Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 04:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d.exe
-
Size
438KB
-
MD5
ba18d9456e85927e1ef6ab9810c31b82
-
SHA1
1a91a56e602a7353c4bdf926a7c326c1985ed476
-
SHA256
edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d
-
SHA512
11e1bd483f1b05af4b8963fa9402578b9e30ba80bed7ac319e36392a41ebd484f9c0c8550f8f361a199f26de49f59dba922ec113bb904ac160979d640942db92
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0p5WI09JN:n3C9ytvn8whkb4i3e3GFO6JN
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/3012-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1324-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1120-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2608 bthntn.exe 2116 3jpjp.exe 2368 xlxlllx.exe 2760 3btttb.exe 3028 pjddj.exe 2964 5ffxflx.exe 2656 hbbbnh.exe 2632 lxllfxl.exe 1924 jdpvd.exe 2060 7rlxffr.exe 1324 nhtthn.exe 2832 pdvvd.exe 1964 9xrxlrx.exe 2812 dvpdp.exe 2732 xxlrflf.exe 1768 nnhhtt.exe 1120 xlllfxl.exe 2176 hnhtnb.exe 1148 vvjjd.exe 1864 fxrflxr.exe 1132 thbbbb.exe 1508 7fxfrfr.exe 3036 5bntnn.exe 956 nbnthh.exe 2084 pjddj.exe 1828 xxflrxl.exe 560 7djpv.exe 2492 hnbhtb.exe 888 ppvdv.exe 2132 3thtnt.exe 3000 vvjjp.exe 2372 vjvvv.exe 1584 xrllfxl.exe 2824 3vjpp.exe 2772 jjddv.exe 2896 1xllllx.exe 2064 nnbbhh.exe 2932 bbnthh.exe 2964 jjdjv.exe 2768 xrrxflx.exe 2688 hbntbb.exe 2676 hbbhtb.exe 2300 vjppv.exe 2800 3fxxflx.exe 1760 7rffllx.exe 2852 nhttbh.exe 800 7vvjv.exe 1940 xlffrxl.exe 2856 3fffrxl.exe 2952 nbtntt.exe 1052 pdvpj.exe 2732 rlrffrl.exe 1564 frlrxxf.exe 1120 nhhhnt.exe 2124 jjvjv.exe 1488 ppppd.exe 872 xrfllfl.exe 1928 tbhtbn.exe 692 bbthbb.exe 3048 5vppj.exe 1404 xfllrxx.exe 952 lxrxxxf.exe 1676 3bnnbb.exe 2188 pjvvd.exe -
resource yara_rule behavioral1/memory/3012-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1324-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1120-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-285-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2608 3012 edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d.exe 30 PID 3012 wrote to memory of 2608 3012 edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d.exe 30 PID 3012 wrote to memory of 2608 3012 edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d.exe 30 PID 3012 wrote to memory of 2608 3012 edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d.exe 30 PID 2608 wrote to memory of 2116 2608 bthntn.exe 31 PID 2608 wrote to memory of 2116 2608 bthntn.exe 31 PID 2608 wrote to memory of 2116 2608 bthntn.exe 31 PID 2608 wrote to memory of 2116 2608 bthntn.exe 31 PID 2116 wrote to memory of 2368 2116 3jpjp.exe 32 PID 2116 wrote to memory of 2368 2116 3jpjp.exe 32 PID 2116 wrote to memory of 2368 2116 3jpjp.exe 32 PID 2116 wrote to memory of 2368 2116 3jpjp.exe 32 PID 2368 wrote to memory of 2760 2368 xlxlllx.exe 33 PID 2368 wrote to memory of 2760 2368 xlxlllx.exe 33 PID 2368 wrote to memory of 2760 2368 xlxlllx.exe 33 PID 2368 wrote to memory of 2760 2368 xlxlllx.exe 33 PID 2760 wrote to memory of 3028 2760 3btttb.exe 34 PID 2760 wrote to memory of 3028 2760 3btttb.exe 34 PID 2760 wrote to memory of 3028 2760 3btttb.exe 34 PID 2760 wrote to memory of 3028 2760 