Analysis
-
max time kernel
150s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-08-2024 19:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
192a878f4c5354a6e99045e71380f8b632f63df32f5973a5b198ad7c3ecfa95f.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
General
-
Target
192a878f4c5354a6e99045e71380f8b632f63df32f5973a5b198ad7c3ecfa95f.exe
-
Size
56KB
-
MD5
2b61bddc27abfd9f5f94e0187881f47f
-
SHA1
188e85435737d7f91ac3357e591b5281d6d40b13
-
SHA256
192a878f4c5354a6e99045e71380f8b632f63df32f5973a5b198ad7c3ecfa95f
-
SHA512
9dd609a28898720bb16786cafa7e5c6bea6e16b0f3b9cd4bd9aa18e814122e0189808ffae991cf2de6b869451aac9d03564edd79c1c03cecfd5cd10b28cd6e0b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIYgEWX:ymb3NkkiQ3mdBjFI3EWX
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/628-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-56-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2224 7nnnhh.exe 5112 nbhnhh.exe 1384 dvdvj.exe 2608 jdddd.exe 4616 rfffxff.exe 4900 7htntb.exe 5012 nttnnn.exe 4912 jdjdp.exe 2612 vpdvd.exe 3256 xxxllrr.exe 1192 nhthbh.exe 4556 3vjjp.exe 3320 7jpjj.exe 2552 xxfxxxx.exe 3676 3thhbb.exe 4612 bhbthh.exe 4052 jjdvd.exe 2296 rrxfffx.exe 4648 llllfff.exe 3108 bthhhb.exe 4184 pdjjd.exe 2548 jvvpd.exe 3048 lrfxrrl.exe 748 nbhnnn.exe 2780 nnnnnt.exe 2152 vdjjp.exe 2720 9djpj.exe 1920 xfffxxr.exe 4312 1nhthb.exe 3804 5pvvd.exe 4872 jjjpp.exe 3472 rrrlffx.exe 4168 fllfffx.exe 3988 nhntbh.exe 4288 tttbtt.exe 4788 nnnttb.exe 860 dvppp.exe 3892 pdjpd.exe 1440 lxxrffr.exe 2580 lxxxlfx.exe 1808 3nnhhb.exe 5052 dvddv.exe 4124 jjddd.exe 2496 rlrxrlr.exe 4908 frxrxxr.exe 1772 nhtnhb.exe 4504 vjppp.exe 3544 1pvvj.exe 4428 rlrfffx.exe 3348 lffxfff.exe 4148 bhhbtt.exe 2288 pvvvp.exe 312 3jppd.exe 2464 5lrlfff.exe 5084 nttnhh.exe 1552 jdppj.exe 2240 rxxxrxr.exe 4260 5rrrlxr.exe 3484 hbhhbb.exe 4008 btnhbb.exe 1212 ddvpj.exe 1516 1fffrrl.exe 3408 rlfrfxl.exe 1624 htbtnh.exe -
resource yara_rule behavioral2/memory/628-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1192-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2552-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-189-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 628 wrote to memory of 2224 628 192a878f4c5354a6e99045e71380f8b632f63df32f5973a5b198ad7c3ecfa95f.exe 86 PID 628 wrote to memory of 2224 628 192a878f4c5354a6e99045e71380f8b632f63df32f5973a5b198ad7c3ecfa95f.exe 86 PID 628 wrote to memory of 2224 628 192a878f4c5354a6e99045e71380f8b632f63df32f5973a5b198ad7c3ecfa95f.exe 86 PID 2224 wrote to memory of 5112 2224 7nnnhh.exe 87 PID 2224 wrote to