Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-09-2024 23:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7db85bc4464e8c014f5e01ffb26c7e28f53f6e7a242138e8531ca6e7bf2a91bd.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
7db85bc4464e8c014f5e01ffb26c7e28f53f6e7a242138e8531ca6e7bf2a91bd.exe
-
Size
70KB
-
MD5
7988471efb6939dc418a0936e3fccd38
-
SHA1
2d85a18e650fe503902fefc8c471b9e3e9919c9a
-
SHA256
7db85bc4464e8c014f5e01ffb26c7e28f53f6e7a242138e8531ca6e7bf2a91bd
-
SHA512
a7aa4b70552b993500c9b67a0bfc6b4c7c00cef8876b9e97cae84032cca2be3931008c61b01dd4225206507d9884f2fb3676ec134d65e1466fb0e39a402536f5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjK:ymb3NkkiQ3mdBjFI4V6
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/3056-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/676-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/780-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2576 fflxrxr.exe 3068 tnhhhb.exe 2148 dvdpv.exe 2304 btnnbh.exe 2908 1nhnbh.exe 2068 pddjp.exe 2152 5vjvj.exe 2160 ttthhb.exe 2704 htbhhb.exe 2592 jvddp.exe 676 rlxxlrx.exe 2212 7hnhbn.exe 2012 bnbhbh.exe 2400 jjjjv.exe 2876 rllxxxl.exe 1060 xlllrxr.exe 1832 nhhthh.exe 1772 pdvvp.exe 2268 ddvpv.exe 656 xlflrrx.exe 872 lflfrrx.exe 2092 5hbbtb.exe 832 ppvjd.exe 304 7fxxxfr.exe 612 1rflrrf.exe 780 nnbbnn.exe 2492 bnhnnt.exe 768 pvdpp.exe 2256 vvpdv.exe 3060 9frxffl.exe 1736 bbttnb.exe 1740 dvjvp.exe 2364 7jdjj.exe 2148 fxfrrrx.exe 1296 fxllxrx.exe 2920 3hnnnt.exe 2888 ppdpd.exe 2960 1pvpv.exe 2748 rrlffll.exe 2796 3llrfxr.exe 2160 1hhhnn.exe 2676 nhbhth.exe 2164 vpdjj.exe 1312 xxlxxlr.exe 676 fxxrlrx.exe 2212 ttbhhh.exe 2216 3thnbh.exe 2848 nbnhnb.exe 2180 jvpvp.exe 1768 5vpvj.exe 2028 lfrxlrr.exe 2728 fxllxrf.exe 2040 nhnbnt.exe 2604 3bhthh.exe 1492 jddjp.exe 996 vjjvv.exe 1308 lfxfrrx.exe 1928 5xlxrlr.exe 2612 1hbntb.exe 1404 nhtbbb.exe 1164 vjjpj.exe 932 vjvdp.exe 1676 lxxxllx.exe 2572 fxllrfl.exe -
resource yara_rule behavioral1/memory/3056-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/676-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/780-258-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2576 3056 7db85bc4464e8c014f5e01ffb26c7e28f53f6e7a242138e8531ca6e7bf2a91bd.exe 30 PID 3056 wrote to memory of 2576 3056 7db85bc4464e8c014f5e01ffb26c7e28f53f6e7a242138e8531ca6e7bf2a91bd.exe 30 PID 3056 wrote to memory of 2576 3056 7db85bc4464e8c014f5e01ffb26c7e28f53f6e7a242138e8531ca6e7bf2a91bd.exe 30 PID 3056 wrote to memory of 2576 3056 7db85bc4464e8c014f5e01ffb26c7e28f53f6e7a242138e8531ca6e7bf2a91bd.exe 30 PID 2576 wrote to memory of 3068 2576 fflxrxr.exe 31 PID 2576 