Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 01:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
355d59537ce6a25ff0d46ff8c54b17b0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
355d59537ce6a25ff0d46ff8c54b17b0N.exe
-
Size
72KB
-
MD5
355d59537ce6a25ff0d46ff8c54b17b0
-
SHA1
a6b8258c1e130f9d3ba91a4a88a097ca0d8f61ad
-
SHA256
543dd32db1451cb7f48d667c236c6b5c78d29558ea4cc2a4982a873090f24bb1
-
SHA512
f90a1d767efb00973677370344b5017f05c2e75b6ea6eebcad1afd5d8e26e15b2d0b328863446b56b963cf0867680ea37c7b5b508d85b379e24e4a3aa6d6b3ee
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OG1UMYC:ymb3NkkiQ3mdBjFIvl358nLA89OaqC
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2232-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-73-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/308-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1216-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/684-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2668 pjjpd.exe 2816 xrfflrl.exe 2948 ttttht.exe 2736 bthntt.exe 2604 fxrfrxr.exe 2328 tnbbhb.exe 2728 1tntth.exe 2400 9pjdd.exe 2912 7lxrfrf.exe 2316 hnthhn.exe 1940 hhttbh.exe 308 dvpvj.exe 1056 fxflrxf.exe 1644 3thnbn.exe 1216 dvpdp.exe 2264 vvvpd.exe 764 flrrlrx.exe 1748 hhthtb.exe 2352 1ppvd.exe 2188 vpjvj.exe 2360 3lxrxxf.exe 1848 1xrfxff.exe 652 btnthh.exe 1804 3jvjv.exe 2888 dpjjp.exe 3000 xrlxlxf.exe 1756 hbtbtb.exe 2004 dddpp.exe 684 jddpp.exe 860 rllrxxf.exe 2208 hbnthn.exe 2700 dddpp.exe 2720 3vvvv.exe 2688 7rlxlrx.exe 1704 7xxfrrl.exe 2760 7hbntb.exe 2548 7nnbnb.exe 2560 pjpvv.exe 2600 vpdpv.exe 2564 rfxrxxl.exe 864 xrxxlrf.exe 1516 3bthbn.exe 2392 5hnhnh.exe 2748 pjvdp.exe 2008 pjdjv.exe 2852 xllfrxf.exe 2840 lllffrx.exe 308 hbtnnn.exe 2244 nhnbtb.exe 1604 tthntb.exe 2136 dvjvv.exe 292 fllxxrx.exe 912 xlrxffx.exe 764 hbhhhn.exe 1776 5bbttb.exe 2192 bhnbbn.exe 2164 3vpjj.exe 2228 vjvvj.exe 1300 frflxfl.exe 1608 ffxxllx.exe 1852 nnnnbh.exe 2896 3bhnhh.exe 1544 jjdpp.exe 624 7pdjp.exe -
resource yara_rule behavioral1/memory/2232-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1216-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/684-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2668 2232 355d59537ce6a25ff0d46ff8c54b17b0N.exe 30 PID 2232 wrote to memory of 2668 2232 355d59537ce6a25ff0d46ff8c54b17b0N.exe 30 PID 2232 wrote to memory of 2668 2232 355d59537ce6a25ff0d46ff8c54b17b0N.exe 30 PID 2232 wrote to memory of 2668 2232 355d59537ce6a25ff0d46ff8c54b17b0N.exe 30 PID 2668 wrote to memory of 2816 2668 pjjpd.exe 31 PID 2668 wrote to memory of 2816 2668 pjjpd.exe 31 PID 2668 wrote to memory of 2816 2668 pjjpd.exe 31 PID 2668 wrote to memory of 2816 2668 pjjpd.exe 31 PID 2816 wrote to memory of 2948 2816 xrfflrl.exe 32 PID 2816 wrote to memory of 2948 2816 xrfflrl.exe 32 PID 2816 wrote to memory of 2948 2816 xrfflrl.exe 32 PID 2816 wrote to memory of 2948 2816 xrfflrl.exe 32 PID 2948 wrote to memory of 2736 2948 ttttht.exe 33 PID 2948 wrote to memory of 2736 2948 ttttht.exe 33 PID 2948 wrote to memory of 2736 2948 ttttht.exe 33 PID 2948 wrote to memory of 2736 2948 ttttht.exe 33 PID 2736 wrote to memory of 2604 2736 bthntt.exe 34 PID 2736 wrote to memory of 2604 2736 bthntt.exe 34 PID 2736 wrote to memory of 2604 2736 