Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-10-2024 04:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9d96c8808ad67396e36be06d1bbf4f0b78710d3445ff7c145d167eeb94d91250N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
9d96c8808ad67396e36be06d1bbf4f0b78710d3445ff7c145d167eeb94d91250N.exe
-
Size
64KB
-
MD5
16825c5f652ed06f01333b53a56c6e40
-
SHA1
4dda983bcdc5cf331492e3bdf0c44faf608aaef4
-
SHA256
9d96c8808ad67396e36be06d1bbf4f0b78710d3445ff7c145d167eeb94d91250
-
SHA512
037483d4b94d5863ff64762fcffc59032146bbd16cf48844409620a749576e78a9f6cc9d553fb2863561e08dbdcf55a4a6e7daa25f8c4bd1594fb88b36ec0be7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxiI1:ymb3NkkiQ3mdBjF0y7kb51
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2912-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1848-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1420-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/712-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/572-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3032 vdpdp.exe 2164 ffrxllr.exe 2284 ntbbbh.exe 2392 pdppj.exe 2004 lxrxllx.exe 2256 nhbnhh.exe 2064 1ntnth.exe 2684 fxlxllr.exe 2484 3fxffxr.exe 2640 9dvjj.exe 2616 7vpjp.exe 2480 ffrrrfl.exe 2248 rlxrffl.exe 2528 bbnnnn.exe 1512 vvjpj.exe 1796 7lflxxl.exe 1704 fxxfffr.exe 1668 hbhnnt.exe 1848 3bnhnn.exe 1420 pvdvp.exe 620 lfrfxll.exe 712 fxlfflx.exe 2780 thbthb.exe 2716 5djpv.exe 2344 pvvdv.exe 748 ffllffr.exe 1028 9ntbtb.exe 2184 nnnthn.exe 572 7dppd.exe 1736 rrrfrfr.exe 2356 9llxrxl.exe 1880 nbntbb.exe 2448 jdpjv.exe 1692 fxlrrrx.exe 2388 lxfrrxf.exe 2404 5tbtnn.exe 1932 pvvpj.exe 2428 vdvdd.exe 2160 rlrrfxl.exe 1052 lxflxxf.exe 3052 btttbb.exe 2632 1jvdp.exe 2712 vdvvj.exe 2608 rfllxrx.exe 2328 5ttbhn.exe 2500 dvjvv.exe 2496 ppjvd.exe 3020 xxflffr.exe 1764 rlxxffr.exe 1800 5nbnbb.exe 1664 nnhthh.exe 1192 vpdpv.exe 1900 ddpvp.exe 276 lfxfflx.exe 1668 ttbnnh.exe 1432 hhbhtt.exe 836 hthtnn.exe 784 vvjpd.exe 620 lfrrrxx.exe 2464 ffxlflf.exe 2936 hnttnh.exe 904 nhhbhn.exe 2984 ddpvd.exe 1960 fxxxrfx.exe -
resource yara_rule behavioral1/memory/2912-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1420-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/712-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 3032 2912 9d96c8808ad67396e36be06d1bbf4f0b78710d3445ff7c145d167eeb94d91250N.exe 28 PID 2912 wrote to memory of 3032 2912 9d96c8808ad67396e36be06d1bbf4f0b78710d3445ff7c145d167eeb94d91250N.exe 28 PID 2912 wrote to memory of 3032 2912 9d96c8808ad67396e36be06d1bbf4f0b78710d3445ff7c145d167eeb94d91250N.exe 28 PID 2912 wrote to memory of 3032 2912 9d96c8808ad67396e36be06d1bbf4f0b78710d3445ff7c145d167eeb94d91250N.exe 