3btttb.exe 34 PID 3028 wrote to memory of 2964 3028 pjddj.exe 35 PID 3028 wrote to memory of 2964 3028 pjddj.exe 35 PID 3028 wrote to memory of 2964 3028 pjddj.exe 35 PID 3028 wrote to memory of 2964 3028 pjddj.exe 35 PID 2964 wrote to memory of 2656 2964 5ffxflx.exe 36 PID 2964 wrote to memory of 2656 2964 5ffxflx.exe 36 PID 2964 wrote to memory of 2656 2964 5ffxflx.exe 36 PID 2964 wrote to memory of 2656 2964 5ffxflx.exe 36 PID 2656 wrote to memory of 2632 2656 hbbbnh.exe 37 PID 2656 wrote to memory of 2632 2656 hbbbnh.exe 37 PID 2656 wrote to memory of 2632 2656 hbbbnh.exe 37 PID 2656 wrote to memory of 2632 2656 hbbbnh.exe 37 PID 2632 wrote to memory of 1924 2632 lxllfxl.exe 38 PID 2632 wrote to memory of 1924 2632 lxllfxl.exe 38 PID 2632 wrote to memory of 1924 2632 lxllfxl.exe 38 PID 2632 wrote to memory of 1924 2632 lxllfxl.exe 38 PID 1924 wrote to memory of 2060 1924 jdpvd.exe 39 PID 1924 wrote to memory of 2060 1924 jdpvd.exe 39 PID 1924 wrote to memory of 2060 1924 jdpvd.exe 39 PID 1924 wrote to memory of 2060 1924 jdpvd.exe 39 PID 2060 wrote to memory of 1324 2060 7rlxffr.exe 40 PID 2060 wrote to memory of 1324 2060 7rlxffr.exe 40 PID 2060 wrote to memory of 1324 2060 7rlxffr.exe 40 PID 2060 wrote to memory of 1324 2060 7rlxffr.exe 40 PID 1324 wrote to memory of 2832 1324 nhtthn.exe 41 PID 1324 wrote to memory of 2832 1324 nhtthn.exe 41 PID 1324 wrote to memory of 2832 1324 nhtthn.exe 41 PID 1324 wrote to memory of 2832 1324 nhtthn.exe 41 PID 2832 wrote to memory of 1964 2832 pdvvd.exe 42 PID 2832 wrote to memory of 1964 2832 pdvvd.exe 42 PID 2832 wrote to memory of 1964 2832 pdvvd.exe 42 PID 2832 wrote to memory of 1964 2832 pdvvd.exe 42 PID 1964 wrote to memory of 2812 1964 9xrxlrx.exe 43 PID 1964 wrote to memory of 2812 1964 9xrxlrx.exe 43 PID 1964 wrote to memory of 2812 1964 9xrxlrx.exe 43 PID 1964 wrote to memory of 2812 1964 9xrxlrx.exe 43 PID 2812 wrote to memory of 2732 2812 dvpdp.exe 44 PID 2812 wrote to memory of 2732 2812 dvpdp.exe 44 PID 2812 wrote to memory of 2732 2812 dvpdp.exe 44 PID 2812 wrote to memory of 2732 2812 dvpdp.exe 44 PID 2732 wrote to memory of 1768 2732 xxlrflf.exe 45 PID 2732 wrote to memory of 1768 2732 xxlrflf.exe 45 PID 2732 wrote to memory of 1768 2732 xxlrflf.exe 45 PID 2732 wrote to memory of 1768 2732 xxlrflf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d.exe"C:\Users\Admin\AppData\Local\Temp\edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\bthntn.exec:\bthntn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\3jpjp.exec:\3jpjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\xlxlllx.exec:\xlxlllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\3btttb.exec:\3btttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\pjddj.exec:\pjddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\5ffxflx.exec:\5ffxflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\hbbbnh.exec:\hbbbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\lxllfxl.exec:\lxllfxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\jdpvd.exec:\jdpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\7rlxffr.exec:\7rlxffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\nhtthn.exec:\nhtthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\pdvvd.exec:\pdvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\9xrxlrx.exec:\9xrxlrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\dvpdp.exec:\dvpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\xxlrflf.exec:\xxlrflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nnhhtt.exec:\nnhhtt.exe17⤵
