Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 10:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e50533859ca55a55d8ff04fef9a29aa0N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
e50533859ca55a55d8ff04fef9a29aa0N.exe
-
Size
72KB
-
MD5
e50533859ca55a55d8ff04fef9a29aa0
-
SHA1
4723e05d6d7cf792f7b5ebe85e020cde355206ac
-
SHA256
7545aba7687d5c465dec70e9c61000db7394a1e59312172e398afad322e50a9b
-
SHA512
e62d0f11fd1f871691bea4b68d71b78f421fee32f17f27604ae65274d4fac0f169f00ee19b4542500369913f1c3ae61d4366aa50963be7c69c3af93ec0e4d769
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjM:ymb3NkkiQ3mdBjFI4V8
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1984-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1288-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1288-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/304-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1128-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/828-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1288-1343-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1288 1lfrlrf.exe 2468 hnhhbh.exe 2684 jdvjd.exe 2772 lrfrfrl.exe 2800 jvvdj.exe 1632 dvpdv.exe 2556 hbnhhn.exe 2448 5thtnb.exe 1248 vdppj.exe 1784 lrfxxxf.exe 304 hhtthn.exe 2316 1tnntb.exe 1712 llflrfr.exe 1516 7llrrxr.exe 2792 ttttnt.exe 1128 jjjdp.exe 2856 9vvpd.exe 1936 rrflxlx.exe 2140 tnbttn.exe 1696 bhntbt.exe 2656 dvvvd.exe 828 pppdp.exe 1648 9fxxflr.exe 1704 bhhbbt.exe 1752 dppvv.exe 3000 5vpjv.exe 2412 fxrxxxl.exe 1208 ttnnth.exe 2352 3hhbth.exe 2460 jjdpv.exe 2464 rrrrlrr.exe 3064 nhnbht.exe 2788 djvpp.exe 1440 jjjpv.exe 2908 rlllxfr.exe 2584 xrrxllf.exe 2828 bbthnn.exe 2508 ttbbnn.exe 2576 vvvdp.exe 2992 pvpdv.exe 2632 5dvdp.exe 1480 xxlrflf.exe 2616 lfrrxxl.exe 304 nthnht.exe 1088 vvpdv.exe 572 jdvjd.exe 1576 dvpvd.exe 1724 rrxfxfl.exe 1740 ffflxlx.exe 2112 nnbtht.exe 1128 tbnbhb.exe 2144 jjpvd.exe 2100 ppdpd.exe 1396 1xxfxfl.exe 2176 xrlrxxl.exe 1696 bbbnth.exe 952 thhnbh.exe 1044 ppjvj.exe 2924 jjdpj.exe 2008 xfxlrlx.exe 1320 lrxrrxf.exe 1752 hhbbht.exe 2516 bnnntb.exe 556 1vvjj.exe -
resource yara_rule behavioral1/memory/1984-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1128-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/828-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-305-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-1343-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1288 1984 e50533859ca55a55d8ff04fef9a29aa0N.exe 31 PID 1984 wrote to memory of 1288 1984 e50533859ca55a55d8ff04fef9a29aa0N.exe 31 PID 1984 wrote to memory of 1288 1984 e50533859ca55a55d8ff04fef9a29aa0N.exe 31 PID 1984 wrote to memory of 1288 1984 e50533859ca55a55d8ff04fef9a29aa0N.exe 31 PID 1288 wrote to memory of 2468 1288 1lfrlrf.exe 32 PID 1288 wrote to memory of 2468 1288 1lfrlrf.exe 32 PID 1288 wrote to memory of 2468 1288 1lfrlrf.exe 32 PID 1288 wrote to memory of 2468 1288 1lfrlrf.exe 32 PID 2468 wrote to memory of 2684 2468 hnhhbh.exe 33 PID 2468 wrote to memory of 2684 2468 hnhhbh.exe 33 PID 2468 wrote to memory of 2684 2468 hnhhbh.exe 33 PID 2468 wrote to memory of 2684 2468 hnhhbh.exe 33 PID 2684 wrote to memory of 2772 2684 jdvjd.exe 34 PID 2684 wrote to memory of 2772 2684 jdvjd.exe 34 PID 2684 wrote to memory of 2772 2684 jdvjd.exe 34 