Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 00:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f59154d4b5c203cc7b5848710dbb4160N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
f59154d4b5c203cc7b5848710dbb4160N.exe
-
Size
230KB
-
MD5
f59154d4b5c203cc7b5848710dbb4160
-
SHA1
1e41f5362c3ccc130fec629089297570491f934b
-
SHA256
1569b7d77388f600014e7874fd12d2988c6046b93b9efcde5c6b3c2f284ee5ed
-
SHA512
b1c3af4fe16032fea44d31969276e93d4b70fdc60416a00419bf017f3c9206927dfc5f238772b1c80a0b086753f0c7b9effde3a086c14d879974c1635a3cebc6
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLjBeG+k:n3C9BRo7MlrWKo+lxKJ
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4016-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/732-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2648-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1900 jpvdv.exe 4020 vvddv.exe 3972 hnnhnn.exe 2924 jvdvv.exe 3984 pjjvp.exe 3152 hntttt.exe 2220 vdvpd.exe 732 rrxrflf.exe 3480 xxllxfr.exe 5040 1nhbbh.exe 2712 vvpjd.exe 1228 vpvpp.exe 2308 3hhhbh.exe 2964 7pvvp.exe 4428 vpddv.exe 4576 bhnhhh.exe 716 tbnhhh.exe 1536 dvpjp.exe 2588 7xfxrrr.exe 3576 htnnhb.exe 924 dpppp.exe 3516 xxllfff.exe 748 frrrlll.exe 4004 thhhbb.exe 4744 vvddp.exe 2648 rlrlrll.exe 4924 9httbh.exe 640 jjdvp.exe 3520 lrrxfxf.exe 3356 hhhhhn.exe 3028 jvddp.exe 3684 rrlfrrf.exe 808 nbttnn.exe 1776 bbbbbb.exe 1620 vpjdp.exe 2604 lrlfxxx.exe 4016 xrxxrrr.exe 1408 tnbbtb.exe 2212 ppjdp.exe 1100 vjppj.exe 1400 xrlfxxx.exe 4384 xrrlfxr.exe 1308 bbbnnn.exe 4048 jjvjj.exe 1080 pjddd.exe 3612 rflfxxr.exe 1376 rxlllll.exe 1412 7nhttt.exe 1108 pjdvd.exe 4236 jvdjj.exe 2932 fxllfff.exe 4532 xrxfxll.exe 4796 9tbtnn.exe 2276 vvddd.exe 2744 vvppj.exe 1228 1rxrrxx.exe 3604 7thbhh.exe 2308 5thhht.exe 4752 vdpjj.exe 2200 vjpjd.exe 760 xffxrrl.exe 4616 5lrlffx.exe 1816 hhbthh.exe 716 3nttnn.exe -
resource yara_rule behavioral2/memory/4016-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2648-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrlxx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4016 wrote to memory of 1900 4016 f59154d4b5c203cc7b5848710dbb4160N.exe 83 PID 4016 wrote to memory of 1900 4016 f59154d4b5c203cc7b5848710dbb4160N.exe 83 PID 4016 wrote to memory of 1900 4016 f59154d4b5c203cc7b5848710dbb4160N.exe 83 PID 1900 wrote to memory of 4020 1900 jpvdv.exe 84 PID 1900 wrote to memory of 4020 1900 jpvdv.exe 84 PID 1900 wrote to memory of 4020 1900 jpvdv.exe 84 PID 4020 wrote to memory of 3972 4020 vvddv.exe 85 PID 4020 wrote to memory of 3972 4020 vvddv.exe 85 PID 4020 wrote to memory of 3972 4020 vvddv.exe 85 PID 3972 wrote to memory of 2924 3972 hnnhnn.exe 86 PID 3972 wrote to memory of 2924 3972 hnnhnn.exe 86 PID 3972 wrote to memory of 2924 3972 hnnhnn.exe 86 PID 2924 wrote to memory of 3984 2924 jvdvv.exe 88 PID 2924 wrote to memory of 3984 2924 jvdvv.exe 88 PID 2924 wrote to memory of 3984 2924 jvdvv.exe 88 PID 3984 wrote to memory of 3152 3984 pjjvp.exe 89 PID 3984 wrote to memory of 3152 3984 pjjvp.exe 89 PID 3984 wrote to memory of 3152 3984 pjjvp.exe 89 PID 3152 wrote to memory of 2220 3152 hntttt.exe 90 PID 3152 wrote to memory of 2220 3152 hntttt.exe 90 PID 3152 wrote to memory of 2220 3152 hntttt.exe 90 PID 2220 wrote to memory