bthntt.exe 34 PID 2736 wrote to memory of 2604 2736 bthntt.exe 34 PID 2604 wrote to memory of 2328 2604 fxrfrxr.exe 35 PID 2604 wrote to memory of 2328 2604 fxrfrxr.exe 35 PID 2604 wrote to memory of 2328 2604 fxrfrxr.exe 35 PID 2604 wrote to memory of 2328 2604 fxrfrxr.exe 35 PID 2328 wrote to memory of 2728 2328 tnbbhb.exe 36 PID 2328 wrote to memory of 2728 2328 tnbbhb.exe 36 PID 2328 wrote to memory of 2728 2328 tnbbhb.exe 36 PID 2328 wrote to memory of 2728 2328 tnbbhb.exe 36 PID 2728 wrote to memory of 2400 2728 1tntth.exe 37 PID 2728 wrote to memory of 2400 2728 1tntth.exe 37 PID 2728 wrote to memory of 2400 2728 1tntth.exe 37 PID 2728 wrote to memory of 2400 2728 1tntth.exe 37 PID 2400 wrote to memory of 2912 2400 9pjdd.exe 38 PID 2400 wrote to memory of 2912 2400 9pjdd.exe 38 PID 2400 wrote to memory of 2912 2400 9pjdd.exe 38 PID 2400 wrote to memory of 2912 2400 9pjdd.exe 38 PID 2912 wrote to memory of 2316 2912 7lxrfrf.exe 39 PID 2912 wrote to memory of 2316 2912 7lxrfrf.exe 39 PID 2912 wrote to memory of 2316 2912 7lxrfrf.exe 39 PID 2912 wrote to memory of 2316 2912 7lxrfrf.exe 39 PID 2316 wrote to memory of 1940 2316 hnthhn.exe 40 PID 2316 wrote to memory of 1940 2316 hnthhn.exe 40 PID 2316 wrote to memory of 1940 2316 hnthhn.exe 40 PID 2316 wrote to memory of 1940 2316 hnthhn.exe 40 PID 1940 wrote to memory of 308 1940 hhttbh.exe 41 PID 1940 wrote to memory of 308 1940 hhttbh.exe 41 PID 1940 wrote to memory of 308 1940 hhttbh.exe 41 PID 1940 wrote to memory of 308 1940 hhttbh.exe 41 PID 308 wrote to memory of 1056 308 dvpvj.exe 42 PID 308 wrote to memory of 1056 308 dvpvj.exe 42 PID 308 wrote to memory of 1056 308 dvpvj.exe 42 PID 308 wrote to memory of 1056 308 dvpvj.exe 42 PID 1056 wrote to memory of 1644 1056 fxflrxf.exe 43 PID 1056 wrote to memory of 1644 1056 fxflrxf.exe 43 PID 1056 wrote to memory of 1644 1056 fxflrxf.exe 43 PID 1056 wrote to memory of 1644 1056 fxflrxf.exe 43 PID 1644 wrote to memory of 1216 1644 3thnbn.exe 44 PID 1644 wrote to memory of 1216 1644 3thnbn.exe 44 PID 1644 wrote to memory of 1216 1644 3thnbn.exe 44 PID 1644 wrote to memory of 1216 1644 3thnbn.exe 44 PID 1216 wrote to memory of 2264 1216 dvpdp.exe 45 PID 1216 wrote to memory of 2264 1216 dvpdp.exe 45 PID 1216 wrote to memory of 2264 1216 dvpdp.exe 45 PID 1216 wrote to memory of 2264 1216 dvpdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\355d59537ce6a25ff0d46ff8c54b17b0N.exe"C:\Users\Admin\AppData\Local\Temp\355d59537ce6a25ff0d46ff8c54b17b0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\pjjpd.exec:\pjjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\xrfflrl.exec:\xrfflrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\ttttht.exec:\ttttht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\bthntt.exec:\bthntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\fxrfrxr.exec:\fxrfrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\tnbbhb.exec:\tnbbhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\1tntth.exec:\1tntth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\9pjdd.exec:\9pjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\7lxrfrf.exec:\7lxrfrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\hnthhn.exec:\hnthhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\hhttbh.exec:\hhttbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\dvpvj.exec:\dvpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\fxflrxf.exec:\fxflrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\3thnbn.exec:\3thnbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\dvpdp.exec:\dvpdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\vvvpd.exec:\vvvpd.exe17⤵
