Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 00:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe
-
Size
911KB
-
MD5
a7c13c67f5de73babde428bc0e05dbf4
-
SHA1
3d8a9529529ec44fc8ab1efa76f28423f6353f8a
-
SHA256
6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071
-
SHA512
6e1a7836076bc960a0d1d204f0cf3e03658ca19aecf1d93ea22601edd7b4f097c869e12dbe42992544c341bf5d9208b87e30dceb4fa2625a97068392da23948c
-
SSDEEP
24576:OY+UB5TsjZ03clghyKm1QgRHYKPUQ4U3yzZy5gFxopB:OUbAjZ035mMOyDFxon
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2284-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-38-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2716-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-65-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2672-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/896-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/648-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-166-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1572-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/684-242-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/684-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1296-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1296-260-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2244-290-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1716-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-317-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3044-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-567-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-604-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-618-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2592-617-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1116-697-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/768-883-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2296 dvjdj.exe 2128 3pvvd.exe 2644 xrflrxl.exe 2716 1rxffxf.exe 2616 9nbhhh.exe 2840 jpdpp.exe 2672 ttbthn.exe 2520 9vpjj.exe 3004 vjdpv.exe 320 fxxxfrr.exe 896 jvddj.exe 648 lxllrlr.exe 2776 pvvdv.exe 2688 5fxrrlr.exe 2336 pdpjj.exe 2460 tbntbn.exe 1572 3ttbhb.exe 1076 bththb.exe 1872 flrxlxr.exe 2000 7thhnt.exe 2368 nhthhh.exe 2680 vpjpv.exe 2428 rlrrxxx.exe 684 thtbbb.exe 1632 hbnttb.exe 1296 dvjjv.exe 1168 hbtbtn.exe 1784 nhhnhh.exe 2256 hbbttt.exe 2244 rlfflll.exe 1716 tbbnbh.exe 2392 7djpd.exe 3024 thtbtb.exe 3044 nhtbhh.exe 2964 rfrxlfl.exe 2732 rxrxfxr.exe 2720 nbnhnn.exe 3068 dvjpp.exe 2788 fxxflrr.exe 2524 5bbhhh.exe 2840 rrfxfrl.exe 2664 ntbhnt.exe 2496 dvjvj.exe 2984 rlxfllr.exe 588 jvpvj.exe 556 rlfxxrr.exe 320 nhntbb.exe 280 jdvpj.exe 828 9lflrll.exe 1660 hthhhh.exe 2844 djppj.exe 2824 1dpvd.exe 2400 lxlrxxf.exe 1808 1thtbt.exe 2676 ddjdd.exe 1560 9fxfffl.exe 1080 htbhhh.exe 1728 pdvdv.exe 2236 rfrffxr.exe 1872 bthntn.exe 2596 ddppd.exe 1992 xrffffl.exe 2480 tnnbtn.exe 1948 1dppv.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bththb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbttt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2296 2284 6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe 28 PID 2284 wrote to memory of 2296 2284 6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe 28 PID 2284 wrote to memory of 2296 2284 6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe 28 PID 2284 wrote to memory of 2296 2284 6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe 28 PID 2296 