- Executes dropped EXE
PID:1768 -
\??\c:\xlllfxl.exec:\xlllfxl.exe18⤵
- Executes dropped EXE
PID:1120 -
\??\c:\hnhtnb.exec:\hnhtnb.exe19⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vvjjd.exec:\vvjjd.exe20⤵
- Executes dropped EXE
PID:1148 -
\??\c:\fxrflxr.exec:\fxrflxr.exe21⤵
- Executes dropped EXE
PID:1864 -
\??\c:\thbbbb.exec:\thbbbb.exe22⤵
- Executes dropped EXE
PID:1132 -
\??\c:\7fxfrfr.exec:\7fxfrfr.exe23⤵
- Executes dropped EXE
PID:1508 -
\??\c:\5bntnn.exec:\5bntnn.exe24⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nbnthh.exec:\nbnthh.exe25⤵
- Executes dropped EXE
PID:956 -
\??\c:\pjddj.exec:\pjddj.exe26⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xxflrxl.exec:\xxflrxl.exe27⤵
- Executes dropped EXE
PID:1828 -
\??\c:\7djpv.exec:\7djpv.exe28⤵
- Executes dropped EXE
PID:560 -
\??\c:\hnbhtb.exec:\hnbhtb.exe29⤵
- Executes dropped EXE
PID:2492 -
\??\c:\ppvdv.exec:\ppvdv.exe30⤵
- Executes dropped EXE
PID:888 -
\??\c:\3thtnt.exec:\3thtnt.exe31⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vvjjp.exec:\vvjjp.exe32⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vjvvv.exec:\vjvvv.exe33⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xrllfxl.exec:\xrllfxl.exe34⤵
- Executes dropped EXE
PID:1584 -
\??\c:\3vjpp.exec:\3vjpp.exe35⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jjddv.exec:\jjddv.exe36⤵
- Executes dropped EXE
PID:2772 -
\??\c:\1xllllx.exec:\1xllllx.exe37⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nnbbhh.exec:\nnbbhh.exe38⤵
- Executes dropped EXE
PID:2064 -
\??\c:\bbnthh.exec:\bbnthh.exe39⤵
- Executes dropped EXE
PID:2932 -
\??\c:\jjdjv.exec:\jjdjv.exe40⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xrrxflx.exec:\xrrxflx.exe41⤵
- Executes dropped EXE
PID:2768 -
\??\c:\hbntbb.exec:\hbntbb.exe42⤵
- Executes dropped EXE
PID:2688 -
\??\c:\hbbhtb.exec:\hbbhtb.exe43⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vjppv.exec:\vjppv.exe44⤵
- Executes dropped EXE
PID:2300 -
\??\c:\3fxxflx.exec:\3fxxflx.exe45⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7rffllx.exec:\7rffllx.exe46⤵
- Executes dropped EXE
PID:1760 -
\??\c:\nhttbh.exec:\nhttbh.exe47⤵
- Executes dropped EXE
PID:2852 -
\??\c:\7vvjv.exec:\7vvjv.exe48⤵
- Executes dropped EXE
PID:800 -
\??\c:\xlffrxl.exec:\xlffrxl.exe49⤵
- Executes dropped EXE
PID:1940 -
\??\c:\3fffrxl.exec:\3fffrxl.exe50⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nbtntt.exec:\nbtntt.exe51⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pdvpj.exec:\pdvpj.exe52⤵
- Executes dropped EXE
PID:1052 -
\??\c:\rlrffrl.exec:\rlrffrl.exe53⤵
- Executes dropped EXE
PID:2732 -
\??\c:\frlrxxf.exec:\frlrxxf.exe54⤵
- Executes dropped EXE
PID:1564 -
\??\c:\nhhhnt.exec:\nhhhnt.exe55⤵
- Executes dropped EXE
PID:1120 -
\??\c:\jjvjv.exec:\jjvjv.exe56⤵
- Executes dropped EXE
PID:2124 -
\??\c:\ppppd.exec:\ppppd.exe57⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xrfllfl.exec:\xrfllfl.exe58⤵