memory of 5112 2224 7nnnhh.exe 87 PID 2224 wrote to memory of 5112 2224 7nnnhh.exe 87 PID 5112 wrote to memory of 1384 5112 nbhnhh.exe 88 PID 5112 wrote to memory of 1384 5112 nbhnhh.exe 88 PID 5112 wrote to memory of 1384 5112 nbhnhh.exe 88 PID 1384 wrote to memory of 2608 1384 dvdvj.exe 89 PID 1384 wrote to memory of 2608 1384 dvdvj.exe 89 PID 1384 wrote to memory of 2608 1384 dvdvj.exe 89 PID 2608 wrote to memory of 4616 2608 jdddd.exe 90 PID 2608 wrote to memory of 4616 2608 jdddd.exe 90 PID 2608 wrote to memory of 4616 2608 jdddd.exe 90 PID 4616 wrote to memory of 4900 4616 rfffxff.exe 91 PID 4616 wrote to memory of 4900 4616 rfffxff.exe 91 PID 4616 wrote to memory of 4900 4616 rfffxff.exe 91 PID 4900 wrote to memory of 5012 4900 7htntb.exe 92 PID 4900 wrote to memory of 5012 4900 7htntb.exe 92 PID 4900 wrote to memory of 5012 4900 7htntb.exe 92 PID 5012 wrote to memory of 4912 5012 nttnnn.exe 93 PID 5012 wrote to memory of 4912 5012 nttnnn.exe 93 PID 5012 wrote to memory of 4912 5012 nttnnn.exe 93 PID 4912 wrote to memory of 2612 4912 jdjdp.exe 94 PID 4912 wrote to memory of 2612 4912 jdjdp.exe 94 PID 4912 wrote to memory of 2612 4912 jdjdp.exe 94 PID 2612 wrote to memory of 3256 2612 vpdvd.exe 95 PID 2612 wrote to memory of 3256 2612 vpdvd.exe 95 PID 2612 wrote to memory of 3256 2612 vpdvd.exe 95 PID 3256 wrote to memory of 1192 3256 xxxllrr.exe 96 PID 3256 wrote to memory of 1192 3256 xxxllrr.exe 96 PID 3256 wrote to memory of 1192 3256 xxxllrr.exe 96 PID 1192 wrote to memory of 4556 1192 nhthbh.exe 97 PID 1192 wrote to memory of 4556 1192 nhthbh.exe 97 PID 1192 wrote to memory of 4556 1192 nhthbh.exe 97 PID 4556 wrote to memory of 3320 4556 3vjjp.exe 98 PID 4556 wrote to memory of 3320 4556 3vjjp.exe 98 PID 4556 wrote to memory of 3320 4556 3vjjp.exe 98 PID 3320 wrote to memory of 2552 3320 7jpjj.exe 99 PID 3320 wrote to memory of 2552 3320 7jpjj.exe 99 PID 3320 wrote to memory of 2552 3320 7jpjj.exe 99 PID 2552 wrote to memory of 3676 2552 xxfxxxx.exe 100 PID 2552 wrote to memory of 3676 2552 xxfxxxx.exe 100 PID 2552 wrote to memory of 3676 2552 xxfxxxx.exe 100 PID 3676 wrote to memory of 4612 3676 3thhbb.exe 101 PID 3676 wrote to memory of 4612 3676 3thhbb.exe 101 PID 3676 wrote to memory of 4612 3676 3thhbb.exe 101 PID 4612 wrote to memory of 4052 4612 bhbthh.exe 102 PID 4612 wrote to memory of 4052 4612 bhbthh.exe 102 PID 4612 wrote to memory of 4052 4612 bhbthh.exe 102 PID 4052 wrote to memory of 2296 4052 jjdvd.exe 103 PID 4052 wrote to memory of 2296 4052 jjdvd.exe 103 PID 4052 wrote to memory of 2296 4052 jjdvd.exe 103 PID 2296 wrote to