Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-10-2024 21:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
451e330c80f7784cb9c980c089252bf454e97bf29432caf7419971cefc44d38a.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
451e330c80f7784cb9c980c089252bf454e97bf29432caf7419971cefc44d38a.exe
-
Size
71KB
-
MD5
6d4c6b2b189aa2bae17b60322901f153
-
SHA1
6978b0f8f3630a6ffa21c075f280086d0286d356
-
SHA256
451e330c80f7784cb9c980c089252bf454e97bf29432caf7419971cefc44d38a
-
SHA512
c5182059b9e8e21a61058775f70e752e3444fe87abac9c77ef1668b91ded616cf74f34c3a2ad2b35a7c1c2ae4ecbd926d8310e0bad94365f5b1b87264f5388be
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjF:ymb3NkkiQ3mdBjFI4VV
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral1/memory/2692-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1564-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/308-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1340-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/936-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/468-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2376 bthntb.exe 1840 vdjvp.exe 1564 7lfrxxf.exe 2812 5hhtnb.exe 2616 jdjpj.exe 2864 rrfrxxf.exe 2724 llxlrfr.exe 2660 tbbbhn.exe 2564 bthtbt.exe 2032 ppjpd.exe 308 xlrrlff.exe 1396 hbbnhn.exe 1892 nnbnhh.exe 1488 pjdjv.exe 532 lxlxlxf.exe 1868 nnbntt.exe 1340 vdjvp.exe 2900 vpjpv.exe 1044 xflllfx.exe 1968 7thbnb.exe 2452 jpdpv.exe 2844 jpdpv.exe 1084 lfxxxlr.exe 936 xrfflrf.exe 3048 hhhnth.exe 468 vvvjp.exe 2356 pjvdp.exe 2584 7rrxflx.exe 1392 nnhtnt.exe 1628 5ppjp.exe 2060 rllxxfx.exe 2788 ffrxlrr.exe 1724 3btnhh.exe 2396 1jjpd.exe 1620 3vpdj.exe 2828 xxrlxfx.exe 2952 rrxlxlx.exe 2740 bnbtbh.exe 3068 btbhnn.exe 2724 djdvd.exe 1624 jjpjj.exe 3028 fxllrrx.exe 668 nnhbhh.exe 2564 thbhtb.exe 2880 jjdjv.exe 1900 jjpvd.exe 308 fffrllf.exe 1912 1nbhth.exe 1956 tbnhhb.exe 1488 1jjpp.exe 1388 pjpdd.exe 2004 lfrfrxr.exe 2676 xllfrxf.exe 1260 rlxfrrf.exe 1552 nnbnhn.exe 2704 9djvp.exe 3012 1vjdj.exe 2648 llfxlxf.exe 904 lfrxflx.exe 944 9nnttb.exe 1780 nhhtnn.exe 560 pjjjd.exe 1896 vvdpd.exe 2932 1jvpj.exe -
resource yara_rule behavioral1/memory/2692-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1340-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/936-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/468-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-287-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2376 2692 451e330c80f7784cb9c980c089252bf454e97bf29432caf7419971cefc44d38a.exe 30 PID 2692 wrote to memory of 2376 2692 451e330c80f7784cb9c980c089252bf454e97bf29432caf7419971cefc44d38a.exe 30 PID 2692 wrote to memory of 2376 2692 451e330c80f7784cb9c980c089252bf454e97bf29432caf7419971cefc44d38a.exe 30 PID 2692 wrote to memory of 2376 2692 451e330c80f7784cb9c980c089252bf454e97bf29432caf7419971cefc44d38a.exe 30 PID 2376 wrote to memory of 1840 2376 bthntb.exe 31 PID 2376 wrote to memory of 1840 2376 bthntb.exe 31 PID 2376 wrote to memory of 1840 2376 bthntb.exe 31 PID 2376 wrote to memory of 1840 2376 bthntb.exe 31 PID 1840 wrote to memory of 1564 1840 vdjvp.exe 32 PID 1840 wrote to memory of 1564 1840 vdjvp.exe 32 PID 1840 wrote to memory of 1564 1840 vdjvp.exe 32 PID 1840 wrote to memory of 1564 1840 vdjvp.exe 32 PID 1564 wrote to memory of 2812 1564 7lfrxxf.exe 33 PID 1564 wrote to memory of 