Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 06:52
Static task
static1
Behavioral task
behavioral1
Sample
0c7265eb92231c0232d3b983bc08ec1efb8cb9b650214b46cb973ca4f22e9c1aN.exe
Resource
win7-20240729-en
General
-
Target
0c7265eb92231c0232d3b983bc08ec1efb8cb9b650214b46cb973ca4f22e9c1aN.exe
-
Size
93KB
-
MD5
d0894c5dc08ea0b08316156d50f75a60
-
SHA1
fd380798628466a2d84001735e0b967666b1ecd3
-
SHA256
0c7265eb92231c0232d3b983bc08ec1efb8cb9b650214b46cb973ca4f22e9c1a
-
SHA512
a7f8385bdd95435ba7110934d0a2a85bd264e400029261f18d537e4e3cf4bdcb9fa6e7dfae7d103995e299a0bedbe7d3278da91207edc423b3eb99e42c2ba516
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp99zx/A0Utg8:ymb3NkkiQ3mdBjFo73tvn+Yp99zDuP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2932-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1308-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1220-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1304-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/952-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/996-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1880 nbhttn.exe 2760 vdjpv.exe 2672 flllfff.exe 2788 nhbnnh.exe 1088 vpjvd.exe 2548 5rrflrx.exe 3024 tnbtbh.exe 1308 jvdpv.exe 2900 ffflxfx.exe 1220 hhnthh.exe 2072 bthhtt.exe 1304 ffrxlxl.exe 2288 lxrlxfl.exe 2808 ppvvv.exe 1732 pdjdd.exe 1356 lflflff.exe 2212 hbbnhn.exe 1924 1jjvp.exe 2276 xfllllr.exe 952 ffrxfxl.exe 1764 tbtbhn.exe 1920 pvjvj.exe 1044 llrrflr.exe 1756 1lrlxlx.exe 2172 bbthtb.exe 2468 5ppjd.exe 996 jpjdj.exe 2112 xfrxflx.exe 292 tnbntb.exe 2440 jdvdv.exe 2688 rxrrlxr.exe 2464 9bbbnt.exe 2700 7thttb.exe 1584 1tnbtt.exe 2944 djvdp.exe 2820 5xrfxfr.exe 2720 7xrxrxf.exe 2564 5bthth.exe 2548 nhhthn.exe 2360 jdjjd.exe 1772 jpdjp.exe 2892 xxffrxf.exe 1112 nhthbh.exe 1384 5thbhn.exe 616 1jvdj.exe 776 pjpvj.exe 1748 lrflrxl.exe 672 5xrrfll.exe 1992 nnttbt.exe 1872 vvdjj.exe 1136 ppddp.exe 2448 llxlflx.exe 1616 7lllxlr.exe 2304 nnnhbt.exe 2532 hntbtb.exe 2388 vdppd.exe 2132 pvpdj.exe 832 hbnnhn.exe 1604 bbnbtb.exe 1072 vdvvd.exe 1980 jjjpj.exe 372 fxfrfrx.exe 568 flrlllr.exe 2340 thntnb.exe -
resource yara_rule behavioral1/memory/2932-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1308-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1220-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1304-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/952-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/996-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-271-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 1880 2932 0c7265eb92231c0232d3b983bc08ec1efb8cb9b650214b46cb973ca4f22e9c1aN.exe 31 PID 2932 wrote to memory of 1880 2932 0c7265eb92231c0232d3b983bc08ec1efb8cb9b650214b46cb973ca4f22e9c1aN.exe 31 PID 2932 wrote to memory of 1880 2932 0c7265eb92231c0232d3b983bc08ec1efb8cb9b650214b46cb973ca4f22e9c1aN.exe 31 PID 2932 wrote to memory of 1880 2932 0c7265eb92231c0232d3b983bc08ec1efb8cb9b650214b46cb973ca4f22e9c1aN.exe 31 PID 1880 wrote to memory of 2760 1880 nbhttn.exe 32 PID 1880 wrote to memory of 2760 1880 nbhttn.exe 32 PID 1880 wrote to memory of 2760 1880 nbhttn.exe 32 PID 1880 wrote to memory of 2760 1880 nbhttn.exe 32 PID 2760 wrote to memory of 2672 2760 vdjpv.exe 33 PID 2760 wrote to memory of 2672 2760 vdjpv.exe 33 PID 2760 wrote to memory of 2672 2760 vdjpv.exe 33 PID 2760 wrote to memory of 2672 2760 