Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 12:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3cc0161c3315a0543ab5e41115c04350N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
3cc0161c3315a0543ab5e41115c04350N.exe
-
Size
95KB
-
MD5
3cc0161c3315a0543ab5e41115c04350
-
SHA1
9ee499677f85d00e0447928b32b25b39d52ea693
-
SHA256
4dd5ea80d4a250be080593e7b76e4b6a8e747a62f824a740694122614c4ced32
-
SHA512
b8e2bbd07dff358eb8715d4d3ad244fba3c511adf16a3e1f9b920b99154bb955e935865e18a9260f38ce02e2d9e408d971b51a7727e6d8312762d2741181392c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLuePjDYlZMzcLF:ymb3NkkiQ3mdBjFoLucjD7cp
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4712-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-35-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/620-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1076-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4712 vppvp.exe 3660 3xrlfff.exe 2852 flllffx.exe 628 bthhht.exe 3032 dpvpp.exe 3212 xrxxlll.exe 620 hhnhbh.exe 1588 djjjj.exe 116 llrffll.exe 2080 lfrrxrr.exe 2940 dvppp.exe 3656 fxlfxff.exe 3932 tthbtt.exe 1996 vdjpj.exe 4724 llrlllx.exe 2284 nnntnn.exe 224 nbhhbb.exe 1624 vpvvp.exe 4344 jvjdp.exe 4728 xxfxrrl.exe 752 7hnnnn.exe 3500 bbbtnn.exe 1168 jdpvp.exe 1028 vppjd.exe 4772 xrxrllf.exe 392 hhtnbb.exe 1076 pppjj.exe 5108 3vjvp.exe 1716 lrffrrl.exe 2868 ntbtnn.exe 4280 pdjdd.exe 1868 lfrxlxx.exe 2364 3hnhbb.exe 4332 tnhbtt.exe 3836 ttttnn.exe 4856 vdpjp.exe 4200 lrrfllr.exe 3372 xxrlrrx.exe 884 nhtntt.exe 4564 9bhnbh.exe 748 3ddjj.exe 1736 dvvpj.exe 3032 frxrfxr.exe 2128 htnbbt.exe 3212 thnnhh.exe 4760 vjvvv.exe 4248 dddvv.exe 3716 frrrlrl.exe 3056 bnhbbb.exe 4312 5pppj.exe 2012 xlrxxff.exe 3944 rlxxxxr.exe 2652 bbbbtt.exe 1072 nhhbnb.exe 3984 1ppvp.exe 4864 jpvpj.exe 2976 xflfxff.exe 4820 5fffxxx.exe 4444 hbnnhh.exe 4220 tnbbbb.exe 1760 pdjpd.exe 1240 pddvp.exe 2788 fxlfffr.exe 1000 frxxrrl.exe -
resource yara_rule behavioral2/memory/1948-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/620-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/620-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1076-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1948 wrote to memory of 4712 1948 3cc0161c3315a0543ab5e41115c04350N.exe 83 PID 1948 wrote to memory of 4712 1948 3cc0161c3315a0543ab5e41115c04350N.exe 83 PID 1948 wrote to memory of 4712 1948 3cc0161c3315a0543ab5e41115c04350N.exe 83 PID 4712 wrote to memory of 3660 4712 vppvp.exe 84 PID 4712 wrote to memory of 3660 4712 vppvp.exe 84 PID 4712 wrote to memory of 3660 4712 vppvp.exe 84 PID 3660 wrote to memory of 2852 3660 3xrlfff.exe 85 PID 3660 wrote to memory of 2852 3660 3xrlfff.exe 85 PID 3660 wrote to memory of 2852 3660 3xrlfff.exe 85 PID 2852 wrote to memory of 628 2852 flllffx.exe 86 PID 2852 wrote to memory of 628 2852 flllffx.exe 86 PID 2852 wrote to memory of 628 2852 flllffx.exe 86 PID 628 wrote to memory of 3032 628 bthhht.exe 87 PID 628 wrote to memory of 3032 628 bthhht.exe 87 PID 628 wrote to memory of 3032 628 bthhht.exe 87 PID 3032 wrote to memory of 3212 3032 dpvpp.exe 88 PID 3032 wrote to memory of 3212 3032 dpvpp.exe 88 PID 3032 wrote to memory of 3212 3032 dpvpp.exe 88 PID 3212 