wrote to memory of 2128 2296 dvjdj.exe 29 PID 2296 wrote to memory of 2128 2296 dvjdj.exe 29 PID 2296 wrote to memory of 2128 2296 dvjdj.exe 29 PID 2296 wrote to memory of 2128 2296 dvjdj.exe 29 PID 2128 wrote to memory of 2644 2128 3pvvd.exe 30 PID 2128 wrote to memory of 2644 2128 3pvvd.exe 30 PID 2128 wrote to memory of 2644 2128 3pvvd.exe 30 PID 2128 wrote to memory of 2644 2128 3pvvd.exe 30 PID 2644 wrote to memory of 2716 2644 xrflrxl.exe 31 PID 2644 wrote to memory of 2716 2644 xrflrxl.exe 31 PID 2644 wrote to memory of 2716 2644 xrflrxl.exe 31 PID 2644 wrote to memory of 2716 2644 xrflrxl.exe 31 PID 2716 wrote to memory of 2616 2716 1rxffxf.exe 32 PID 2716 wrote to memory of 2616 2716 1rxffxf.exe 32 PID 2716 wrote to memory of 2616 2716 1rxffxf.exe 32 PID 2716 wrote to memory of 2616 2716 1rxffxf.exe 32 PID 2616 wrote to memory of 2840 2616 9nbhhh.exe 33 PID 2616 wrote to memory of 2840 2616 9nbhhh.exe 33 PID 2616 wrote to memory of 2840 2616 9nbhhh.exe 33 PID 2616 wrote to memory of 2840 2616 9nbhhh.exe 33 PID 2840 wrote to memory of 2672 2840 jpdpp.exe 34 PID 2840 wrote to memory of 2672 2840 jpdpp.exe 34 PID 2840 wrote to memory of 2672 2840 jpdpp.exe 34 PID 2840 wrote to memory of 2672 2840 jpdpp.exe 34 PID 2672 wrote to memory of 2520 2672 ttbthn.exe 35 PID 2672 wrote to memory of 2520 2672 ttbthn.exe 35 PID 2672 wrote to memory of 2520 2672 ttbthn.exe 35 PID 2672 wrote to memory of 2520 2672 ttbthn.exe 35 PID 2520 wrote to memory of 3004 2520 9vpjj.exe 36 PID 2520 wrote to memory of 3004 2520 9vpjj.exe 36 PID 2520 wrote to memory of 3004 2520 9vpjj.exe 36 PID 2520 wrote to memory of 3004 2520 9vpjj.exe 36 PID 3004 wrote to memory of 320 3004 vjdpv.exe 37 PID 3004 wrote to memory of 320 3004 vjdpv.exe 37 PID 3004 wrote to memory of 320 3004 vjdpv.exe 37 PID 3004 wrote to memory of 320 3004 vjdpv.exe 37 PID 320 wrote to memory of 896 320 fxxxfrr.exe 38 PID 320 wrote to memory of 896 320 fxxxfrr.exe 38 PID 320 wrote to memory of 896 320 fxxxfrr.exe 38 PID 320 wrote to memory of 896 320 fxxxfrr.exe 38 PID 896 wrote to memory of 648 896 jvddj.exe 39 PID 896 wrote to memory of 648 896 jvddj.exe 39 PID 896 wrote to memory of 648 896 jvddj.exe 39 PID 896 wrote to memory of 648 896 jvddj.exe 39 PID 648 wrote to memory of 2776 648 lxllrlr.exe 40 PID 648 wrote to memory of 2776 648 lxllrlr.exe 40 PID 648 wrote to memory of 2776 648 lxllrlr.exe 40 PID 648 wrote to memory of 2776 648 lxllrlr.exe 40 PID 2776 wrote to memory of 2688 2776 pvvdv.exe 41 PID 2776 wrote to memory of 2688 2776 pvvdv.exe 41 PID 2776 wrote to memory of 2688 2776 pvvdv.exe 41 PID 2776 wrote to memory of 2688 2776 pvvdv.exe 41 PID 2688 wrote to memory of 2336 2688 5fxrrlr.exe 42 PID 2688 wrote to memory of 2336 2688 5fxrrlr.exe 42 PID 2688 wrote to memory of 2336 2688 5fxrrlr.exe 42 PID 2688 wrote to memory of 2336 2688 5fxrrlr.exe 42 PID 2336 wrote to memory of 2460 2336 pdpjj.exe 43 PID 2336 wrote to memory of 2460 2336 pdpjj.exe 43 PID 2336 wrote to memory of 2460 2336 pdpjj.exe 43 PID 2336 wrote to memory of 2460 2336 