Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2024 06:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
70f755519abfcc428a7f683731952ce0N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
70f755519abfcc428a7f683731952ce0N.exe
-
Size
59KB
-
MD5
70f755519abfcc428a7f683731952ce0
-
SHA1
6ae39ee07e1b2e0c3334f71adeb86d8d510c5424
-
SHA256
ccc4a2857e6e4aa78beef83bd2271ad0d473cd92d703868f3b852495e35892ca
-
SHA512
7bb57e8ff496c448f0b0c7ed13da349b6e3fb8627aecac380da47b6e24c25f8a920d43fac9e54671d6fe17edf6055477087a334139f8b43d4c35c9b5fe71242a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVn9PG:ymb3NkkiQ3mdBjF0crg
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3000-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/716-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/788-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3376 rrlffff.exe 1656 tthhnn.exe 2284 bnttnt.exe 1936 jdvpp.exe 2184 flxrlll.exe 4284 flrrlll.exe 1868 hhbtnb.exe 3356 bbhhhh.exe 716 vvdvd.exe 1072 1xfxrrr.exe 3896 hnhbtt.exe 788 pjvpp.exe 5016 jdvpv.exe 2952 fffrllf.exe 2572 ttntnh.exe 3412 jddpj.exe 4088 vjpjv.exe 512 xxxrlll.exe 2920 thttnn.exe 3528 vpppp.exe 1604 vpddd.exe 1824 rflrxrr.exe 4704 llllffl.exe 4264 thtnth.exe 3400 7pvpj.exe 3160 lfrrffr.exe 1896 rlffxxx.exe 2416 1ththh.exe 5012 vpvpp.exe 3212 rflfxrl.exe 4388 hnbtnh.exe 2944 jvdvv.exe 2188 rllffff.exe 4804 lxllxrr.exe 2536 bnbbhh.exe 3768 dvvjv.exe 3656 dvvpj.exe 3748 pdjdj.exe 4452 rllxrrl.exe 3460 tttnhh.exe 2784 nbhbtb.exe 4348 rlxxfrr.exe 1716 xlxxxxx.exe 1244 btttnb.exe 884 tnbbbb.exe 5068 bbbbtn.exe 4040 vvdvd.exe 3608 vvvpj.exe 4732 lllfrrx.exe 2112 nbbbnn.exe 4564 pjjjv.exe 4784 pjjjd.exe 1252 flrrrxx.exe 5112 hhhbbt.exe 2152 1nnnhh.exe 1032 pdvdv.exe 2468 dpvpj.exe 1912 lrrlfff.exe 5000 7nbbbb.exe 100 3bbtnn.exe 2912 ppddd.exe 60 9rxrlff.exe 4048 xlxfflf.exe 3112 htbbbb.exe -
resource yara_rule behavioral2/memory/3000-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1868-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/716-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/788-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnbtn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 3376 3000 70f755519abfcc428a7f683731952ce0N.exe 85 PID 3000 wrote to memory of 3376 3000 70f755519abfcc428a7f683731952ce0N.exe 85 PID 3000 wrote to memory of 3376 3000 70f755519abfcc428a7f683731952ce0N.exe 85 PID 3376 wrote to memory of 1656 3376 rrlffff.exe 86 PID 3376 wrote to memory of 1656 3376 rrlffff.exe 86 PID 3376 wrote to memory of 1656 3376 rrlffff.exe 86 PID 1656 wrote to memory of 2284 1656 tthhnn.exe 87 PID 1656 wrote to memory of 2284 1656 tthhnn.exe 87 PID 1656 wrote to memory of 2284 1656 tthhnn.exe 87 PID 2284 wrote to memory of 1936 2284 bnttnt.exe 88 PID 2284 wrote to memory of 1936 2284 bnttnt.exe 88 PID 2284 wrote to memory of 1936 2284 bnttnt.exe 88 PID 1936 wrote to memory of 2184 1936 jdvpp.exe 89 PID 1936 wrote to memory of 2184 1936 jdvpp.exe 89 PID 1936 wrote to memory of 2184 1936 jdvpp.exe 89 PID 2184 wrote to memory of 4284 2184 flxrlll.exe 90 PID 2184 wrote to memory of 4284 2184 flxrlll.exe 90 PID 2184 wrote to memory of 4284 2184 flxrlll.exe 90 PID 4284 wrote to memory of 1868 