Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 09:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b540de8b959a83b7eb41a847df63eff0N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
b540de8b959a83b7eb41a847df63eff0N.exe
-
Size
151KB
-
MD5
b540de8b959a83b7eb41a847df63eff0
-
SHA1
4c86ea27c659b074c0e3828fce0e333214750c0d
-
SHA256
6e710baa1c8179377512abf70491b75765d871e39669bcfc09faa123ac789fe5
-
SHA512
9c8e1e26af5843c74bd5d7487d8a7e4a4a74dec8cc7af887a92f967a1be0c2f9a92055ab88233cfe758f79de43057990477c768ed194eceb6a0f0489054b357b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIRUohDmRG08fKkZEU5hkVaqaK6qa50iKVb:n3C9BRo/AIuuOmfDZEU5OVFii
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral1/memory/2292-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-90-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-71-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-51-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-61-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1848-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/776-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/824-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2408 djdvd.exe 2292 flxlrxr.exe 2100 bntbbn.exe 2088 htbhnn.exe 2896 jpjdv.exe 856 lfxrxlr.exe 2944 rrfrlxf.exe 2804 tbbttb.exe 2652 bhhbhh.exe 2196 djpjp.exe 2260 vjvpj.exe 1072 rfrflll.exe 2940 flfxxff.exe 584 dpdpv.exe 2068 fllfxrl.exe 1288 pjvjj.exe 2968 rxlfffr.exe 1848 nhnhht.exe 2824 bhhtnn.exe 2080 rlfxxrx.exe 2108 tbnnbb.exe 1892 1dvjp.exe 1256 frflfxl.exe 1792 hhnntb.exe 776 vvpvp.exe 3004 lllrflx.exe 2440 nhhntt.exe 824 jpvpv.exe 1276 lrffrxx.exe 3036 bhtnnh.exe 1956 1pjdv.exe 2284 lfrllxx.exe 2360 bthnbh.exe 2868 dvppd.exe 2388 5ffrxxf.exe 2840 rlrxffx.exe 2856 bnbbbt.exe 2864 rfrxfff.exe 2672 rrfrlxr.exe 708 tbhbnh.exe 2760 jjjjd.exe 2636 frffrxf.exe 1072 rlrxllr.exe 1268 nbnnhb.exe 1208 pjvdv.exe 2160 rlrxxxr.exe 2940 lxllxfx.exe 2724 xfrxffr.exe 2452 hhbhhn.exe 1948 tnbbnn.exe 1280 dppdv.exe 1768 xlxfflr.exe 1764 rrfrrlr.exe 2976 htbnnn.exe 2456 djpvd.exe 2824 3lxrxxx.exe 2280 xrxlrlr.exe 2240 nnhttt.exe 2612 tbnbtn.exe 1376 vpjdp.exe 968 fllffll.exe 648 tbbnbb.exe 1552 bhhbbb.exe 2584 3jdvd.exe -
resource yara_rule behavioral1/memory/2424-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/824-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2408 2424 b540de8b959a83b7eb41a847df63eff0N.exe 30 PID 2424 wrote to memory of 2408 2424 b540de8b959a83b7eb41a847df63eff0N.exe 30 PID 2424 wrote to memory of 2408 2424 b540de8b959a83b7eb41a847df63eff0N.exe 30 PID 2424 wrote to memory of 2408 2424 b540de8b959a83b7eb41a847df63eff0N.exe 30 PID 2408 wrote to memory of 2292 2408 djdvd.exe 31 PID 2408 wrote to memory of 2292 2408 djdvd.exe 31 PID 2408 wrote to memory of 2292 2408 djdvd.exe 31 PID 2408 wrote to memory of 2292 2408 djdvd.exe 31 PID 2292 wrote to memory of 2100 2292 flxlrxr.exe 32 PID 2292 wrote to memory of 2100 2292 flxlrxr.exe 32 PID 2292 wrote to memory of 2100 2292 flxlrxr.exe 32 PID 2292 wrote to memory of 2100 2292 flxlrxr.exe 32 PID 2100 wrote to memory of 2088 2100 bntbbn.exe 33 PID 2100 wrote to memory of 2088 2100 bntbbn.exe 33 PID 2100 wrote to memory of 2088 2100 bntbbn.exe 33 PID 2100 wrote to memory of 2088 2100 bntbbn.exe 33 PID 