vdjpv.exe 33 PID 2672 wrote to memory of 2788 2672 flllfff.exe 34 PID 2672 wrote to memory of 2788 2672 flllfff.exe 34 PID 2672 wrote to memory of 2788 2672 flllfff.exe 34 PID 2672 wrote to memory of 2788 2672 flllfff.exe 34 PID 2788 wrote to memory of 1088 2788 nhbnnh.exe 35 PID 2788 wrote to memory of 1088 2788 nhbnnh.exe 35 PID 2788 wrote to memory of 1088 2788 nhbnnh.exe 35 PID 2788 wrote to memory of 1088 2788 nhbnnh.exe 35 PID 1088 wrote to memory of 2548 1088 vpjvd.exe 36 PID 1088 wrote to memory of 2548 1088 vpjvd.exe 36 PID 1088 wrote to memory of 2548 1088 vpjvd.exe 36 PID 1088 wrote to memory of 2548 1088 vpjvd.exe 36 PID 2548 wrote to memory of 3024 2548 5rrflrx.exe 37 PID 2548 wrote to memory of 3024 2548 5rrflrx.exe 37 PID 2548 wrote to memory of 3024 2548 5rrflrx.exe 37 PID 2548 wrote to memory of 3024 2548 5rrflrx.exe 37 PID 3024 wrote to memory of 1308 3024 tnbtbh.exe 38 PID 3024 wrote to memory of 1308 3024 tnbtbh.exe 38 PID 3024 wrote to memory of 1308 3024 tnbtbh.exe 38 PID 3024 wrote to memory of 1308 3024 tnbtbh.exe 38 PID 1308 wrote to memory of 2900 1308 jvdpv.exe 39 PID 1308 wrote to memory of 2900 1308 jvdpv.exe 39 PID 1308 wrote to memory of 2900 1308 jvdpv.exe 39 PID 1308 wrote to memory of 2900 1308 jvdpv.exe 39 PID 2900 wrote to memory of 1220 2900 ffflxfx.exe 40 PID 2900 wrote to memory of 1220 2900 ffflxfx.exe 40 PID 2900 wrote to memory of 1220 2900 ffflxfx.exe 40 PID 2900 wrote to memory of 1220 2900 ffflxfx.exe 40 PID 1220 wrote to memory of 2072 1220 hhnthh.exe 41 PID 1220 wrote to memory of 2072 1220 hhnthh.exe 41 PID 1220 wrote to memory of 2072 1220 hhnthh.exe 41 PID 1220 wrote to memory of 2072 1220 hhnthh.exe 41 PID 2072 wrote to memory of 1304 2072 bthhtt.exe 42 PID 2072 wrote to memory of 1304 2072 bthhtt.exe 42 PID 2072 wrote to memory of 1304 2072 bthhtt.exe 42 PID 2072 wrote to memory of 1304 2072 bthhtt.exe 42 PID 1304 wrote to memory of 2288 1304 ffrxlxl.exe 43 PID 1304 wrote to memory of 2288 1304 ffrxlxl.exe 43 PID 1304 wrote to memory of 2288 1304 ffrxlxl.exe 43 PID 1304 wrote to memory of 2288 1304 ffrxlxl.exe 43 PID 2288 wrote to memory of 2808 2288 lxrlxfl.exe 44 PID 2288 wrote to memory of 2808 2288 lxrlxfl.exe 44 PID 2288 wrote to memory of 2808 2288 lxrlxfl.exe 44 PID 2288 wrote to memory of 2808 2288 lxrlxfl.exe 44 PID 2808 wrote to memory of 1732 2808 ppvvv.exe 45 PID 2808 wrote to memory of 1732 2808 ppvvv.exe 45 PID 2808 wrote to memory of 1732 2808 ppvvv.exe 45 PID 2808 wrote to memory of 1732 2808 ppvvv.exe 45 PID 1732 wrote to memory of 1356 1732 pdjdd.exe 46 PID 1732 wrote to memory of 1356 1732 pdjdd.exe 46 PID 1732 wrote to memory of 1356 1732 pdjdd.exe 46 PID 1732 wrote to memory of 1356 1732 pdjdd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c7265eb92231c0232d3b983bc08ec1efb8cb9b650214b46cb973ca4f22e9c1aN.exe"C:\Users\Admin\AppData\Local\Temp\0c7265eb92231c0232d3b983bc08ec1efb8cb9b650214b46cb973ca4f22e9c1aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\nbhttn.exec:\nbhttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\vdjpv.exec:\vdjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\flllfff.exec:\flllfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\nhbnnh.exec:\nhbnnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\vpjvd.exec:\vpjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\5rrflrx.exec:\5rrflrