.exe 32 PID 1524 wrote to memory of 2988 1524 1jppp.exe 32 PID 1524 wrote to memory of 2988 1524 1jppp.exe 32 PID 2988 wrote to memory of 2056 2988 3llffll.exe 33 PID 2988 wrote to memory of 2056 2988 3llffll.exe 33 PID 2988 wrote to memory of 2056 2988 3llffll.exe 33 PID 2988 wrote to memory of 2056 2988 3llffll.exe 33 PID 2056 wrote to memory of 2908 2056 bbnnhh.exe 34 PID 2056 wrote to memory of 2908 2056 bbnnhh.exe 34 PID 2056 wrote to memory of 2908 2056 bbnnhh.exe 34 PID 2056 wrote to memory of 2908 2056 bbnnhh.exe 34 PID 2908 wrote to memory of 2756 2908 5vjdj.exe 35 PID 2908 wrote to memory of 2756 2908 5vjdj.exe 35 PID 2908 wrote to memory of 2756 2908 5vjdj.exe 35 PID 2908 wrote to memory of 2756 2908 5vjdj.exe 35 PID 2756 wrote to memory of 2980 2756 pjddp.exe 36 PID 2756 wrote to memory of 2980 2756 pjddp.exe 36 PID 2756 wrote to memory of 2980 2756 pjddp.exe 36 PID 2756 wrote to memory of 2980 2756 pjddp.exe 36 PID 2980 wrote to memory of 2792 2980 fxlxlrr.exe 37 PID 2980 wrote to memory of 2792 2980 fxlxlrr.exe 37 PID 2980 wrote to memory of 2792 2980 fxlxlrr.exe 37 PID 2980 wrote to memory of 2792 2980 fxlxlrr.exe 37 PID 2792 wrote to memory of 2640 2792 bnhtbn.exe 38 PID 2792 wrote to memory of 2640 2792 bnhtbn.exe 38 PID 2792 wrote to memory of 2640 2792 bnhtbn.exe 38 PID 2792 wrote to memory of 2640 2792 bnhtbn.exe 38 PID 2640 wrote to memory of 2672 2640 9djjv.exe 39 PID 2640 wrote to memory of 2672 2640 9djjv.exe 39 PID 2640 wrote to memory of 2672 2640 9djjv.exe 39 PID 2640 wrote to memory of 2672 2640 9djjv.exe 39 PID 2672 wrote to memory of 2692 2672 3jjjj.exe 40 PID 2672 wrote to memory of 2692 2672 3jjjj.exe 40 PID 2672 wrote to memory of 2692 2672 3jjjj.exe 40 PID 2672 wrote to memory of 2692 2672 3jjjj.exe 40 PID 2692 wrote to memory of 3024 2692 fxrxxfl.exe 41 PID 2692 wrote to memory of 3024 2692 fxrxxfl.exe 41 PID 2692 wrote to memory of 3024 2692 fxrxxfl.exe 41 PID 2692 wrote to memory of 3024 2692 fxrxxfl.exe 41 PID 3024 wrote to memory of 2848 3024 1fxfllr.exe 42 PID 3024 wrote to memory of 2848 3024 1fxfllr.exe 42 PID 3024 wrote to memory of 2848 3024 1fxfllr.exe 42 PID 3024 wrote to memory of 2848 3024 1fxfllr.exe 42 PID 2848 wrote to memory of 3060 2848 thbbhn.exe 43 PID 2848 wrote to memory of 3060 2848 thbbhn.exe 43 PID 2848 wrote to memory of 3060 2848 thbbhn.exe 43 PID 2848 wrote to memory of 3060 2848 thbbhn.exe 43 PID 3060 wrote to memory of 2816 3060 ddvjv.exe 44 PID 3060 wrote to memory of 2816 3060 ddvjv.exe 44 PID 3060 wrote to memory of 2816 3060 ddvjv.exe 44 PID 3060 wrote to memory of 2816 3060 ddvjv.exe 44 PID 2816 wrote to memory of 2844 2816 vpjjj.exe 45 