wrote to memory of 620 3212 xrxxlll.exe 89 PID 3212 wrote to memory of 620 3212 xrxxlll.exe 89 PID 3212 wrote to memory of 620 3212 xrxxlll.exe 89 PID 620 wrote to memory of 1588 620 hhnhbh.exe 90 PID 620 wrote to memory of 1588 620 hhnhbh.exe 90 PID 620 wrote to memory of 1588 620 hhnhbh.exe 90 PID 1588 wrote to memory of 116 1588 djjjj.exe 91 PID 1588 wrote to memory of 116 1588 djjjj.exe 91 PID 1588 wrote to memory of 116 1588 djjjj.exe 91 PID 116 wrote to memory of 2080 116 llrffll.exe 93 PID 116 wrote to memory of 2080 116 llrffll.exe 93 PID 116 wrote to memory of 2080 116 llrffll.exe 93 PID 2080 wrote to memory of 2940 2080 lfrrxrr.exe 94 PID 2080 wrote to memory of 2940 2080 lfrrxrr.exe 94 PID 2080 wrote to memory of 2940 2080 lfrrxrr.exe 94 PID 2940 wrote to memory of 3656 2940 dvppp.exe 95 PID 2940 wrote to memory of 3656 2940 dvppp.exe 95 PID 2940 wrote to memory of 3656 2940 dvppp.exe 95 PID 3656 wrote to memory of 3932 3656 fxlfxff.exe 96 PID 3656 wrote to memory of 3932 3656 fxlfxff.exe 96 PID 3656 wrote to memory of 3932 3656 fxlfxff.exe 96 PID 3932 wrote to memory of 1996 3932 tthbtt.exe 98 PID 3932 wrote to memory of 1996 3932 tthbtt.exe 98 PID 3932 wrote to memory of 1996 3932 tthbtt.exe 98 PID 1996 wrote to memory of 4724 1996 vdjpj.exe 99 PID 1996 wrote to memory of 4724 1996 vdjpj.exe 99 PID 1996 wrote to memory of 4724 1996 vdjpj.exe 99 PID 4724 wrote to memory of 2284 4724 llrlllx.exe 100 PID 4724 wrote to memory of 2284 4724 llrlllx.exe 100 PID 4724 wrote to memory of 2284 4724 llrlllx.exe 100 PID 2284 wrote to memory of 224 2284 nnntnn.exe 101 PID 2284 wrote to memory of 224 2284 nnntnn.exe 101 PID 2284 wrote to memory of 224 2284 nnntnn.exe 101 PID 224 wrote to memory of 1624 224 nbhhbb.exe 102 PID 224 wrote to memory of 1624 224 nbhhbb.exe 102 PID 224 wrote to memory of 1624 224 nbhhbb.exe 102 PID 1624 wrote to memory of 4344 1624 vpvvp.exe 103 PID 1624 wrote to memory of 4344 1624 vpvvp.exe 103 PID 1624 wrote to memory of 4344 1624 vpvvp.exe 103 PID 4344 wrote to memory of 4728 4344 jvjdp.exe 104 PID 4344 wrote to memory of 4728 4344 jvjdp.exe 104 PID 4344 wrote to memory of 4728 4344 jvjdp.exe 104 PID 4728 wrote to memory of 752 4728 xxfxrrl.exe 106 PID 4728 wrote to memory of 752 4728 xxfxrrl.exe 106 PID 4728 wrote to memory of 752 4728 xxfxrrl.exe 106 PID 752 wrote to memory of 3500 752 7hnnnn.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cc0161c3315a0543ab5e41115c04350N.exe"C:\Users\Admin\AppData\Local\Temp\3cc0161c3315a0543ab5e41115c04350N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\vppvp.exec:\vppvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\3xrlfff.exec:\3xrlfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\flllffx.exec:\flllffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\bthhht.exec:\bthhht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\dpvpp.exec:\dpvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\xrxxlll.exec:\xrxxlll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\hhnhbh.exec:\hhnhbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\djjjj.exec:\djjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\llrffll.exec:\llrffll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