wrote to memory of 3068 2576 fflxrxr.exe 31 PID 2576 wrote to memory of 3068 2576 fflxrxr.exe 31 PID 2576 wrote to memory of 3068 2576 fflxrxr.exe 31 PID 3068 wrote to memory of 2148 3068 tnhhhb.exe 32 PID 3068 wrote to memory of 2148 3068 tnhhhb.exe 32 PID 3068 wrote to memory of 2148 3068 tnhhhb.exe 32 PID 3068 wrote to memory of 2148 3068 tnhhhb.exe 32 PID 2148 wrote to memory of 2304 2148 dvdpv.exe 33 PID 2148 wrote to memory of 2304 2148 dvdpv.exe 33 PID 2148 wrote to memory of 2304 2148 dvdpv.exe 33 PID 2148 wrote to memory of 2304 2148 dvdpv.exe 33 PID 2304 wrote to memory of 2908 2304 btnnbh.exe 34 PID 2304 wrote to memory of 2908 2304 btnnbh.exe 34 PID 2304 wrote to memory of 2908 2304 btnnbh.exe 34 PID 2304 wrote to memory of 2908 2304 btnnbh.exe 34 PID 2908 wrote to memory of 2068 2908 1nhnbh.exe 35 PID 2908 wrote to memory of 2068 2908 1nhnbh.exe 35 PID 2908 wrote to memory of 2068 2908 1nhnbh.exe 35 PID 2908 wrote to memory of 2068 2908 1nhnbh.exe 35 PID 2068 wrote to memory of 2152 2068 pddjp.exe 36 PID 2068 wrote to memory of 2152 2068 pddjp.exe 36 PID 2068 wrote to memory of 2152 2068 pddjp.exe 36 PID 2068 wrote to memory of 2152 2068 pddjp.exe 36 PID 2152 wrote to memory of 2160 2152 5vjvj.exe 37 PID 2152 wrote to memory of 2160 2152 5vjvj.exe 37 PID 2152 wrote to memory of 2160 2152 5vjvj.exe 37 PID 2152 wrote to memory of 2160 2152 5vjvj.exe 37 PID 2160 wrote to memory of 2704 2160 ttthhb.exe 38 PID 2160 wrote to memory of 2704 2160 ttthhb.exe 38 PID 2160 wrote to memory of 2704 2160 ttthhb.exe 38 PID 2160 wrote to memory of 2704 2160 ttthhb.exe 38 PID 2704 wrote to memory of 2592 2704 htbhhb.exe 39 PID 2704 wrote to memory of 2592 2704 htbhhb.exe 39 PID 2704 wrote to memory of 2592 2704 htbhhb.exe 39 PID 2704 wrote to memory of 2592 2704 htbhhb.exe 39 PID 2592 wrote to memory of 676 2592 jvddp.exe 40 PID 2592 wrote to memory of 676 2592 jvddp.exe 40 PID 2592 wrote to memory of 676 2592 jvddp.exe 40 PID 2592 wrote to memory of 676 2592 jvddp.exe 40 PID 676 wrote to memory of 2212 676 rlxxlrx.exe 41 PID 676 wrote to memory of 2212 676 rlxxlrx.exe 41 PID 676 wrote to memory of 2212 676 rlxxlrx.exe 41 PID 676 wrote to memory of 2212 676 rlxxlrx.exe 41 PID 2212 wrote to memory of 2012 2212 7hnhbn.exe 42 PID 2212 wrote to memory of 2012 2212 7hnhbn.exe 42 PID 2212 wrote to memory of 2012 2212 7hnhbn.exe 42 PID 2212 wrote to memory of 2012 2212 7hnhbn.exe 42 PID 2012 wrote to memory of 2400 2012 bnbhbh.exe 43 PID 2012 wrote to memory of 2400 2012 bnbhbh.exe 43 PID 2012 wrote to memory of 2400 2012 bnbhbh.exe 43 PID 2012 wrote to memory of 2400 2012 bnbhbh.exe 