28 PID 3032 wrote to memory of 2164 3032 vdpdp.exe 29 PID 3032 wrote to memory of 2164 3032 vdpdp.exe 29 PID 3032 wrote to memory of 2164 3032 vdpdp.exe 29 PID 3032 wrote to memory of 2164 3032 vdpdp.exe 29 PID 2164 wrote to memory of 2284 2164 ffrxllr.exe 30 PID 2164 wrote to memory of 2284 2164 ffrxllr.exe 30 PID 2164 wrote to memory of 2284 2164 ffrxllr.exe 30 PID 2164 wrote to memory of 2284 2164 ffrxllr.exe 30 PID 2284 wrote to memory of 2392 2284 ntbbbh.exe 31 PID 2284 wrote to memory of 2392 2284 ntbbbh.exe 31 PID 2284 wrote to memory of 2392 2284 ntbbbh.exe 31 PID 2284 wrote to memory of 2392 2284 ntbbbh.exe 31 PID 2392 wrote to memory of 2004 2392 pdppj.exe 32 PID 2392 wrote to memory of 2004 2392 pdppj.exe 32 PID 2392 wrote to memory of 2004 2392 pdppj.exe 32 PID 2392 wrote to memory of 2004 2392 pdppj.exe 32 PID 2004 wrote to memory of 2256 2004 lxrxllx.exe 33 PID 2004 wrote to memory of 2256 2004 lxrxllx.exe 33 PID 2004 wrote to memory of 2256 2004 lxrxllx.exe 33 PID 2004 wrote to memory of 2256 2004 lxrxllx.exe 33 PID 2256 wrote to memory of 2064 2256 nhbnhh.exe 34 PID 2256 wrote to memory of 2064 2256 nhbnhh.exe 34 PID 2256 wrote to memory of 2064 2256 nhbnhh.exe 34 PID 2256 wrote to memory of 2064 2256 nhbnhh.exe 34 PID 2064 wrote to memory of 2684 2064 1ntnth.exe 35 PID 2064 wrote to memory of 2684 2064 1ntnth.exe 35 PID 2064 wrote to memory of 2684 2064 1ntnth.exe 35 PID 2064 wrote to memory of 2684 2064 1ntnth.exe 35 PID 2684 wrote to memory of 2484 2684 fxlxllr.exe 36 PID 2684 wrote to memory of 2484 2684 fxlxllr.exe 36 PID 2684 wrote to memory of 2484 2684 fxlxllr.exe 36 PID 2684 wrote to memory of 2484 2684 fxlxllr.exe 36 PID 2484 wrote to memory of 2640 2484 3fxffxr.exe 37 PID 2484 wrote to memory of 2640 2484 3fxffxr.exe 37 PID 2484 wrote to memory of 2640 2484 3fxffxr.exe 37 PID 2484 wrote to memory of 2640 2484 3fxffxr.exe 37 PID 2640 wrote to memory of 2616 2640 9dvjj.exe 38 PID 2640 wrote to memory of 2616 2640 9dvjj.exe 38 PID 2640 wrote to memory of 2616 2640 9dvjj.exe 38 PID 2640 wrote to memory of 2616 2640 9dvjj.exe 38 PID 2616 wrote to memory of 2480 2616 7vpjp.exe 39 PID 2616 wrote to memory of 2480 2616 7vpjp.exe 39 PID 2616 wrote to memory of 2480 2616 7vpjp.exe 39 PID 2616 wrote to memory of 2480 2616 7vpjp.exe 39 PID 2480 wrote to memory of 2248 2480 ffrrrfl.exe 40 PID 2480 wrote to memory of 2248 2480 ffrrrfl.exe 40 PID 2480 wrote to memory of 2248 2480 ffrrrfl.exe 40 PID 2480 wrote to memory of 2248 2480 ffrrrfl.exe 40 PID 2248 wrote to memory of 2528 2248 rlxrffl.exe 41 PID 2248 wrote to memory of 2528 2248 rlxrffl.exe 41 PID 2248 wrote to memory of 2528 2248 rlxrffl.exe 41 