Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
28/08/2024, 19:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f.exe
Resource
win7-20240705-en
6 signatures
150 seconds
General
-
Target
23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f.exe
-
Size
67KB
-
MD5
1a4da2ba9f5b2b15ab3de99e89333d9f
-
SHA1
db7776e58f808c76ccf76f8738251f41ea990bdd
-
SHA256
23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f
-
SHA512
cdadea79c73fa43fe0c2bf106be3dac42079a54abe04da3a3749bb132607f0ce680fb8a33d2725922ae5907351de6ac1d3d35fcc551363ddad1cc92d258a24a1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAcp:ymb3NkkiQ3mdBjFIsIVcp
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2648-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-22-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/800-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/556-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1164-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2684 hbnnth.exe 2748 7pdjp.exe 2588 3bhtnh.exe 2816 hbhntb.exe 2564 rlxfllx.exe 3044 fxflxfr.exe 2792 ppjvp.exe 800 dvddv.exe 2532 xrffllx.exe 2100 1tnntt.exe 1816 dvpjp.exe 1040 jdpdv.exe 600 fxxffrx.exe 2860 9bbhtb.exe 2020 btbhnn.exe 1496 ddvvj.exe 580 ffxxxfr.exe 2240 xxrflrf.exe 896 hbntnn.exe 1764 jjdvp.exe 1936 pjjpd.exe 556 rrlxxfl.exe 1044 tnthnt.exe 692 3tnbnn.exe 1552 pdpjp.exe 2528 xxxfrlx.exe 2972 lxrrrrr.exe 1868 1hbbbb.exe 1164 pvvpj.exe 2352 9fxllll.exe 1588 bbbhnb.exe 1172 bthhtn.exe 2808 dvppd.exe 2916 lffxlrf.exe 2720 xxrffrr.exe 2572 dvvdd.exe 2632 vpvdj.exe 2396 llflrfr.exe 2200 xrxrxfl.exe 840 rlffrxl.exe 1744 nnbhnt.exe 1060 djvdv.exe 2196 pjjpv.exe 2768 rrlrffl.exe 1736 xxlrffr.exe 1656 7tnnbb.exe 756 jjdjv.exe 2852 5jvvj.exe 1412 rrlrffx.exe 2860 rlrflxf.exe 2020 btbntn.exe 2276 tnhnnb.exe 2228 jjjpd.exe 2004 vvpdv.exe 2116 fxllxfr.exe 2364 xrlxllf.exe 2332 tthnbh.exe 1404 bbbhnt.exe 304 jdjjp.exe 1996 ddpjp.exe 2976 lxrxxfr.exe 1804 7rxfrrx.exe 2324 nnbnhh.exe 3024 bththn.exe -
resource yara_rule behavioral1/memory/2648-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-309-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2684 2648 23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f.exe 30 PID 2648 wrote to memory of 2684 2648 23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f.exe 30 PID 2648 wrote to memory of 2684 2648 23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f.exe 30 PID 2648 wrote to memory of 2684 2648 23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f.exe 30 PID 2684 wrote to memory of 2748 2684 hbnnth.exe 31 PID 2684 wrote to memory of 2748 2684 hbnnth.exe 31 PID 2684 wrote to memory of 2748 2684 hbnnth.exe 31 PID 2684 wrote to memory of 2748 2684 hbnnth.exe 31 PID 2748 wrote to memory of 2588 2748 7pdjp.exe 32 PID 2748 wrote to memory of 2588 2748 7pdjp.exe 32 PID 2748 wrote to memory of 2588 2748 7pdjp.exe 32 PID 2748 wrote to memory of 2588 2748 7pdjp.exe 32 PID 2588 wrote to memory of 2816 2588 3bhtnh.exe 33 PID 2588 wrote to memory of 2816 2588 3bhtnh.exe 33 PID 2588 wrote to memory of 2816 2588 3bhtnh.exe 33 PID 2588 wrote to memory of 2816 2588 3bhtnh.exe 33 PID 2816 wrote to memory of 2564 2816 hbhntb.exe 34 PID 2816 wrote to memory of 2564 