43 PID 2400 wrote to memory of 2876 2400 jjjjv.exe 44 PID 2400 wrote to memory of 2876 2400 jjjjv.exe 44 PID 2400 wrote to memory of 2876 2400 jjjjv.exe 44 PID 2400 wrote to memory of 2876 2400 jjjjv.exe 44 PID 2876 wrote to memory of 1060 2876 rllxxxl.exe 45 PID 2876 wrote to memory of 1060 2876 rllxxxl.exe 45 PID 2876 wrote to memory of 1060 2876 rllxxxl.exe 45 PID 2876 wrote to memory of 1060 2876 rllxxxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7db85bc4464e8c014f5e01ffb26c7e28f53f6e7a242138e8531ca6e7bf2a91bd.exe"C:\Users\Admin\AppData\Local\Temp\7db85bc4464e8c014f5e01ffb26c7e28f53f6e7a242138e8531ca6e7bf2a91bd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\fflxrxr.exec:\fflxrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\tnhhhb.exec:\tnhhhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\dvdpv.exec:\dvdpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\btnnbh.exec:\btnnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\1nhnbh.exec:\1nhnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\pddjp.exec:\pddjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\5vjvj.exec:\5vjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\ttthhb.exec:\ttthhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\htbhhb.exec:\htbhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\jvddp.exec:\jvddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rlxxlrx.exec:\rlxxlrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\7hnhbn.exec:\7hnhbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\bnbhbh.exec:\bnbhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\jjjjv.exec:\jjjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\rllxxxl.exec:\rllxxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\xlllrxr.exec:\xlllrxr.exe17⤵
- Executes dropped EXE
PID:1060 -
\??\c:\nhhthh.exec:\nhhthh.exe18⤵
- Executes dropped EXE
PID:1832 -
\??\c:\pdvvp.exec:\pdvvp.exe19⤵
- Executes dropped EXE
PID:1772 -
\??\c:\ddvpv.exec:\ddvpv.exe20⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xlflrrx.exec:\xlflrrx.exe21⤵
- Executes dropped EXE
PID:656 -
\??\c:\lflfrrx.exec:\lflfrrx.exe22⤵
- Executes dropped EXE
PID:872 -
\??\c:\5hbbtb.exec:\5hbbtb.exe23⤵
- Executes dropped EXE
PID:2092 -
\??\c:\ppvjd.exec:\ppvjd.exe24⤵
- Executes dropped EXE
PID:832 -
\??\c:\7fxxxfr.exec:\7fxxxfr.exe25⤵
- Executes dropped EXE
PID:304 -
\??\c:\1rflrrf.exec:\1rflrrf.exe26⤵
- Executes dropped EXE
PID:612 -
\??\c:\nnbbnn.exec:\nnbbnn.exe27⤵
- Executes dropped EXE
PID:780 -
\??\c:\bnhnnt.exec:\bnhnnt.exe28⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pvdpp.exec:\pvdpp.exe29⤵
- Executes dropped EXE