PID 2248 wrote to memory of 2528 2248 rlxrffl.exe 41 PID 2528 wrote to memory of 1512 2528 bbnnnn.exe 42 PID 2528 wrote to memory of 1512 2528 bbnnnn.exe 42 PID 2528 wrote to memory of 1512 2528 bbnnnn.exe 42 PID 2528 wrote to memory of 1512 2528 bbnnnn.exe 42 PID 1512 wrote to memory of 1796 1512 vvjpj.exe 43 PID 1512 wrote to memory of 1796 1512 vvjpj.exe 43 PID 1512 wrote to memory of 1796 1512 vvjpj.exe 43 PID 1512 wrote to memory of 1796 1512 vvjpj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d96c8808ad67396e36be06d1bbf4f0b78710d3445ff7c145d167eeb94d91250N.exe"C:\Users\Admin\AppData\Local\Temp\9d96c8808ad67396e36be06d1bbf4f0b78710d3445ff7c145d167eeb94d91250N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\vdpdp.exec:\vdpdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\ffrxllr.exec:\ffrxllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\ntbbbh.exec:\ntbbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\pdppj.exec:\pdppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\lxrxllx.exec:\lxrxllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\nhbnhh.exec:\nhbnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\1ntnth.exec:\1ntnth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\fxlxllr.exec:\fxlxllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\3fxffxr.exec:\3fxffxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\9dvjj.exec:\9dvjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\7vpjp.exec:\7vpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ffrrrfl.exec:\ffrrrfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\rlxrffl.exec:\rlxrffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\bbnnnn.exec:\bbnnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\vvjpj.exec:\vvjpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\7lflxxl.exec:\7lflxxl.exe17⤵
- Executes dropped EXE
PID:1796 -
\??\c:\fxxfffr.exec:\fxxfffr.exe18⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hbhnnt.exec:\hbhnnt.exe19⤵
- Executes dropped EXE
PID:1668 -
\??\c:\3bnhnn.exec:\3bnhnn.exe20⤵
- Executes dropped EXE
PID:1848 -
\??\c:\pvdvp.exec:\pvdvp.exe21⤵
- Executes dropped EXE
PID:1420 -
\??\c:\lfrfxll.exec:\lfrfxll.exe22⤵
- Executes dropped EXE
PID:620 -
\??\c:\fxlfflx.exec:\fxlfflx.exe23⤵
- Executes dropped EXE
PID:712 -
\??\c:\thbthb.exec:\thbthb.exe24⤵
- Executes dropped EXE
PID:2780 -
\??\c:\5djpv.exec:\5djpv.exe25⤵
- Executes dropped EXE
PID:2716 -
\??\c:\pvvdv.exec:\pvvdv.exe26⤵
- Executes dropped EXE
PID:2344 -
\??\c:\ffllffr.exec:\ffllffr.exe27⤵
- Executes dropped EXE
PID:748 -
\??\c:\9ntbtb.exec:\9ntbtb.exe28⤵
- Executes dropped EXE
PID:1028 -
\??\c:\nnnthn.exec:\nnnthn.exe29⤵