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\tnbtbh.exec:\tnbtbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jvdpv.exec:\jvdpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\ffflxfx.exec:\ffflxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\hhnthh.exec:\hhnthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\bthhtt.exec:\bthhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\ffrxlxl.exec:\ffrxlxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\lxrlxfl.exec:\lxrlxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\ppvvv.exec:\ppvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\pdjdd.exec:\pdjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\lflflff.exec:\lflflff.exe17⤵
- Executes dropped EXE
PID:1356 -
\??\c:\hbbnhn.exec:\hbbnhn.exe18⤵
- Executes dropped EXE
PID:2212 -
\??\c:\1jjvp.exec:\1jjvp.exe19⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xfllllr.exec:\xfllllr.exe20⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ffrxfxl.exec:\ffrxfxl.exe21⤵
- Executes dropped EXE
PID:952 -
\??\c:\tbtbhn.exec:\tbtbhn.exe22⤵
- Executes dropped EXE
PID:1764 -
\??\c:\pvjvj.exec:\pvjvj.exe23⤵
- Executes dropped EXE
PID:1920 -
\??\c:\llrrflr.exec:\llrrflr.exe24⤵
- Executes dropped EXE
PID:1044 -
\??\c:\1lrlxlx.exec:\1lrlxlx.exe25⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bbthtb.exec:\bbthtb.exe26⤵
- Executes dropped EXE
PID:2172 -
\??\c:\5ppjd.exec:\5ppjd.exe27⤵
- Executes dropped EXE
PID:2468 -
\??\c:\jpjdj.exec:\jpjdj.exe28⤵
- Executes dropped EXE
PID:996 -
\??\c:\xfrxflx.exec:\xfrxflx.exe29⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tnbntb.exec:\tnbntb.exe30⤵
- Executes dropped EXE
PID:292 -
\??\c:\jdvdv.exec:\jdvdv.exe31⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rxrrlxr.exec:\rxrrlxr.exe32⤵
- Executes dropped EXE
PID:2688 -
\??\c:\9bbbnt.exec:\9bbbnt.exe33⤵
- Executes dropped EXE
PID:2464 -
\??\c:\7thttb.exec:\7thttb.exe34⤵
- Executes dropped EXE
PID:2700 -
\??\c:\1tnbtt.exec:\1tnbtt.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\djvdp.exec:\djvdp.exe36⤵
- Executes dropped EXE
PID:2944 -
\??\c:\5xrfxfr.exec:\5xrfxfr.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\7xrxrxf.exec:\7xrxrxf.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\5bthth.exec:\5bthth.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\nhhthn.exec:\nhhthn.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jdjjd.exec:\jdjjd.exe41⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jpdjp.exec:\jpdjp.exe42⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xxffrxf.exec:\xxffrxf.exe43⤵
- Executes dropped EXE
PID:2892 -
\??\c:\nhthbh.exec:\nhthbh.exe44⤵
- Executes dropped EXE
PID:1112 -
\??\c:\5thbhn.exec:\5thbhn.exe45⤵
- Executes dropped EXE
PID:1384 -
\??\c:\1jvdj.exec:\1jvdj.exe46⤵
- Executes dropped EXE
PID:616 -
\??\c:\pjpvj.exec:\pjpvj.exe47⤵
- Executes dropped EXE
PID:776 -
\??\c:\lrflrxl.exec:\lrflrxl.exe48⤵
- Executes dropped EXE
PID:1748 -
\??\c:\5xrrfll.exec:\5xrrfll.exe49⤵
- Executes dropped EXE
PID:672 -
\??\c:\nnttbt.exec:\nnttbt.exe50⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vvdjj.exec:\vvdjj.exe51⤵
- Executes dropped EXE
PID:1872 -
\??\c:\ppddp.exec:\ppddp.exe52⤵
- Executes dropped EXE
PID:1136 -
\??\c:\llxlflx.exec:\llxlflx.exe53⤵
- Executes dropped EXE
PID:2448 -
