Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 12:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3cc0161c3315a0543ab5e41115c04350N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
3cc0161c3315a0543ab5e41115c04350N.exe
-
Size
95KB
-
MD5
3cc0161c3315a0543ab5e41115c04350
-
SHA1
9ee499677f85d00e0447928b32b25b39d52ea693
-
SHA256
4dd5ea80d4a250be080593e7b76e4b6a8e747a62f824a740694122614c4ced32
-
SHA512
b8e2bbd07dff358eb8715d4d3ad244fba3c511adf16a3e1f9b920b99154bb955e935865e18a9260f38ce02e2d9e408d971b51a7727e6d8312762d2741181392c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLuePjDYlZMzcLF:ymb3NkkiQ3mdBjFoLucjD7cp
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2424-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1148-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/804-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1732 bbtbnh.exe 2696 vvpvv.exe 1148 xxxflrf.exe 2576 pjjvd.exe 2816 ddpjv.exe 2828 llfrfrl.exe 3028 bhhttn.exe 2748 lllxlxr.exe 2644 bnnhnn.exe 2172 vpjvd.exe 2672 lllxlxx.exe 1640 xxxrlfx.exe 2868 3bntnt.exe 804 pvvpj.exe 2944 pjdjj.exe 536 ffrxfrf.exe 1992 xxlxlxl.exe 2652 nntttb.exe 2708 pppdd.exe 1720 vdvpd.exe 2064 lllfrlf.exe 1520 ntntnt.exe 2136 7httnb.exe 1108 jjpjj.exe 1344 tttnbn.exe 1212 9tnnbn.exe 2512 ppvjd.exe 2584 vvvvj.exe 896 rxlrrxr.exe 1876 5hbnhh.exe 1724 pvpjj.exe 2416 vpjvp.exe 2420 3lrrlrl.exe 1452 bbtbbb.exe 1608 hnnbht.exe 2716 vddjj.exe 2796 vvjdd.exe 2812 llflxlx.exe 2744 llrllxl.exe 2912 nnnbth.exe 2640 nnhnhh.exe 1744 vpppd.exe 2684 7ddvp.exe 2524 flfrrfr.exe 2124 flrllxx.exe 2544 hhbhbn.exe 2600 1thbhb.exe 588 7djvj.exe 2888 pjjvv.exe 1168 xlflrrx.exe 2928 9rfrlff.exe 1064 9bthht.exe 2004 7ddpj.exe 1988 7pvdp.exe 2332 xxxlfrl.exe 1244 rxxfrff.exe 1976 tttbnb.exe 2012 bbnhhb.exe 2128 jjjjp.exe 352 pjvvd.exe 1796 ffrllrf.exe 1620 xxfrlxr.exe 1708 tnbhtt.exe 1084 jjvvj.exe -
resource yara_rule behavioral1/memory/2424-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1148-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/804-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-274-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2424 wrote to memory of 1732 2424 3cc0161c3315a0543ab5e41115c04350N.exe 30 PID 2424 wrote to memory of 1732 2424 3cc0161c3315a0543ab5e41115c04350N.exe 30 PID 2424 wrote to memory of 1732 2424 3cc0161c3315a0543ab5e41115c04350N.exe 30 PID 2424 wrote to memory of 1732 2424 3cc0161c3315a0543ab5e41115c04350N.exe 30 PID 1732 wrote to memory of 2696 1732 bbtbnh.exe 31 PID 1732 wrote to memory of 2696 1732 bbtbnh.exe 31 PID 1732 wrote to memory of 2696 1732 bbtbnh.exe 31 PID 1732 wrote to memory of 2696 1732 bbtbnh.exe 31 PID 2696 wrote to memory of 1148 2696 vvpvv.exe 32 PID 2696 wrote to memory of 1148 2696 vvpvv.exe 32 PID 2696 wrote to memory of 1148 2696 vvpvv.exe 32 PID 2696 wrote to memory of 1148 2696 vvpvv.exe 32 PID 1148 wrote to memory of 2576 1148 xxxflrf.exe 33 PID 1148 wrote to memory of 2576 1148 xxxflrf.exe 33 PID 1148 wrote to memory of 2576 1148 xxxflrf.exe 33 PID 1148 wrote to memory of 2576 1148 xxxflrf.exe 33 PID 2576 wrote to memory of 2816 2576 pjjvd.exe 34 PID 2576 wrote to memory of 2816 2576 pjjvd.exe 34 PID 2576 wrote to memory of 2816 