PID 2684 wrote to memory of 2772 2684 jdvjd.exe 34 PID 2772 wrote to memory of 2800 2772 lrfrfrl.exe 35 PID 2772 wrote to memory of 2800 2772 lrfrfrl.exe 35 PID 2772 wrote to memory of 2800 2772 lrfrfrl.exe 35 PID 2772 wrote to memory of 2800 2772 lrfrfrl.exe 35 PID 2800 wrote to memory of 1632 2800 jvvdj.exe 36 PID 2800 wrote to memory of 1632 2800 jvvdj.exe 36 PID 2800 wrote to memory of 1632 2800 jvvdj.exe 36 PID 2800 wrote to memory of 1632 2800 jvvdj.exe 36 PID 1632 wrote to memory of 2556 1632 dvpdv.exe 37 PID 1632 wrote to memory of 2556 1632 dvpdv.exe 37 PID 1632 wrote to memory of 2556 1632 dvpdv.exe 37 PID 1632 wrote to memory of 2556 1632 dvpdv.exe 37 PID 2556 wrote to memory of 2448 2556 hbnhhn.exe 38 PID 2556 wrote to memory of 2448 2556 hbnhhn.exe 38 PID 2556 wrote to memory of 2448 2556 hbnhhn.exe 38 PID 2556 wrote to memory of 2448 2556 hbnhhn.exe 38 PID 2448 wrote to memory of 1248 2448 5thtnb.exe 39 PID 2448 wrote to memory of 1248 2448 5thtnb.exe 39 PID 2448 wrote to memory of 1248 2448 5thtnb.exe 39 PID 2448 wrote to memory of 1248 2448 5thtnb.exe 39 PID 1248 wrote to memory of 1784 1248 vdppj.exe 40 PID 1248 wrote to memory of 1784 1248 vdppj.exe 40 PID 1248 wrote to memory of 1784 1248 vdppj.exe 40 PID 1248 wrote to memory of 1784 1248 vdppj.exe 40 PID 1784 wrote to memory of 304 1784 lrfxxxf.exe 41 PID 1784 wrote to memory of 304 1784 lrfxxxf.exe 41 PID 1784 wrote to memory of 304 1784 lrfxxxf.exe 41 PID 1784 wrote to memory of 304 1784 lrfxxxf.exe 41 PID 304 wrote to memory of 2316 304 hhtthn.exe 42 PID 304 wrote to memory of 2316 304 hhtthn.exe 42 PID 304 wrote to memory of 2316 304 hhtthn.exe 42 PID 304 wrote to memory of 2316 304 hhtthn.exe 42 PID 2316 wrote to memory of 1712 2316 1tnntb.exe 43 PID 2316 wrote to memory of 1712 2316 1tnntb.exe 43 PID 2316 wrote to memory of 1712 2316 1tnntb.exe 43 PID 2316 wrote to memory of 1712 2316 1tnntb.exe 43 PID 1712 wrote to memory of 1516 1712 llflrfr.exe 44 PID 1712 wrote to memory of 1516 1712 llflrfr.exe 44 PID 1712 wrote to memory of 1516 1712 llflrfr.exe 44 PID 1712 wrote to memory of 1516 1712 llflrfr.exe 44 PID 1516 wrote to memory of 2792 1516 7llrrxr.exe 45 PID 1516 wrote to memory of 2792 1516 7llrrxr.exe 45 PID 1516 wrote to memory of 2792 1516 7llrrxr.exe 45 PID 1516 wrote to memory of 2792 1516 7llrrxr.exe 45 PID 2792 wrote to memory of 1128 2792 ttttnt.exe 46 PID 2792 wrote to memory of 1128 2792 ttttnt.exe 46 PID 2792 wrote to memory of 1128 2792 ttttnt.exe 46 PID 2792 wrote to memory of 1128 2792 ttttnt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e50533859ca55a55d8ff04fef9a29aa0N.exe"C:\Users\Admin\AppData\Local\Temp\e50533859ca55a55d8ff04fef9a29aa0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\1lfrlrf.exec:\1lfrlrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\hnhhbh.exec:\hnhhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\jdvjd.exec:\jdvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\lrfrfrl.exec:\lrfrfrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\jvvdj.exec:\jvvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\dvpdv.exec:\dvpdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\hbnhhn.exec:\hbnhhn.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\5thtnb.exec:\5thtnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\vdppj.exec:\vdppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\lrfxxxf.exec:\lrfxxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\hhtthn.exec:\hhtthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
