Analysis
-
max time kernel
98s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22-08-2024 18:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ebc40cd78bf15a7862f1db4c29cd7580N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
ebc40cd78bf15a7862f1db4c29cd7580N.exe
-
Size
73KB
-
MD5
ebc40cd78bf15a7862f1db4c29cd7580
-
SHA1
07273016d621b7035c7e6d053dc0591df73b06b3
-
SHA256
ec07e19890290a8c09077fdafb7e1c8b158bb7aa17f1659a8014bd2ecf787e4f
-
SHA512
35f622a9eddc02a94a62a3650ef85f557c0a487e2d3cc0d4d6768db95361dbd4768dadeed949ec37b8bce1cd8ec506dffdc883c23812b6c2166ec6956fd98cb2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfot3ey:ymb3NkkiQ3mdBjFWXkj7afoV
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2308-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1348-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1436-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1212-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/676-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1348 nbhtbh.exe 2396 jdvdp.exe 2792 nnhnbb.exe 2752 9vvdp.exe 2968 fxlrffl.exe 2732 rrrflxr.exe 2788 9djdp.exe 2820 rrxxllx.exe 2728 5nbhbn.exe 2212 nhtbnn.exe 2040 1pjvd.exe 1908 rlrrxfl.exe 2908 nhbnbn.exe 1264 9tnthn.exe 1436 1jpvj.exe 1212 9xxrrrr.exe 3016 lfrfxxl.exe 2492 tbnbbb.exe 2300 7pvpp.exe 1572 ppdpv.exe 1072 ffrxffx.exe 1852 hbntnb.exe 1872 hbnhnn.exe 676 jjdjp.exe 2316 1lllrxl.exe 2480 nhnntt.exe 1940 bbthbb.exe 328 vvpjv.exe 2140 9fxlxrl.exe 1820 rrllffr.exe 2376 7hnhbb.exe 2412 jdjvj.exe 2356 3pvjp.exe 2712 7rfffll.exe 2808 hhthtb.exe 2736 tthnnt.exe 2848 jdvvp.exe 2904 llxfllx.exe 2872 lllfxfl.exe 2912 nhbnht.exe 2648 nnhtnb.exe 2600 ddvjd.exe 2776 ppjjj.exe 3056 xrffrrx.exe 464 fxxlxfl.exe 2040 5tnttt.exe 1120 ddvjv.exe 2664 dpdjp.exe 1684 llxfllr.exe 2936 5xlxlxf.exe 2188 1hbnth.exe 3044 jdpjv.exe 3032 jdvdv.exe 2056 9xrxlxl.exe 1484 xrxxfrf.exe 2388 bnttbn.exe 2236 btbtbh.exe 444 vvjpv.exe 616 ffrrxfl.exe 1984 rlrrfll.exe 2184 bnbhtn.exe 904 tntthh.exe 2068 3jvjj.exe 1088 jjddj.exe -
resource yara_rule behavioral1/memory/2308-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1348-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1212-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/676-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-271-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 1348 2308 ebc40cd78bf15a7862f1db4c29cd7580N.exe 30 PID 2308 wrote to memory of 1348 2308 ebc40cd78bf15a7862f1db4c29cd7580N.exe 30 PID 2308 wrote to memory of 1348 2308 ebc40cd78bf15a7862f1db4c29cd7580N.exe 30 PID 2308 wrote to memory of 1348 2308 ebc40cd78bf15a7862f1db4c29cd7580N.exe 30 PID 1348 wrote to memory of 2396 1348 nbhtbh.exe 31 PID 1348 wrote to memory of 2396 1348 nbhtbh.exe 31 PID 1348 wrote to memory of 2396 1348 nbhtbh.exe 31 PID 1348 wrote to memory of 2396 1348 nbhtbh.exe 31 PID 2396 wrote to memory of 2792 2396 jdvdp.exe 32 PID 2396 wrote to memory of 2792 2396 jdvdp.exe 32 PID 2396 wrote to memory of 2792 2396 jdvdp.exe 32 PID 2396 wrote to memory of 2792 2396 jdvdp.exe 32 PID 2792 wrote to memory of 2752 2792 nnhnbb.exe 33 PID 2792 wrote to memory of 2752 2792 nnhnbb.exe 33 PID 2792 wrote to memory of 2752 2792 nnhnbb.exe 33 PID 2792 wrote to memory of 2752 2792 nnhnbb.exe 33 PID 2752 wrote to memory of 2968 2752 