\lfrrxrr.exec:\lfrrxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\dvppp.exec:\dvppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\fxlfxff.exec:\fxlfxff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\tthbtt.exec:\tthbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\vdjpj.exec:\vdjpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\llrlllx.exec:\llrlllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\nnntnn.exec:\nnntnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\nbhhbb.exec:\nbhhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\vpvvp.exec:\vpvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\jvjdp.exec:\jvjdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\7hnnnn.exec:\7hnnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\bbbtnn.exec:\bbbtnn.exe23⤵
- Executes dropped EXE
PID:3500 -
\??\c:\jdpvp.exec:\jdpvp.exe24⤵
- Executes dropped EXE
PID:1168 -
\??\c:\vppjd.exec:\vppjd.exe25⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xrxrllf.exec:\xrxrllf.exe26⤵
- Executes dropped EXE
PID:4772 -
\??\c:\hhtnbb.exec:\hhtnbb.exe27⤵
- Executes dropped EXE
PID:392 -
\??\c:\pppjj.exec:\pppjj.exe28⤵
- Executes dropped EXE
PID:1076 -
\??\c:\3vjvp.exec:\3vjvp.exe29⤵
- Executes dropped EXE
PID:5108 -
\??\c:\lrffrrl.exec:\lrffrrl.exe30⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ntbtnn.exec:\ntbtnn.exe31⤵
- Executes dropped EXE
PID:2868 -
\??\c:\pdjdd.exec:\pdjdd.exe32⤵
- Executes dropped EXE
PID:4280 -
\??\c:\lfrxlxx.exec:\lfrxlxx.exe33⤵
- Executes dropped EXE
PID:1868 -
\??\c:\3hnhbb.exec:\3hnhbb.exe34⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tnhbtt.exec:\tnhbtt.exe35⤵
- Executes dropped EXE
PID:4332 -
\??\c:\ttttnn.exec:\ttttnn.exe36⤵
- Executes dropped EXE
PID:3836 -
\??\c:\vdpjp.exec:\vdpjp.exe37⤵
- Executes dropped EXE
PID:4856 -
\??\c:\lrrfllr.exec:\lrrfllr.exe38⤵
- Executes dropped EXE
PID:4200 -
\??\c:\xxrlrrx.exec:\xxrlrrx.exe39⤵
- Executes dropped EXE
PID:3372 -
\??\c:\nhtntt.exec:\nhtntt.exe40⤵
- Executes dropped EXE
PID:884 -
\??\c:\9bhnbh.exec:\9bhnbh.exe41⤵
- Executes dropped EXE
PID:4564 -
\??\c:\3ddjj.exec:\3ddjj.exe42⤵
- Executes dropped EXE
PID:748 -
\??\c:\dvvpj.exec:\dvvpj.exe43⤵
- Executes dropped EXE
PID:1736 -
\??\c:\frxrfxr.exec:\frxrfxr.exe44⤵
- Executes dropped EXE
PID:3032 -
\??\c:\htnbbt.exec:\htnbbt.exe45⤵
- Executes dropped EXE
PID:2128 -
\??\c:\thnnhh.exec:\thnnhh.exe46⤵
- Executes dropped EXE
PID:3212 -
\??\c:\vjvvv.exec:\vjvvv.exe47⤵
- Executes dropped EXE
PID:4760 -
\??\c:\dddvv.exec:\dddvv.exe48⤵
- Executes dropped EXE
PID:4248 -
\??\c:\frrrlrl.exec:\frrrlrl.exe49⤵
- Executes dropped EXE
PID:3716 -
\??\c:\bnhbbb.exec:\bnhbbb.exe50⤵
- Executes dropped EXE
PID:3056 -
\??\c:\5pppj.exec:\5pppj.exe51⤵
- Executes dropped EXE
PID:4312 -
\??\c:\xlrxxff.exec:\xlrxxff.exe52⤵
- Executes dropped EXE
PID:2012 -
\??\c:\rlxxxxr.exec:\rlxxxxr.exe53⤵
- Executes dropped EXE
PID:3944 -
\??\c:\bbbbtt.exec:\bbbbtt.exe54⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nhhbnb.exec:\nhhbnb.exe55⤵
- Executes dropped EXE
PID:1072 -
\??\c:\1ppvp.exec:\1ppvp.exe56⤵
- Executes dropped EXE
PID:3984 -
\??\c:\jpvpj.exec:\jpvpj.exe57⤵
- Executes dropped EXE
PID:4864 -