- Executes dropped EXE
PID:2184 -
\??\c:\7dppd.exec:\7dppd.exe30⤵
- Executes dropped EXE
PID:572 -
\??\c:\rrrfrfr.exec:\rrrfrfr.exe31⤵
- Executes dropped EXE
PID:1736 -
\??\c:\9llxrxl.exec:\9llxrxl.exe32⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nbntbb.exec:\nbntbb.exe33⤵
- Executes dropped EXE
PID:1880 -
\??\c:\3vdjj.exec:\3vdjj.exe34⤵PID:2908
-
\??\c:\jdpjv.exec:\jdpjv.exe35⤵
- Executes dropped EXE
PID:2448 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe36⤵
- Executes dropped EXE
PID:1692 -
\??\c:\lxfrrxf.exec:\lxfrrxf.exe37⤵
- Executes dropped EXE
PID:2388 -
\??\c:\5tbtnn.exec:\5tbtnn.exe38⤵
- Executes dropped EXE
PID:2404 -
\??\c:\pvvpj.exec:\pvvpj.exe39⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vdvdd.exec:\vdvdd.exe40⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rlrrfxl.exec:\rlrrfxl.exe41⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lxflxxf.exec:\lxflxxf.exe42⤵
- Executes dropped EXE
PID:1052 -
\??\c:\btttbb.exec:\btttbb.exe43⤵
- Executes dropped EXE
PID:3052 -
\??\c:\1jvdp.exec:\1jvdp.exe44⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vdvvj.exec:\vdvvj.exe45⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rfllxrx.exec:\rfllxrx.exe46⤵
- Executes dropped EXE
PID:2608 -
\??\c:\5ttbhn.exec:\5ttbhn.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2328 -
\??\c:\dvjvv.exec:\dvjvv.exe48⤵
- Executes dropped EXE
PID:2500 -
\??\c:\ppjvd.exec:\ppjvd.exe49⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xxflffr.exec:\xxflffr.exe50⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rlxxffr.exec:\rlxxffr.exe51⤵
- Executes dropped EXE
PID:1764 -
\??\c:\5nbnbb.exec:\5nbnbb.exe52⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nnhthh.exec:\nnhthh.exe53⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vpdpv.exec:\vpdpv.exe54⤵
- Executes dropped EXE
PID:1192 -
\??\c:\ddpvp.exec:\ddpvp.exe55⤵
- Executes dropped EXE
PID:1900 -
\??\c:\lfxfflx.exec:\lfxfflx.exe56⤵
- Executes dropped EXE
PID:276 -
\??\c:\ttbnnh.exec:\ttbnnh.exe57⤵
- Executes dropped EXE
PID:1668 -
\??\c:\hhbhtt.exec:\hhbhtt.exe58⤵
- Executes dropped EXE
PID:1432 -
\??\c:\hthtnn.exec:\hthtnn.exe59⤵
- Executes dropped EXE
PID:836 -
\??\c:\vvjpd.exec:\vvjpd.exe60⤵
- Executes dropped EXE
PID:784 -
\??\c:\lfrrrxx.exec:\lfrrrxx.exe61⤵
- Executes dropped EXE
PID:620 -
\??\c:\ffxlflf.exec:\ffxlflf.exe62⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hnttnh.exec:\hnttnh.exe63⤵
- Executes dropped EXE
PID:2936 -
\??\c:\nhhbhn.exec:\nhhbhn.exe64⤵
- Executes dropped EXE
PID:904 -
\??\c:\ddpvd.exec:\ddpvd.exe65⤵
- Executes dropped EXE
PID:2984 -
\??\c:\fxxxrfx.exec:\fxxxrfx.exe66⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xrrrffx.exec:\xrrrffx.exe67⤵PID:2576