9vvdp.exe 34 PID 2752 wrote to memory of 2968 2752 9vvdp.exe 34 PID 2752 wrote to memory of 2968 2752 9vvdp.exe 34 PID 2752 wrote to memory of 2968 2752 9vvdp.exe 34 PID 2968 wrote to memory of 2732 2968 fxlrffl.exe 35 PID 2968 wrote to memory of 2732 2968 fxlrffl.exe 35 PID 2968 wrote to memory of 2732 2968 fxlrffl.exe 35 PID 2968 wrote to memory of 2732 2968 fxlrffl.exe 35 PID 2732 wrote to memory of 2788 2732 rrrflxr.exe 36 PID 2732 wrote to memory of 2788 2732 rrrflxr.exe 36 PID 2732 wrote to memory of 2788 2732 rrrflxr.exe 36 PID 2732 wrote to memory of 2788 2732 rrrflxr.exe 36 PID 2788 wrote to memory of 2820 2788 9djdp.exe 37 PID 2788 wrote to memory of 2820 2788 9djdp.exe 37 PID 2788 wrote to memory of 2820 2788 9djdp.exe 37 PID 2788 wrote to memory of 2820 2788 9djdp.exe 37 PID 2820 wrote to memory of 2728 2820 rrxxllx.exe 38 PID 2820 wrote to memory of 2728 2820 rrxxllx.exe 38 PID 2820 wrote to memory of 2728 2820 rrxxllx.exe 38 PID 2820 wrote to memory of 2728 2820 rrxxllx.exe 38 PID 2728 wrote to memory of 2212 2728 5nbhbn.exe 39 PID 2728 wrote to memory of 2212 2728 5nbhbn.exe 39 PID 2728 wrote to memory of 2212 2728 5nbhbn.exe 39 PID 2728 wrote to memory of 2212 2728 5nbhbn.exe 39 PID 2212 wrote to memory of 2040 2212 nhtbnn.exe 40 PID 2212 wrote to memory of 2040 2212 nhtbnn.exe 40 PID 2212 wrote to memory of 2040 2212 nhtbnn.exe 40 PID 2212 wrote to memory of 2040 2212 nhtbnn.exe 40 PID 2040 wrote to memory of 1908 2040 1pjvd.exe 41 PID 2040 wrote to memory of 1908 2040 1pjvd.exe 41 PID 2040 wrote to memory of 1908 2040 1pjvd.exe 41 PID 2040 wrote to memory of 1908 2040 1pjvd.exe 41 PID 1908 wrote to memory of 2908 1908 rlrrxfl.exe 42 PID 1908 wrote to memory of 2908 1908 rlrrxfl.exe 42 PID 1908 wrote to memory of 2908 1908 rlrrxfl.exe 42 PID 1908 wrote to memory of 2908 1908 rlrrxfl.exe 42 PID 2908 wrote to memory of 1264 2908 nhbnbn.exe 43 PID 2908 wrote to memory of 1264 2908 nhbnbn.exe 43 PID 2908 wrote to memory of 1264 2908 nhbnbn.exe 43 PID 2908 wrote to memory of 1264 2908 nhbnbn.exe 43 PID 1264 wrote to memory of 1436 1264 9tnthn.exe 44 PID 1264 wrote to memory of 1436 1264 9tnthn.exe 44 PID 1264 wrote to memory of 1436 1264 9tnthn.exe 44 PID 1264 wrote to memory of 1436 1264 9tnthn.exe 44 PID 1436 wrote to memory of 1212 1436 1jpvj.exe 45 PID 1436 wrote to memory of 1212 1436 1jpvj.exe 45 PID 1436 wrote to memory of 1212 1436 1jpvj.exe 45 PID 1436 wrote to memory of 1212 1436 1jpvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebc40cd78bf15a7862f1db4c29cd7580N.exe"C:\Users\Admin\AppData\Local\Temp\ebc40cd78bf15a7862f1db4c29cd7580N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\nbhtbh.exec:\nbhtbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\jdvdp.exec:\jdvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\nnhnbb.exec:\nnhnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\9vvdp.exec:\9vvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\fxlrffl.exec:\fxlrffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\rrrflxr.exec:\rrrflxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\9djdp.exec:\9djdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\rrxxllx.exec:\rrxxllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\5nbhbn.exec:\5nbhbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\nhtbnn.exec:\nhtbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\1pjvd.exec:\1pjvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\rlrrxfl.exec:\rlrrxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\nhbnbn.exec:\nhbnbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\9tnthn.exec:\9tnthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\1jpvj.exec:\1jpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\9xxrrrr.exec:\9xxrrrr.exe17⤵