2576 pjjvd.exe 34 PID 2576 wrote to memory of 2816 2576 pjjvd.exe 34 PID 2816 wrote to memory of 2828 2816 ddpjv.exe 35 PID 2816 wrote to memory of 2828 2816 ddpjv.exe 35 PID 2816 wrote to memory of 2828 2816 ddpjv.exe 35 PID 2816 wrote to memory of 2828 2816 ddpjv.exe 35 PID 2828 wrote to memory of 3028 2828 llfrfrl.exe 36 PID 2828 wrote to memory of 3028 2828 llfrfrl.exe 36 PID 2828 wrote to memory of 3028 2828 llfrfrl.exe 36 PID 2828 wrote to memory of 3028 2828 llfrfrl.exe 36 PID 3028 wrote to memory of 2748 3028 bhhttn.exe 37 PID 3028 wrote to memory of 2748 3028 bhhttn.exe 37 PID 3028 wrote to memory of 2748 3028 bhhttn.exe 37 PID 3028 wrote to memory of 2748 3028 bhhttn.exe 37 PID 2748 wrote to memory of 2644 2748 lllxlxr.exe 38 PID 2748 wrote to memory of 2644 2748 lllxlxr.exe 38 PID 2748 wrote to memory of 2644 2748 lllxlxr.exe 38 PID 2748 wrote to memory of 2644 2748 lllxlxr.exe 38 PID 2644 wrote to memory of 2172 2644 bnnhnn.exe 39 PID 2644 wrote to memory of 2172 2644 bnnhnn.exe 39 PID 2644 wrote to memory of 2172 2644 bnnhnn.exe 39 PID 2644 wrote to memory of 2172 2644 bnnhnn.exe 39 PID 2172 wrote to memory of 2672 2172 vpjvd.exe 40 PID 2172 wrote to memory of 2672 2172 vpjvd.exe 40 PID 2172 wrote to memory of 2672 2172 vpjvd.exe 40 PID 2172 wrote to memory of 2672 2172 vpjvd.exe 40 PID 2672 wrote to memory of 1640 2672 lllxlxx.exe 41 PID 2672 wrote to memory of 1640 2672 lllxlxx.exe 41 PID 2672 wrote to memory of 1640 2672 lllxlxx.exe 41 PID 2672 wrote to memory of 1640 2672 lllxlxx.exe 41 PID 1640 wrote to memory of 2868 1640 xxxrlfx.exe 42 PID 1640 wrote to memory of 2868 1640 xxxrlfx.exe 42 PID 1640 wrote to memory of 2868 1640 xxxrlfx.exe 42 PID 1640 wrote to memory of 2868 1640 xxxrlfx.exe 42 PID 2868 wrote to memory of 804 2868 3bntnt.exe 43 PID 2868 wrote to memory of 804 2868 3bntnt.exe 43 PID 2868 wrote to memory of 804 2868 3bntnt.exe 43 PID 2868 wrote to memory of 804 2868 3bntnt.exe 43 PID 804 wrote to memory of 2944 804 pvvpj.exe 44 PID 804 wrote to memory of 2944 804 pvvpj.exe 44 PID 804 wrote to memory of 2944 804 pvvpj.exe 44 PID 804 wrote to memory of 2944 804 pvvpj.exe 44 PID 2944 wrote to memory of 536 2944 pjdjj.exe 45 PID 2944 wrote to memory of 536 2944 pjdjj.exe 45 PID 2944 wrote to memory of 536 2944 pjdjj.exe 45 PID 2944 wrote to memory of 536 2944 pjdjj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cc0161c3315a0543ab5e41115c04350N.exe"C:\Users\Admin\AppData\Local\Temp\3cc0161c3315a0543ab5e41115c04350N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\bbtbnh.exec:\bbtbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\vvpvv.exec:\vvpvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xxxflrf.exec:\xxxflrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\pjjvd.exec:\pjjvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\ddpjv.exec:\ddpjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\llfrfrl.exec:\llfrfrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\bhhttn.exec:\bhhttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\lllxlxr.exec:\lllxlxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\bnnhnn.exec:\bnnhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\vpjvd.exec:\vpjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\lllxlxx.exec:\lllxlxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\3bntnt.exec:\3bntnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\pvvpj.exec:\pvvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\pjdjj.exec:\pjdjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\ffrxfrf.exec:\ffrxfrf.exe17⤵