2816 hbhntb.exe 34 PID 2816 wrote to memory of 2564 2816 hbhntb.exe 34 PID 2816 wrote to memory of 2564 2816 hbhntb.exe 34 PID 2564 wrote to memory of 3044 2564 rlxfllx.exe 35 PID 2564 wrote to memory of 3044 2564 rlxfllx.exe 35 PID 2564 wrote to memory of 3044 2564 rlxfllx.exe 35 PID 2564 wrote to memory of 3044 2564 rlxfllx.exe 35 PID 3044 wrote to memory of 2792 3044 fxflxfr.exe 36 PID 3044 wrote to memory of 2792 3044 fxflxfr.exe 36 PID 3044 wrote to memory of 2792 3044 fxflxfr.exe 36 PID 3044 wrote to memory of 2792 3044 fxflxfr.exe 36 PID 2792 wrote to memory of 800 2792 ppjvp.exe 37 PID 2792 wrote to memory of 800 2792 ppjvp.exe 37 PID 2792 wrote to memory of 800 2792 ppjvp.exe 37 PID 2792 wrote to memory of 800 2792 ppjvp.exe 37 PID 800 wrote to memory of 2532 800 dvddv.exe 38 PID 800 wrote to memory of 2532 800 dvddv.exe 38 PID 800 wrote to memory of 2532 800 dvddv.exe 38 PID 800 wrote to memory of 2532 800 dvddv.exe 38 PID 2532 wrote to memory of 2100 2532 xrffllx.exe 39 PID 2532 wrote to memory of 2100 2532 xrffllx.exe 39 PID 2532 wrote to memory of 2100 2532 xrffllx.exe 39 PID 2532 wrote to memory of 2100 2532 xrffllx.exe 39 PID 2100 wrote to memory of 1816 2100 1tnntt.exe 40 PID 2100 wrote to memory of 1816 2100 1tnntt.exe 40 PID 2100 wrote to memory of 1816 2100 1tnntt.exe 40 PID 2100 wrote to memory of 1816 2100 1tnntt.exe 40 PID 1816 wrote to memory of 1040 1816 dvpjp.exe 41 PID 1816 wrote to memory of 1040 1816 dvpjp.exe 41 PID 1816 wrote to memory of 1040 1816 dvpjp.exe 41 PID 1816 wrote to memory of 1040 1816 dvpjp.exe 41 PID 1040 wrote to memory of 600 1040 jdpdv.exe 42 PID 1040 wrote to memory of 600 1040 jdpdv.exe 42 PID 1040 wrote to memory of 600 1040 jdpdv.exe 42 PID 1040 wrote to memory of 600 1040 jdpdv.exe 42 PID 600 wrote to memory of 2860 600 fxxffrx.exe 43 PID 600 wrote to memory of 2860 600 fxxffrx.exe 43 PID 600 wrote to memory of 2860 600 fxxffrx.exe 43 PID 600 wrote to memory of 2860 600 fxxffrx.exe 43 PID 2860 wrote to memory of 2020 2860 9bbhtb.exe 44 PID 2860 wrote to memory of 2020 2860 9bbhtb.exe 44 PID 2860 wrote to memory of 2020 2860 9bbhtb.exe 44 PID 2860 wrote to memory of 2020 2860 9bbhtb.exe 44 PID 2020 wrote to memory of 1496 2020 btbhnn.exe 45 PID 2020 wrote to memory of 1496 2020 btbhnn.exe 45 PID 2020 wrote to memory of 1496 2020 btbhnn.exe 45 PID 2020 wrote to memory of 1496 2020 btbhnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f.exe"C:\Users\Admin\AppData\Local\Temp\23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hbnnth.exec:\hbnnth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\7pdjp.exec:\7pdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\3bhtnh.exec:\3bhtnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\hbhntb.exec:\hbhntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\rlxfllx.exec:\rlxfllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\fxflxfr.exec:\fxflxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\ppjvp.exec:\ppjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\dvddv.exec:\dvddv.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\xrffllx.exec:\xrffllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\1tnntt.exec:\1tnntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\dvpjp.exec:\dvpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\jdpdv.exec:\jdpdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\fxxffrx.exec:\fxxffrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\9bbhtb.exec:\9bbhtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\btbhnn.exec:\btbhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\ddvvj.exec:\ddvvj.exe17⤵