memory of 4648 2296 rrxfffx.exe 104 PID 2296 wrote to memory of 4648 2296 rrxfffx.exe 104 PID 2296 wrote to memory of 4648 2296 rrxfffx.exe 104 PID 4648 wrote to memory of 3108 4648 llllfff.exe 105 PID 4648 wrote to memory of 3108 4648 llllfff.exe 105 PID 4648 wrote to memory of 3108 4648 llllfff.exe 105 PID 3108 wrote to memory of 4184 3108 bthhhb.exe 106 PID 3108 wrote to memory of 4184 3108 bthhhb.exe 106 PID 3108 wrote to memory of 4184 3108 bthhhb.exe 106 PID 4184 wrote to memory of 2548 4184 pdjjd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\192a878f4c5354a6e99045e71380f8b632f63df32f5973a5b198ad7c3ecfa95f.exe"C:\Users\Admin\AppData\Local\Temp\192a878f4c5354a6e99045e71380f8b632f63df32f5973a5b198ad7c3ecfa95f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\7nnnhh.exec:\7nnnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\nbhnhh.exec:\nbhnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\dvdvj.exec:\dvdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\jdddd.exec:\jdddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\rfffxff.exec:\rfffxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\7htntb.exec:\7htntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\nttnnn.exec:\nttnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\jdjdp.exec:\jdjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\vpdvd.exec:\vpdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\xxxllrr.exec:\xxxllrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\nhthbh.exec:\nhthbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\3vjjp.exec:\3vjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\7jpjj.exec:\7jpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\3thhbb.exec:\3thhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\bhbthh.exec:\bhbthh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\jjdvd.exec:\jjdvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\rrxfffx.exec:\rrxfffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\llllfff.exec:\llllfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\bthhhb.exec:\bthhhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\pdjjd.exec:\pdjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\jvvpd.exec:\jvvpd.exe23⤵
- Executes dropped EXE
PID:2548 -
\??\c:\lrfxrrl.exec:\lrfxrrl.exe24⤵
- Executes dropped EXE
PID:3048 -
\??\c:\nbhnnn.exec:\nbhnnn.exe25⤵
- Executes dropped EXE
PID:748 -
\??\c:\nnnnnt.exec:\nnnnnt.exe26⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vdjjp.exec:\vdjjp.exe27⤵
- Executes dropped EXE
PID:2152 -
\??\c:\9djpj.exec:\9djpj.exe28⤵
- Executes dropped EXE
