Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 23:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
deb8cc4d2e28901c1ddaecfc0eb69430N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
deb8cc4d2e28901c1ddaecfc0eb69430N.exe
-
Size
64KB
-
MD5
deb8cc4d2e28901c1ddaecfc0eb69430
-
SHA1
f643c30ced3be39245d9a2025713ceef1622a560
-
SHA256
4eb91b32a500e67cfd47add1092e2f498f428b053e2e797fd60114c59adec2e1
-
SHA512
6543891fe9f5bd1a706d5e9fe9b1772a7a5eeb8b6b83ec6bb97cdb1986a71c2247917afcaaa48f9a225d5308d8a7bcc511f0149f47720c41e27e9490d3527537
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxm:ymb3NkkiQ3mdBjF0y7kbY
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2340-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-30-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1676-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/788-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1208-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2340 rxrllfr.exe 1676 hhbhtb.exe 2300 ddvvp.exe 2696 dvdpd.exe 2708 nnhntb.exe 2736 dvdjj.exe 2584 9vjjp.exe 2796 hbnbtn.exe 2632 9bbbnh.exe 2440 jdpdj.exe 1956 lfrlxfl.exe 3028 rlfrxxf.exe 2544 nnbhnt.exe 2868 pdvvj.exe 2904 frrrrfl.exe 1944 fxxlxff.exe 1592 9bbbnb.exe 788 djjdv.exe 2100 jjpdj.exe 2268 fffffrl.exe 1332 7nnbnt.exe 860 bbbnbh.exe 1020 ppdjp.exe 1464 1vvjv.exe 1716 ffxxffr.exe 2224 5bnbhh.exe 1228 ddvjv.exe 2288 lfxflrf.exe 1208 rlfrflx.exe 324 nhthnt.exe 2368 7jpjd.exe 1728 dvjpv.exe 2152 xxxflfx.exe 2004 hhbhtb.exe 2684 btbnbh.exe 2200 vpjpp.exe 2844 dvjdj.exe 2712 fxffxfl.exe 2716 lfxlrxl.exe 1628 nhtttb.exe 2584 nhnntb.exe 2720 dvddp.exe 2184 5ppvv.exe 1080 xxlrffl.exe 1712 lrlxfrf.exe 1736 hbnbhb.exe 2832 hhtnnb.exe 2808 9dvpv.exe 2824 jdpvj.exe 2732 rlxrrrf.exe 1548 ffrfxxx.exe 1852 nbntth.exe 992 vvdpv.exe 2092 vppvj.exe 2088 9frlxxl.exe 2404 lffflll.exe 2652 nhhnbb.exe 916 nhbbtt.exe 600 dpdjp.exe 1556 vpjjp.exe 2336 lrrfxfr.exe 988 ththnt.exe 1784 bbhbbt.exe 2976 dpvdj.exe -
resource yara_rule behavioral1/memory/2340-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/788-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1208-280-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frfxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1744 wrote to memory of 2340 1744 deb8cc4d2e28901c1ddaecfc0eb69430N.exe 31 PID 1744 wrote to memory of 2340 1744 deb8cc4d2e28901c1ddaecfc0eb69430N.exe 31 PID 1744 wrote to memory of 2340 1744 deb8cc4d2e28901c1ddaecfc0eb69430N.exe 31 PID 1744 wrote to memory of 2340 1744 deb8cc4d2e28901c1ddaecfc0eb69430N.exe 31 PID 2340 wrote to memory of 1676 2340 rxrllfr.exe 32 