2088 wrote to memory of 2896 2088 htbhnn.exe 34 PID 2088 wrote to memory of 2896 2088 htbhnn.exe 34 PID 2088 wrote to memory of 2896 2088 htbhnn.exe 34 PID 2088 wrote to memory of 2896 2088 htbhnn.exe 34 PID 2896 wrote to memory of 856 2896 jpjdv.exe 35 PID 2896 wrote to memory of 856 2896 jpjdv.exe 35 PID 2896 wrote to memory of 856 2896 jpjdv.exe 35 PID 2896 wrote to memory of 856 2896 jpjdv.exe 35 PID 856 wrote to memory of 2944 856 lfxrxlr.exe 36 PID 856 wrote to memory of 2944 856 lfxrxlr.exe 36 PID 856 wrote to memory of 2944 856 lfxrxlr.exe 36 PID 856 wrote to memory of 2944 856 lfxrxlr.exe 36 PID 2944 wrote to memory of 2804 2944 rrfrlxf.exe 37 PID 2944 wrote to memory of 2804 2944 rrfrlxf.exe 37 PID 2944 wrote to memory of 2804 2944 rrfrlxf.exe 37 PID 2944 wrote to memory of 2804 2944 rrfrlxf.exe 37 PID 2804 wrote to memory of 2652 2804 tbbttb.exe 38 PID 2804 wrote to memory of 2652 2804 tbbttb.exe 38 PID 2804 wrote to memory of 2652 2804 tbbttb.exe 38 PID 2804 wrote to memory of 2652 2804 tbbttb.exe 38 PID 2652 wrote to memory of 2196 2652 bhhbhh.exe 39 PID 2652 wrote to memory of 2196 2652 bhhbhh.exe 39 PID 2652 wrote to memory of 2196 2652 bhhbhh.exe 39 PID 2652 wrote to memory of 2196 2652 bhhbhh.exe 39 PID 2196 wrote to memory of 2260 2196 djpjp.exe 40 PID 2196 wrote to memory of 2260 2196 djpjp.exe 40 PID 2196 wrote to memory of 2260 2196 djpjp.exe 40 PID 2196 wrote to memory of 2260 2196 djpjp.exe 40 PID 2260 wrote to memory of 1072 2260 vjvpj.exe 41 PID 2260 wrote to memory of 1072 2260 vjvpj.exe 41 PID 2260 wrote to memory of 1072 2260 vjvpj.exe 41 PID 2260 wrote to memory of 1072 2260 vjvpj.exe 41 PID 1072 wrote to memory of 2940 1072 rfrflll.exe 42 PID 1072 wrote to memory of 2940 1072 rfrflll.exe 42 PID 1072 wrote to memory of 2940 1072 rfrflll.exe 42 PID 1072 wrote to memory of 2940 1072 rfrflll.exe 42 PID 2940 wrote to memory of 584 2940 flfxxff.exe 43 PID 2940 wrote to memory of 584 2940 flfxxff.exe 43 PID 2940 wrote to memory of 584 2940 flfxxff.exe 43 PID 2940 wrote to memory of 584 2940 flfxxff.exe 43 PID 584 wrote to memory of 2068 584 dpdpv.exe 44 PID 584 wrote to memory of 2068 584 dpdpv.exe 44 PID 584 wrote to memory of 2068 584 dpdpv.exe 44 PID 584 wrote to memory of 2068 584 dpdpv.exe 44 PID 2068 wrote to memory of 1288 2068 fllfxrl.exe 45 PID 2068 wrote to memory of 1288 2068 fllfxrl.exe 45 PID 2068 wrote to memory of 1288 2068 fllfxrl.exe 45 PID 2068 wrote to memory of 1288 2068 fllfxrl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b540de8b959a83b7eb41a847df63eff0N.exe"C:\Users\Admin\AppData\Local\Temp\b540de8b959a83b7eb41a847df63eff0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\djdvd.exec:\djdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\flxlrxr.exec:\flxlrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\bntbbn.exec:\bntbbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\htbhnn.exec:\htbhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\jpjdv.exec:\jpjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\lfxrxlr.exec:\lfxrxlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\rrfrlxf.exec:\rrfrlxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\tbbttb.exec:\tbbttb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\bhhbhh.exec:\bhhbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\djpjp.exec:\djpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\vjvpj.exec:\vjvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\rfrflll.exec:\rfrflll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\flfxxff.exec:\flfxxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\dpdpv.exec:\dpdpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\fllfxrl.exec:\fllfxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\pjvjj.exec:\pjvjj.exe17⤵
