Analysis
-
max time kernel
120s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/11/2024, 02:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
221e8c1bb311c20f59810f07efcbd1df7f9ce75fce474325462b1f31c853f5dbN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
221e8c1bb311c20f59810f07efcbd1df7f9ce75fce474325462b1f31c853f5dbN.exe
-
Size
71KB
-
MD5
5e7311becc25b8bbf4b9d800fafd50b0
-
SHA1
47b09cb4734bc8e673b44860309b439efbafb1f1
-
SHA256
221e8c1bb311c20f59810f07efcbd1df7f9ce75fce474325462b1f31c853f5db
-
SHA512
30c043eb840e04395344e471af5bde04eb102e52e1fc570ddd22f0496e85a30c6fad352bc1eeafd6027390a7450c71bf7e6a3e0dcb2c5b79110ba2ed3b2204fd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj0:ymb3NkkiQ3mdBjFI4VE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1868-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/556-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/808-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1288-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2632 jpdvd.exe 2812 dvppv.exe 532 rrrrrxl.exe 2820 lflxflr.exe 2664 dvppd.exe 2576 5fflxfl.exe 3044 ffrxlxr.exe 2280 dpjjj.exe 556 vvpvd.exe 2740 llfllxr.exe 2304 tbnhhb.exe 2744 7pjpv.exe 2724 fxllrxl.exe 2924 fxxffff.exe 808 3hbhtt.exe 2332 pjppd.exe 604 jdvdp.exe 1680 xrlllfl.exe 2168 xrrrxfr.exe 2208 bthnbh.exe 2092 vpvdd.exe 1288 7jdjj.exe 776 rfrflfl.exe 1976 9xlxxxf.exe 3024 bbntht.exe 1672 1vppv.exe 1248 pjpvj.exe 2444 5lxflll.exe 1828 hbbhnn.exe 1540 7vvjd.exe 2288 dvjpv.exe 2836 lxrxflr.exe 2652 fxlrrrx.exe 2844 nhhntb.exe 2876 bntbbt.exe 1632 vpppp.exe 2572 vppjv.exe 2540 rlrfxfx.exe 3040 xrlxfll.exe 1152 9thtnh.exe 1224 7bhbnn.exe 444 vjdjp.exe 1176 vpjjj.exe 2508 7frrxxl.exe 592 lxrflfx.exe 2904 xlfrrxf.exe 2596 bbnnnt.exe 2752 hbttbt.exe 2900 1pddj.exe 1556 jjjdd.exe 1948 lfxfflr.exe 2492 1xllxxf.exe 1044 hbhntt.exe 604 thtthb.exe 2340 vpvvj.exe 2172 pdppp.exe 2324 7frrffl.exe 2060 lfrxflx.exe 868 nhnbtb.exe 1288 hhnbhn.exe 1612 htbthh.exe 1724 dvjpd.exe 2352 5dvpd.exe 992 lfxflrf.exe -
resource yara_rule behavioral1/memory/1868-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2632 1868 221e8c1bb311c20f59810f07efcbd1df7f9ce75fce474325462b1f31c853f5dbN.exe 30 PID 1868 wrote to memory of 2632 1868 221e8c1bb311c20f59810f07efcbd1df7f9ce75fce474325462b1f31c853f5dbN.exe 30 PID 1868 wrote to memory of 2632 1868 221e8c1bb311c20f59810f07efcbd1df7f9ce75fce474325462b1f31c853f5dbN.exe 30 PID 1868 wrote to memory of 2632 1868 221e8c1bb311c20f59810f07efcbd1df7f9ce75fce474325462b1f31c853f5dbN.exe 30 PID 2632 wrote to memory of 2812 2632 jpdvd.exe 31 PID 2632 wrote to memory of 2812 2632 