\??\c:\1tnntb.exec:\1tnntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\llflrfr.exec:\llflrfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\7llrrxr.exec:\7llrrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\ttttnt.exec:\ttttnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jjjdp.exec:\jjjdp.exe17⤵
- Executes dropped EXE
PID:1128 -
\??\c:\9vvpd.exec:\9vvpd.exe18⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rrflxlx.exec:\rrflxlx.exe19⤵
- Executes dropped EXE
PID:1936 -
\??\c:\tnbttn.exec:\tnbttn.exe20⤵
- Executes dropped EXE
PID:2140 -
\??\c:\bhntbt.exec:\bhntbt.exe21⤵
- Executes dropped EXE
PID:1696 -
\??\c:\dvvvd.exec:\dvvvd.exe22⤵
- Executes dropped EXE
PID:2656 -
\??\c:\pppdp.exec:\pppdp.exe23⤵
- Executes dropped EXE
PID:828 -
\??\c:\9fxxflr.exec:\9fxxflr.exe24⤵
- Executes dropped EXE
PID:1648 -
\??\c:\bhhbbt.exec:\bhhbbt.exe25⤵
- Executes dropped EXE
PID:1704 -
\??\c:\dppvv.exec:\dppvv.exe26⤵
- Executes dropped EXE
PID:1752 -
\??\c:\5vpjv.exec:\5vpjv.exe27⤵
- Executes dropped EXE
PID:3000 -
\??\c:\fxrxxxl.exec:\fxrxxxl.exe28⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ttnnth.exec:\ttnnth.exe29⤵
- Executes dropped EXE
PID:1208 -
\??\c:\3hhbth.exec:\3hhbth.exe30⤵
- Executes dropped EXE
PID:2352 -
\??\c:\jjdpv.exec:\jjdpv.exe31⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rrrrlrr.exec:\rrrrlrr.exe32⤵
- Executes dropped EXE
PID:2464 -
\??\c:\nhnbht.exec:\nhnbht.exe33⤵
- Executes dropped EXE
PID:3064 -
\??\c:\djvpp.exec:\djvpp.exe34⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jjjpv.exec:\jjjpv.exe35⤵
- Executes dropped EXE
PID:1440 -
\??\c:\rlllxfr.exec:\rlllxfr.exe36⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xrrxllf.exec:\xrrxllf.exe37⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bbthnn.exec:\bbthnn.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\ttbbnn.exec:\ttbbnn.exe39⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vvvdp.exec:\vvvdp.exe40⤵
- Executes dropped EXE
PID:2576 -
\??\c:\pvpdv.exec:\pvpdv.exe41⤵
- Executes dropped EXE
PID:2992 -
\??\c:\5dvdp.exec:\5dvdp.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xxlrflf.exec:\xxlrflf.exe43⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nthnht.exec:\nthnht.exe45⤵
- Executes dropped EXE
PID:304 -
\??\c:\vvpdv.exec:\vvpdv.exe46⤵
- Executes dropped EXE
PID:1088 -
\??\c:\jdvjd.exec:\jdvjd.exe47⤵
- Executes dropped EXE
PID:572 -
\??\c:\dvpvd.exec:\dvpvd.exe48⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rrxfxfl.exec:\rrxfxfl.exe49⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ffflxlx.exec:\ffflxlx.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1740 -
\??\c:\nnbtht.exec:\nnbtht.exe51⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tbnbhb.exec:\tbnbhb.exe52⤵
- Executes dropped EXE
PID:1128 -
\??\c:\jjpvd.exec:\jjpvd.exe53⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ppdpd.exec:\ppdpd.exe54⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1xxfxfl.exec:\1xxfxfl.exe55⤵
- Executes dropped EXE
