Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03-08-2024 03:20
Static task
static1
Behavioral task
behavioral1
Sample
cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581.exe
Resource
win7-20240708-en
General
-
Target
cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581.exe
-
Size
107KB
-
MD5
38ba27bd886286588fb072673d34f0cb
-
SHA1
836ca398172fd7c8f1f3669a83f905db374c6729
-
SHA256
cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581
-
SHA512
db4cb2783db74e218247d13ad47dcb8769457e19d5b03daade4ae48d43e505acdedfa7453cff53c97965b8ff82ad560eb000a876b50839634db9c66a77098490
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoTNKDeS98hPUdHV7RNzfJNXZmJ:ymb3NkkiQ3mdBjFo5KDe88g1fDg
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/3044-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/968-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/596-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/912-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1052-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1096-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2704 7vvdj.exe 2660 9rllxfx.exe 2804 7nbnth.exe 2584 dvjvj.exe 2668 rlfflrr.exe 2628 9lfflrf.exe 2972 vvvjp.exe 1780 vpjvd.exe 1040 lfxfrrf.exe 2908 btbbhh.exe 2188 dpdpj.exe 2544 pdpjv.exe 2828 3xxlrfl.exe 1644 btbtbb.exe 2348 dpjvd.exe 968 dvddj.exe 596 xrlxllx.exe 3036 nhbbtt.exe 2072 vpdvd.exe 2456 xrfxxxx.exe 2356 llfflxf.exe 1860 hbtbnn.exe 912 bnhbbt.exe 1052 ddvdd.exe 2500 fflxfxf.exe 1096 xfrlrlf.exe 1948 bthbhh.exe 1968 ddvpp.exe 304 rlxrxrf.exe 3044 nnbnth.exe 2752 ttntbn.exe 2712 vppjp.exe 2564 lfxxflx.exe 2096 3fxxlfl.exe 2596 tththt.exe 2556 thnnnb.exe 2588 jjpvv.exe 1064 3jdjp.exe 1304 5llrxfr.exe 1696 rlrxffr.exe 1144 3thtnb.exe 108 btnnnt.exe 2896 vpppv.exe 2228 9pjpv.exe 1432 9xlllfr.exe 2944 rffffxr.exe 2384 3bhhtt.exe 2616 nnnnbt.exe 1980 nbtbbh.exe 1964 7vjjj.exe 1688 jddjv.exe 2000 xrllxxl.exe 1352 fxrxflx.exe 3016 nhbhbn.exe 2432 btthbt.exe 3040 vpvdj.exe 1356 vpppv.exe 2356 vpddp.exe 2380 rfllrll.exe 1800 fllrrxl.exe 1788 hhtbtt.exe 2296 9tbbnh.exe 2920 hhnnbh.exe 2200 3ddvj.exe -
resource yara_rule behavioral1/memory/3044-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/968-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/596-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1052-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1096-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-273-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2704 3044 cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581.exe 30 PID 3044 wrote to memory of 2704 3044 cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581.exe 30 PID 3044 wrote to memory of 2704 3044 cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581.exe 30 PID 3044 wrote to memory of 2704 3044 cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581.exe 30 PID 2704 wrote to memory of 2660 2704 7vvdj.exe 31 PID 2704 wrote to memory of 2660 2704 7vvdj.exe 31 PID 2704 wrote to memory of 2660 2704 7vvdj.exe 31 PID 2704 wrote to memory of 2660 2704 7vvdj.exe 31 PID 2660 wrote to memory of 2804 2660 9rllxfx.exe 32 PID 2660 wrote to memory of 2804 2660 9rllxfx.exe 32 PID 2660 wrote to memory of 2804 2660 9rllxfx.exe 32 PID 2660 wrote to memory of 2804 2660 9rllxfx.exe 32 PID 2804 wrote to