PID 2340 wrote to memory of 1676 2340 rxrllfr.exe 32 PID 2340 wrote to memory of 1676 2340 rxrllfr.exe 32 PID 2340 wrote to memory of 1676 2340 rxrllfr.exe 32 PID 1676 wrote to memory of 2300 1676 hhbhtb.exe 33 PID 1676 wrote to memory of 2300 1676 hhbhtb.exe 33 PID 1676 wrote to memory of 2300 1676 hhbhtb.exe 33 PID 1676 wrote to memory of 2300 1676 hhbhtb.exe 33 PID 2300 wrote to memory of 2696 2300 ddvvp.exe 34 PID 2300 wrote to memory of 2696 2300 ddvvp.exe 34 PID 2300 wrote to memory of 2696 2300 ddvvp.exe 34 PID 2300 wrote to memory of 2696 2300 ddvvp.exe 34 PID 2696 wrote to memory of 2708 2696 dvdpd.exe 35 PID 2696 wrote to memory of 2708 2696 dvdpd.exe 35 PID 2696 wrote to memory of 2708 2696 dvdpd.exe 35 PID 2696 wrote to memory of 2708 2696 dvdpd.exe 35 PID 2708 wrote to memory of 2736 2708 nnhntb.exe 36 PID 2708 wrote to memory of 2736 2708 nnhntb.exe 36 PID 2708 wrote to memory of 2736 2708 nnhntb.exe 36 PID 2708 wrote to memory of 2736 2708 nnhntb.exe 36 PID 2736 wrote to memory of 2584 2736 dvdjj.exe 37 PID 2736 wrote to memory of 2584 2736 dvdjj.exe 37 PID 2736 wrote to memory of 2584 2736 dvdjj.exe 37 PID 2736 wrote to memory of 2584 2736 dvdjj.exe 37 PID 2584 wrote to memory of 2796 2584 9vjjp.exe 38 PID 2584 wrote to memory of 2796 2584 9vjjp.exe 38 PID 2584 wrote to memory of 2796 2584 9vjjp.exe 38 PID 2584 wrote to memory of 2796 2584 9vjjp.exe 38 PID 2796 wrote to memory of 2632 2796 hbnbtn.exe 39 PID 2796 wrote to memory of 2632 2796 hbnbtn.exe 39 PID 2796 wrote to memory of 2632 2796 hbnbtn.exe 39 PID 2796 wrote to memory of 2632 2796 hbnbtn.exe 39 PID 2632 wrote to memory of 2440 2632 9bbbnh.exe 40 PID 2632 wrote to memory of 2440 2632 9bbbnh.exe 40 PID 2632 wrote to memory of 2440 2632 9bbbnh.exe 40 PID 2632 wrote to memory of 2440 2632 9bbbnh.exe 40 PID 2440 wrote to memory of 1956 2440 jdpdj.exe 41 PID 2440 wrote to memory of 1956 2440 jdpdj.exe 41 PID 2440 wrote to memory of 1956 2440 jdpdj.exe 41 PID 2440 wrote to memory of 1956 2440 jdpdj.exe 41 PID 1956 wrote to memory of 3028 1956 lfrlxfl.exe 42 PID 1956 wrote to memory of 3028 1956 lfrlxfl.exe 42 PID 1956 wrote to memory of 3028 1956 lfrlxfl.exe 42 PID 1956 wrote to memory of 3028 1956 lfrlxfl.exe 42 PID 3028 wrote to memory of 2544 3028 rlfrxxf.exe 43 PID 3028 wrote to memory of 2544 3028 rlfrxxf.exe 43 PID 3028 wrote to memory of 2544 3028 rlfrxxf.exe 43 PID 3028 wrote to memory of 2544 3028 rlfrxxf.exe 43 PID 2544 wrote to memory of 2868 2544 nnbhnt.exe 44 PID 2544 wrote to memory of 2868 2544 nnbhnt.exe 44 PID 2544 wrote to memory of 2868 2544 nnbhnt.exe 44 PID 2544 wrote to memory