- Executes dropped EXE
PID:536 -
\??\c:\xxlxlxl.exec:\xxlxlxl.exe18⤵
- Executes dropped EXE
PID:1992 -
\??\c:\nntttb.exec:\nntttb.exe19⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pppdd.exec:\pppdd.exe20⤵
- Executes dropped EXE
PID:2708 -
\??\c:\vdvpd.exec:\vdvpd.exe21⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lllfrlf.exec:\lllfrlf.exe22⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ntntnt.exec:\ntntnt.exe23⤵
- Executes dropped EXE
PID:1520 -
\??\c:\7httnb.exec:\7httnb.exe24⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jjpjj.exec:\jjpjj.exe25⤵
- Executes dropped EXE
PID:1108 -
\??\c:\tttnbn.exec:\tttnbn.exe26⤵
- Executes dropped EXE
PID:1344 -
\??\c:\9tnnbn.exec:\9tnnbn.exe27⤵
- Executes dropped EXE
PID:1212 -
\??\c:\ppvjd.exec:\ppvjd.exe28⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vvvvj.exec:\vvvvj.exe29⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rxlrrxr.exec:\rxlrrxr.exe30⤵
- Executes dropped EXE
PID:896 -
\??\c:\5hbnhh.exec:\5hbnhh.exe31⤵
- Executes dropped EXE
PID:1876 -
\??\c:\pvpjj.exec:\pvpjj.exe32⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vpjvp.exec:\vpjvp.exe33⤵
- Executes dropped EXE
PID:2416 -
\??\c:\3lrrlrl.exec:\3lrrlrl.exe34⤵
- Executes dropped EXE
PID:2420 -
\??\c:\bbtbbb.exec:\bbtbbb.exe35⤵
- Executes dropped EXE
PID:1452 -
\??\c:\hnnbht.exec:\hnnbht.exe36⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vddjj.exec:\vddjj.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vvjdd.exec:\vvjdd.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\llflxlx.exec:\llflxlx.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\llrllxl.exec:\llrllxl.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\nnnbth.exec:\nnnbth.exe41⤵
- Executes dropped EXE
PID:2912 -
\??\c:\nnhnhh.exec:\nnhnhh.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vpppd.exec:\vpppd.exe43⤵
- Executes dropped EXE
PID:1744 -
\??\c:\7ddvp.exec:\7ddvp.exe44⤵
- Executes dropped EXE
PID:2684 -
\??\c:\flfrrfr.exec:\flfrrfr.exe45⤵
- Executes dropped EXE
PID:2524 -
\??\c:\flrllxx.exec:\flrllxx.exe46⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hhbhbn.exec:\hhbhbn.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1thbhb.exec:\1thbhb.exe48⤵
- Executes dropped EXE
PID:2600 -
\??\c:\7djvj.exec:\7djvj.exe49⤵
- Executes dropped EXE
PID:588 -
\??\c:\pjjvv.exec:\pjjvv.exe50⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xlflrrx.exec:\xlflrrx.exe51⤵
- Executes dropped EXE
PID:1168 -
\??\c:\9rfrlff.exec:\9rfrlff.exe52⤵
- Executes dropped EXE
PID:2928 -
\??\c:\9bthht.exec:\9bthht.exe53⤵
- Executes dropped EXE
PID:1064 -
\??\c:\7ddpj.exec:\7ddpj.exe54⤵
- Executes dropped EXE
PID:2004 -
\??\c:\7pvdp.exec:\7pvdp.exe55⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xxxlfrl.exec:\xxxlfrl.exe56⤵
- Executes dropped EXE
PID:2332 -
\??\c:\rxxfrff.exec:\rxxfrff.exe57⤵