PID 2816 wrote to memory of 2844 2816 vpjjj.exe 45 PID 2816 wrote to memory of 2844 2816 vpjjj.exe 45 PID 2816 wrote to memory of 2844 2816 vpjjj.exe 45 PID 2844 wrote to memory of 1824 2844 lfxlrxl.exe 46 PID 2844 wrote to memory of 1824 2844 lfxlrxl.exe 46 PID 2844 wrote to memory of 1824 2844 lfxlrxl.exe 46 PID 2844 wrote to memory of 1824 2844 lfxlrxl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\c12ae8483a49f306bad04007a1626814ae1facde5a96a635edb68a30739b1ac1.exe"C:\Users\Admin\AppData\Local\Temp\c12ae8483a49f306bad04007a1626814ae1facde5a96a635edb68a30739b1ac1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\1jppp.exec:\1jppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\3llffll.exec:\3llffll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\bbnnhh.exec:\bbnnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\5vjdj.exec:\5vjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\pjddp.exec:\pjddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\fxlxlrr.exec:\fxlxlrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\bnhtbn.exec:\bnhtbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\9djjv.exec:\9djjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\3jjjj.exec:\3jjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\fxrxxfl.exec:\fxrxxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\1fxfllr.exec:\1fxfllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\thbbhn.exec:\thbbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\ddvjv.exec:\ddvjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\vpjjj.exec:\vpjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\lfxlrxl.exec:\lfxlrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\7ffxfff.exec:\7ffxfff.exe17⤵
- Executes dropped EXE
PID:1824 -
\??\c:\hhtbnb.exec:\hhtbnb.exe18⤵
- Executes dropped EXE
PID:788 -
\??\c:\dvdjv.exec:\dvdjv.exe19⤵
- Executes dropped EXE
PID:2096 -
\??\c:\9dpvv.exec:\9dpvv.exe20⤵
- Executes dropped EXE
PID:2100 -
\??\c:\3ffrfxr.exec:\3ffrfxr.exe21⤵
- Executes dropped EXE
PID:2420 -
\??\c:\nbbbnn.exec:\nbbbnn.exe22⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bnhbnn.exec:\bnhbnn.exe23⤵
- Executes dropped EXE
PID:2000 -
\??\c:\djddj.exec:\djddj.exe24⤵
- Executes dropped EXE
PID:1836 -
\??\c:\fffrlxf.exec:\fffrlxf.exe25⤵
- Executes dropped EXE
PID:1052 -
\??\c:\1tntbh.exec:\1tntbh.exe26⤵
- Executes dropped EXE
PID:2508 -
\??\c:\tnbbhb.exec:\tnbbhb.exe27⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vjjvv.exec:\vjjvv.exe28⤵
- Executes dropped EXE
PID:2232 -
\??\c:\dpvvj.exec:\dpvvj.exe29⤵
- Executes dropped EXE
PID:1500 -
\??\c:\xrllfrx.exec:\xrllfrx.exe30⤵
- Executes dropped EXE