jpdvd.exe 31 PID 2632 wrote to memory of 2812 2632 jpdvd.exe 31 PID 2632 wrote to memory of 2812 2632 jpdvd.exe 31 PID 2812 wrote to memory of 532 2812 dvppv.exe 32 PID 2812 wrote to memory of 532 2812 dvppv.exe 32 PID 2812 wrote to memory of 532 2812 dvppv.exe 32 PID 2812 wrote to memory of 532 2812 dvppv.exe 32 PID 532 wrote to memory of 2820 532 rrrrrxl.exe 33 PID 532 wrote to memory of 2820 532 rrrrrxl.exe 33 PID 532 wrote to memory of 2820 532 rrrrrxl.exe 33 PID 532 wrote to memory of 2820 532 rrrrrxl.exe 33 PID 2820 wrote to memory of 2664 2820 lflxflr.exe 34 PID 2820 wrote to memory of 2664 2820 lflxflr.exe 34 PID 2820 wrote to memory of 2664 2820 lflxflr.exe 34 PID 2820 wrote to memory of 2664 2820 lflxflr.exe 34 PID 2664 wrote to memory of 2576 2664 dvppd.exe 35 PID 2664 wrote to memory of 2576 2664 dvppd.exe 35 PID 2664 wrote to memory of 2576 2664 dvppd.exe 35 PID 2664 wrote to memory of 2576 2664 dvppd.exe 35 PID 2576 wrote to memory of 3044 2576 5fflxfl.exe 36 PID 2576 wrote to memory of 3044 2576 5fflxfl.exe 36 PID 2576 wrote to memory of 3044 2576 5fflxfl.exe 36 PID 2576 wrote to memory of 3044 2576 5fflxfl.exe 36 PID 3044 wrote to memory of 2280 3044 ffrxlxr.exe 37 PID 3044 wrote to memory of 2280 3044 ffrxlxr.exe 37 PID 3044 wrote to memory of 2280 3044 ffrxlxr.exe 37 PID 3044 wrote to memory of 2280 3044 ffrxlxr.exe 37 PID 2280 wrote to memory of 556 2280 dpjjj.exe 38 PID 2280 wrote to memory of 556 2280 dpjjj.exe 38 PID 2280 wrote to memory of 556 2280 dpjjj.exe 38 PID 2280 wrote to memory of 556 2280 dpjjj.exe 38 PID 556 wrote to memory of 2740 556 vvpvd.exe 39 PID 556 wrote to memory of 2740 556 vvpvd.exe 39 PID 556 wrote to memory of 2740 556 vvpvd.exe 39 PID 556 wrote to memory of 2740 556 vvpvd.exe 39 PID 2740 wrote to memory of 2304 2740 llfllxr.exe 40 PID 2740 wrote to memory of 2304 2740 llfllxr.exe 40 PID 2740 wrote to memory of 2304 2740 llfllxr.exe 40 PID 2740 wrote to memory of 2304 2740 llfllxr.exe 40 PID 2304 wrote to memory of 2744 2304 tbnhhb.exe 41 PID 2304 wrote to memory of 2744 2304 tbnhhb.exe 41 PID 2304 wrote to memory of 2744 2304 tbnhhb.exe 41 PID 2304 wrote to memory of 2744 2304 tbnhhb.exe 41 PID 2744 wrote to memory of 2724 2744 7pjpv.exe 42 PID 2744 wrote to memory of 2724 2744 7pjpv.exe 42 PID 2744 wrote to memory of 2724 2744 7pjpv.exe 42 PID 2744 wrote to memory of 2724 2744 7pjpv.exe 42 PID 2724 wrote to memory of 2924 2724 fxllrxl.exe 43 PID 2724 wrote to memory of 2924 2724 fxllrxl.exe 43 PID 2724 wrote to memory of 2924 2724 fxllrxl.exe 43 PID 2724 wrote to memory of 2924 2724 fxllrxl.exe 43 PID 2924 wrote to memory of 808 2924 