- Executes dropped EXE
PID:1496 -
\??\c:\ffxxxfr.exec:\ffxxxfr.exe18⤵
- Executes dropped EXE
PID:580 -
\??\c:\xxrflrf.exec:\xxrflrf.exe19⤵
- Executes dropped EXE
PID:2240 -
\??\c:\hbntnn.exec:\hbntnn.exe20⤵
- Executes dropped EXE
PID:896 -
\??\c:\jjdvp.exec:\jjdvp.exe21⤵
- Executes dropped EXE
PID:1764 -
\??\c:\pjjpd.exec:\pjjpd.exe22⤵
- Executes dropped EXE
PID:1936 -
\??\c:\rrlxxfl.exec:\rrlxxfl.exe23⤵
- Executes dropped EXE
PID:556 -
\??\c:\tnthnt.exec:\tnthnt.exe24⤵
- Executes dropped EXE
PID:1044 -
\??\c:\3tnbnn.exec:\3tnbnn.exe25⤵
- Executes dropped EXE
PID:692 -
\??\c:\pdpjp.exec:\pdpjp.exe26⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xxxfrlx.exec:\xxxfrlx.exe27⤵
- Executes dropped EXE
PID:2528 -
\??\c:\lxrrrrr.exec:\lxrrrrr.exe28⤵
- Executes dropped EXE
PID:2972 -
\??\c:\1hbbbb.exec:\1hbbbb.exe29⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pvvpj.exec:\pvvpj.exe30⤵
- Executes dropped EXE
PID:1164 -
\??\c:\9fxllll.exec:\9fxllll.exe31⤵
- Executes dropped EXE
PID:2352 -
\??\c:\bbbhnb.exec:\bbbhnb.exe32⤵
- Executes dropped EXE
PID:1588 -
\??\c:\bthhtn.exec:\bthhtn.exe33⤵
- Executes dropped EXE
PID:1172 -
\??\c:\dvppd.exec:\dvppd.exe34⤵
- Executes dropped EXE
PID:2808 -
\??\c:\lffxlrf.exec:\lffxlrf.exe35⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xxrffrr.exec:\xxrffrr.exe36⤵
- Executes dropped EXE
PID:2720 -
\??\c:\dvvdd.exec:\dvvdd.exe37⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vpvdj.exec:\vpvdj.exe38⤵
- Executes dropped EXE
PID:2632 -
\??\c:\llflrfr.exec:\llflrfr.exe39⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xrxrxfl.exec:\xrxrxfl.exe40⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rlffrxl.exec:\rlffrxl.exe41⤵
- Executes dropped EXE
PID:840 -
\??\c:\nnbhnt.exec:\nnbhnt.exe42⤵
- Executes dropped EXE
PID:1744 -
\??\c:\djvdv.exec:\djvdv.exe43⤵
- Executes dropped EXE
PID:1060 -
\??\c:\pjjpv.exec:\pjjpv.exe44⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rrlrffl.exec:\rrlrffl.exe45⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xxlrffr.exec:\xxlrffr.exe46⤵
- Executes dropped EXE
PID:1736 -
\??\c:\7tnnbb.exec:\7tnnbb.exe47⤵
- Executes dropped EXE
PID:1656 -
\??\c:\jjdjv.exec:\jjdjv.exe48⤵
- Executes dropped EXE
PID:756 -
\??\c:\5jvvj.exec:\5jvvj.exe49⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rrlrffx.exec:\rrlrffx.exe50⤵
- Executes dropped EXE
PID:1412 -
\??\c:\rlrflxf.exec:\rlrflxf.exe51⤵
- Executes dropped EXE
PID:2860 -
\??\c:\btbntn.exec:\btbntn.exe52⤵
- Executes dropped EXE
PID:2020 -
\??\c:\tnhnnb.exec:\tnhnnb.exe53⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jjjpd.exec:\jjjpd.exe54⤵
- Executes dropped EXE
PID:2228 -
\??\c:\vvpdv.exec:\vvpdv.exe55⤵
- Executes dropped EXE
PID:2004 -
\??\c:\fxllxfr.exec:\fxllxfr.exe56⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xrlxllf.exec:\xrlxllf.exe57⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tthnbh.exec:\tthnbh.exe58⤵