- Executes dropped EXE
PID:1212 -
\??\c:\lfrfxxl.exec:\lfrfxxl.exe18⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tbnbbb.exec:\tbnbbb.exe19⤵
- Executes dropped EXE
PID:2492 -
\??\c:\7pvpp.exec:\7pvpp.exe20⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ppdpv.exec:\ppdpv.exe21⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ffrxffx.exec:\ffrxffx.exe22⤵
- Executes dropped EXE
PID:1072 -
\??\c:\hbntnb.exec:\hbntnb.exe23⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hbnhnn.exec:\hbnhnn.exe24⤵
- Executes dropped EXE
PID:1872 -
\??\c:\jjdjp.exec:\jjdjp.exe25⤵
- Executes dropped EXE
PID:676 -
\??\c:\1lllrxl.exec:\1lllrxl.exe26⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nhnntt.exec:\nhnntt.exe27⤵
- Executes dropped EXE
PID:2480 -
\??\c:\bbthbb.exec:\bbthbb.exe28⤵
- Executes dropped EXE
PID:1940 -
\??\c:\vvpjv.exec:\vvpjv.exe29⤵
- Executes dropped EXE
PID:328 -
\??\c:\9fxlxrl.exec:\9fxlxrl.exe30⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rrllffr.exec:\rrllffr.exe31⤵
- Executes dropped EXE
PID:1820 -
\??\c:\7hnhbb.exec:\7hnhbb.exe32⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jdjvj.exec:\jdjvj.exe33⤵
- Executes dropped EXE
PID:2412 -
\??\c:\3pvjp.exec:\3pvjp.exe34⤵
- Executes dropped EXE
PID:2356 -
\??\c:\7rfffll.exec:\7rfffll.exe35⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hhthtb.exec:\hhthtb.exe36⤵
- Executes dropped EXE
PID:2808 -
\??\c:\tthnnt.exec:\tthnnt.exe37⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jdvvp.exec:\jdvvp.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\llxfllx.exec:\llxfllx.exe39⤵
- Executes dropped EXE
PID:2904 -
\??\c:\lllfxfl.exec:\lllfxfl.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nhbnht.exec:\nhbnht.exe41⤵
- Executes dropped EXE
PID:2912 -
\??\c:\nnhtnb.exec:\nnhtnb.exe42⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ddvjd.exec:\ddvjd.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\ppjjj.exec:\ppjjj.exe44⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xrffrrx.exec:\xrffrrx.exe45⤵
- Executes dropped EXE
PID:3056 -
\??\c:\fxxlxfl.exec:\fxxlxfl.exe46⤵
- Executes dropped EXE
PID:464 -
\??\c:\5tnttt.exec:\5tnttt.exe47⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ddvjv.exec:\ddvjv.exe48⤵
- Executes dropped EXE
PID:1120 -
\??\c:\dpdjp.exec:\dpdjp.exe49⤵
- Executes dropped EXE
PID:2664 -
\??\c:\llxfllr.exec:\llxfllr.exe50⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5xlxlxf.exec:\5xlxlxf.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2936 -
\??\c:\1hbnth.exec:\1hbnth.exe52⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jdpjv.exec:\jdpjv.exe53⤵
- Executes dropped EXE
PID:3044 -
\??\c:\jdvdv.exec:\jdvdv.exe54⤵
- Executes dropped EXE
PID:3032 -
\??\c:\9xrxlxl.exec:\9xrxlxl.exe55⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xrxxfrf.exec:\xrxxfrf.exe56⤵
- Executes dropped EXE