PID:2292 -
\??\c:\btbhnt.exec:\btbhnt.exe31⤵
- Executes dropped EXE
PID:1524 -
\??\c:\hhtthh.exec:\hhtthh.exe32⤵
- Executes dropped EXE
PID:1572 -
\??\c:\vpddv.exec:\vpddv.exe33⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xxrflxf.exec:\xxrflxf.exe34⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rlfflfr.exec:\rlfflfr.exe35⤵
- Executes dropped EXE
PID:2904 -
\??\c:\9nbhtb.exec:\9nbhtb.exe36⤵
- Executes dropped EXE
PID:2872 -
\??\c:\hbtttt.exec:\hbtttt.exe37⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vpdjj.exec:\vpdjj.exe38⤵
- Executes dropped EXE
PID:2820 -
\??\c:\7jjdj.exec:\7jjdj.exe39⤵
- Executes dropped EXE
PID:2880 -
\??\c:\3rflrxf.exec:\3rflrxf.exe40⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xrrlrrx.exec:\xrrlrrx.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\xrlfrxf.exec:\xrlfrxf.exe42⤵
- Executes dropped EXE
PID:2436 -
\??\c:\bbthnt.exec:\bbthnt.exe43⤵
- Executes dropped EXE
PID:1580 -
\??\c:\3pjpp.exec:\3pjpp.exe44⤵
- Executes dropped EXE
PID:1868 -
\??\c:\7jdvd.exec:\7jdvd.exe45⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lfxffll.exec:\lfxffll.exe46⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tntbbh.exec:\tntbbh.exe47⤵
- Executes dropped EXE
PID:2832 -
\??\c:\nhbnbb.exec:\nhbnbb.exe48⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jdvvd.exec:\jdvvd.exe49⤵
- Executes dropped EXE
PID:2956 -
\??\c:\pjppv.exec:\pjppv.exe50⤵
- Executes dropped EXE
PID:2020 -
\??\c:\lrxffrx.exec:\lrxffrx.exe51⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xxlrxxf.exec:\xxlrxxf.exe52⤵
- Executes dropped EXE
PID:2068 -
\??\c:\htnntt.exec:\htnntt.exe53⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hhhtbb.exec:\hhhtbb.exe54⤵
- Executes dropped EXE
PID:680 -
\??\c:\vjppv.exec:\vjppv.exe55⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jdjdj.exec:\jdjdj.exe56⤵
- Executes dropped EXE
PID:912 -
\??\c:\xflrrrx.exec:\xflrrrx.exe57⤵
- Executes dropped EXE
PID:992 -
\??\c:\ffflrrl.exec:\ffflrrl.exe58⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bbtbtb.exec:\bbtbtb.exe59⤵
- Executes dropped EXE
PID:2600 -
\??\c:\5xrfffr.exec:\5xrfffr.exe60⤵
- Executes dropped EXE
PID:1684 -
\??\c:\xrxflxf.exec:\xrxflxf.exe61⤵
- Executes dropped EXE
PID:2504 -
\??\c:\fflfrfx.exec:\fflfrfx.exe62⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tthbbh.exec:\tthbbh.exe63⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9hbbbb.exec:\9hbbbb.exe64⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ppdjp.exec:\ppdjp.exe65⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ppjpv.exec:\ppjpv.exe66⤵PID:2080
-
\??\c:\frxxxxl.exec:\frxxxxl.exe67⤵PID:1500
-