fxxffff.exe 44 PID 2924 wrote to memory of 808 2924 fxxffff.exe 44 PID 2924 wrote to memory of 808 2924 fxxffff.exe 44 PID 2924 wrote to memory of 808 2924 fxxffff.exe 44 PID 808 wrote to memory of 2332 808 3hbhtt.exe 45 PID 808 wrote to memory of 2332 808 3hbhtt.exe 45 PID 808 wrote to memory of 2332 808 3hbhtt.exe 45 PID 808 wrote to memory of 2332 808 3hbhtt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\221e8c1bb311c20f59810f07efcbd1df7f9ce75fce474325462b1f31c853f5dbN.exe"C:\Users\Admin\AppData\Local\Temp\221e8c1bb311c20f59810f07efcbd1df7f9ce75fce474325462b1f31c853f5dbN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\jpdvd.exec:\jpdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\dvppv.exec:\dvppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\rrrrrxl.exec:\rrrrrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\lflxflr.exec:\lflxflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\dvppd.exec:\dvppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\5fflxfl.exec:\5fflxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\ffrxlxr.exec:\ffrxlxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\dpjjj.exec:\dpjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\vvpvd.exec:\vvpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\llfllxr.exec:\llfllxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\tbnhhb.exec:\tbnhhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\7pjpv.exec:\7pjpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\fxllrxl.exec:\fxllrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\fxxffff.exec:\fxxffff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\3hbhtt.exec:\3hbhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\pjppd.exec:\pjppd.exe17⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jdvdp.exec:\jdvdp.exe18⤵
- Executes dropped EXE
PID:604 -
\??\c:\xrlllfl.exec:\xrlllfl.exe19⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xrrrxfr.exec:\xrrrxfr.exe20⤵
- Executes dropped EXE
PID:2168 -
\??\c:\bthnbh.exec:\bthnbh.exe21⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vpvdd.exec:\vpvdd.exe22⤵
- Executes dropped EXE
PID:2092 -
\??\c:\7jdjj.exec:\7jdjj.exe23⤵
- Executes dropped EXE
PID:1288 -
\??\c:\rfrflfl.exec:\rfrflfl.exe24⤵
- Executes dropped EXE
PID:776 -
\??\c:\9xlxxxf.exec:\9xlxxxf.exe25⤵
- Executes dropped EXE
PID:1976 -
\??\c:\bbntht.exec:\bbntht.exe26⤵
- Executes dropped EXE
PID:3024 -
\??\c:\1vppv.exec:\1vppv.exe27⤵
- Executes dropped EXE
PID:1672 -
\??\c:\pjpvj.exec:\pjpvj.exe28⤵
- Executes dropped EXE
PID:1248 -
\??\c:\5lxflll.exec:\5lxflll.exe29⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hbbhnn.exec:\hbbhnn.exe30⤵