- Executes dropped EXE
PID:2264 -
\??\c:\flrrlrx.exec:\flrrlrx.exe18⤵
- Executes dropped EXE
PID:764 -
\??\c:\hhthtb.exec:\hhthtb.exe19⤵
- Executes dropped EXE
PID:1748 -
\??\c:\1ppvd.exec:\1ppvd.exe20⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vpjvj.exec:\vpjvj.exe21⤵
- Executes dropped EXE
PID:2188 -
\??\c:\3lxrxxf.exec:\3lxrxxf.exe22⤵
- Executes dropped EXE
PID:2360 -
\??\c:\1xrfxff.exec:\1xrfxff.exe23⤵
- Executes dropped EXE
PID:1848 -
\??\c:\btnthh.exec:\btnthh.exe24⤵
- Executes dropped EXE
PID:652 -
\??\c:\3jvjv.exec:\3jvjv.exe25⤵
- Executes dropped EXE
PID:1804 -
\??\c:\dpjjp.exec:\dpjjp.exe26⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xrlxlxf.exec:\xrlxlxf.exe27⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hbtbtb.exec:\hbtbtb.exe28⤵
- Executes dropped EXE
PID:1756 -
\??\c:\dddpp.exec:\dddpp.exe29⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jddpp.exec:\jddpp.exe30⤵
- Executes dropped EXE
PID:684 -
\??\c:\rllrxxf.exec:\rllrxxf.exe31⤵
- Executes dropped EXE
PID:860 -
\??\c:\hbnthn.exec:\hbnthn.exe32⤵
- Executes dropped EXE
PID:2208 -
\??\c:\dddpp.exec:\dddpp.exe33⤵
- Executes dropped EXE
PID:2700 -
\??\c:\3vvvv.exec:\3vvvv.exe34⤵
- Executes dropped EXE
PID:2720 -
\??\c:\7rlxlrx.exec:\7rlxlrx.exe35⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7xxfrrl.exec:\7xxfrrl.exe36⤵
- Executes dropped EXE
PID:1704 -
\??\c:\7hbntb.exec:\7hbntb.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\7nnbnb.exec:\7nnbnb.exe38⤵
- Executes dropped EXE
PID:2548 -
\??\c:\pjpvv.exec:\pjpvv.exe39⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vpdpv.exec:\vpdpv.exe40⤵
- Executes dropped EXE
PID:2600 -
\??\c:\rfxrxxl.exec:\rfxrxxl.exe41⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xrxxlrf.exec:\xrxxlrf.exe42⤵
- Executes dropped EXE
PID:864 -
\??\c:\3bthbn.exec:\3bthbn.exe43⤵
- Executes dropped EXE
PID:1516 -
\??\c:\5hnhnh.exec:\5hnhnh.exe44⤵
- Executes dropped EXE
PID:2392 -
\??\c:\pjvdp.exec:\pjvdp.exe45⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pjdjv.exec:\pjdjv.exe46⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xllfrxf.exec:\xllfrxf.exe47⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lllffrx.exec:\lllffrx.exe48⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hbtnnn.exec:\hbtnnn.exe49⤵
- Executes dropped EXE
PID:308 -
\??\c:\nhnbtb.exec:\nhnbtb.exe50⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tthntb.exec:\tthntb.exe51⤵
- Executes dropped EXE
PID:1604 -
\??\c:\dvjvv.exec:\dvjvv.exe52⤵
- Executes dropped EXE
PID:2136 -
\??\c:\fllxxrx.exec:\fllxxrx.exe53⤵
- Executes dropped EXE
PID:292 -
\??\c:\xlrxffx.exec:\xlrxffx.exe54⤵
- Executes dropped EXE
PID:912 -
\??\c:\hbhhhn.exec:\hbhhhn.exe55⤵
- Executes dropped EXE
PID:764 -
\??\c:\5bbttb.exec:\5bbttb.exe56⤵
- Executes dropped EXE
PID:1776 -
\??\c:\bhnbbn.exec:\bhnbbn.exe57⤵
- Executes dropped EXE
PID:2192 -