2812 1564 7lfrxxf.exe 33 PID 1564 wrote to memory of 2812 1564 7lfrxxf.exe 33 PID 1564 wrote to memory of 2812 1564 7lfrxxf.exe 33 PID 2812 wrote to memory of 2616 2812 5hhtnb.exe 34 PID 2812 wrote to memory of 2616 2812 5hhtnb.exe 34 PID 2812 wrote to memory of 2616 2812 5hhtnb.exe 34 PID 2812 wrote to memory of 2616 2812 5hhtnb.exe 34 PID 2616 wrote to memory of 2864 2616 jdjpj.exe 35 PID 2616 wrote to memory of 2864 2616 jdjpj.exe 35 PID 2616 wrote to memory of 2864 2616 jdjpj.exe 35 PID 2616 wrote to memory of 2864 2616 jdjpj.exe 35 PID 2864 wrote to memory of 2724 2864 rrfrxxf.exe 36 PID 2864 wrote to memory of 2724 2864 rrfrxxf.exe 36 PID 2864 wrote to memory of 2724 2864 rrfrxxf.exe 36 PID 2864 wrote to memory of 2724 2864 rrfrxxf.exe 36 PID 2724 wrote to memory of 2660 2724 llxlrfr.exe 37 PID 2724 wrote to memory of 2660 2724 llxlrfr.exe 37 PID 2724 wrote to memory of 2660 2724 llxlrfr.exe 37 PID 2724 wrote to memory of 2660 2724 llxlrfr.exe 37 PID 2660 wrote to memory of 2564 2660 tbbbhn.exe 38 PID 2660 wrote to memory of 2564 2660 tbbbhn.exe 38 PID 2660 wrote to memory of 2564 2660 tbbbhn.exe 38 PID 2660 wrote to memory of 2564 2660 tbbbhn.exe 38 PID 2564 wrote to memory of 2032 2564 bthtbt.exe 39 PID 2564 wrote to memory of 2032 2564 bthtbt.exe 39 PID 2564 wrote to memory of 2032 2564 bthtbt.exe 39 PID 2564 wrote to memory of 2032 2564 bthtbt.exe 39 PID 2032 wrote to memory of 308 2032 ppjpd.exe 40 PID 2032 wrote to memory of 308 2032 ppjpd.exe 40 PID 2032 wrote to memory of 308 2032 ppjpd.exe 40 PID 2032 wrote to memory of 308 2032 ppjpd.exe 40 PID 308 wrote to memory of 1396 308 xlrrlff.exe 41 PID 308 wrote to memory of 1396 308 xlrrlff.exe 41 PID 308 wrote to memory of 1396 308 xlrrlff.exe 41 PID 308 wrote to memory of 1396 308 xlrrlff.exe 41 PID 1396 wrote to memory of 1892 1396 hbbnhn.exe 42 PID 1396 wrote to memory of 1892 1396 hbbnhn.exe 42 PID 1396 wrote to memory of 1892 1396 hbbnhn.exe 42 PID 1396 wrote to memory of 1892 1396 hbbnhn.exe 42 PID 1892 wrote to memory of 1488 1892 nnbnhh.exe 43 PID 1892 wrote to memory of 1488 1892 nnbnhh.exe 43 PID 1892 wrote to memory of 1488 1892 nnbnhh.exe 43 PID 1892 wrote to memory of 1488 1892 nnbnhh.exe 43 PID 1488 wrote to memory of 532 1488 pjdjv.exe 44 PID 1488 wrote to memory of 532 1488 pjdjv.exe 44 PID 1488 wrote to memory of 532 1488 pjdjv.exe 44 PID 1488 wrote to memory of 532 1488 pjdjv.exe 44 PID 532 wrote to memory of 1868 532 lxlxlxf.exe 45 PID 532 wrote to memory of 1868 532 lxlxlxf.exe 45 PID 532 wrote to memory of 1868 532 lxlxlxf.exe 45 PID 532 wrote to memory of 1868 532 lxlxlxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\451e330c80f7784cb9c980c089252bf454e97bf29432caf7419971cefc44d38a.exe"C:\Users\Admin\AppData\Local\Temp\451e330c80f7784cb9c980c089252bf454e97bf29432caf7419971cefc44d38a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\bthntb.exec:\bthntb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\vdjvp.exec:\vdjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\7lfrxxf.exec:\7lfrxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\5hhtnb.exec:\5hhtnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\jdjpj.exec:\jdjpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\rrfrxxf.exec:\rrfrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\llxlrfr.exec:\llxlrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