- Executes dropped EXE
PID:2332 -
\??\c:\bbbhnt.exec:\bbbhnt.exe59⤵
- Executes dropped EXE
PID:1404 -
\??\c:\jdjjp.exec:\jdjjp.exe60⤵
- Executes dropped EXE
PID:304 -
\??\c:\ddpjp.exec:\ddpjp.exe61⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lxrxxfr.exec:\lxrxxfr.exe62⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7rxfrrx.exec:\7rxfrrx.exe63⤵
- Executes dropped EXE
PID:1804 -
\??\c:\nnbnhh.exec:\nnbnhh.exe64⤵
- Executes dropped EXE
PID:2324 -
\??\c:\bththn.exec:\bththn.exe65⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5dvvj.exec:\5dvvj.exe66⤵PID:348
-
\??\c:\jjpvd.exec:\jjpvd.exe67⤵PID:1724
-
\??\c:\7xxfrfl.exec:\7xxfrfl.exe68⤵PID:1728
-
\??\c:\llxfllx.exec:\llxfllx.exe69⤵PID:3064
-
\??\c:\bttbhh.exec:\bttbhh.exe70⤵
- System Location Discovery: System Language Discovery
PID:1608 -
\??\c:\tnbhhh.exec:\tnbhhh.exe71⤵PID:1776
-
\??\c:\vjppd.exec:\vjppd.exe72⤵PID:2096
-
\??\c:\ppvvd.exec:\ppvvd.exe73⤵PID:1172
-
\??\c:\3xrlrrx.exec:\3xrlrrx.exe74⤵PID:2820
-
\??\c:\tntbbb.exec:\tntbbb.exe75⤵PID:2824
-
\??\c:\1nbbbb.exec:\1nbbbb.exe76⤵PID:2720
-
\??\c:\jdvpj.exec:\jdvpj.exe77⤵PID:1524
-
\??\c:\1jvdj.exec:\1jvdj.exe78⤵PID:2632
-
\??\c:\fxlfrxf.exec:\fxlfrxf.exe79⤵PID:1644
-
\??\c:\7xrfrxl.exec:\7xrfrxl.exe80⤵PID:3004
-
\??\c:\nhbbnt.exec:\nhbbnt.exe81⤵PID:552
-
\??\c:\vjjpv.exec:\vjjpv.exe82⤵PID:344
-
\??\c:\1ppdj.exec:\1ppdj.exe83⤵PID:2236
-
\??\c:\3fxlrrx.exec:\3fxlrrx.exe84⤵PID:2196
-
\??\c:\5lrfllr.exec:\5lrfllr.exe85⤵PID:2156
-
\??\c:\5ttntt.exec:\5ttntt.exe86⤵PID:1736
-
\??\c:\vjpvv.exec:\vjpvv.exe87⤵PID:1492
-
\??\c:\jjjjp.exec:\jjjjp.exe88⤵PID:600
-
\??\c:\frlrrll.exec:\frlrrll.exe89⤵PID:2336
-
\??\c:\tnhnbb.exec:\tnhnbb.exe90⤵PID:1412
-
\??\c:\hbtbbn.exec:\hbtbbn.exe91⤵PID:2860
-
\??\c:\dvjvd.exec:\dvjvd.exe92⤵PID:1092
-
\??\c:\pdjdp.exec:\pdjdp.exe93⤵PID:2276
-
\??\c:\7xfflxx.exec:\7xfflxx.exe94⤵PID:2128
-
\??\c:\lrflflf.exec:\lrflflf.exe95⤵PID:2004
-
\??\c:\btntbt.exec:\btntbt.exe96⤵PID:1536
-
\??\c:\bthntb.exec:\bthntb.exe97⤵PID:2364
-
\??\c:\dpddj.exec:\dpddj.exe98⤵PID:1936
-
\??\c:\9jppv.exec:\9jppv.exe99⤵PID:1404
-
\??\c:\ffxfrfl.exec:\ffxfrfl.exe100⤵PID:1044
-
\??\c:\nhbbbb.exec:\nhbbbb.exe101⤵PID:1996
-
\??\c:\tnbhhn.exec:\tnbhhn.exe102⤵PID:1156
-
\??\c:\bbntnn.exec:\bbntnn.exe103⤵PID:2980
-
\??\c:\pjdvp.exec:\pjdvp.exe104⤵PID:2168
-
\??\c:\dddvp.exec:\dddvp.exe105⤵PID:3024
-
\??\c:\9lflxxf.exec:\9lflxxf.exe106⤵PID:892
-
\??\c:\3bthbb.exec:\3bthbb.exe107⤵PID:1724
-
\??\c:\hbntbb.exec:\hbntbb.exe108⤵PID:2664
-
\??\c:\vppjv.exec:\vppjv.exe109⤵PID:2784
-
\??\c:\ppddd.exec:\ppddd.exe110⤵PID:2796
-
\??\c:\rlfrrlx.exec:\rlfrrlx.exe111⤵PID:1776
-
\??\c:\rfrrrxr.exec:\rfrrrxr.exe112⤵PID:2096
-
\??\c:\tbhhnn.exec:\tbhhnn.exe113⤵PID:1172
-
\??\c:\7nbttn.exec:\7nbttn.exe114⤵PID:2600
-
\??\c:\ddpvd.exec:\ddpvd.exe115⤵PID:2824
-
\??\c:\dpdvv.exec:\dpdvv.exe116⤵PID:2568
-
\??\c:\7lfflrx.exec:\7lfflrx.exe117⤵PID:1524
-
\??\c:\3flffrl.exec:\3flffrl.exe118⤵PID:1660
-
\??\c:\tntnhh.exec:\tntnhh.exe119⤵PID:1644
-
\??\c:\nbnntt.exec:\nbnntt.exe120⤵PID:3004
-
\??\c:\ppddj.exec:\ppddj.exe121⤵PID:2948
-
\??\c:\9jddp.exec:\9jddp.exe122⤵PID:800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-