- Executes dropped EXE
PID:1244 -
\??\c:\tttbnb.exec:\tttbnb.exe58⤵
- Executes dropped EXE
PID:1976 -
\??\c:\bbnhhb.exec:\bbnhhb.exe59⤵
- Executes dropped EXE
PID:2012 -
\??\c:\jjjjp.exec:\jjjjp.exe60⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pjvvd.exec:\pjvvd.exe61⤵
- Executes dropped EXE
PID:352 -
\??\c:\ffrllrf.exec:\ffrllrf.exe62⤵
- Executes dropped EXE
PID:1796 -
\??\c:\xxfrlxr.exec:\xxfrlxr.exe63⤵
- Executes dropped EXE
PID:1620 -
\??\c:\tnbhtt.exec:\tnbhtt.exe64⤵
- Executes dropped EXE
PID:1708 -
\??\c:\jjvvj.exec:\jjvvj.exe65⤵
- Executes dropped EXE
PID:1084 -
\??\c:\pjppd.exec:\pjppd.exe66⤵PID:1212
-
\??\c:\xxlxlrx.exec:\xxlxlrx.exe67⤵PID:2508
-
\??\c:\5rlfrfl.exec:\5rlfrfl.exe68⤵PID:3024
-
\??\c:\3lflxfr.exec:\3lflxfr.exe69⤵PID:772
-
\??\c:\tthnbh.exec:\tthnbh.exe70⤵PID:2588
-
\??\c:\hhbbnt.exec:\hhbbnt.exe71⤵PID:2368
-
\??\c:\3vppp.exec:\3vppp.exe72⤵PID:1924
-
\??\c:\xrrrlxr.exec:\xrrrlxr.exe73⤵PID:2076
-
\??\c:\5rrfrxl.exec:\5rrfrxl.exe74⤵PID:1076
-
\??\c:\1hbbth.exec:\1hbbth.exe75⤵PID:2696
-
\??\c:\tbnhnt.exec:\tbnhnt.exe76⤵PID:2704
-
\??\c:\pppdd.exec:\pppdd.exe77⤵PID:2740
-
\??\c:\vvvdp.exec:\vvvdp.exe78⤵PID:2860
-
\??\c:\xfrfllf.exec:\xfrfllf.exe79⤵PID:2784
-
\??\c:\bhhnbh.exec:\bhhnbh.exe80⤵PID:2840
-
\??\c:\9hhbtb.exec:\9hhbtb.exe81⤵PID:2736
-
\??\c:\vpdjj.exec:\vpdjj.exe82⤵PID:2660
-
\??\c:\jjpvp.exec:\jjpvp.exe83⤵PID:2748
-
\??\c:\llflxxf.exec:\llflxxf.exe84⤵PID:2344
-
\??\c:\flllffx.exec:\flllffx.exe85⤵PID:2900
-
\??\c:\hhnbtb.exec:\hhnbtb.exe86⤵PID:684
-
\??\c:\tntnnb.exec:\tntnnb.exe87⤵PID:1816
-
\??\c:\hhhnnt.exec:\hhhnnt.exe88⤵PID:2040
-
\??\c:\ppvvd.exec:\ppvvd.exe89⤵PID:1512
-
\??\c:\xfxfrfr.exec:\xfxfrfr.exe90⤵PID:2868
-
\??\c:\5lllxrl.exec:\5lllxrl.exe91⤵PID:2936
-
\??\c:\nbthht.exec:\nbthht.exe92⤵PID:2896
-
\??\c:\tththt.exec:\tththt.exe93⤵PID:2976
-
\??\c:\hbtbht.exec:\hbtbht.exe94⤵PID:468
-
\??\c:\dvvjp.exec:\dvvjp.exe95⤵PID:3008
-
\??\c:\jjdvv.exec:\jjdvv.exe96⤵PID:1988
-
\??\c:\rrlrxll.exec:\rrlrxll.exe97⤵PID:1948
-
\??\c:\xflrlxl.exec:\xflrlxl.exe98⤵PID:2168
-
\??\c:\9hhnbt.exec:\9hhnbt.exe99⤵PID:2284
-
\??\c:\nbbtnh.exec:\nbbtnh.exe100⤵PID:1564
-
\??\c:\ddppd.exec:\ddppd.exe101⤵PID:1060
-
\??\c:\djppp.exec:\djppp.exe102⤵PID:1936
-
\??\c:\5llxxrl.exec:\5llxxrl.exe103⤵
- System Location Discovery: System Language Discovery
PID:1764 -
\??\c:\xxrlfrl.exec:\xxrlfrl.exe104⤵PID:768
-
\??\c:\htntbh.exec:\htntbh.exe105⤵PID:2428
-
\??\c:\hbthtb.exec:\hbthtb.exe106⤵PID:1556
-
\??\c:\ddpdp.exec:\ddpdp.exe107⤵PID:1728
-
\??\c:\jjjdv.exec:\jjjdv.exe108⤵PID:2712
-
\??\c:\fxlrflf.exec:\fxlrflf.exe109⤵PID:628
-
\??\c:\rxrflxr.exec:\rxrflxr.exe110⤵PID:1656
-
\??\c:\5tnbnn.exec:\5tnbnn.exe111⤵PID:2408
-
\??\c:\bbbnnb.exec:\bbbnnb.exe112⤵PID:2116
-
\??\c:\9vdpd.exec:\9vdpd.exe113⤵PID:1528
-
\??\c:\pjpdp.exec:\pjpdp.exe114⤵PID:1748
-
\??\c:\9ffrrll.exec:\9ffrrll.exe115⤵PID:1612
-
\??\c:\rxxrllf.exec:\rxxrllf.exe116⤵PID:2492
-
\??\c:\1tbbnt.exec:\1tbbnt.exe117⤵PID:2820
-
\??\c:\nhbnth.exec:\nhbnth.exe118⤵PID:2832
-
\??\c:\ppddd.exec:\ppddd.exe119⤵PID:2848
-
\??\c:\vdvjp.exec:\vdvjp.exe120⤵PID:2856
-
\??\c:\lrlllxr.exec:\lrlllxr.exe121⤵PID:2840
-
\??\c:\lrxrxlx.exec:\lrxrxlx.exe122⤵PID:2612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-