of 2868 2544 nnbhnt.exe 44 PID 2868 wrote to memory of 2904 2868 pdvvj.exe 45 PID 2868 wrote to memory of 2904 2868 pdvvj.exe 45 PID 2868 wrote to memory of 2904 2868 pdvvj.exe 45 PID 2868 wrote to memory of 2904 2868 pdvvj.exe 45 PID 2904 wrote to memory of 1944 2904 frrrrfl.exe 46 PID 2904 wrote to memory of 1944 2904 frrrrfl.exe 46 PID 2904 wrote to memory of 1944 2904 frrrrfl.exe 46 PID 2904 wrote to memory of 1944 2904 frrrrfl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\deb8cc4d2e28901c1ddaecfc0eb69430N.exe"C:\Users\Admin\AppData\Local\Temp\deb8cc4d2e28901c1ddaecfc0eb69430N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\rxrllfr.exec:\rxrllfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\hhbhtb.exec:\hhbhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\ddvvp.exec:\ddvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\dvdpd.exec:\dvdpd.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\nnhntb.exec:\nnhntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\dvdjj.exec:\dvdjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\9vjjp.exec:\9vjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\hbnbtn.exec:\hbnbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\9bbbnh.exec:\9bbbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\jdpdj.exec:\jdpdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\lfrlxfl.exec:\lfrlxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\rlfrxxf.exec:\rlfrxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\nnbhnt.exec:\nnbhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\pdvvj.exec:\pdvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\frrrrfl.exec:\frrrrfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\fxxlxff.exec:\fxxlxff.exe17⤵
- Executes dropped EXE
PID:1944 -
\??\c:\9bbbnb.exec:\9bbbnb.exe18⤵
- Executes dropped EXE
PID:1592 -
\??\c:\djjdv.exec:\djjdv.exe19⤵
- Executes dropped EXE
PID:788 -
\??\c:\jjpdj.exec:\jjpdj.exe20⤵
- Executes dropped EXE
PID:2100 -
\??\c:\fffffrl.exec:\fffffrl.exe21⤵
- Executes dropped EXE
PID:2268 -
\??\c:\7nnbnt.exec:\7nnbnt.exe22⤵
- Executes dropped EXE
PID:1332 -
\??\c:\bbbnbh.exec:\bbbnbh.exe23⤵
- Executes dropped EXE
PID:860 -
\??\c:\ppdjp.exec:\ppdjp.exe24⤵
- Executes dropped EXE
PID:1020 -
\??\c:\1vvjv.exec:\1vvjv.exe25⤵
- Executes dropped EXE
PID:1464 -
\??\c:\ffxxffr.exec:\ffxxffr.exe26⤵
- Executes dropped EXE
PID:1716 -
\??\c:\5bnbhh.exec:\5bnbhh.exe27⤵
- Executes dropped EXE
PID:2224 -
\??\c:\ddvjv.exec:\ddvjv.exe28⤵
- Executes dropped EXE
PID:1228 -
\??\c:\lfxflrf.exec:\lfxflrf.exe29⤵
- Executes dropped EXE
PID:2288 -