PID:1396 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe56⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bbbnth.exec:\bbbnth.exe57⤵
- Executes dropped EXE
PID:1696 -
\??\c:\thhnbh.exec:\thhnbh.exe58⤵
- Executes dropped EXE
PID:952 -
\??\c:\ppjvj.exec:\ppjvj.exe59⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jjdpj.exec:\jjdpj.exe60⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xfxlrlx.exec:\xfxlrlx.exe61⤵
- Executes dropped EXE
PID:2008 -
\??\c:\lrxrrxf.exec:\lrxrrxf.exe62⤵
- Executes dropped EXE
PID:1320 -
\??\c:\hhbbht.exec:\hhbbht.exe63⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bnnntb.exec:\bnnntb.exe64⤵
- Executes dropped EXE
PID:2516 -
\??\c:\1vvjj.exec:\1vvjj.exe65⤵
- Executes dropped EXE
PID:556 -
\??\c:\7vpvp.exec:\7vpvp.exe66⤵PID:2068
-
\??\c:\frrrfll.exec:\frrrfll.exe67⤵PID:1748
-
\??\c:\btthtt.exec:\btthtt.exe68⤵PID:1216
-
\??\c:\bbthht.exec:\bbthht.exe69⤵PID:2460
-
\??\c:\7ppvj.exec:\7ppvj.exe70⤵PID:1588
-
\??\c:\jjjdv.exec:\jjjdv.exe71⤵PID:2784
-
\??\c:\1ffxfll.exec:\1ffxfll.exe72⤵PID:2080
-
\??\c:\rffrfrl.exec:\rffrfrl.exe73⤵PID:2700
-
\??\c:\9nnhnn.exec:\9nnhnn.exe74⤵PID:1440
-
\??\c:\vpjdv.exec:\vpjdv.exe75⤵PID:2908
-
\??\c:\vpjpd.exec:\vpjpd.exe76⤵PID:2584
-
\??\c:\lllflrf.exec:\lllflrf.exe77⤵PID:2868
-
\??\c:\9rrlxrl.exec:\9rrlxrl.exe78⤵PID:2508
-
\??\c:\hbbnbb.exec:\hbbnbb.exe79⤵PID:2820
-
\??\c:\nnhthn.exec:\nnhthn.exe80⤵PID:2992
-
\??\c:\5ddvp.exec:\5ddvp.exe81⤵PID:1728
-
\??\c:\lffxrlf.exec:\lffxrlf.exe82⤵PID:2544
-
\??\c:\lrllxfr.exec:\lrllxfr.exe83⤵PID:1192
-
\??\c:\nhbhtb.exec:\nhbhtb.exe84⤵PID:304
-
\??\c:\bthhth.exec:\bthhth.exe85⤵PID:1948
-
\??\c:\vppvp.exec:\vppvp.exe86⤵PID:572
-
\??\c:\3ddpd.exec:\3ddpd.exe87⤵PID:1692
-
\??\c:\rrlrrxl.exec:\rrlrrxl.exe88⤵PID:1724
-
\??\c:\hnhtbn.exec:\hnhtbn.exe89⤵PID:2864
-
\??\c:\hhthtt.exec:\hhthtt.exe90⤵PID:2112
-
\??\c:\djjpv.exec:\djjpv.exe91⤵PID:2872
-
\??\c:\vppdp.exec:\vppdp.exe92⤵PID:2144
-
\??\c:\lfrfxlf.exec:\lfrfxlf.exe93⤵PID:2100
-
\??\c:\3flxxxr.exec:\3flxxxr.exe94⤵PID:1396
-
\??\c:\7hnhtb.exec:\7hnhtb.exe95⤵PID:2176
-
\??\c:\hbhbbn.exec:\hbhbbn.exe96⤵PID:1964
-
\??\c:\vpvpj.exec:\vpvpj.exe97⤵PID:2392
-
\??\c:\3flxfxr.exec:\3flxfxr.exe98⤵PID:1044
-
\??\c:\rrrrlrf.exec:\rrrrlrf.exe99⤵PID:2924
-
\??\c:\hnhhbn.exec:\hnhhbn.exe100⤵PID:1824
-
\??\c:\nnhtht.exec:\nnhtht.exe101⤵PID:1320
-
\??\c:\ddvdd.exec:\ddvdd.exe102⤵PID:1752
-
\??\c:\jjdjj.exec:\jjdjj.exe103⤵PID:2516
-
\??\c:\lrrlxxx.exec:\lrrlxxx.exe104⤵PID:556
-
\??\c:\3llfrfr.exec:\3llfrfr.exe105⤵PID:2352
-
\??\c:\tnhnhb.exec:\tnhnhb.exe106⤵PID:2952
-
\??\c:\jjjdd.exec:\jjjdd.exe107⤵PID:1216
-
\??\c:\pjdjj.exec:\pjdjj.exe108⤵PID:2460
-
\??\c:\rfxlxxr.exec:\rfxlxxr.exe109⤵PID:1968
-
\??\c:\lffxlxl.exec:\lffxlxl.exe110⤵PID:2784
-
\??\c:\hthttt.exec:\hthttt.exe111⤵PID:2080
-
\??\c:\vjvpp.exec:\vjvpp.exe112⤵PID:2700
-
\??\c:\pppjd.exec:\pppjd.exe113⤵PID:2800
-
\??\c:\9flxrrf.exec:\9flxrrf.exe114⤵PID:2908
-
\??\c:\hbtbbn.exec:\hbtbbn.exe115⤵PID:2552
-
\??\c:\hhbnhh.exec:\hhbnhh.exe116⤵PID:2868
-
\??\c:\jjpdd.exec:\jjpdd.exe117⤵PID:2588
-
\??\c:\5lfxflr.exec:\5lfxflr.exe118⤵PID:2820
-
\??\c:\xxxrxlx.exec:\xxxrxlx.exe119⤵PID:2992
-
\??\c:\7ttbtb.exec:\7ttbtb.exe120⤵PID:1728
-
\??\c:\hhhtnb.exec:\hhhtnb.exe121⤵PID:2544
-
\??\c:\ppjjj.exec:\ppjjj.exe122⤵PID:2084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-