memory of 2584 2804 7nbnth.exe 33 PID 2804 wrote to memory of 2584 2804 7nbnth.exe 33 PID 2804 wrote to memory of 2584 2804 7nbnth.exe 33 PID 2804 wrote to memory of 2584 2804 7nbnth.exe 33 PID 2584 wrote to memory of 2668 2584 dvjvj.exe 34 PID 2584 wrote to memory of 2668 2584 dvjvj.exe 34 PID 2584 wrote to memory of 2668 2584 dvjvj.exe 34 PID 2584 wrote to memory of 2668 2584 dvjvj.exe 34 PID 2668 wrote to memory of 2628 2668 rlfflrr.exe 35 PID 2668 wrote to memory of 2628 2668 rlfflrr.exe 35 PID 2668 wrote to memory of 2628 2668 rlfflrr.exe 35 PID 2668 wrote to memory of 2628 2668 rlfflrr.exe 35 PID 2628 wrote to memory of 2972 2628 9lfflrf.exe 36 PID 2628 wrote to memory of 2972 2628 9lfflrf.exe 36 PID 2628 wrote to memory of 2972 2628 9lfflrf.exe 36 PID 2628 wrote to memory of 2972 2628 9lfflrf.exe 36 PID 2972 wrote to memory of 1780 2972 vvvjp.exe 37 PID 2972 wrote to memory of 1780 2972 vvvjp.exe 37 PID 2972 wrote to memory of 1780 2972 vvvjp.exe 37 PID 2972 wrote to memory of 1780 2972 vvvjp.exe 37 PID 1780 wrote to memory of 1040 1780 vpjvd.exe 38 PID 1780 wrote to memory of 1040 1780 vpjvd.exe 38 PID 1780 wrote to memory of 1040 1780 vpjvd.exe 38 PID 1780 wrote to memory of 1040 1780 vpjvd.exe 38 PID 1040 wrote to memory of 2908 1040 lfxfrrf.exe 39 PID 1040 wrote to memory of 2908 1040 lfxfrrf.exe 39 PID 1040 wrote to memory of 2908 1040 lfxfrrf.exe 39 PID 1040 wrote to memory of 2908 1040 lfxfrrf.exe 39 PID 2908 wrote to memory of 2188 2908 btbbhh.exe 40 PID 2908 wrote to memory of 2188 2908 btbbhh.exe 40 PID 2908 wrote to memory of 2188 2908 btbbhh.exe 40 PID 2908 wrote to memory of 2188 2908 btbbhh.exe 40 PID 2188 wrote to memory of 2544 2188 dpdpj.exe 41 PID 2188 wrote to memory of 2544 2188 dpdpj.exe 41 PID 2188 wrote to memory of 2544 2188 dpdpj.exe 41 PID 2188 wrote to memory of 2544 2188 dpdpj.exe 41 PID 2544 wrote to memory of 2828 2544 pdpjv.exe 42 PID 2544 wrote to memory of 2828 2544 pdpjv.exe 42 PID 2544 wrote to memory of 2828 2544 pdpjv.exe 42 PID 2544 wrote to memory of 2828 2544 pdpjv.exe 42 PID 2828 wrote to memory of 1644 2828 3xxlrfl.exe 43 PID 2828 wrote to memory of 1644 2828 3xxlrfl.exe 43 PID 2828 wrote to memory of 1644 2828 3xxlrfl.exe 43 PID 2828 wrote to memory of 1644 2828 3xxlrfl.exe 43 PID 1644 wrote to memory of 2348 1644 btbtbb.exe 44 PID 1644 wrote to memory of 2348 1644 btbtbb.exe 44 PID 1644 wrote to memory of 2348 1644 btbtbb.exe 44 PID 1644 wrote to memory of 2348 1644 btbtbb.exe 44 PID 2348 wrote to memory of 968 2348 dpjvd.exe 45 PID 2348 wrote to memory of 968 2348 dpjvd.exe 45 PID 2348 wrote to memory of 968 2348 dpjvd.exe 45 PID 2348 wrote to memory of 968 2348 dpjvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581.exe"C:\Users\Admin\AppData\Local\Temp\cfc296b0789bf43b37b225ed1f918aa444a3132f78eda3a9fd303585d7503581.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\7vvdj.exec:\7vvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\9rllxfx.exec:\9rllxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\7nbnth.exec:\7nbnth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\dvjvj.exec:\dvjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\rlfflrr.exec:\rlfflrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\9lfflrf.exec:\9lfflrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\vvvjp.exec:\vvvjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\vpjvd.exec:\vpjvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\btbbhh.exec:\btbbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\dpdpj.exec:\dpdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\pdpjv.exec:\pdpjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\3xxlrfl.exec:\3xxlrfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\btbtbb.exec:\btbtbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\dpjvd.exec:\dpjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\dvddj.exec:\dvddj.exe17⤵
- Executes dropped EXE
PID:968 -
\??\c:\xrlxllx.exec:\xrlxllx.exe18⤵
- Executes dropped EXE
PID:596 -
\??\c:\nhbbtt.exec:\nhbbtt.exe19⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vpdvd.exec:\vpdvd.exe20⤵
- Executes dropped EXE
PID:2072 -
\??\c:\xrfxxxx.exec:\xrfxxxx.exe21⤵
- Executes dropped EXE
PID:2456 -
\??\c:\llfflxf.exec:\llfflxf.exe22⤵
- Executes dropped EXE
PID:2356 -
\??\c:\hbtbnn.exec:\hbtbnn.exe23⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bnhbbt.exec:\bnhbbt.exe24⤵
- Executes dropped EXE
PID:912 -
\??\c:\ddvdd.exec:\ddvdd.exe25⤵
- Executes dropped EXE
PID:1052 -
\??\c:\fflxfxf.exec:\fflxfxf.exe26⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xfrlrlf.exec:\xfrlrlf.exe27⤵
- Executes dropped EXE
PID:1096 -
\??\c:\bthbhh.exec:\bthbhh.exe28⤵
- Executes dropped EXE
PID:1948 -
\??\c:\ddvpp.exec:\ddvpp.exe29⤵
- Executes dropped EXE
PID:1968 -
\??\c:\rlxrxrf.exec:\rlxrxrf.exe30⤵
- Executes dropped EXE
PID:304 -
\??\c:\nnbnth.exec:\nnbnth.exe31⤵
- Executes dropped EXE
PID:3044 -
\??\c:\ttntbn.exec:\ttntbn.exe32⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vppjp.exec:\vppjp.exe33⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lfxxflx.exec:\lfxxflx.exe34⤵
- Executes dropped EXE
PID:2564 -
\??\c:\3fxxlfl.exec:\3fxxlfl.exe35⤵
- Executes dropped EXE
PID:2096 -
\??\c:\tththt.exec:\tththt.exe36⤵
- Executes dropped EXE
PID:2596 -
\??\c:\thnnnb.exec:\thnnnb.exe37⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jjpvv.exec:\jjpvv.exe38⤵
- Executes dropped EXE
PID:2588 -
\??\c:\3jdjp.exec:\3jdjp.exe39⤵
- Executes dropped EXE
PID:1064 -
\??\c:\5llrxfr.exec:\5llrxfr.exe40⤵
- Executes dropped EXE
PID:1304 -
\??\c:\rlrxffr.exec:\rlrxffr.exe41⤵
- Executes dropped EXE
PID:1696 -
\??\c:\3thtnb.exec:\3thtnb.exe42⤵
- Executes dropped EXE
PID:1144 -
\??\c:\btnnnt.exec:\btnnnt.exe43⤵
- Executes dropped EXE
PID:108 -
\??\c:\vpppv.exec:\vpppv.exe44⤵
- Executes dropped EXE
PID:2896 -
\??\c:\9pjpv.exec:\9pjpv.exe45⤵
- Executes dropped EXE
PID:2228 -
\??\c:\9xlllfr.exec:\9xlllfr.exe46⤵
- Executes dropped EXE
PID:1432 -
\??\c:\rffffxr.exec:\rffffxr.exe47⤵
- Executes dropped EXE
PID:2944 -
\??\c:\3bhhtt.exec:\3bhhtt.exe48⤵
- Executes dropped EXE
PID:2384 -
\??\c:\nnnnbt.exec:\nnnnbt.exe49⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nbtbbh.exec:\nbtbbh.exe50⤵
- Executes dropped EXE
PID:1980 -
\??\c:\7vjjj.exec:\7vjjj.exe51⤵
- Executes dropped EXE
PID:1964 -
\??\c:\jddjv.exec:\jddjv.exe52⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xrllxxl.exec:\xrllxxl.exe53⤵
- Executes dropped EXE
PID:2000 -
\??\c:\fxrxflx.exec:\fxrxflx.exe54⤵
- Executes dropped EXE
PID:1352 -
\??\c:\nhbhbn.exec:\nhbhbn.exe55⤵
- Executes dropped EXE
PID:3016 -
\??\c:\btthbt.exec:\btthbt.exe56⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vpvdj.exec:\vpvdj.exe57⤵