PID:768 -
\??\c:\vvpdv.exec:\vvpdv.exe30⤵
- Executes dropped EXE
PID:2256 -
\??\c:\9frxffl.exec:\9frxffl.exe31⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bbttnb.exec:\bbttnb.exe32⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvjvp.exec:\dvjvp.exe33⤵
- Executes dropped EXE
PID:1740 -
\??\c:\7jdjj.exec:\7jdjj.exe34⤵
- Executes dropped EXE
PID:2364 -
\??\c:\fxfrrrx.exec:\fxfrrrx.exe35⤵
- Executes dropped EXE
PID:2148 -
\??\c:\fxllxrx.exec:\fxllxrx.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1296 -
\??\c:\3hnnnt.exec:\3hnnnt.exe37⤵
- Executes dropped EXE
PID:2920 -
\??\c:\ppdpd.exec:\ppdpd.exe38⤵
- Executes dropped EXE
PID:2888 -
\??\c:\1pvpv.exec:\1pvpv.exe39⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rrlffll.exec:\rrlffll.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\3llrfxr.exec:\3llrfxr.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\1hhhnn.exec:\1hhhnn.exe42⤵
- Executes dropped EXE
PID:2160 -
\??\c:\nhbhth.exec:\nhbhth.exe43⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vpdjj.exec:\vpdjj.exe44⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xxlxxlr.exec:\xxlxxlr.exe45⤵
- Executes dropped EXE
PID:1312 -
\??\c:\fxxrlrx.exec:\fxxrlrx.exe46⤵
- Executes dropped EXE
PID:676 -
\??\c:\ttbhhh.exec:\ttbhhh.exe47⤵
- Executes dropped EXE
PID:2212 -
\??\c:\3thnbh.exec:\3thnbh.exe48⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nbnhnb.exec:\nbnhnb.exe49⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jvpvp.exec:\jvpvp.exe50⤵
- Executes dropped EXE
PID:2180 -
\??\c:\5vpvj.exec:\5vpvj.exe51⤵
- Executes dropped EXE
PID:1768 -
\??\c:\lfrxlrr.exec:\lfrxlrr.exe52⤵
- Executes dropped EXE
PID:2028 -
\??\c:\fxllxrf.exec:\fxllxrf.exe53⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nhnbnt.exec:\nhnbnt.exe54⤵
- Executes dropped EXE
PID:2040 -
\??\c:\3bhthh.exec:\3bhthh.exe55⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jddjp.exec:\jddjp.exe56⤵
- Executes dropped EXE
PID:1492 -
\??\c:\vjjvv.exec:\vjjvv.exe57⤵
- Executes dropped EXE
PID:996 -
\??\c:\lfxfrrx.exec:\lfxfrrx.exe58⤵
- Executes dropped EXE
PID:1308 -
\??\c:\5xlxrlr.exec:\5xlxrlr.exe59⤵
- Executes dropped EXE
PID:1928 -
\??\c:\1hbntb.exec:\1hbntb.exe60⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nhtbbb.exec:\nhtbbb.exe61⤵
- Executes dropped EXE
PID:1404 -
\??\c:\vjjpj.exec:\vjjpj.exe62⤵
- Executes dropped EXE
PID:1164 -
\??\c:\vjvdp.exec:\vjvdp.exe63⤵
- Executes dropped EXE
PID:932 -
\??\c:\lxxxllx.exec:\lxxxllx.exe64⤵
- Executes dropped EXE
PID:1676 -
\??\c:\fxllrfl.exec:\fxllrfl.exe65⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xllrfxl.exec:\xllrfxl.exe66⤵