PID:2720 -
\??\c:\xfffxxr.exec:\xfffxxr.exe29⤵
- Executes dropped EXE
PID:1920 -
\??\c:\1nhthb.exec:\1nhthb.exe30⤵
- Executes dropped EXE
PID:4312 -
\??\c:\5pvvd.exec:\5pvvd.exe31⤵
- Executes dropped EXE
PID:3804 -
\??\c:\jjjpp.exec:\jjjpp.exe32⤵
- Executes dropped EXE
PID:4872 -
\??\c:\rrrlffx.exec:\rrrlffx.exe33⤵
- Executes dropped EXE
PID:3472 -
\??\c:\fllfffx.exec:\fllfffx.exe34⤵
- Executes dropped EXE
PID:4168 -
\??\c:\nhntbh.exec:\nhntbh.exe35⤵
- Executes dropped EXE
PID:3988 -
\??\c:\tttbtt.exec:\tttbtt.exe36⤵
- Executes dropped EXE
PID:4288 -
\??\c:\nnnttb.exec:\nnnttb.exe37⤵
- Executes dropped EXE
PID:4788 -
\??\c:\dvppp.exec:\dvppp.exe38⤵
- Executes dropped EXE
PID:860 -
\??\c:\pdjpd.exec:\pdjpd.exe39⤵
- Executes dropped EXE
PID:3892 -
\??\c:\lxxrffr.exec:\lxxrffr.exe40⤵
- Executes dropped EXE
PID:1440 -
\??\c:\lxxxlfx.exec:\lxxxlfx.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\3nnhhb.exec:\3nnhhb.exe42⤵
- Executes dropped EXE
PID:1808 -
\??\c:\dvddv.exec:\dvddv.exe43⤵
- Executes dropped EXE
PID:5052 -
\??\c:\jjddd.exec:\jjddd.exe44⤵
- Executes dropped EXE
PID:4124 -
\??\c:\rlrxrlr.exec:\rlrxrlr.exe45⤵
- Executes dropped EXE
PID:2496 -
\??\c:\frxrxxr.exec:\frxrxxr.exe46⤵
- Executes dropped EXE
PID:4908 -
\??\c:\nhtnhb.exec:\nhtnhb.exe47⤵
- Executes dropped EXE
PID:1772 -
\??\c:\vjppp.exec:\vjppp.exe48⤵
- Executes dropped EXE
PID:4504 -
\??\c:\1pvvj.exec:\1pvvj.exe49⤵
- Executes dropped EXE
PID:3544 -
\??\c:\rlrfffx.exec:\rlrfffx.exe50⤵
- Executes dropped EXE
PID:4428 -
\??\c:\lffxfff.exec:\lffxfff.exe51⤵
- Executes dropped EXE
PID:3348 -
\??\c:\bhhbtt.exec:\bhhbtt.exe52⤵
- Executes dropped EXE
PID:4148 -
\??\c:\pvvvp.exec:\pvvvp.exe53⤵
- Executes dropped EXE
PID:2288 -
\??\c:\3jppd.exec:\3jppd.exe54⤵
- Executes dropped EXE
PID:312 -
\??\c:\5lrlfff.exec:\5lrlfff.exe55⤵
- Executes dropped EXE
PID:2464 -
\??\c:\nttnhh.exec:\nttnhh.exe56⤵
- Executes dropped EXE
PID:5084 -
\??\c:\jdppj.exec:\jdppj.exe57⤵
- Executes dropped EXE
PID:1552 -
\??\c:\rxxxrxr.exec:\rxxxrxr.exe58⤵
- Executes dropped EXE
PID:2240 -
\??\c:\5rrrlxr.exec:\5rrrlxr.exe59⤵
- Executes dropped EXE
PID:4260 -
\??\c:\hbhhbb.exec:\hbhhbb.exe60⤵
- Executes dropped EXE
PID:3484 -
\??\c:\btnhbb.exec:\btnhbb.exe61⤵
- Executes dropped EXE
PID:4008 -
\??\c:\ddvpj.exec:\ddvpj.exe62⤵
- Executes dropped EXE
PID:1212 -
\??\c:\1fffrrl.exec:\1fffrrl.exe63⤵
- Executes dropped EXE
PID:1516 -
\??\c:\rlfrfxl.exec:\rlfrfxl.exe64⤵
- Executes dropped EXE
PID:3408 -
\??\c:\htbtnh.exec:\htbtnh.exe65⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5vvpj.exec:\5vvpj.exe66⤵PID:760
-