\??\c:\7lllxlr.exec:\7lllxlr.exe54⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nnnhbt.exec:\nnnhbt.exe55⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hntbtb.exec:\hntbtb.exe56⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vdppd.exec:\vdppd.exe57⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pvpdj.exec:\pvpdj.exe58⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hbnnhn.exec:\hbnnhn.exe59⤵
- Executes dropped EXE
PID:832 -
\??\c:\bbnbtb.exec:\bbnbtb.exe60⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vdvvd.exec:\vdvvd.exe61⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jjjpj.exec:\jjjpj.exe62⤵
- Executes dropped EXE
PID:1980 -
\??\c:\fxfrfrx.exec:\fxfrfrx.exe63⤵
- Executes dropped EXE
PID:372 -
\??\c:\flrlllr.exec:\flrlllr.exe64⤵
- Executes dropped EXE
PID:568 -
\??\c:\thntnb.exec:\thntnb.exe65⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nbnthh.exec:\nbnthh.exe66⤵PID:2492
-
\??\c:\ddpvp.exec:\ddpvp.exe67⤵PID:996
-
\??\c:\ddjpd.exec:\ddjpd.exe68⤵PID:1140
-
\??\c:\7xflxfl.exec:\7xflxfl.exe69⤵PID:2848
-
\??\c:\xrffflr.exec:\xrffflr.exe70⤵PID:2656
-
\??\c:\hnhtbb.exec:\hnhtbb.exe71⤵PID:2752
-
\??\c:\bbhbth.exec:\bbhbth.exe72⤵PID:1928
-
\??\c:\jvdvv.exec:\jvdvv.exe73⤵PID:2956
-
\??\c:\djpvj.exec:\djpvj.exe74⤵PID:1592
-
\??\c:\rxxxrxf.exec:\rxxxrxf.exe75⤵PID:2836
-
\??\c:\rlxflrr.exec:\rlxflrr.exe76⤵PID:2812
-
\??\c:\hhtbhn.exec:\hhtbhn.exe77⤵PID:2712
-
\??\c:\hntbnt.exec:\hntbnt.exe78⤵PID:2580
-
\??\c:\vdpdd.exec:\vdpdd.exe79⤵PID:2668
-
\??\c:\pvvjj.exec:\pvvjj.exe80⤵PID:2620
-
\??\c:\ffrxlrx.exec:\ffrxlrx.exe81⤵PID:2888
-
\??\c:\ffrflxf.exec:\ffrflxf.exe82⤵PID:2912
-
\??\c:\1bnbnb.exec:\1bnbnb.exe83⤵PID:2876
-
\??\c:\btnbth.exec:\btnbth.exe84⤵PID:1956
-
\??\c:\jjjpd.exec:\jjjpd.exe85⤵PID:3004
-
\??\c:\ppdpj.exec:\ppdpj.exe86⤵PID:2072
-
\??\c:\1fffrfr.exec:\1fffrfr.exe87⤵PID:1568
-
\??\c:\7fxllrx.exec:\7fxllrx.exe88⤵PID:2728
-
\??\c:\thbttt.exec:\thbttt.exe89⤵PID:2808
-
\??\c:\tbbhhb.exec:\tbbhhb.exe90⤵PID:596
-
\??\c:\7jvjp.exec:\7jvjp.exe91⤵PID:2200
-
\??\c:\jjvvd.exec:\jjvvd.exe92⤵PID:1952
-
\??\c:\rfllrxf.exec:\rfllrxf.exe93⤵PID:1612
-
\??\c:\ffxfflx.exec:\ffxfflx.exe94⤵PID:1660
-
\??\c:\7nhtnt.exec:\7nhtnt.exe95⤵PID:1692
-
\??\c:\hnhttb.exec:\hnhttb.exe96⤵PID:2952
-
\??\c:\pdpvj.exec:\pdpvj.exe97⤵PID:428
-
\??\c:\pjvvv.exec:\pjvvv.exe98⤵PID:1268
-
\??\c:\rrffrxl.exec:\rrffrxl.exe99⤵PID:1060
-
\??\c:\7llrfrx.exec:\7llrfrx.exe100⤵PID:900
-
\??\c:\nthttn.exec:\nthttn.exe101⤵PID:1628
-
\??\c:\1bhtnh.exec:\1bhtnh.exe102⤵PID:1820
-
\??\c:\vvpdj.exec:\vvpdj.exe103⤵PID:2988
-
\??\c:\jpdjv.exec:\jpdjv.exe104⤵PID:2468
-
\??\c:\rxrxxlf.exec:\rxrxxlf.exe105⤵PID:1904
-
\??\c:\xxfflrf.exec:\xxfflrf.exe106⤵PID:1192
-
\??\c:\hntbhh.exec:\hntbhh.exe107⤵PID:888
-
\??\c:\7tthnn.exec:\7tthnn.exe108⤵PID:292
-
\??\c:\ddvjv.exec:\ddvjv.exe109⤵PID:808
-
\??\c:\dpddv.exec:\dpddv.exe110⤵PID:2800
-
\??\c:\rlxfllr.exec:\rlxfllr.exe111⤵PID:2744
-
\??\c:\llffrxf.exec:\llffrxf.exe112⤵PID:2784
-
\??\c:\nhtnbn.exec:\nhtnbn.exe113⤵PID:2284
-
\??\c:\tntbnt.exec:\tntbnt.exe114⤵PID:2948
-
\??\c:\1pjvv.exec:\1pjvv.exe115⤵PID:3064
-
\??\c:\3ddpp.exec:\3ddpp.exe116⤵PID:2036
-
\??\c:\3rffrxl.exec:\3rffrxl.exe117⤵PID:2720
-
\??\c:\xxlrxlf.exec:\xxlrxlf.exe118⤵PID:2832
-
\??\c:\5btnnb.exec:\5btnnb.exe119⤵PID:2432
-
\??\c:\bnbnbn.exec:\bnbnbn.exe120⤵PID:3032
-
\??\c:\7dvpv.exec:\7dvpv.exe121⤵PID:1292
-
\??\c:\3vpvj.exec:\3vpvj.exe122⤵PID:2060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-