- System Location Discovery: System Language Discovery
PID:888 -
\??\c:\3nbhht.exec:\3nbhht.exe67⤵PID:2100
-
\??\c:\hhnnhh.exec:\hhnnhh.exe68⤵PID:3012
-
\??\c:\3jdvj.exec:\3jdvj.exe69⤵PID:2296
-
\??\c:\jdvjp.exec:\jdvjp.exe70⤵PID:2384
-
\??\c:\xrrllrl.exec:\xrrllrl.exe71⤵PID:1584
-
\??\c:\fxxfxfl.exec:\fxxfxfl.exe72⤵PID:3008
-
\??\c:\nhhntn.exec:\nhhntn.exe73⤵PID:1656
-
\??\c:\3hnnbh.exec:\3hnnbh.exe74⤵PID:2900
-
\??\c:\pjjjd.exec:\pjjjd.exe75⤵PID:2784
-
\??\c:\pjvvd.exec:\pjvvd.exe76⤵PID:2964
-
\??\c:\3lxxrrx.exec:\3lxxrrx.exe77⤵PID:2928
-
\??\c:\fxffrll.exec:\fxffrll.exe78⤵PID:2656
-
\??\c:\htbbnt.exec:\htbbnt.exe79⤵PID:2976
-
\??\c:\btbtbt.exec:\btbtbt.exe80⤵PID:2648
-
\??\c:\1dpdp.exec:\1dpdp.exe81⤵PID:2376
-
\??\c:\pjvjv.exec:\pjvjv.exe82⤵PID:2300
-
\??\c:\fxlrllx.exec:\fxlrllx.exe83⤵PID:2592
-
\??\c:\9lflxrx.exec:\9lflxrx.exe84⤵PID:1484
-
\??\c:\nhbbhn.exec:\nhbbhn.exe85⤵PID:1948
-
\??\c:\hbnbtb.exec:\hbnbtb.exe86⤵PID:2620
-
\??\c:\jdvvv.exec:\jdvvv.exe87⤵PID:2820
-
\??\c:\dpvvd.exec:\dpvvd.exe88⤵PID:2952
-
\??\c:\ffffflr.exec:\ffffflr.exe89⤵PID:1052
-
\??\c:\9xlfllx.exec:\9xlfllx.exe90⤵PID:2540
-
\??\c:\nhbbhn.exec:\nhbbhn.exe91⤵PID:2524
-
\??\c:\btntbn.exec:\btntbn.exe92⤵PID:2176
-
\??\c:\dvpdd.exec:\dvpdd.exe93⤵PID:2344
-
\??\c:\dvpvv.exec:\dvpvv.exe94⤵PID:2024
-
\??\c:\xrllrrf.exec:\xrllrrf.exe95⤵PID:656
-
\??\c:\frffrrf.exec:\frffrrf.exe96⤵PID:1952
-
\??\c:\1tbnnb.exec:\1tbnnb.exe97⤵PID:2080
-
\??\c:\pdvvd.exec:\pdvvd.exe98⤵PID:3044
-
\??\c:\pppvp.exec:\pppvp.exe99⤵PID:956
-
\??\c:\lxfxlrf.exec:\lxfxlrf.exe100⤵PID:1304
-
\??\c:\xrfrrxx.exec:\xrfrrxx.exe101⤵PID:2460
-
\??\c:\nhnbnn.exec:\nhnbnn.exe102⤵PID:2324
-
\??\c:\tthhnh.exec:\tthhnh.exe103⤵PID:780
-
\??\c:\vpppv.exec:\vpppv.exe104⤵PID:860
-
\??\c:\9vppp.exec:\9vppp.exe105⤵PID:772
-
\??\c:\lfflxff.exec:\lfflxff.exe106⤵PID:2444
-
\??\c:\lfxflll.exec:\lfxflll.exe107⤵PID:316
-
\??\c:\hhbhth.exec:\hhbhth.exe108⤵PID:3000
-
\??\c:\bbnthb.exec:\bbnthb.exe109⤵PID:1136
-
\??\c:\jjdjp.exec:\jjdjp.exe110⤵PID:1584
-
\??\c:\jvdpv.exec:\jvdpv.exe111⤵PID:2368
-
\??\c:\xrxxxrx.exec:\xrxxxrx.exe112⤵PID:2396
-
\??\c:\xxrfrrx.exec:\xxrfrrx.exe113⤵PID:2316
-
\??\c:\3hbbnt.exec:\3hbbnt.exe114⤵PID:2292
-
\??\c:\tnbhtb.exec:\tnbhtb.exe115⤵PID:2964
-
\??\c:\3vpjv.exec:\3vpjv.exe116⤵PID:2928
-
\??\c:\3pjpd.exec:\3pjpd.exe117⤵PID:2236
-
\??\c:\lflrrxx.exec:\lflrrxx.exe118⤵PID:2976
-
\??\c:\3lllxrf.exec:\3lllxrf.exe119⤵PID:2664
-
\??\c:\1tnbbn.exec:\1tnbbn.exe120⤵PID:1872
-
\??\c:\9nnhtt.exec:\9nnhtt.exe121⤵PID:2300
-
\??\c:\bthnbh.exec:\bthnbh.exe122⤵PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-