PID:1484 -
\??\c:\bnttbn.exec:\bnttbn.exe57⤵
- Executes dropped EXE
PID:2388 -
\??\c:\btbtbh.exec:\btbtbh.exe58⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vvjpv.exec:\vvjpv.exe59⤵
- Executes dropped EXE
PID:444 -
\??\c:\ffrrxfl.exec:\ffrrxfl.exe60⤵
- Executes dropped EXE
PID:616 -
\??\c:\rlrrfll.exec:\rlrrfll.exe61⤵
- Executes dropped EXE
PID:1984 -
\??\c:\bnbhtn.exec:\bnbhtn.exe62⤵
- Executes dropped EXE
PID:2184 -
\??\c:\tntthh.exec:\tntthh.exe63⤵
- Executes dropped EXE
PID:904 -
\??\c:\3jvjj.exec:\3jvjj.exe64⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jjddj.exec:\jjddj.exe65⤵
- Executes dropped EXE
PID:1088 -
\??\c:\1rrrxfl.exec:\1rrrxfl.exe66⤵PID:1972
-
\??\c:\xfxxfxf.exec:\xfxxfxf.exe67⤵PID:692
-
\??\c:\3thhhh.exec:\3thhhh.exe68⤵PID:1048
-
\??\c:\btbtbh.exec:\btbtbh.exe69⤵PID:2140
-
\??\c:\vpddp.exec:\vpddp.exe70⤵PID:304
-
\??\c:\pjddv.exec:\pjddv.exe71⤵PID:1592
-
\??\c:\rrrrxxl.exec:\rrrrxxl.exe72⤵PID:2100
-
\??\c:\hhbnbh.exec:\hhbnbh.exe73⤵PID:532
-
\??\c:\hhbnbh.exec:\hhbnbh.exe74⤵PID:2424
-
\??\c:\jdjpv.exec:\jdjpv.exe75⤵PID:2888
-
\??\c:\1pjdj.exec:\1pjdj.exe76⤵PID:2224
-
\??\c:\rlrrrxl.exec:\rlrrrxl.exe77⤵PID:2608
-
\??\c:\llfxlrf.exec:\llfxlrf.exe78⤵
- System Location Discovery: System Language Discovery
PID:2636 -
\??\c:\nhbnbb.exec:\nhbnbb.exe79⤵PID:2748
-
\??\c:\hnhntb.exec:\hnhntb.exe80⤵PID:2720
-
\??\c:\1vppd.exec:\1vppd.exe81⤵PID:2612
-
\??\c:\9jppv.exec:\9jppv.exe82⤵PID:2676
-
\??\c:\7fffrxr.exec:\7fffrxr.exe83⤵PID:2340
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe84⤵PID:2508
-
\??\c:\1nnnbh.exec:\1nnnbh.exe85⤵PID:2212
-
\??\c:\tnnnnb.exec:\tnnnnb.exe86⤵PID:1956
-
\??\c:\vjjjp.exec:\vjjjp.exe87⤵PID:1952
-
\??\c:\7dddj.exec:\7dddj.exe88⤵PID:1764
-
\??\c:\9fxxrxl.exec:\9fxxrxl.exe89⤵PID:2860
-
\??\c:\hhnbth.exec:\hhnbth.exe90⤵PID:1632
-
\??\c:\1tthtn.exec:\1tthtn.exe91⤵PID:1436
-
\??\c:\ppjdj.exec:\ppjdj.exe92⤵PID:1864
-
\??\c:\jdpdv.exec:\jdpdv.exe93⤵PID:2476
-
\??\c:\lllrffl.exec:\lllrffl.exe94⤵PID:548
-
\??\c:\lrlrrxr.exec:\lrlrrxr.exe95⤵PID:2700
-
\??\c:\9nnhbh.exec:\9nnhbh.exe96⤵PID:2436
-
\??\c:\pjjjd.exec:\pjjjd.exe97⤵PID:2488
-
\??\c:\pjpdp.exec:\pjpdp.exe98⤵PID:1520
-
\??\c:\xfrrxrl.exec:\xfrrxrl.exe99⤵PID:1608
-
\??\c:\xrfxlxf.exec:\xrfxlxf.exe100⤵PID:1852
-
\??\c:\nthhtt.exec:\nthhtt.exe101⤵PID:1872
-
\??\c:\7thtnb.exec:\7thtnb.exe102⤵PID:676
-
\??\c:\dpdpv.exec:\dpdpv.exe103⤵PID:268
-
\??\c:\dvddj.exec:\dvddj.exe104⤵PID:1544
-
\??\c:\lfrfrxf.exec:\lfrfrxf.exe105⤵PID:640
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe106⤵PID:764
-
\??\c:\bbtbbh.exec:\bbtbbh.exe107⤵PID:316
-
\??\c:\bthnbn.exec:\bthnbn.exe108⤵PID:2308
-
\??\c:\3vdpp.exec:\3vdpp.exe109⤵PID:1596
-
\??\c:\3jvvv.exec:\3jvvv.exe110⤵PID:2344
-
\??\c:\lfxlfxf.exec:\lfxlfxf.exe111⤵PID:2116
-
\??\c:\fxfrflr.exec:\fxfrflr.exe112⤵PID:2416
-
\??\c:\hhbtbh.exec:\hhbtbh.exe113⤵PID:2396
-
\??\c:\nnhtbb.exec:\nnhtbb.exe114⤵PID:2804
-
\??\c:\dvddd.exec:\dvddd.exe115⤵PID:2888
-
\??\c:\dpdvd.exec:\dpdvd.exe116⤵PID:2224
-
\??\c:\lfrrfrf.exec:\lfrrfrf.exe117⤵PID:2608
-
\??\c:\1rlflxf.exec:\1rlflxf.exe118⤵PID:2692
-
\??\c:\nhnbnt.exec:\nhnbnt.exe119⤵PID:2748
-
\??\c:\5hbhnt.exec:\5hbhnt.exe120⤵PID:2620
-
\??\c:\jdjpd.exec:\jdjpd.exe121⤵PID:2616
-
\??\c:\vpddp.exec:\vpddp.exe122⤵PID:1688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-