- Executes dropped EXE
PID:1288 -
\??\c:\rxlfffr.exec:\rxlfffr.exe18⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nhnhht.exec:\nhnhht.exe19⤵
- Executes dropped EXE
PID:1848 -
\??\c:\bhhtnn.exec:\bhhtnn.exe20⤵
- Executes dropped EXE
PID:2824 -
\??\c:\rlfxxrx.exec:\rlfxxrx.exe21⤵
- Executes dropped EXE
PID:2080 -
\??\c:\tbnnbb.exec:\tbnnbb.exe22⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1dvjp.exec:\1dvjp.exe23⤵
- Executes dropped EXE
PID:1892 -
\??\c:\frflfxl.exec:\frflfxl.exe24⤵
- Executes dropped EXE
PID:1256 -
\??\c:\hhnntb.exec:\hhnntb.exe25⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vvpvp.exec:\vvpvp.exe26⤵
- Executes dropped EXE
PID:776 -
\??\c:\lllrflx.exec:\lllrflx.exe27⤵
- Executes dropped EXE
PID:3004 -
\??\c:\nhhntt.exec:\nhhntt.exe28⤵
- Executes dropped EXE
PID:2440 -
\??\c:\jpvpv.exec:\jpvpv.exe29⤵
- Executes dropped EXE
PID:824 -
\??\c:\lrffrxx.exec:\lrffrxx.exe30⤵
- Executes dropped EXE
PID:1276 -
\??\c:\bhtnnh.exec:\bhtnnh.exe31⤵
- Executes dropped EXE
PID:3036 -
\??\c:\1pjdv.exec:\1pjdv.exe32⤵
- Executes dropped EXE
PID:1956 -
\??\c:\lfrllxx.exec:\lfrllxx.exe33⤵
- Executes dropped EXE
PID:2284 -
\??\c:\bthnbh.exec:\bthnbh.exe34⤵
- Executes dropped EXE
PID:2360 -
\??\c:\dvppd.exec:\dvppd.exe35⤵
- Executes dropped EXE
PID:2868 -
\??\c:\5ffrxxf.exec:\5ffrxxf.exe36⤵
- Executes dropped EXE
PID:2388 -
\??\c:\rlrxffx.exec:\rlrxffx.exe37⤵
- Executes dropped EXE
PID:2840 -
\??\c:\bnbbbt.exec:\bnbbbt.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rfrxfff.exec:\rfrxfff.exe39⤵
- Executes dropped EXE
PID:2864 -
\??\c:\rrfrlxr.exec:\rrfrlxr.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tbhbnh.exec:\tbhbnh.exe41⤵
- Executes dropped EXE
PID:708 -
\??\c:\jjjjd.exec:\jjjjd.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2760 -
\??\c:\frffrxf.exec:\frffrxf.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rlrxllr.exec:\rlrxllr.exe44⤵
- Executes dropped EXE
PID:1072 -
\??\c:\nbnnhb.exec:\nbnnhb.exe45⤵
- Executes dropped EXE
PID:1268 -
\??\c:\pjvdv.exec:\pjvdv.exe46⤵
- Executes dropped EXE
PID:1208 -
\??\c:\rlrxxxr.exec:\rlrxxxr.exe47⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lxllxfx.exec:\lxllxfx.exe48⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xfrxffr.exec:\xfrxffr.exe49⤵
- Executes dropped EXE
PID:2724 -
\??\c:\hhbhhn.exec:\hhbhhn.exe50⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tnbbnn.exec:\tnbbnn.exe51⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dppdv.exec:\dppdv.exe52⤵
- Executes dropped EXE
PID:1280 -
\??\c:\xlxfflr.exec:\xlxfflr.exe53⤵
- Executes dropped EXE
PID:1768 -
\??\c:\rrfrrlr.exec:\rrfrrlr.exe54⤵
- Executes dropped EXE
PID:1764 -
\??\c:\htbnnn.exec:\htbnnn.exe55⤵
- Executes dropped EXE
PID:2976 -
\??\c:\djpvd.exec:\djpvd.exe56⤵
- Executes dropped EXE