- Executes dropped EXE
PID:1828 -
\??\c:\7vvjd.exec:\7vvjd.exe31⤵
- Executes dropped EXE
PID:1540 -
\??\c:\dvjpv.exec:\dvjpv.exe32⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lxrxflr.exec:\lxrxflr.exe33⤵
- Executes dropped EXE
PID:2836 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe34⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nhhntb.exec:\nhhntb.exe35⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bntbbt.exec:\bntbbt.exe36⤵
- Executes dropped EXE
PID:2876 -
\??\c:\vpppp.exec:\vpppp.exe37⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vppjv.exec:\vppjv.exe38⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rlrfxfx.exec:\rlrfxfx.exe39⤵
- Executes dropped EXE
PID:2540 -
\??\c:\xrlxfll.exec:\xrlxfll.exe40⤵
- Executes dropped EXE
PID:3040 -
\??\c:\9thtnh.exec:\9thtnh.exe41⤵
- Executes dropped EXE
PID:1152 -
\??\c:\7bhbnn.exec:\7bhbnn.exe42⤵
- Executes dropped EXE
PID:1224 -
\??\c:\vjdjp.exec:\vjdjp.exe43⤵
- Executes dropped EXE
PID:444 -
\??\c:\vpjjj.exec:\vpjjj.exe44⤵
- Executes dropped EXE
PID:1176 -
\??\c:\7frrxxl.exec:\7frrxxl.exe45⤵
- Executes dropped EXE
PID:2508 -
\??\c:\lxrflfx.exec:\lxrflfx.exe46⤵
- Executes dropped EXE
PID:592 -
\??\c:\xlfrrxf.exec:\xlfrrxf.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bbnnnt.exec:\bbnnnt.exe48⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hbttbt.exec:\hbttbt.exe49⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1pddj.exec:\1pddj.exe50⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jjjdd.exec:\jjjdd.exe51⤵
- Executes dropped EXE
PID:1556 -
\??\c:\lfxfflr.exec:\lfxfflr.exe52⤵
- Executes dropped EXE
PID:1948 -
\??\c:\1xllxxf.exec:\1xllxxf.exe53⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hbhntt.exec:\hbhntt.exe54⤵
- Executes dropped EXE
PID:1044 -
\??\c:\thtthb.exec:\thtthb.exe55⤵
- Executes dropped EXE
PID:604 -
\??\c:\vpvvj.exec:\vpvvj.exe56⤵
- Executes dropped EXE
PID:2340 -
\??\c:\pdppp.exec:\pdppp.exe57⤵
- Executes dropped EXE
PID:2172 -
\??\c:\7frrffl.exec:\7frrffl.exe58⤵
- Executes dropped EXE
PID:2324 -
\??\c:\lfrxflx.exec:\lfrxflx.exe59⤵
- Executes dropped EXE
PID:2060 -
\??\c:\nhnbtb.exec:\nhnbtb.exe60⤵
- Executes dropped EXE
PID:868 -
\??\c:\hhnbhn.exec:\hhnbhn.exe61⤵
- Executes dropped EXE
PID:1288 -
\??\c:\htbthh.exec:\htbthh.exe62⤵
- Executes dropped EXE
PID:1612 -
\??\c:\dvjpd.exec:\dvjpd.exe63⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5dvpd.exec:\5dvpd.exe64⤵
- Executes dropped EXE
PID:2352 -
\??\c:\lfxflrf.exec:\lfxflrf.exe65⤵
- Executes dropped EXE
PID:992 -
\??\c:\fxlrfrf.exec:\fxlrfrf.exe66⤵PID:2260
-