4284 flrrlll.exe 91 PID 4284 wrote to memory of 1868 4284 flrrlll.exe 91 PID 4284 wrote to memory of 1868 4284 flrrlll.exe 91 PID 1868 wrote to memory of 3356 1868 hhbtnb.exe 92 PID 1868 wrote to memory of 3356 1868 hhbtnb.exe 92 PID 1868 wrote to memory of 3356 1868 hhbtnb.exe 92 PID 3356 wrote to memory of 716 3356 bbhhhh.exe 93 PID 3356 wrote to memory of 716 3356 bbhhhh.exe 93 PID 3356 wrote to memory of 716 3356 bbhhhh.exe 93 PID 716 wrote to memory of 1072 716 vvdvd.exe 94 PID 716 wrote to memory of 1072 716 vvdvd.exe 94 PID 716 wrote to memory of 1072 716 vvdvd.exe 94 PID 1072 wrote to memory of 3896 1072 1xfxrrr.exe 95 PID 1072 wrote to memory of 3896 1072 1xfxrrr.exe 95 PID 1072 wrote to memory of 3896 1072 1xfxrrr.exe 95 PID 3896 wrote to memory of 788 3896 hnhbtt.exe 96 PID 3896 wrote to memory of 788 3896 hnhbtt.exe 96 PID 3896 wrote to memory of 788 3896 hnhbtt.exe 96 PID 788 wrote to memory of 5016 788 pjvpp.exe 97 PID 788 wrote to memory of 5016 788 pjvpp.exe 97 PID 788 wrote to memory of 5016 788 pjvpp.exe 97 PID 5016 wrote to memory of 2952 5016 jdvpv.exe 98 PID 5016 wrote to memory of 2952 5016 jdvpv.exe 98 PID 5016 wrote to memory of 2952 5016 jdvpv.exe 98 PID 2952 wrote to memory of 2572 2952 fffrllf.exe 99 PID 2952 wrote to memory of 2572 2952 fffrllf.exe 99 PID 2952 wrote to memory of 2572 2952 fffrllf.exe 99 PID 2572 wrote to memory of 3412 2572 ttntnh.exe 100 PID 2572 wrote to memory of 3412 2572 ttntnh.exe 100 PID 2572 wrote to memory of 3412 2572 ttntnh.exe 100 PID 3412 wrote to memory of 4088 3412 jddpj.exe 102 PID 3412 wrote to memory of 4088 3412 jddpj.exe 102 PID 3412 wrote to memory of 4088 3412 jddpj.exe 102 PID 4088 wrote to memory of 512 4088 vjpjv.exe 103 PID 4088 wrote to memory of 512 4088 vjpjv.exe 103 PID 4088 wrote to memory of 512 4088 vjpjv.exe 103 PID 512 wrote to memory of 2920 512 xxxrlll.exe 104 PID 512 wrote to memory of 2920 512 xxxrlll.exe 104 PID 512 wrote to memory of 2920 512 xxxrlll.exe 104 PID 2920 wrote to memory of 3528 2920 thttnn.exe 105 PID 2920 wrote to memory of 3528 2920 thttnn.exe 105 PID 2920 wrote to memory of 3528 2920 thttnn.exe 105 PID 3528 wrote to memory of 1604 3528 vpppp.exe 107 PID 3528 wrote to memory of 1604 3528 vpppp.exe 107 PID 3528 wrote to memory of 1604 3528 vpppp.exe 107 PID 1604 wrote to memory of 1824 1604 vpddd.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\70f755519abfcc428a7f683731952ce0N.exe"C:\Users\Admin\AppData\Local\Temp\70f755519abfcc428a7f683731952ce0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\rrlffff.exec:\rrlffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\tthhnn.exec:\tthhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\bnttnt.exec:\bnttnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\jdvpp.exec:\jdvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\flxrlll.exec:\flxrlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\flrrlll.exec:\flrrlll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\hhbtnb.exec:\hhbtnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\bbhhhh.exec:\bbhhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\vvdvd.exec:\vvdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\1xfxrrr.exec:\1xfxrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\hnhbtt.exec:\hnhbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\pjvpp.exec:\pjvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\jdvpv.exec:\jdvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\fffrllf.exec:\fffrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ttntnh.exec:\ttntnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\jddpj.exec:\jddpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\vjpjv.exec:\vjpjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\xxxrlll.exec:\xxxrlll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\thttnn.exec:\thttnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\vpppp.exec:\vpppp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\vpddd.exec:\vpddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\rflrxrr.exec:\rflrxrr.exe23⤵
- Executes dropped EXE
PID:1824 -
\??\c:\llllffl.exec:\llllffl.exe24⤵
- Executes dropped EXE
PID:4704 -
\??\c:\thtnth.exec:\thtnth.exe25⤵
- Executes dropped EXE
PID:4264 -
\??\c:\7pvpj.exec:\7pvpj.exe26⤵
- Executes dropped EXE
PID:3400 -
\??\c:\lfrrffr.exec:\lfrrffr.exe27⤵
- Executes dropped EXE
PID:3160 -
\??\c:\rlffxxx.exec:\rlffxxx.exe28⤵
- Executes dropped EXE
PID:1896 -
\??\c:\1ththh.exec:\1ththh.exe29⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vpvpp.exec:\vpvpp.exe30⤵
- Executes dropped EXE
PID:5012 -
\??\c:\rflfxrl.exec:\rflfxrl.exe31⤵
- Executes dropped EXE
PID:3212 -
\??\c:\hnbtnh.exec:\hnbtnh.exe32⤵
- Executes dropped EXE
PID:4388 -
\??\c:\jvdvv.exec:\jvdvv.exe33⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rllffff.exec:\rllffff.exe34⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lxllxrr.exec:\lxllxrr.exe35⤵
- Executes dropped EXE
PID:4804 -
\??\c:\bnbbhh.exec:\bnbbhh.exe36⤵
- Executes dropped EXE
PID:2536 -
\??\c:\dvvjv.exec:\dvvjv.exe37⤵
- Executes dropped EXE
PID:3768 -
\??\c:\dvvpj.exec:\dvvpj.exe38⤵
- Executes dropped EXE
PID:3656 -
\??\c:\pdjdj.exec:\pdjdj.exe39⤵
- Executes dropped EXE
PID:3748 -
\??\c:\rllxrrl.exec:\rllxrrl.exe40⤵
- Executes dropped EXE
PID:4452 -
\??\c:\tttnhh.exec:\tttnhh.exe41⤵
- Executes dropped EXE
PID:3460 -
\??\c:\nbhbtb.exec:\nbhbtb.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2784 -
\??\c:\rlxxfrr.exec:\rlxxfrr.exe43⤵
- Executes dropped EXE
PID:4348 -
\??\c:\xlxxxxx.exec:\xlxxxxx.exe44⤵
- Executes dropped EXE
PID:1716 -
\??\c:\btttnb.exec:\btttnb.exe45⤵
- Executes dropped EXE
PID:1244 -
\??\c:\tnbbbb.exec:\tnbbbb.exe46⤵
- Executes dropped EXE
PID:884 -
\??\c:\bbbbtn.exec:\bbbbtn.exe47⤵
- Executes dropped EXE
PID:5068 -
\??\c:\vvdvd.exec:\vvdvd.exe48⤵
- Executes dropped EXE
PID:4040 -
\??\c:\vvvpj.exec:\vvvpj.exe49⤵
- Executes dropped EXE
PID:3608 -
\??\c:\lllfrrx.exec:\lllfrrx.exe50⤵
- Executes dropped EXE
PID:4732 -
\??\c:\nbbbnn.exec:\nbbbnn.exe51⤵
- Executes dropped EXE
PID:2112 -
\??\c:\pjjjv.exec:\pjjjv.exe52⤵
- Executes dropped EXE
PID:4564 -
\??\c:\pjjjd.exec:\pjjjd.exe53⤵
- Executes dropped EXE
PID:4784 -
\??\c:\flrrrxx.exec:\flrrrxx.exe54⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hhhbbt.exec:\hhhbbt.exe55⤵
- Executes dropped EXE
PID:5112 -
\??\c:\1nnnhh.exec:\1nnnhh.exe56⤵
- Executes dropped EXE
PID:2152 -
\??\c:\pdvdv.exec:\pdvdv.exe57⤵