- Executes dropped EXE
PID:3040 -
\??\c:\vpppv.exec:\vpppv.exe58⤵
- Executes dropped EXE
PID:1356 -
\??\c:\vpddp.exec:\vpddp.exe59⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rfllrll.exec:\rfllrll.exe60⤵
- Executes dropped EXE
PID:2380 -
\??\c:\fllrrxl.exec:\fllrrxl.exe61⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hhtbtt.exec:\hhtbtt.exe62⤵
- Executes dropped EXE
PID:1788 -
\??\c:\9tbbnh.exec:\9tbbnh.exe63⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hhnnbh.exec:\hhnnbh.exe64⤵
- Executes dropped EXE
PID:2920 -
\??\c:\3ddvj.exec:\3ddvj.exe65⤵
- Executes dropped EXE
PID:2200 -
\??\c:\5dvvd.exec:\5dvvd.exe66⤵PID:2924
-
\??\c:\flrlffr.exec:\flrlffr.exe67⤵PID:900
-
\??\c:\9fxxlrx.exec:\9fxxlrx.exe68⤵PID:2932
-
\??\c:\lrxxxxl.exec:\lrxxxxl.exe69⤵PID:304
-
\??\c:\bthbhn.exec:\bthbhn.exe70⤵PID:2684
-
\??\c:\tntnth.exec:\tntnth.exe71⤵PID:2708
-
\??\c:\vpdvp.exec:\vpdvp.exe72⤵PID:2800
-
\??\c:\1jvvj.exec:\1jvvj.exe73⤵PID:2664
-
\??\c:\9xllllr.exec:\9xllllr.exe74⤵PID:3048
-
\??\c:\fllxffx.exec:\fllxffx.exe75⤵PID:2728
-
\??\c:\9rlrrxf.exec:\9rlrrxf.exe76⤵PID:2568
-
\??\c:\nhhntt.exec:\nhhntt.exe77⤵PID:2612
-
\??\c:\btbhnn.exec:\btbhnn.exe78⤵PID:2080
-
\??\c:\jdjdj.exec:\jdjdj.exe79⤵PID:2860
-
\??\c:\9vvdj.exec:\9vvdj.exe80⤵PID:2256
-
\??\c:\fxlflrl.exec:\fxlflrl.exe81⤵PID:1036
-
\??\c:\xrfflfr.exec:\xrfflfr.exe82⤵PID:2084
-
\??\c:\nhnhnb.exec:\nhnhnb.exe83⤵PID:2092
-
\??\c:\jvjvd.exec:\jvjvd.exe84⤵PID:336
-
\??\c:\ddvdp.exec:\ddvdp.exe85⤵PID:2796
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe86⤵PID:2148
-
\??\c:\bbtnnb.exec:\bbtnnb.exe87⤵PID:2196
-
\??\c:\vpdjv.exec:\vpdjv.exe88⤵PID:2248
-
\??\c:\jpjjd.exec:\jpjjd.exe89⤵PID:2388
-
\??\c:\1xxrfxx.exec:\1xxrfxx.exe90⤵PID:2348
-
\??\c:\nnhntt.exec:\nnhntt.exe91⤵PID:588
-
\??\c:\vdpjp.exec:\vdpjp.exe92⤵PID:2340
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe93⤵PID:2152
-
\??\c:\5xfffxf.exec:\5xfffxf.exe94⤵PID:1616
-
\??\c:\btthtt.exec:\btthtt.exe95⤵PID:1956
-
\??\c:\1pddv.exec:\1pddv.exe96⤵PID:2456
-
\??\c:\pdjjp.exec:\pdjjp.exe97⤵PID:1080
-
\??\c:\pvppd.exec:\pvppd.exe98⤵PID:2520
-
\??\c:\rlrfffr.exec:\rlrfffr.exe99⤵PID:804
-
\??\c:\9rlrrxx.exec:\9rlrrxx.exe100⤵PID:2044
-
\??\c:\bnnhbt.exec:\bnnhbt.exe101⤵PID:1028
-
\??\c:\pjdjv.exec:\pjdjv.exe102⤵PID:2500
-
\??\c:\ddvvv.exec:\ddvvv.exe103⤵PID:592
-
\??\c:\9frlrrl.exec:\9frlrrl.exe104⤵PID:708
-
\??\c:\fxlxrxl.exec:\fxlxrxl.exe105⤵PID:2112
-
\??\c:\5bnbbb.exec:\5bnbbb.exe106⤵PID:1968
-
\??\c:\nnbbtt.exec:\nnbbtt.exe107⤵PID:1916
-
\??\c:\vpjdj.exec:\vpjdj.exe108⤵PID:2932
-
\??\c:\xllffff.exec:\xllffff.exe109⤵PID:304
-
\??\c:\fxffllf.exec:\fxffllf.exe110⤵PID:2752
-
\??\c:\3hbbhh.exec:\3hbbhh.exe111⤵
- System Location Discovery: System Language Discovery
PID:2712 -
\??\c:\thtthn.exec:\thtthn.exe112⤵PID:2844
-
\??\c:\vvdvv.exec:\vvdvv.exe113⤵PID:2664
-
\??\c:\7vdpv.exec:\7vdpv.exe114⤵PID:3048
-
\??\c:\xlxxxff.exec:\xlxxxff.exe115⤵PID:2676
-
\??\c:\xrrxlrf.exec:\xrrxlrf.exe116⤵PID:2964
-
\??\c:\7nhnbh.exec:\7nhnbh.exe117⤵PID:2612
-
\??\c:\btbhbt.exec:\btbhbt.exe118⤵PID:444
-
\??\c:\hbntbb.exec:\hbntbb.exe119⤵PID:1088
-
\??\c:\jdpjj.exec:\jdpjj.exe120⤵PID:1256
-
\??\c:\rrlxflr.exec:\rrlxflr.exe121⤵PID:1040
-
\??\c:\3lxlllx.exec:\3lxlllx.exe122⤵PID:1676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-