pdpjj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe"C:\Users\Admin\AppData\Local\Temp\6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\dvjdj.exec:\dvjdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\3pvvd.exec:\3pvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\xrflrxl.exec:\xrflrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\1rxffxf.exec:\1rxffxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\9nbhhh.exec:\9nbhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jpdpp.exec:\jpdpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\ttbthn.exec:\ttbthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\9vpjj.exec:\9vpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vjdpv.exec:\vjdpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\fxxxfrr.exec:\fxxxfrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\jvddj.exec:\jvddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\lxllrlr.exec:\lxllrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\pvvdv.exec:\pvvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\5fxrrlr.exec:\5fxrrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\pdpjj.exec:\pdpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\tbntbn.exec:\tbntbn.exe17⤵
- Executes dropped EXE
PID:2460 -
\??\c:\3ttbhb.exec:\3ttbhb.exe18⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bththb.exec:\bththb.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1076 -
\??\c:\flrxlxr.exec:\flrxlxr.exe20⤵
- Executes dropped EXE
PID:1872 -
\??\c:\7thhnt.exec:\7thhnt.exe21⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nhthhh.exec:\nhthhh.exe22⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vpjpv.exec:\vpjpv.exe23⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rlrrxxx.exec:\rlrrxxx.exe24⤵
- Executes dropped EXE
PID:2428 -
\??\c:\thtbbb.exec:\thtbbb.exe25⤵
- Executes dropped EXE
PID:684 -
\??\c:\hbnttb.exec:\hbnttb.exe26⤵
- Executes dropped EXE
PID:1632 -
\??\c:\dvjjv.exec:\dvjjv.exe27⤵
- Executes dropped EXE
PID:1296 -
\??\c:\hbtbtn.exec:\hbtbtn.exe28⤵
- Executes dropped EXE
PID:1168 -
\??\c:\nhhnhh.exec:\nhhnhh.exe29⤵
- Executes dropped EXE
PID:1784 -
\??\c:\hbbttt.exec:\hbbttt.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2256 -
\??\c:\rlfflll.exec:\rlfflll.exe31⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tbbnbh.exec:\tbbnbh.exe32⤵
- Executes dropped EXE
PID:1716 -
\??\c:\7djpd.exec:\7djpd.exe33⤵
- Executes dropped EXE
PID:2392 -
\??\c:\thtbtb.exec:\thtbtb.exe34⤵
- Executes dropped EXE
PID:3024 -
\??\c:\nhtbhh.exec:\nhtbhh.exe35⤵
- Executes dropped EXE
PID:3044 -
\??\c:\rfrxlfl.exec:\rfrxlfl.exe36⤵
- Executes dropped EXE
PID:2964 -
\??\c:\rxrxfxr.exec:\rxrxfxr.exe37⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nbnhnn.exec:\nbnhnn.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\dvjpp.exec:\dvjpp.exe39⤵
- Executes dropped EXE
PID:3068 -
\??\c:\fxxflrr.exec:\fxxflrr.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\5bbhhh.exec:\5bbhhh.exe41⤵
- Executes dropped EXE
PID:2524 -
\??\c:\rrfxfrl.exec:\rrfxfrl.exe42⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ntbhnt.exec:\ntbhnt.exe43⤵
- Executes dropped EXE
PID:2664 -
\??\c:\dvjvj.exec:\dvjvj.exe44⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rlxfllr.exec:\rlxfllr.exe45⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jvpvj.exec:\jvpvj.exe46⤵
- Executes dropped EXE
PID:588 -
\??\c:\rlfxxrr.exec:\rlfxxrr.exe47⤵
- Executes dropped EXE
PID:556 -
\??\c:\nhntbb.exec:\nhntbb.exe48⤵
- Executes dropped EXE
PID:320 -
\??\c:\jdvpj.exec:\jdvpj.exe49⤵
- Executes dropped EXE
PID:280 -
\??\c:\9lflrll.exec:\9lflrll.exe50⤵
- Executes dropped EXE
PID:828 -
\??\c:\hthhhh.exec:\hthhhh.exe51⤵
- Executes dropped EXE
PID:1660 -
\??\c:\djppj.exec:\djppj.exe52⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1dpvd.exec:\1dpvd.exe53⤵
- Executes dropped EXE