PID:2456 -
\??\c:\3lxrxxx.exec:\3lxrxxx.exe57⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xrxlrlr.exec:\xrxlrlr.exe58⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nnhttt.exec:\nnhttt.exe59⤵
- Executes dropped EXE
PID:2240 -
\??\c:\tbnbtn.exec:\tbnbtn.exe60⤵
- Executes dropped EXE
PID:2612 -
\??\c:\vpjdp.exec:\vpjdp.exe61⤵
- Executes dropped EXE
PID:1376 -
\??\c:\fllffll.exec:\fllffll.exe62⤵
- Executes dropped EXE
PID:968 -
\??\c:\tbbnbb.exec:\tbbnbb.exe63⤵
- Executes dropped EXE
PID:648 -
\??\c:\bhhbbb.exec:\bhhbbb.exe64⤵
- Executes dropped EXE
PID:1552 -
\??\c:\3jdvd.exec:\3jdvd.exe65⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jdvvp.exec:\jdvvp.exe66⤵PID:600
-
\??\c:\flxlxxf.exec:\flxlxxf.exe67⤵PID:1512
-
\??\c:\tbnbhb.exec:\tbnbhb.exe68⤵PID:904
-
\??\c:\nhthhb.exec:\nhthhb.exe69⤵PID:1276
-
\??\c:\pdpdp.exec:\pdpdp.exe70⤵PID:2128
-
\??\c:\xfxxrll.exec:\xfxxrll.exe71⤵PID:2920
-
\??\c:\hnbnth.exec:\hnbnth.exe72⤵PID:2472
-
\??\c:\htbtbt.exec:\htbtbt.exe73⤵PID:1404
-
\??\c:\pdjpv.exec:\pdjpv.exe74⤵PID:2908
-
\??\c:\rrrlllf.exec:\rrrlllf.exe75⤵PID:2892
-
\??\c:\flxfrrx.exec:\flxfrrx.exe76⤵PID:2972
-
\??\c:\nhbhnt.exec:\nhbhnt.exe77⤵PID:1260
-
\??\c:\hthnth.exec:\hthnth.exe78⤵PID:2504
-
\??\c:\jvjvj.exec:\jvjvj.exe79⤵PID:796
-
\??\c:\3flflll.exec:\3flflll.exe80⤵PID:2308
-
\??\c:\hnhhth.exec:\hnhhth.exe81⤵PID:2692
-
\??\c:\bnnthh.exec:\bnnthh.exe82⤵PID:2640
-
\??\c:\jvpvj.exec:\jvpvj.exe83⤵PID:1488
-
\??\c:\lflxllx.exec:\lflxllx.exe84⤵PID:1752
-
\??\c:\tnhnnh.exec:\tnhnnh.exe85⤵PID:1880
-
\??\c:\htnnnn.exec:\htnnnn.exe86⤵PID:2596
-
\??\c:\jdppv.exec:\jdppv.exe87⤵PID:972
-
\??\c:\xlflrfl.exec:\xlflrfl.exe88⤵PID:2940
-
\??\c:\htbhtt.exec:\htbhtt.exe89⤵PID:2072
-
\??\c:\bbhtnb.exec:\bbhtnb.exe90⤵PID:2452
-
\??\c:\djdpj.exec:\djdpj.exe91⤵PID:1948
-
\??\c:\7rllxxx.exec:\7rllxxx.exe92⤵PID:1280
-
\??\c:\rfxlrrr.exec:\rfxlrrr.exe93⤵PID:868
-
\??\c:\nhbhht.exec:\nhbhht.exe94⤵
- System Location Discovery: System Language Discovery
PID:1764 -
\??\c:\ddvdj.exec:\ddvdj.exe95⤵PID:2976
-
\??\c:\xrflfff.exec:\xrflfff.exe96⤵PID:2456
-
\??\c:\xllfffr.exec:\xllfffr.exe97⤵PID:1328
-
\??\c:\bbnhtb.exec:\bbnhtb.exe98⤵PID:716
-
\??\c:\dvvpv.exec:\dvvpv.exe99⤵PID:3012
-
\??\c:\3jvjd.exec:\3jvjd.exe100⤵PID:1388
-
\??\c:\xxlxfrx.exec:\xxlxfrx.exe101⤵PID:1568
-
\??\c:\xrlfrrf.exec:\xrlfrrf.exe102⤵PID:1972
-
\??\c:\ttbnth.exec:\ttbnth.exe103⤵PID:2116
-
\??\c:\pjdjd.exec:\pjdjd.exe104⤵PID:604
-
\??\c:\vvjdj.exec:\vvjdj.exe105⤵PID:1056
-
\??\c:\xllxfrl.exec:\xllxfrl.exe106⤵PID:1656
-
\??\c:\3bbntb.exec:\3bbntb.exe107⤵PID:2436
-
\??\c:\vvpjp.exec:\vvpjp.exe108⤵PID:2256
-
\??\c:\pjvvj.exec:\pjvvj.exe109⤵PID:3036
-
\??\c:\fxrrlll.exec:\fxrrlll.exe110⤵PID:1956
-
\??\c:\hnbttt.exec:\hnbttt.exe111⤵PID:2336
-
\??\c:\3bthtt.exec:\3bthtt.exe112⤵PID:2792
-
\??\c:\ddjvp.exec:\ddjvp.exe113⤵PID:2868
-
\??\c:\dpddp.exec:\dpddp.exe114⤵PID:3008
-
\??\c:\lxrrlrl.exec:\lxrrlrl.exe115⤵PID:2744
-
\??\c:\nhbtnt.exec:\nhbtnt.exe116⤵PID:2972
-
\??\c:\hhbntb.exec:\hhbntb.exe117⤵PID:2924
-
\??\c:\5pvvv.exec:\5pvvv.exe118⤵PID:1168
-
\??\c:\xrrflxf.exec:\xrrflxf.exe119⤵PID:1436
-
\??\c:\nhnnth.exec:\nhnnth.exe120⤵PID:2644
-
\??\c:\bnbnnn.exec:\bnbnnn.exe121⤵PID:1272
-
\??\c:\jjjjv.exec:\jjjjv.exe122⤵PID:2096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-