\??\c:\3vpjj.exec:\3vpjj.exe58⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vjvvj.exec:\vjvvj.exe59⤵
- Executes dropped EXE
PID:2228 -
\??\c:\frflxfl.exec:\frflxfl.exe60⤵
- Executes dropped EXE
PID:1300 -
\??\c:\ffxxllx.exec:\ffxxllx.exe61⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nnnnbh.exec:\nnnnbh.exe62⤵
- Executes dropped EXE
PID:1852 -
\??\c:\3bhnhh.exec:\3bhnhh.exe63⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jjdpp.exec:\jjdpp.exe64⤵
- Executes dropped EXE
PID:1544 -
\??\c:\7pdjp.exec:\7pdjp.exe65⤵
- Executes dropped EXE
PID:624 -
\??\c:\jdvvd.exec:\jdvvd.exe66⤵PID:2956
-
\??\c:\5lfxlrx.exec:\5lfxlrx.exe67⤵PID:1756
-
\??\c:\rrrfxlf.exec:\rrrfxlf.exe68⤵PID:568
-
\??\c:\1tnnbh.exec:\1tnnbh.exe69⤵PID:2632
-
\??\c:\nhttbh.exec:\nhttbh.exe70⤵PID:2636
-
\??\c:\djpdd.exec:\djpdd.exe71⤵PID:2668
-
\??\c:\ppjdd.exec:\ppjdd.exe72⤵PID:2708
-
\??\c:\lfxxflx.exec:\lfxxflx.exe73⤵PID:2812
-
\??\c:\xxflxxl.exec:\xxflxxl.exe74⤵PID:2660
-
\??\c:\btnbnn.exec:\btnbnn.exe75⤵PID:1568
-
\??\c:\hnthtn.exec:\hnthtn.exe76⤵PID:2844
-
\??\c:\dvjjp.exec:\dvjjp.exe77⤵PID:2596
-
\??\c:\dvpdd.exec:\dvpdd.exe78⤵PID:2736
-
\??\c:\7fxfflr.exec:\7fxfflr.exe79⤵PID:2628
-
\??\c:\fxrxfrx.exec:\fxrxfrx.exe80⤵PID:1100
-
\??\c:\tthnbn.exec:\tthnbn.exe81⤵PID:2728
-
\??\c:\7bhbtt.exec:\7bhbtt.exe82⤵PID:2000
-
\??\c:\jjjpv.exec:\jjjpv.exe83⤵PID:2924
-
\??\c:\ppjvv.exec:\ppjvv.exe84⤵PID:2960
-
\??\c:\3fxlfrx.exec:\3fxlfrx.exe85⤵PID:2972
-
\??\c:\1rlfrfl.exec:\1rlfrfl.exe86⤵PID:2016
-
\??\c:\tbntbb.exec:\tbntbb.exe87⤵PID:1740
-
\??\c:\3bbthh.exec:\3bbthh.exe88⤵PID:1272
-
\??\c:\jjvpj.exec:\jjvpj.exe89⤵PID:376
-
\??\c:\vpdjj.exec:\vpdjj.exe90⤵PID:1444
-
\??\c:\frrlfff.exec:\frrlfff.exe91⤵PID:1628
-
\??\c:\rrlfrxr.exec:\rrlfrxr.exe92⤵PID:1228
-
\??\c:\1nhbnt.exec:\1nhbnt.exe93⤵PID:2404
-
\??\c:\hbnnnb.exec:\hbnnnb.exe94⤵
- System Location Discovery: System Language Discovery
PID:2108 -
\??\c:\ppdvp.exec:\ppdvp.exe95⤵PID:2116
-
\??\c:\pdpjp.exec:\pdpjp.exe96⤵PID:2200
-
\??\c:\xxxxlrf.exec:\xxxxlrf.exe97⤵PID:1776
-
\??\c:\nhnhnt.exec:\nhnhnt.exe98⤵PID:2132
-
\??\c:\1hhbnb.exec:\1hhbnb.exe99⤵PID:2360
-
\??\c:\vpjpd.exec:\vpjpd.exe100⤵PID:1796
-
\??\c:\vpvvp.exec:\vpvvp.exe101⤵PID:628
-
\??\c:\1xrrxxl.exec:\1xrrxxl.exe102⤵PID:928
-
\??\c:\5flllrx.exec:\5flllrx.exe103⤵PID:1728
-
\??\c:\hhbntb.exec:\hhbntb.exe104⤵PID:1844
-
\??\c:\tnbhtt.exec:\tnbhtt.exe105⤵PID:1928
-
\??\c:\jdppv.exec:\jdppv.exe106⤵PID:1148
-
\??\c:\jdjpv.exec:\jdjpv.exe107⤵PID:1684
-
\??\c:\xxflrlf.exec:\xxflrlf.exe108⤵PID:980
-
\??\c:\lfflflr.exec:\lfflflr.exe109⤵PID:1040
-
\??\c:\bbnhnb.exec:\bbnhnb.exe110⤵PID:1044
-
\??\c:\vpdpp.exec:\vpdpp.exe111⤵PID:2240
-
\??\c:\vjddd.exec:\vjddd.exe112⤵PID:2712
-
\??\c:\lrrxrxl.exec:\lrrxrxl.exe113⤵PID:2148
-
\??\c:\9frrffl.exec:\9frrffl.exe114⤵PID:2720
-
\??\c:\nntbnt.exec:\nntbnt.exe115⤵
- System Location Discovery: System Language Discovery
PID:2716 -
\??\c:\7nntht.exec:\7nntht.exe116⤵PID:1708
-
\??\c:\hhtnbh.exec:\hhtnbh.exe117⤵PID:2696
-
\??\c:\vvjjd.exec:\vvjjd.exe118⤵PID:2548
-
\??\c:\frrfrfl.exec:\frrfrfl.exe119⤵PID:2580
-
\??\c:\lfxflxf.exec:\lfxflxf.exe120⤵PID:2600
-
\??\c:\7httbn.exec:\7httbn.exe121⤵PID:1720
-
\??\c:\5nbbnt.exec:\5nbbnt.exe122⤵PID:816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-