\??\c:\rlfrflx.exec:\rlfrflx.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1208 -
\??\c:\nhthnt.exec:\nhthnt.exe31⤵
- Executes dropped EXE
PID:324 -
\??\c:\7jpjd.exec:\7jpjd.exe32⤵
- Executes dropped EXE
PID:2368 -
\??\c:\dvjpv.exec:\dvjpv.exe33⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xxxflfx.exec:\xxxflfx.exe34⤵
- Executes dropped EXE
PID:2152 -
\??\c:\hhbhtb.exec:\hhbhtb.exe35⤵
- Executes dropped EXE
PID:2004 -
\??\c:\btbnbh.exec:\btbnbh.exe36⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vpjpp.exec:\vpjpp.exe37⤵
- Executes dropped EXE
PID:2200 -
\??\c:\dvjdj.exec:\dvjdj.exe38⤵
- Executes dropped EXE
PID:2844 -
\??\c:\fxffxfl.exec:\fxffxfl.exe39⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lfxlrxl.exec:\lfxlrxl.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nhtttb.exec:\nhtttb.exe41⤵
- Executes dropped EXE
PID:1628 -
\??\c:\nhnntb.exec:\nhnntb.exe42⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dvddp.exec:\dvddp.exe43⤵
- Executes dropped EXE
PID:2720 -
\??\c:\5ppvv.exec:\5ppvv.exe44⤵
- Executes dropped EXE
PID:2184 -
\??\c:\xxlrffl.exec:\xxlrffl.exe45⤵
- Executes dropped EXE
PID:1080 -
\??\c:\lrlxfrf.exec:\lrlxfrf.exe46⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hbnbhb.exec:\hbnbhb.exe47⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hhtnnb.exec:\hhtnnb.exe48⤵
- Executes dropped EXE
PID:2832 -
\??\c:\9dvpv.exec:\9dvpv.exe49⤵
- Executes dropped EXE
PID:2808 -
\??\c:\jdpvj.exec:\jdpvj.exe50⤵
- Executes dropped EXE
PID:2824 -
\??\c:\rlxrrrf.exec:\rlxrrrf.exe51⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ffrfxxx.exec:\ffrfxxx.exe52⤵
- Executes dropped EXE
PID:1548 -
\??\c:\nbntth.exec:\nbntth.exe53⤵
- Executes dropped EXE
PID:1852 -
\??\c:\vvdpv.exec:\vvdpv.exe54⤵
- Executes dropped EXE
PID:992 -
\??\c:\vppvj.exec:\vppvj.exe55⤵
- Executes dropped EXE
PID:2092 -
\??\c:\9frlxxl.exec:\9frlxxl.exe56⤵
- Executes dropped EXE
PID:2088 -
\??\c:\lffflll.exec:\lffflll.exe57⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nhhnbb.exec:\nhhnbb.exe58⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nhbbtt.exec:\nhbbtt.exe59⤵
- Executes dropped EXE
PID:916 -
\??\c:\dpdjp.exec:\dpdjp.exe60⤵
- Executes dropped EXE
PID:600 -
\??\c:\vpjjp.exec:\vpjjp.exe61⤵
- Executes dropped EXE
PID:1556 -
\??\c:\lrrfxfr.exec:\lrrfxfr.exe62⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ththnt.exec:\ththnt.exe63⤵
- Executes dropped EXE
PID:988 -
\??\c:\bbhbbt.exec:\bbhbbt.exe64⤵
- Executes dropped EXE
PID:1784 -
\??\c:\dpvdj.exec:\dpvdj.exe65⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nnbhbh.exec:\nnbhbh.exe66⤵PID:1424
-