\tbbbhn.exec:\tbbbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bthtbt.exec:\bthtbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\ppjpd.exec:\ppjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\xlrrlff.exec:\xlrrlff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\hbbnhn.exec:\hbbnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\nnbnhh.exec:\nnbnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\pjdjv.exec:\pjdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\lxlxlxf.exec:\lxlxlxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\nnbntt.exec:\nnbntt.exe17⤵
- Executes dropped EXE
PID:1868 -
\??\c:\vdjvp.exec:\vdjvp.exe18⤵
- Executes dropped EXE
PID:1340 -
\??\c:\vpjpv.exec:\vpjpv.exe19⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xflllfx.exec:\xflllfx.exe20⤵
- Executes dropped EXE
PID:1044 -
\??\c:\7thbnb.exec:\7thbnb.exe21⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jpdpv.exec:\jpdpv.exe22⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jpdpv.exec:\jpdpv.exe23⤵
- Executes dropped EXE
PID:2844 -
\??\c:\lfxxxlr.exec:\lfxxxlr.exe24⤵
- Executes dropped EXE
PID:1084 -
\??\c:\xrfflrf.exec:\xrfflrf.exe25⤵
- Executes dropped EXE
PID:936 -
\??\c:\hhhnth.exec:\hhhnth.exe26⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vvvjp.exec:\vvvjp.exe27⤵
- Executes dropped EXE
PID:468 -
\??\c:\pjvdp.exec:\pjvdp.exe28⤵
- Executes dropped EXE
PID:2356 -
\??\c:\7rrxflx.exec:\7rrxflx.exe29⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nnhtnt.exec:\nnhtnt.exe30⤵
- Executes dropped EXE
PID:1392 -
\??\c:\5ppjp.exec:\5ppjp.exe31⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rllxxfx.exec:\rllxxfx.exe32⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ffrxlrr.exec:\ffrxlrr.exe33⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3btnhh.exec:\3btnhh.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1jjpd.exec:\1jjpd.exe35⤵
- Executes dropped EXE
PID:2396 -
\??\c:\3vpdj.exec:\3vpdj.exe36⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xxrlxfx.exec:\xxrlxfx.exe37⤵
- Executes dropped EXE
PID:2828 -
\??\c:\rrxlxlx.exec:\rrxlxlx.exe38⤵
- Executes dropped EXE
PID:2952 -
\??\c:\bnbtbh.exec:\bnbtbh.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\btbhnn.exec:\btbhnn.exe40⤵
- Executes dropped EXE
PID:3068 -
\??\c:\djdvd.exec:\djdvd.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\jjpjj.exec:\jjpjj.exe42⤵
- Executes dropped EXE
PID:1624 -
\??\c:\fxllrrx.exec:\fxllrrx.exe43⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nnhbhh.exec:\nnhbhh.exe44⤵
- Executes dropped EXE
PID:668 -
\??\c:\thbhtb.exec:\thbhtb.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\jjdjv.exec:\jjdjv.exe46⤵
- Executes dropped EXE
PID:2880 -
\??\c:\jjpvd.exec:\jjpvd.exe47⤵
- Executes dropped EXE
PID:1900 -
\??\c:\fffrllf.exec:\fffrllf.exe48⤵
- Executes dropped EXE
PID:308 -
\??\c:\1nbhth.exec:\1nbhth.exe49⤵
- Executes dropped EXE
PID:1912 -
\??\c:\tbnhhb.exec:\tbnhhb.exe50⤵
- Executes dropped EXE
PID:1956 -
\??\c:\1jjpp.exec:\1jjpp.exe51⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pjpdd.exec:\pjpdd.exe52⤵
- Executes dropped EXE
PID:1388 -
\??\c:\lfrfrxr.exec:\lfrfrxr.exe53⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xllfrxf.exec:\xllfrxf.exe54⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe55⤵
- Executes dropped EXE