-
\??\c:\nbhbhn.exec:\nbhbhn.exe68⤵PID:2880
-
\??\c:\bbnhtb.exec:\bbnhtb.exe69⤵PID:1768
-
\??\c:\dvvvv.exec:\dvvvv.exe70⤵PID:1732
-
\??\c:\5vvdj.exec:\5vvdj.exe71⤵PID:2788
-
\??\c:\xrrxfrl.exec:\xrrxfrl.exe72⤵PID:3008
-
\??\c:\frxffxr.exec:\frxffxr.exe73⤵PID:2560
-
\??\c:\hbttht.exec:\hbttht.exe74⤵PID:1944
-
\??\c:\jdpdd.exec:\jdpdd.exe75⤵PID:3032
-
\??\c:\vvvpv.exec:\vvvpv.exe76⤵
- System Location Discovery: System Language Discovery
PID:3044 -
\??\c:\5jdjv.exec:\5jdjv.exe77⤵
- System Location Discovery: System Language Discovery
PID:2384 -
\??\c:\fxxxrrx.exec:\fxxxrrx.exe78⤵PID:2192
-
\??\c:\3xlfxrr.exec:\3xlfxrr.exe79⤵PID:2312
-
\??\c:\htbhnn.exec:\htbhnn.exe80⤵PID:2416
-
\??\c:\htbhnn.exec:\htbhnn.exe81⤵PID:2268
-
\??\c:\ttttbh.exec:\ttttbh.exe82⤵PID:2232
-
\??\c:\ddpdv.exec:\ddpdv.exe83⤵PID:2128
-
\??\c:\lrrxxff.exec:\lrrxxff.exe84⤵PID:2672
-
\??\c:\9xfrxxf.exec:\9xfrxxf.exe85⤵PID:2584
-
\??\c:\tnhthn.exec:\tnhthn.exe86⤵PID:2596
-
\??\c:\tnbhbh.exec:\tnbhbh.exe87⤵PID:2708
-
\??\c:\dpvvd.exec:\dpvvd.exe88⤵PID:2644
-
\??\c:\7jjpj.exec:\7jjpj.exe89⤵PID:2700
-
\??\c:\xrxxflr.exec:\xrxxflr.exe90⤵PID:2472
-
\??\c:\lxrxffx.exec:\lxrxffx.exe91⤵PID:2144
-
\??\c:\9btntt.exec:\9btntt.exe92⤵PID:2952
-
\??\c:\hhhthn.exec:\hhhthn.exe93⤵PID:1604
-
\??\c:\1dppd.exec:\1dppd.exe94⤵PID:1660
-
\??\c:\ffxllrx.exec:\ffxllrx.exe95⤵PID:1548
-
\??\c:\fxlrrxl.exec:\fxlrrxl.exe96⤵PID:308
-
\??\c:\hhthbh.exec:\hhthbh.exe97⤵PID:2240
-
\??\c:\nhnnnn.exec:\nhnnnn.exe98⤵PID:1680
-
\??\c:\ddvdp.exec:\ddvdp.exe99⤵PID:828
-
\??\c:\vjjpj.exec:\vjjpj.exe100⤵PID:1432
-
\??\c:\5rxfrrx.exec:\5rxfrrx.exe101⤵PID:776
-
\??\c:\rfxlxxx.exec:\rfxlxxx.exe102⤵PID:1312
-
\??\c:\7nbtht.exec:\7nbtht.exe103⤵PID:2796
-
\??\c:\hthbnt.exec:\hthbnt.exe104⤵PID:2968
-
\??\c:\djvdj.exec:\djvdj.exe105⤵PID:2716
-
\??\c:\vjvvp.exec:\vjvvp.exe106⤵PID:1888
-
\??\c:\5rlxflr.exec:\5rlxflr.exe107⤵PID:2820
-
\??\c:\3lxfflr.exec:\3lxfflr.exe108⤵PID:1976
-
\??\c:\bhntth.exec:\bhntth.exe109⤵PID:1028
-
\??\c:\1bbtht.exec:\1bbtht.exe110⤵PID:2324
-
\??\c:\vdjdv.exec:\vdjdv.exe111⤵PID:864
-
\??\c:\vpvdv.exec:\vpvdv.exe112⤵PID:2900
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe113⤵PID:2252
-
\??\c:\thbhnt.exec:\thbhnt.exe114⤵PID:3008
-
\??\c:\5bthtt.exec:\5bthtt.exe115⤵PID:3024
-
\??\c:\djjvd.exec:\djjvd.exe116⤵PID:2840
-
\??\c:\vpvpv.exec:\vpvpv.exe117⤵PID:2264
-
\??\c:\ffxlfrl.exec:\ffxlfrl.exe118⤵PID:2280
-
\??\c:\lfffffr.exec:\lfffffr.exe119⤵PID:1256
-
\??\c:\5tnbhb.exec:\5tnbhb.exe120⤵PID:2404
-
\??\c:\htbthn.exec:\htbthn.exe121⤵PID:2004
-
\??\c:\jddjd.exec:\jddjd.exe122⤵PID:2428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-