\??\c:\5tnnnt.exec:\5tnnnt.exe67⤵PID:1000
-
\??\c:\jjdjv.exec:\jjdjv.exe68⤵PID:2288
-
\??\c:\ddvdv.exec:\ddvdv.exe69⤵PID:1208
-
\??\c:\rlrxrrf.exec:\rlrxrrf.exe70⤵PID:2340
-
\??\c:\xrlflrx.exec:\xrlflrx.exe71⤵PID:1684
-
\??\c:\5hbnhh.exec:\5hbnhh.exe72⤵PID:468
-
\??\c:\bbnhnn.exec:\bbnhnn.exe73⤵PID:1728
-
\??\c:\5pjdj.exec:\5pjdj.exe74⤵PID:2152
-
\??\c:\9vjdd.exec:\9vjdd.exe75⤵PID:2772
-
\??\c:\vjdpv.exec:\vjdpv.exe76⤵PID:700
-
\??\c:\xxffflf.exec:\xxffflf.exe77⤵PID:2664
-
\??\c:\7xrlxrx.exec:\7xrlxrx.exe78⤵PID:2844
-
\??\c:\5bnbbh.exec:\5bnbbh.exe79⤵PID:2708
-
\??\c:\hbttbh.exec:\hbttbh.exe80⤵PID:2716
-
\??\c:\pjpvd.exec:\pjpvd.exe81⤵PID:1596
-
\??\c:\jdppv.exec:\jdppv.exe82⤵PID:2584
-
\??\c:\lffrffx.exec:\lffrffx.exe83⤵PID:2604
-
\??\c:\rlflrxf.exec:\rlflrxf.exe84⤵PID:2184
-
\??\c:\tnbnnn.exec:\tnbnnn.exe85⤵PID:2164
-
\??\c:\bbntbh.exec:\bbntbh.exe86⤵PID:1712
-
\??\c:\dppvv.exec:\dppvv.exe87⤵PID:2060
-
\??\c:\ppdpv.exec:\ppdpv.exe88⤵PID:2832
-
\??\c:\9flrrrr.exec:\9flrrrr.exe89⤵PID:2616
-
\??\c:\3llxfrr.exec:\3llxfrr.exe90⤵PID:1940
-
\??\c:\9hhbnh.exec:\9hhbnh.exe91⤵PID:864
-
\??\c:\ththtb.exec:\ththtb.exe92⤵PID:2452
-
\??\c:\ppddp.exec:\ppddp.exe93⤵PID:1600
-
\??\c:\dpppv.exec:\dpppv.exe94⤵PID:992
-
\??\c:\fxffxxx.exec:\fxffxxx.exe95⤵PID:2084
-
\??\c:\rflxxxf.exec:\rflxxxf.exe96⤵PID:1668
-
\??\c:\7hhbth.exec:\7hhbth.exe97⤵PID:2280
-
\??\c:\nnntbh.exec:\nnntbh.exe98⤵PID:2652
-
\??\c:\nbntbt.exec:\nbntbt.exe99⤵PID:1332
-
\??\c:\jdpdp.exec:\jdpdp.exe100⤵PID:1460
-
\??\c:\3rxxrxr.exec:\3rxxrxr.exe101⤵PID:804
-
\??\c:\lflxflx.exec:\lflxflx.exe102⤵PID:2336
-
\??\c:\fxxlllr.exec:\fxxlllr.exe103⤵PID:1464
-
\??\c:\tbthhn.exec:\tbthhn.exe104⤵PID:1784
-
\??\c:\tthtnb.exec:\tthtnb.exe105⤵PID:2428
-
\??\c:\1pddv.exec:\1pddv.exe106⤵PID:1424
-
\??\c:\vpdpp.exec:\vpdpp.exe107⤵PID:2076
-
\??\c:\lfxxflx.exec:\lfxxflx.exe108⤵PID:2288
-
\??\c:\1lfrrxx.exec:\1lfrrxx.exe109⤵PID:1948
-
\??\c:\hbnntn.exec:\hbnntn.exe110⤵PID:1844
-
\??\c:\tnbhnh.exec:\tnbhnh.exe111⤵PID:2296
-
\??\c:\vjvvv.exec:\vjvvv.exe112⤵PID:468
-
\??\c:\dpjdp.exec:\dpjdp.exe113⤵PID:1532
-
\??\c:\xflffff.exec:\xflffff.exe114⤵PID:1448
-
\??\c:\xffxlxf.exec:\xffxlxf.exe115⤵PID:1512
-
\??\c:\ttthbn.exec:\ttthbn.exe116⤵
- System Location Discovery: System Language Discovery
PID:700 -
\??\c:\tntttb.exec:\tntttb.exe117⤵PID:2200
-
\??\c:\jjdjd.exec:\jjdjd.exe118⤵PID:2508
-
\??\c:\vjpjv.exec:\vjpjv.exe119⤵PID:2712
-
\??\c:\rfrlffl.exec:\rfrlffl.exe120⤵PID:2716
-
\??\c:\3xxllrx.exec:\3xxllrx.exe121⤵
- System Location Discovery: System Language Discovery
PID:2572 -
\??\c:\5nbbnt.exec:\5nbbnt.exe122⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-