- Executes dropped EXE
PID:1032 -
\??\c:\dpvpj.exec:\dpvpj.exe58⤵
- Executes dropped EXE
PID:2468 -
\??\c:\lrrlfff.exec:\lrrlfff.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1912 -
\??\c:\7nbbbb.exec:\7nbbbb.exe60⤵
- Executes dropped EXE
PID:5000 -
\??\c:\3bbtnn.exec:\3bbtnn.exe61⤵
- Executes dropped EXE
PID:100 -
\??\c:\ppddd.exec:\ppddd.exe62⤵
- Executes dropped EXE
PID:2912 -
\??\c:\9rxrlff.exec:\9rxrlff.exe63⤵
- Executes dropped EXE
PID:60 -
\??\c:\xlxfflf.exec:\xlxfflf.exe64⤵
- Executes dropped EXE
PID:4048 -
\??\c:\htbbbb.exec:\htbbbb.exe65⤵
- Executes dropped EXE
PID:3112 -
\??\c:\5jddv.exec:\5jddv.exe66⤵PID:2640
-
\??\c:\jjjdv.exec:\jjjdv.exe67⤵PID:2380
-
\??\c:\xxfxlff.exec:\xxfxlff.exe68⤵PID:4088
-
\??\c:\ttnhbn.exec:\ttnhbn.exe69⤵PID:2688
-
\??\c:\tttnht.exec:\tttnht.exe70⤵PID:1944
-
\??\c:\dppjv.exec:\dppjv.exe71⤵PID:1388
-
\??\c:\rllfrrl.exec:\rllfrrl.exe72⤵PID:2292
-
\??\c:\xxlflfl.exec:\xxlflfl.exe73⤵PID:2936
-
\??\c:\btbhtb.exec:\btbhtb.exe74⤵PID:656
-
\??\c:\nhhhhh.exec:\nhhhhh.exe75⤵PID:2116
-
\??\c:\9pjjv.exec:\9pjjv.exe76⤵PID:3136
-
\??\c:\dvppj.exec:\dvppj.exe77⤵PID:4292
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe78⤵PID:4012
-
\??\c:\5fflrxf.exec:\5fflrxf.exe79⤵PID:1560
-
\??\c:\htbhtb.exec:\htbhtb.exe80⤵PID:1896
-
\??\c:\tnhbtt.exec:\tnhbtt.exe81⤵PID:3504
-
\??\c:\dvddd.exec:\dvddd.exe82⤵PID:2416
-
\??\c:\3ntnhh.exec:\3ntnhh.exe83⤵PID:4884
-
\??\c:\9hnhth.exec:\9hnhth.exe84⤵PID:1224
-
\??\c:\3dpdd.exec:\3dpdd.exe85⤵PID:1784
-
\??\c:\jvvvp.exec:\jvvvp.exe86⤵PID:1900
-
\??\c:\xrfxllr.exec:\xrfxllr.exe87⤵PID:3280
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe88⤵PID:1624
-
\??\c:\1ntnnn.exec:\1ntnnn.exe89⤵PID:4556
-
\??\c:\bbhbtt.exec:\bbhbtt.exe90⤵PID:2788
-
\??\c:\vppjj.exec:\vppjj.exe91⤵PID:4840
-
\??\c:\pppjd.exec:\pppjd.exe92⤵PID:1904
-
\??\c:\lffxllr.exec:\lffxllr.exe93⤵PID:2024
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe94⤵PID:3620
-
\??\c:\5bbbtn.exec:\5bbbtn.exe95⤵PID:1344
-
\??\c:\btbtbt.exec:\btbtbt.exe96⤵PID:2668
-
\??\c:\9pppd.exec:\9pppd.exe97⤵PID:3000
-
\??\c:\jdjdv.exec:\jdjdv.exe98⤵PID:4808
-
\??\c:\xrxrfff.exec:\xrxrfff.exe99⤵PID:1444
-
\??\c:\1lfffff.exec:\1lfffff.exe100⤵PID:3444
-
\??\c:\bttnhh.exec:\bttnhh.exe101⤵PID:2284
-
\??\c:\nbtnnb.exec:\nbtnnb.exe102⤵PID:4208
-
\??\c:\1vdjd.exec:\1vdjd.exe103⤵PID:2312
-
\??\c:\rrrxxxx.exec:\rrrxxxx.exe104⤵PID:2332
-
\??\c:\xxffxxx.exec:\xxffxxx.exe105⤵PID:2112
-
\??\c:\hhhhhb.exec:\hhhhhb.exe106⤵PID:4816
-
\??\c:\vvvpj.exec:\vvvpj.exe107⤵PID:1060
-
\??\c:\ppppj.exec:\ppppj.exe108⤵PID:1948
-
\??\c:\5rfxlxx.exec:\5rfxlxx.exe109⤵PID:4216
-
\??\c:\xlfxxxx.exec:\xlfxxxx.exe110⤵PID:716
-
\??\c:\nbbttt.exec:\nbbttt.exe111⤵PID:808
-
\??\c:\btttnh.exec:\btttnh.exe112⤵PID:1072
-
\??\c:\vjvvp.exec:\vjvvp.exe113⤵PID:2060
-
\??\c:\xrrlffx.exec:\xrrlffx.exe114⤵PID:3240
-
\??\c:\llrrxxl.exec:\llrrxxl.exe115⤵PID:1492
-
\??\c:\nhbbbt.exec:\nhbbbt.exe116⤵PID:2088
-
\??\c:\jppjd.exec:\jppjd.exe117⤵PID:4180
-
\??\c:\5pvpj.exec:\5pvpj.exe118⤵PID:4048
-
\??\c:\ffrlffx.exec:\ffrlffx.exe119⤵PID:3112
-
\??\c:\lfllrrl.exec:\lfllrrl.exe120⤵PID:1316
-
\??\c:\frxxxxr.exec:\frxxxxr.exe121⤵PID:4652
-
\??\c:\1bnnnt.exec:\1bnnnt.exe122⤵PID:1852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-