\??\c:\9ffxrll.exec:\9ffxrll.exe67⤵PID:2008
-
\??\c:\btnbbb.exec:\btnbbb.exe68⤵PID:404
-
\??\c:\bbnnbb.exec:\bbnnbb.exe69⤵PID:1040
-
\??\c:\lxlffrl.exec:\lxlffrl.exe70⤵PID:3964
-
\??\c:\7rrrllf.exec:\7rrrllf.exe71⤵PID:4740
-
\??\c:\hhhbtt.exec:\hhhbtt.exe72⤵PID:4884
-
\??\c:\bntnbh.exec:\bntnbh.exe73⤵PID:2340
-
\??\c:\vvpjp.exec:\vvpjp.exe74⤵PID:2688
-
\??\c:\3pvpp.exec:\3pvpp.exe75⤵PID:3576
-
\??\c:\lffxflr.exec:\lffxflr.exe76⤵PID:3520
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe77⤵PID:400
-
\??\c:\nhtnhh.exec:\nhtnhh.exe78⤵PID:4508
-
\??\c:\9btbtt.exec:\9btbtt.exe79⤵PID:2484
-
\??\c:\5ppjv.exec:\5ppjv.exe80⤵PID:1800
-
\??\c:\jvpjv.exec:\jvpjv.exe81⤵PID:4760
-
\??\c:\9rllxlx.exec:\9rllxlx.exe82⤵PID:3440
-
\??\c:\rrfxrlr.exec:\rrfxrlr.exe83⤵PID:1644
-
\??\c:\7nntnn.exec:\7nntnn.exe84⤵PID:512
-
\??\c:\5dddp.exec:\5dddp.exe85⤵PID:4188
-
\??\c:\ddjdj.exec:\ddjdj.exe86⤵PID:2224
-
\??\c:\dvpvp.exec:\dvpvp.exe87⤵PID:3112
-
\??\c:\5bhbnt.exec:\5bhbnt.exe88⤵PID:4660
-
\??\c:\btbthh.exec:\btbthh.exe89⤵
- System Location Discovery: System Language Discovery
PID:5112 -
\??\c:\dddvd.exec:\dddvd.exe90⤵PID:1908
-
\??\c:\rrffrlf.exec:\rrffrlf.exe91⤵PID:3420
-
\??\c:\nhntnt.exec:\nhntnt.exe92⤵PID:3704
-
\??\c:\hbbbnb.exec:\hbbbnb.exe93⤵PID:3876
-
\??\c:\7dppj.exec:\7dppj.exe94⤵PID:3532
-
\??\c:\dpvpj.exec:\dpvpj.exe95⤵PID:1500
-
\??\c:\9rxfxrx.exec:\9rxfxrx.exe96⤵PID:4412
-
\??\c:\hthbtb.exec:\hthbtb.exe97⤵PID:4368
-
\??\c:\thhbtn.exec:\thhbtn.exe98⤵PID:2872
-
\??\c:\jpdvd.exec:\jpdvd.exe99⤵PID:2160
-
\??\c:\lrrlffl.exec:\lrrlffl.exe100⤵PID:2640
-
\??\c:\5xxrrrf.exec:\5xxrrrf.exe101⤵PID:2760
-
\??\c:\btbnbb.exec:\btbnbb.exe102⤵PID:3676
-
\??\c:\pppjd.exec:\pppjd.exe103⤵PID:2724
-
\??\c:\3vpjv.exec:\3vpjv.exe104⤵PID:2860
-
\??\c:\5rrfxxr.exec:\5rrfxxr.exe105⤵PID:5056
-
\??\c:\nnhbnh.exec:\nnhbnh.exe106⤵PID:1632
-
\??\c:\7nnhbb.exec:\7nnhbb.exe107⤵PID:5096
-
\??\c:\vvvpj.exec:\vvvpj.exe108⤵PID:5116
-
\??\c:\jddvp.exec:\jddvp.exe109⤵PID:1624
-
\??\c:\rlrlrll.exec:\rlrlrll.exe110⤵PID:3612
-
\??\c:\xxrlxff.exec:\xxrlxff.exe111⤵PID:2636
-
\??\c:\flrffff.exec:\flrffff.exe112⤵PID:2588
-
\??\c:\5btttt.exec:\5btttt.exe113⤵PID:1504
-
\??\c:\btbbhh.exec:\btbbhh.exe114⤵PID:4372
-
\??\c:\7dvpj.exec:\7dvpj.exe115⤵PID:3180
-
\??\c:\1jjdd.exec:\1jjdd.exe116⤵PID:3368
-
\??\c:\ffllrll.exec:\ffllrll.exe117⤵PID:4816
-
\??\c:\lflfllr.exec:\lflfllr.exe118⤵PID:1836
-
\??\c:\bbhbhh.exec:\bbhbhh.exe119⤵PID:3708
-
\??\c:\ntbhtn.exec:\ntbhtn.exe120⤵PID:4252
-
\??\c:\jddvp.exec:\jddvp.exe121⤵PID:864
-
\??\c:\1pjjv.exec:\1pjjv.exe122⤵PID:4800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-