\??\c:\5bbntb.exec:\5bbntb.exe67⤵PID:1416
-
\??\c:\btntbb.exec:\btntbb.exe68⤵
- System Location Discovery: System Language Discovery
PID:1000 -
\??\c:\3pddd.exec:\3pddd.exe69⤵PID:876
-
\??\c:\jdppv.exec:\jdppv.exe70⤵PID:2252
-
\??\c:\5bbhhh.exec:\5bbhhh.exe71⤵PID:2964
-
\??\c:\hbthnn.exec:\hbthnn.exe72⤵PID:2668
-
\??\c:\jdpjv.exec:\jdpjv.exe73⤵PID:2660
-
\??\c:\7ddvj.exec:\7ddvj.exe74⤵PID:2688
-
\??\c:\ffflflr.exec:\ffflflr.exe75⤵PID:532
-
\??\c:\lfxxxxf.exec:\lfxxxxf.exe76⤵PID:1488
-
\??\c:\btnnbb.exec:\btnnbb.exe77⤵PID:2820
-
\??\c:\9bnbnn.exec:\9bnbnn.exe78⤵PID:2532
-
\??\c:\ddpdp.exec:\ddpdp.exe79⤵PID:2600
-
\??\c:\lflllrr.exec:\lflllrr.exe80⤵
- System Location Discovery: System Language Discovery
PID:1300 -
\??\c:\fxffllx.exec:\fxffllx.exe81⤵PID:3056
-
\??\c:\hbntbn.exec:\hbntbn.exe82⤵PID:1816
-
\??\c:\5nbhhn.exec:\5nbhhn.exe83⤵PID:2000
-
\??\c:\tnbbhh.exec:\tnbbhh.exe84⤵PID:1192
-
\??\c:\vjdjp.exec:\vjdjp.exe85⤵PID:2988
-
\??\c:\3pvvv.exec:\3pvvv.exe86⤵PID:1004
-
\??\c:\ffxrfff.exec:\ffxrfff.exe87⤵PID:2304
-
\??\c:\fxfxfxf.exec:\fxfxfxf.exe88⤵PID:2616
-
\??\c:\7nnbnt.exec:\7nnbnt.exe89⤵PID:2880
-
\??\c:\nhtttt.exec:\nhtttt.exe90⤵PID:3052
-
\??\c:\vvjjp.exec:\vvjjp.exe91⤵PID:2108
-
\??\c:\dpvjv.exec:\dpvjv.exe92⤵PID:2244
-
\??\c:\lflrrlr.exec:\lflrrlr.exe93⤵PID:580
-
\??\c:\xrxxffx.exec:\xrxxffx.exe94⤵PID:2328
-
\??\c:\hbtbhh.exec:\hbtbhh.exe95⤵PID:2116
-
\??\c:\thnthn.exec:\thnthn.exe96⤵PID:2104
-
\??\c:\dvjpd.exec:\dvjpd.exe97⤵PID:2168
-
\??\c:\5vpvd.exec:\5vpvd.exe98⤵PID:1996
-
\??\c:\9fxxfll.exec:\9fxxfll.exe99⤵PID:960
-
\??\c:\5nttbb.exec:\5nttbb.exe100⤵PID:836
-
\??\c:\3thhnh.exec:\3thhnh.exe101⤵PID:656
-
\??\c:\dpvvp.exec:\dpvvp.exe102⤵PID:2052
-
\??\c:\dvppj.exec:\dvppj.exe103⤵PID:1976
-
\??\c:\vvjdd.exec:\vvjdd.exe104⤵PID:2768
-
\??\c:\llrrflr.exec:\llrrflr.exe105⤵PID:1840
-
\??\c:\9lfrffl.exec:\9lfrffl.exe106⤵PID:2284
-
\??\c:\hhhnbb.exec:\hhhnbb.exe107⤵PID:236
-
\??\c:\hnnnbb.exec:\hnnnbb.exe108⤵PID:1060
-
\??\c:\jdvvv.exec:\jdvvv.exe109⤵PID:2276
-
\??\c:\5ddpd.exec:\5ddpd.exe110⤵PID:2188
-
\??\c:\xrfxfxl.exec:\xrfxfxl.exe111⤵PID:2684
-
\??\c:\ffxflrf.exec:\ffxflrf.exe112⤵PID:2672
-
\??\c:\3btbhn.exec:\3btbhn.exe113⤵PID:2960
-
\??\c:\ttbnnt.exec:\ttbnnt.exe114⤵PID:2228
-
\??\c:\dpddp.exec:\dpddp.exe115⤵PID:2656
-
\??\c:\dvvvj.exec:\dvvvj.exe116⤵PID:2564
-
\??\c:\pjvjj.exec:\pjvjj.exe117⤵PID:1632
-
\??\c:\9xlrllf.exec:\9xlrllf.exe118⤵PID:2604
-
\??\c:\9xrxffr.exec:\9xrxffr.exe119⤵PID:2576
-
\??\c:\hbthnt.exec:\hbthnt.exe120⤵PID:3040
-
\??\c:\bbtbtt.exec:\bbtbtt.exe121⤵PID:1152
-
\??\c:\dvjdd.exec:\dvjdd.exe122⤵PID:1624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-