PID:2824 -
\??\c:\lxlrxxf.exec:\lxlrxxf.exe54⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1thtbt.exec:\1thtbt.exe55⤵
- Executes dropped EXE
PID:1808 -
\??\c:\ddjdd.exec:\ddjdd.exe56⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9fxfffl.exec:\9fxfffl.exe57⤵
- Executes dropped EXE
PID:1560 -
\??\c:\htbhhh.exec:\htbhhh.exe58⤵
- Executes dropped EXE
PID:1080 -
\??\c:\pdvdv.exec:\pdvdv.exe59⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rfrffxr.exec:\rfrffxr.exe60⤵
- Executes dropped EXE
PID:2236 -
\??\c:\bthntn.exec:\bthntn.exe61⤵
- Executes dropped EXE
PID:1872 -
\??\c:\ddppd.exec:\ddppd.exe62⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xrffffl.exec:\xrffffl.exe63⤵
- Executes dropped EXE
PID:1992 -
\??\c:\tnnbtn.exec:\tnnbtn.exe64⤵
- Executes dropped EXE
PID:2480 -
\??\c:\1dppv.exec:\1dppv.exe65⤵
- Executes dropped EXE
PID:1948 -
\??\c:\3xfflrr.exec:\3xfflrr.exe66⤵PID:2024
-
\??\c:\nhnhnh.exec:\nhnhnh.exe67⤵PID:2148
-
\??\c:\3dppv.exec:\3dppv.exe68⤵PID:1792
-
\??\c:\rflfrlf.exec:\rflfrlf.exe69⤵PID:3064
-
\??\c:\nthbnt.exec:\nthbnt.exe70⤵PID:1576
-
\??\c:\jvjdj.exec:\jvjdj.exe71⤵PID:928
-
\??\c:\9xrrxxl.exec:\9xrrxxl.exe72⤵PID:2328
-
\??\c:\hhhtbn.exec:\hhhtbn.exe73⤵PID:2580
-
\??\c:\hhbnnb.exec:\hhbnnb.exe74⤵PID:568
-
\??\c:\7vpvv.exec:\7vpvv.exe75⤵PID:2176
-
\??\c:\fxrfrxl.exec:\fxrfrxl.exe76⤵PID:892
-
\??\c:\thnhht.exec:\thnhht.exe77⤵PID:2060
-
\??\c:\vdppp.exec:\vdppp.exe78⤵PID:2284
-
\??\c:\xrffrlr.exec:\xrffrlr.exe79⤵PID:3024
-
\??\c:\7bttbh.exec:\7bttbh.exe80⤵PID:3040
-
\??\c:\jpdvv.exec:\jpdvv.exe81⤵PID:2592
-
\??\c:\rrfrfxx.exec:\rrfrfxx.exe82⤵PID:2964
-
\??\c:\bththh.exec:\bththh.exe83⤵PID:2624
-
\??\c:\dvjpv.exec:\dvjpv.exe84⤵PID:2744
-
\??\c:\5rffrlr.exec:\5rffrlr.exe85⤵PID:2144
-
\??\c:\tnntbh.exec:\tnntbh.exe86⤵PID:2788
-
\??\c:\jjpjd.exec:\jjpjd.exe87⤵PID:2960
-
\??\c:\lfllxrr.exec:\lfllxrr.exe88⤵PID:2556
-
\??\c:\hbtbhb.exec:\hbtbhb.exe89⤵PID:2576
-
\??\c:\vdjdd.exec:\vdjdd.exe90⤵PID:2456
-
\??\c:\jvjvv.exec:\jvjvv.exe91⤵PID:1256
-
\??\c:\nnhhnb.exec:\nnhhnb.exe92⤵PID:596
-
\??\c:\jdjvv.exec:\jdjvv.exe93⤵PID:572
-
\??\c:\fxxxrxl.exec:\fxxxrxl.exe94⤵PID:1116
-
\??\c:\tnbtbt.exec:\tnbtbt.exe95⤵PID:2272
-
\??\c:\nnnbbb.exec:\nnnbbb.exe96⤵PID:828
-
\??\c:\3jdvd.exec:\3jdvd.exe97⤵PID:648
-
\??\c:\flrxffl.exec:\flrxffl.exe98⤵PID:1712
-
\??\c:\btbhhb.exec:\btbhhb.exe99⤵PID:2824
-
\??\c:\pdjvv.exec:\pdjvv.exe100⤵PID:1816
-
\??\c:\7frxllf.exec:\7frxllf.exe101⤵PID:1808
-
\??\c:\tbbnth.exec:\tbbnth.exe102⤵PID:1648
-
\??\c:\pjjjd.exec:\pjjjd.exe103⤵PID:1876
-
\??\c:\pdpdp.exec:\pdpdp.exe104⤵PID:1204
-
\??\c:\5xxxxxx.exec:\5xxxxxx.exe105⤵PID:2472
-
\??\c:\tnbtbb.exec:\tnbtbb.exe106⤵PID:2968
-
\??\c:\ddjvd.exec:\ddjvd.exe107⤵PID:1964
-
\??\c:\7xlflrr.exec:\7xlflrr.exe108⤵PID:2596
-
\??\c:\tntnnn.exec:\tntnnn.exe109⤵PID:1992
-
\??\c:\1djjv.exec:\1djjv.exe110⤵PID:2204
-
\??\c:\9xrflrr.exec:\9xrflrr.exe111⤵PID:1776
-
\??\c:\tnnbnh.exec:\tnnbnh.exe112⤵PID:1708
-
\??\c:\dvjjp.exec:\dvjjp.exe113⤵PID:2092
-
\??\c:\lfrrxff.exec:\lfrrxff.exe114⤵PID:1048
-
\??\c:\fxfrxxx.exec:\fxfrxxx.exe115⤵PID:964
-
\??\c:\bbthtb.exec:\bbthtb.exe116⤵PID:1652
-
\??\c:\jvpdj.exec:\jvpdj.exe117⤵PID:2384
-
\??\c:\9fxrfff.exec:\9fxrfff.exe118⤵PID:2580
-
\??\c:\htbbtt.exec:\htbbtt.exe119⤵PID:568
-
\??\c:\jpvjj.exec:\jpvjj.exe120⤵PID:1956
-
\??\c:\5xlflrx.exec:\5xlflrx.exe121⤵PID:768
-
\??\c:\hbntbh.exec:\hbntbh.exe122⤵PID:1588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-