\??\c:\xflfxff.exec:\xflfxff.exe58⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5fffxxx.exec:\5fffxxx.exe59⤵
- Executes dropped EXE
PID:4820 -
\??\c:\hbnnhh.exec:\hbnnhh.exe60⤵
- Executes dropped EXE
PID:4444 -
\??\c:\tnbbbb.exec:\tnbbbb.exe61⤵
- Executes dropped EXE
PID:4220 -
\??\c:\pdjpd.exec:\pdjpd.exe62⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pddvp.exec:\pddvp.exe63⤵
- Executes dropped EXE
PID:1240 -
\??\c:\fxlfffr.exec:\fxlfffr.exe64⤵
- Executes dropped EXE
PID:2788 -
\??\c:\frxxrrl.exec:\frxxrrl.exe65⤵
- Executes dropped EXE
PID:1000 -
\??\c:\hhbhhn.exec:\hhbhhn.exe66⤵PID:3544
-
\??\c:\nnbbbh.exec:\nnbbbh.exe67⤵PID:3968
-
\??\c:\dppjd.exec:\dppjd.exe68⤵PID:4848
-
\??\c:\1jpjp.exec:\1jpjp.exe69⤵PID:4960
-
\??\c:\xxlfllr.exec:\xxlfllr.exe70⤵PID:3496
-
\??\c:\flfffff.exec:\flfffff.exe71⤵PID:3996
-
\??\c:\bbttth.exec:\bbttth.exe72⤵PID:4772
-
\??\c:\btnhtt.exec:\btnhtt.exe73⤵PID:1728
-
\??\c:\jvpvp.exec:\jvpvp.exe74⤵
- System Location Discovery: System Language Discovery
PID:4964 -
\??\c:\3djdv.exec:\3djdv.exe75⤵PID:2344
-
\??\c:\lxxrffl.exec:\lxxrffl.exe76⤵PID:3088
-
\??\c:\1rrlfrl.exec:\1rrlfrl.exe77⤵PID:1228
-
\??\c:\tnnnhb.exec:\tnnnhb.exe78⤵PID:5100
-
\??\c:\bthbtb.exec:\bthbtb.exe79⤵PID:740
-
\??\c:\rrrlfff.exec:\rrrlfff.exe80⤵PID:1868
-
\??\c:\9httnb.exec:\9httnb.exe81⤵PID:2624
-
\??\c:\tthbbb.exec:\tthbbb.exe82⤵PID:4332
-
\??\c:\nbnhbb.exec:\nbnhbb.exe83⤵PID:5068
-
\??\c:\ppjjp.exec:\ppjjp.exe84⤵PID:4856
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe85⤵PID:4240
-
\??\c:\nhhhtt.exec:\nhhhtt.exe86⤵PID:2736
-
\??\c:\htbtbt.exec:\htbtbt.exe87⤵PID:1912
-
\??\c:\jppjd.exec:\jppjd.exe88⤵PID:4452
-
\??\c:\xxlfxfx.exec:\xxlfxfx.exe89⤵PID:1408
-
\??\c:\xlrxxxx.exec:\xlrxxxx.exe90⤵PID:1232
-
\??\c:\btttnn.exec:\btttnn.exe91⤵PID:3084
-
\??\c:\bbbnnh.exec:\bbbnnh.exe92⤵PID:3204
-
\??\c:\9pjjv.exec:\9pjjv.exe93⤵PID:3176
-
\??\c:\3vpjd.exec:\3vpjd.exe94⤵PID:4288
-
\??\c:\rlrrrrf.exec:\rlrrrrf.exe95⤵PID:4420
-
\??\c:\1rrrlrr.exec:\1rrrlrr.exe96⤵PID:3576
-
\??\c:\tbbtnn.exec:\tbbtnn.exe97⤵PID:60
-
\??\c:\pvdpj.exec:\pvdpj.exe98⤵PID:2680
-
\??\c:\jdvpv.exec:\jdvpv.exe99⤵PID:964
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe100⤵PID:2180
-
\??\c:\7xlfllr.exec:\7xlfllr.exe101⤵PID:4196
-
\??\c:\tnttnn.exec:\tnttnn.exe102⤵PID:4440
-
\??\c:\tthbbb.exec:\tthbbb.exe103⤵PID:4724
-
\??\c:\vdjjd.exec:\vdjjd.exe104⤵PID:668
-
\??\c:\ddpjd.exec:\ddpjd.exe105⤵PID:2216
-
\??\c:\flfxrxr.exec:\flfxrxr.exe106⤵PID:2668
-
\??\c:\xxffxxx.exec:\xxffxxx.exe107⤵PID:592
-
\??\c:\bthtnt.exec:\bthtnt.exe108⤵PID:436
-
\??\c:\bhbnhh.exec:\bhbnhh.exe109⤵PID:4948
-
\??\c:\pdvpd.exec:\pdvpd.exe110⤵PID:2352
-
\??\c:\djvpj.exec:\djvpj.exe111⤵PID:4108
-
\??\c:\llfrlfr.exec:\llfrlfr.exe112⤵PID:1804
-
\??\c:\bbbttn.exec:\bbbttn.exe113⤵PID:3500
-
\??\c:\1ntnhn.exec:\1ntnhn.exe114⤵PID:1292
-
\??\c:\5vvvv.exec:\5vvvv.exe115⤵PID:1168
-
\??\c:\dvdjd.exec:\dvdjd.exe116⤵PID:2524
-
\??\c:\rllxrrr.exec:\rllxrrr.exe117⤵PID:2528
-
\??\c:\9htnhh.exec:\9htnhh.exe118⤵PID:1332
-
\??\c:\3hnhbb.exec:\3hnhbb.exe119⤵PID:2536
-
\??\c:\dddvv.exec:\dddvv.exe120⤵PID:3456
-
\??\c:\rrxrffl.exec:\rrxrffl.exe121⤵PID:1236
-
\??\c:\3hnnhh.exec:\3hnnhh.exe122⤵PID:4924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-