\??\c:\1flllrf.exec:\1flllrf.exe68⤵PID:2552
-
\??\c:\bbnhtb.exec:\bbnhtb.exe69⤵PID:2388
-
\??\c:\bthhbh.exec:\bthhbh.exe70⤵PID:2088
-
\??\c:\3vpvv.exec:\3vpvv.exe71⤵PID:2728
-
\??\c:\1pjpv.exec:\1pjpv.exe72⤵PID:2220
-
\??\c:\rfrrxrx.exec:\rfrrxrx.exe73⤵PID:2312
-
\??\c:\9rllrxl.exec:\9rllrxl.exe74⤵PID:2972
-
\??\c:\tbtthh.exec:\tbtthh.exe75⤵PID:2872
-
\??\c:\hbnnbt.exec:\hbnnbt.exe76⤵PID:2892
-
\??\c:\7jdjj.exec:\7jdjj.exe77⤵PID:2648
-
\??\c:\jdppd.exec:\jdppd.exe78⤵PID:2796
-
\??\c:\7lxfffl.exec:\7lxfffl.exe79⤵PID:2620
-
\??\c:\rfxllrf.exec:\rfxllrf.exe80⤵PID:2700
-
\??\c:\bnbbbt.exec:\bnbbbt.exe81⤵PID:2436
-
\??\c:\hhttbb.exec:\hhttbb.exe82⤵PID:1468
-
\??\c:\nnhntb.exec:\nnhntb.exe83⤵PID:1868
-
\??\c:\1jjdp.exec:\1jjdp.exe84⤵PID:3016
-
\??\c:\9pjpv.exec:\9pjpv.exe85⤵PID:2968
-
\??\c:\9fxfffr.exec:\9fxfffr.exe86⤵PID:2840
-
\??\c:\fxrxllx.exec:\fxrxllx.exe87⤵PID:2860
-
\??\c:\nbttbb.exec:\nbttbb.exe88⤵PID:2956
-
\??\c:\7hhntb.exec:\7hhntb.exe89⤵PID:1944
-
\??\c:\dvvjj.exec:\dvvjj.exe90⤵
- System Location Discovery: System Language Discovery
PID:1748 -
\??\c:\1jpvd.exec:\1jpvd.exe91⤵PID:2068
-
\??\c:\jvppv.exec:\jvppv.exe92⤵PID:572
-
\??\c:\3frlxlr.exec:\3frlxlr.exe93⤵PID:2324
-
\??\c:\lfrxrrf.exec:\lfrxrrf.exe94⤵PID:1428
-
\??\c:\nhnntt.exec:\nhnntt.exe95⤵PID:1840
-
\??\c:\1btbbb.exec:\1btbbb.exe96⤵PID:768
-
\??\c:\5dvpp.exec:\5dvpp.exe97⤵PID:1764
-
\??\c:\pjjvj.exec:\pjjvj.exe98⤵PID:2600
-
\??\c:\llfflrr.exec:\llfflrr.exe99⤵PID:1124
-
\??\c:\llfrfxf.exec:\llfrfxf.exe100⤵PID:608
-
\??\c:\nhttht.exec:\nhttht.exe101⤵
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\hbbhhh.exec:\hbbhhh.exe102⤵PID:2540
-
\??\c:\vpddp.exec:\vpddp.exe103⤵PID:888
-
\??\c:\3vdvv.exec:\3vdvv.exe104⤵PID:1276
-
\??\c:\7jvvd.exec:\7jvvd.exe105⤵PID:2364
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe106⤵PID:2468
-
\??\c:\lflrrrr.exec:\lflrrrr.exe107⤵PID:1632
-
\??\c:\hhthnt.exec:\hhthnt.exe108⤵PID:1608
-
\??\c:\ttnhhn.exec:\ttnhhn.exe109⤵PID:1872
-
\??\c:\9pjjp.exec:\9pjjp.exe110⤵PID:2084
-
\??\c:\pdvvj.exec:\pdvvj.exe111⤵PID:2188
-
\??\c:\xxrrxfl.exec:\xxrrxfl.exe112⤵PID:2112
-
\??\c:\9xxflrf.exec:\9xxflrf.exe113⤵PID:2052
-
\??\c:\btbbhb.exec:\btbbhb.exe114⤵PID:2800
-
\??\c:\hhbhhh.exec:\hhbhhh.exe115⤵PID:2784
-
\??\c:\pjjvd.exec:\pjjvd.exe116⤵
- System Location Discovery: System Language Discovery
PID:2928 -
\??\c:\dvddd.exec:\dvddd.exe117⤵PID:2688
-
\??\c:\xrlrrxf.exec:\xrlrrxf.exe118⤵PID:2492
-
\??\c:\fxrrxrx.exec:\fxrrxrx.exe119⤵PID:2744
-
\??\c:\5nttbb.exec:\5nttbb.exe120⤵PID:2340
-
\??\c:\nnhbbh.exec:\nnhbbh.exe121⤵PID:3032
-
\??\c:\pdpjv.exec:\pdpjv.exe122⤵PID:1820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-