PID:1260 -
\??\c:\nnbnhn.exec:\nnbnhn.exe56⤵
- Executes dropped EXE
PID:1552 -
\??\c:\9djvp.exec:\9djvp.exe57⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1vjdj.exec:\1vjdj.exe58⤵
- Executes dropped EXE
PID:3012 -
\??\c:\llfxlxf.exec:\llfxlxf.exe59⤵
- Executes dropped EXE
PID:2648 -
\??\c:\lfrxflx.exec:\lfrxflx.exe60⤵
- Executes dropped EXE
PID:904 -
\??\c:\9nnttb.exec:\9nnttb.exe61⤵
- Executes dropped EXE
PID:944 -
\??\c:\nhhtnn.exec:\nhhtnn.exe62⤵
- Executes dropped EXE
PID:1780 -
\??\c:\pjjjd.exec:\pjjjd.exe63⤵
- Executes dropped EXE
PID:560 -
\??\c:\vvdpd.exec:\vvdpd.exe64⤵
- Executes dropped EXE
PID:1896 -
\??\c:\1jvpj.exec:\1jvpj.exe65⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rlrllff.exec:\rlrllff.exe66⤵PID:2356
-
\??\c:\5rffrxl.exec:\5rffrxl.exe67⤵PID:2928
-
\??\c:\btthnb.exec:\btthnb.exe68⤵PID:2364
-
\??\c:\tnhntb.exec:\tnhntb.exe69⤵PID:3052
-
\??\c:\pjvjd.exec:\pjvjd.exe70⤵PID:2888
-
\??\c:\dddpp.exec:\dddpp.exe71⤵PID:2688
-
\??\c:\7fflxfr.exec:\7fflxfr.exe72⤵PID:2720
-
\??\c:\lxllrxl.exec:\lxllrxl.exe73⤵PID:2228
-
\??\c:\tnbnbn.exec:\tnbnbn.exe74⤵PID:2700
-
\??\c:\bhhhth.exec:\bhhhth.exe75⤵
- System Location Discovery: System Language Discovery
PID:2480 -
\??\c:\3dpvp.exec:\3dpvp.exe76⤵PID:2804
-
\??\c:\9ddjv.exec:\9ddjv.exe77⤵PID:2808
-
\??\c:\lfrxfrx.exec:\lfrxfrx.exe78⤵PID:2208
-
\??\c:\rrfxlrf.exec:\rrfxlrf.exe79⤵PID:2912
-
\??\c:\btthnb.exec:\btthnb.exe80⤵PID:2780
-
\??\c:\nhthnt.exec:\nhthnt.exe81⤵PID:2608
-
\??\c:\ppvjd.exec:\ppvjd.exe82⤵PID:2784
-
\??\c:\9jpdj.exec:\9jpdj.exe83⤵PID:1104
-
\??\c:\7xrxlfr.exec:\7xrxlfr.exe84⤵PID:1852
-
\??\c:\flrlfll.exec:\flrlfll.exe85⤵PID:2620
-
\??\c:\nhtbbh.exec:\nhtbbh.exe86⤵PID:800
-
\??\c:\jjdjv.exec:\jjdjv.exe87⤵PID:444
-
\??\c:\5dddp.exec:\5dddp.exe88⤵PID:1652
-
\??\c:\llffxlx.exec:\llffxlx.exe89⤵PID:1720
-
\??\c:\lrrffrr.exec:\lrrffrr.exe90⤵PID:1688
-
\??\c:\ttbtbt.exec:\ttbtbt.exe91⤵PID:532
-
\??\c:\ddvpv.exec:\ddvpv.exe92⤵PID:592
-
\??\c:\vpppp.exec:\vpppp.exe93⤵PID:2708
-
\??\c:\1xlfxxl.exec:\1xlfxxl.exe94⤵PID:2448
-
\??\c:\flrfxlr.exec:\flrfxlr.exe95⤵PID:2444
-
\??\c:\ttnbbh.exec:\ttnbbh.exe96⤵PID:2556
-
\??\c:\ppppp.exec:\ppppp.exe97⤵PID:2592
-
\??\c:\1vjpj.exec:\1vjpj.exe98⤵PID:2844
-
\??\c:\7rrxlrr.exec:\7rrxlrr.exe99⤵PID:1848
-
\??\c:\llxxxlf.exec:\llxxxlf.exe100⤵PID:1168
-
\??\c:\nnthbt.exec:\nnthbt.exe101⤵PID:888
-
\??\c:\tbtnht.exec:\tbtnht.exe102⤵PID:2696
-
\??\c:\jdpvd.exec:\jdpvd.exe103⤵PID:2532
-
\??\c:\xxxflrx.exec:\xxxflrx.exe104⤵PID:1656
-
\??\c:\flxrrlr.exec:\flxrrlr.exe105⤵PID:3056
-
\??\c:\nnnhhn.exec:\nnnhhn.exe106⤵PID:268
-
\??\c:\jpvpv.exec:\jpvpv.exe107⤵PID:760
-
\??\c:\ppppd.exec:\ppppd.exe108⤵PID:1628
-
\??\c:\rlxxflx.exec:\rlxxflx.exe109⤵PID:868
-
\??\c:\lllrffl.exec:\lllrffl.exe110⤵PID:1240
-
\??\c:\ntthbb.exec:\ntthbb.exe111⤵PID:2156
-
\??\c:\7bhhhb.exec:\7bhhhb.exe112⤵PID:2720
-
\??\c:\vppjp.exec:\vppjp.exe113⤵PID:2116
-
\??\c:\lllxlxr.exec:\lllxlxr.exe114⤵PID:1620
-
\??\c:\xxxflxr.exec:\xxxflxr.exe115⤵PID:2812
-
\??\c:\tnhnbb.exec:\tnhnbb.exe116⤵PID:2728
-
\??\c:\ttthhn.exec:\ttthhn.exe117⤵PID:2904
-
\??\c:\nnnhtb.exec:\nnnhtb.exe118⤵PID:2656
-
\??\c:\pdjvp.exec:\pdjvp.exe119⤵PID:2664
-
\??\c:\5llxfrx.exec:\5llxfrx.exe120⤵PID:2680
-
\??\c:\fxflrll.exec:\fxflrll.exe121⤵PID:2000
-
\??\c:\hnbbhn.exec:\hnbbhn.exe122⤵PID:2280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-