- Executes dropped EXE
PID:872 -
\??\c:\tbhtbn.exec:\tbhtbn.exe59⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bbthbb.exec:\bbthbb.exe60⤵
- Executes dropped EXE
PID:692 -
\??\c:\5vppj.exec:\5vppj.exe61⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xfllrxx.exec:\xfllrxx.exe62⤵
- Executes dropped EXE
PID:1404 -
\??\c:\lxrxxxf.exec:\lxrxxxf.exe63⤵
- Executes dropped EXE
PID:952 -
\??\c:\3bnnbb.exec:\3bnnbb.exe64⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pjvvd.exec:\pjvvd.exe65⤵
- Executes dropped EXE
PID:2188 -
\??\c:\ppppv.exec:\ppppv.exe66⤵PID:2324
-
\??\c:\1fxfllx.exec:\1fxfllx.exe67⤵PID:2424
-
\??\c:\7hbbhn.exec:\7hbbhn.exe68⤵PID:2100
-
\??\c:\nntthb.exec:\nntthb.exe69⤵PID:2448
-
\??\c:\vpjjp.exec:\vpjjp.exe70⤵PID:3012
-
\??\c:\rrlxflx.exec:\rrlxflx.exe71⤵PID:2240
-
\??\c:\thbbhn.exec:\thbbhn.exe72⤵PID:3000
-
\??\c:\5tnntb.exec:\5tnntb.exe73⤵PID:1724
-
\??\c:\pjvdj.exec:\pjvdj.exe74⤵PID:3064
-
\??\c:\xlfflrf.exec:\xlfflrf.exe75⤵PID:2316
-
\??\c:\5fflrlr.exec:\5fflrlr.exe76⤵PID:2888
-
\??\c:\bthnbh.exec:\bthnbh.exe77⤵PID:2900
-
\??\c:\1vpvj.exec:\1vpvj.exe78⤵PID:2756
-
\??\c:\xlxxfxf.exec:\xlxxfxf.exe79⤵PID:2068
-
\??\c:\7xxxxff.exec:\7xxxxff.exe80⤵PID:2412
-
\??\c:\htnhtb.exec:\htnhtb.exe81⤵
- System Location Discovery: System Language Discovery
PID:2792 -
\??\c:\dvppp.exec:\dvppp.exe82⤵PID:2644
-
\??\c:\1ddjp.exec:\1ddjp.exe83⤵PID:2708
-
\??\c:\rlxxllx.exec:\rlxxllx.exe84⤵PID:2252
-
\??\c:\nhbhtb.exec:\nhbhtb.exe85⤵PID:676
-
\??\c:\bnhbbh.exec:\bnhbbh.exe86⤵PID:2860
-
\??\c:\ddpdp.exec:\ddpdp.exe87⤵PID:2836
-
\??\c:\xrllxfr.exec:\xrllxfr.exe88⤵PID:2700
-
\??\c:\9lxfrxl.exec:\9lxfrxl.exe89⤵PID:2808
-
\??\c:\nhbbhn.exec:\nhbbhn.exe90⤵PID:2844
-
\??\c:\pdvjp.exec:\pdvjp.exe91⤵PID:2944
-
\??\c:\rlflrrf.exec:\rlflrrf.exe92⤵PID:2576
-
\??\c:\lxrxxlr.exec:\lxrxxlr.exe93⤵PID:2028
-
\??\c:\bbnbnt.exec:\bbnbnt.exe94⤵PID:2728
-
\??\c:\9dvdp.exec:\9dvdp.exe95⤵PID:2108
-
\??\c:\jdjjp.exec:\jdjjp.exe96⤵PID:2120
-
\??\c:\lfxfrrl.exec:\lfxfrrl.exe97⤵PID:2024
-
\??\c:\1lxrfff.exec:\1lxrfff.exe98⤵PID:1352
-
\??\c:\tbtttt.exec:\tbtttt.exe99⤵PID:916
-
\??\c:\jvjpj.exec:\jvjpj.exe100⤵PID:1376
-
\??\c:\9xrrfxl.exec:\9xrrfxl.exe101⤵PID:404
-
\??\c:\lxrrrxf.exec:\lxrrrxf.exe102⤵PID:2992
-
\??\c:\nnbhtt.exec:\nnbhtt.exe103⤵PID:1096
-
\??\c:\vpjvj.exec:\vpjvj.exe104⤵PID:1944
-
\??\c:\dvpvd.exec:\dvpvd.exe105⤵PID:2276
-
\??\c:\3lrllxf.exec:\3lrllxf.exe106⤵PID:2432
-
\??\c:\nhbhnn.exec:\nhbhnn.exe107⤵PID:2156
-
\??\c:\nnhntn.exec:\nnhntn.exe108⤵PID:1516
-
\??\c:\pjdjv.exec:\pjdjv.exe109⤵PID:880
-
\??\c:\5rllrrf.exec:\5rllrrf.exe110⤵PID:2132
-
\??\c:\1xxxlrf.exec:\1xxxlrf.exe111⤵PID:2420
-
\??\c:\bnhbhh.exec:\bnhbhh.exe112⤵PID:1996
-
\??\c:\7vpdj.exec:\7vpdj.exe113⤵PID:2416
-
\??\c:\vjvvd.exec:\vjvvd.exe114⤵PID:1584
-
\??\c:\5lxxxxl.exec:\5lxxxxl.exe115⤵PID:2968
-
\??\c:\nbhbhh.exec:\nbhbhh.exe116⤵PID:2736
-
\??\c:\httbnt.exec:\httbnt.exe117⤵PID:2304
-
\??\c:\dvjjv.exec:\dvjjv.exe118⤵PID:2884
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe119⤵PID:2956
-
\??\c:\1rrrffl.exec:\1rrrffl.exe120⤵PID:2964
-
\??\c:\9bbhbn.exec:\9bbhbn.exe121⤵PID:2184
-
\??\c:\jdppd.exec:\jdppd.exe122⤵PID:2636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-