of 732 2220 vdvpd.exe 91 PID 2220 wrote to memory of 732 2220 vdvpd.exe 91 PID 2220 wrote to memory of 732 2220 vdvpd.exe 91 PID 732 wrote to memory of 3480 732 rrxrflf.exe 92 PID 732 wrote to memory of 3480 732 rrxrflf.exe 92 PID 732 wrote to memory of 3480 732 rrxrflf.exe 92 PID 3480 wrote to memory of 5040 3480 xxllxfr.exe 93 PID 3480 wrote to memory of 5040 3480 xxllxfr.exe 93 PID 3480 wrote to memory of 5040 3480 xxllxfr.exe 93 PID 5040 wrote to memory of 2712 5040 1nhbbh.exe 95 PID 5040 wrote to memory of 2712 5040 1nhbbh.exe 95 PID 5040 wrote to memory of 2712 5040 1nhbbh.exe 95 PID 2712 wrote to memory of 1228 2712 vvpjd.exe 96 PID 2712 wrote to memory of 1228 2712 vvpjd.exe 96 PID 2712 wrote to memory of 1228 2712 vvpjd.exe 96 PID 1228 wrote to memory of 2308 1228 vpvpp.exe 97 PID 1228 wrote to memory of 2308 1228 vpvpp.exe 97 PID 1228 wrote to memory of 2308 1228 vpvpp.exe 97 PID 2308 wrote to memory of 2964 2308 3hhhbh.exe 98 PID 2308 wrote to memory of 2964 2308 3hhhbh.exe 98 PID 2308 wrote to memory of 2964 2308 3hhhbh.exe 98 PID 2964 wrote to memory of 4428 2964 7pvvp.exe 99 PID 2964 wrote to memory of 4428 2964 7pvvp.exe 99 PID 2964 wrote to memory of 4428 2964 7pvvp.exe 99 PID 4428 wrote to memory of 4576 4428 vpddv.exe 100 PID 4428 wrote to memory of 4576 4428 vpddv.exe 100 PID 4428 wrote to memory of 4576 4428 vpddv.exe 100 PID 4576 wrote to memory of 716 4576 bhnhhh.exe 102 PID 4576 wrote to memory of 716 4576 bhnhhh.exe 102 PID 4576 wrote to memory of 716 4576 bhnhhh.exe 102 PID 716 wrote to memory of 1536 716 tbnhhh.exe 103 PID 716 wrote to memory of 1536 716 tbnhhh.exe 103 PID 716 wrote to memory of 1536 716 tbnhhh.exe 103 PID 1536 wrote to memory of 2588 1536 dvpjp.exe 104 PID 1536 wrote to memory of 2588 1536 dvpjp.exe 104 PID 1536 wrote to memory of 2588 1536 dvpjp.exe 104 PID 2588 wrote to memory of 3576 2588 7xfxrrr.exe 105 PID 2588 wrote to memory of 3576 2588 7xfxrrr.exe 105 PID 2588 wrote to memory of 3576 2588 7xfxrrr.exe 105 PID 3576 wrote to memory of 924 3576 htnnhb.exe 106 PID 3576 wrote to memory of 924 3576 htnnhb.exe 106 PID 3576 wrote to memory of 924 3576 htnnhb.exe 106 PID 924 wrote to memory of 3516 924 dpppp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\f59154d4b5c203cc7b5848710dbb4160N.exe"C:\Users\Admin\AppData\Local\Temp\f59154d4b5c203cc7b5848710dbb4160N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\jpvdv.exec:\jpvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\vvddv.exec:\vvddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\hnnhnn.exec:\hnnhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\jvdvv.exec:\jvdvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\pjjvp.exec:\pjjvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\hntttt.exec:\hntttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\vdvpd.exec:\vdvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\rrxrflf.exec:\rrxrflf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\xxllxfr.exec:\xxllxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\1nhbbh.exec:\1nhbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\vvpjd.exec:\vvpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\vpvpp.exec:\vpvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\3hhhbh.exec:\3hhhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\7pvvp.exec:\7pvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vpddv.exec:\vpddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\bhnhhh.exec:\bhnhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\tbnhhh.exec:\tbnhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\dvpjp.exec:\dvpjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\7xfxrrr.exec:\7xfxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\htnnhb.exec:\htnnhb.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\dpppp.exec:\dpppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\xxllfff.exec:\xxllfff.exe23⤵
- Executes dropped EXE
PID:3516 -
\??\c:\frrrlll.exec:\frrrlll.exe24⤵
- Executes dropped EXE
PID:748 -
\??\c:\thhhbb.exec:\thhhbb.exe25⤵
- Executes dropped EXE
PID:4004 -
\??\c:\vvddp.exec:\vvddp.exe26⤵
- Executes dropped EXE
PID:4744 -
\??\c:\rlrlrll.exec:\rlrlrll.exe27⤵
- Executes dropped EXE
PID:2648 -
\??\c:\9httbh.exec:\9httbh.exe28⤵
- Executes dropped EXE
PID:4924 -
\??\c:\jjdvp.exec:\jjdvp.exe29⤵
- Executes dropped EXE
PID:640 -
\??\c:\lrrxfxf.exec:\lrrxfxf.exe30⤵
- Executes dropped EXE
PID:3520 -
\??\c:\hhhhhn.exec:\hhhhhn.exe31⤵
- Executes dropped EXE
PID:3356 -
\??\c:\jvddp.exec:\jvddp.exe32⤵
- Executes dropped EXE
PID:3028 -
\??\c:\rrlfrrf.exec:\rrlfrrf.exe33⤵
- Executes dropped EXE
PID:3684 -
\??\c:\nbttnn.exec:\nbttnn.exe34⤵
- Executes dropped EXE
PID:808 -
\??\c:\bbbbbb.exec:\bbbbbb.exe35⤵
- Executes dropped EXE
PID:1776 -
\??\c:\vpjdp.exec:\vpjdp.exe36⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lrlfxxx.exec:\lrlfxxx.exe37⤵
- Executes dropped EXE
PID:2604 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe38⤵
- Executes dropped EXE
PID:4016 -
\??\c:\tnbbtb.exec:\tnbbtb.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1408 -
\??\c:\ppjdp.exec:\ppjdp.exe40⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vjppj.exec:\vjppj.exe41⤵
- Executes dropped EXE
PID:1100 -
\??\c:\xrlfxxx.exec:\xrlfxxx.exe42⤵
- Executes dropped EXE
PID:1400 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe43⤵
- Executes dropped EXE
PID:4384 -
\??\c:\bbbnnn.exec:\bbbnnn.exe44⤵
- Executes dropped EXE
PID:1308 -
\??\c:\jjvjj.exec:\jjvjj.exe45⤵
- Executes dropped EXE
PID:4048 -
\??\c:\pjddd.exec:\pjddd.exe46⤵
- Executes dropped EXE
PID:1080 -
\??\c:\rflfxxr.exec:\rflfxxr.exe47⤵
- Executes dropped EXE
PID:3612 -
\??\c:\rxlllll.exec:\rxlllll.exe48⤵
- Executes dropped EXE
PID:1376 -
\??\c:\7nhttt.exec:\7nhttt.exe49⤵
- Executes dropped EXE
PID:1412 -
\??\c:\pjdvd.exec:\pjdvd.exe50⤵
- Executes dropped EXE
PID:1108 -
\??\c:\jvdjj.exec:\jvdjj.exe51⤵
- Executes dropped EXE
PID:4236 -
\??\c:\fxllfff.exec:\fxllfff.exe52⤵
- Executes dropped EXE
PID:2932 -
\??\c:\xrxfxll.exec:\xrxfxll.exe53⤵
- Executes dropped EXE
PID:4532 -
\??\c:\9tbtnn.exec:\9tbtnn.exe54⤵
- Executes dropped EXE
PID:4796 -
\??\c:\vvddd.exec:\vvddd.exe55⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vvppj.exec:\vvppj.exe56⤵
- Executes dropped EXE
PID:2744 -
\??\c:\1rxrrxx.exec:\1rxrrxx.exe57⤵
- Executes dropped EXE
PID:1228 -
\??\c:\7thbhh.exec:\7thbhh.exe58⤵
- Executes dropped EXE
PID:3604 -
\??\c:\5thhht.exec:\5thhht.exe59⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vdpjj.exec:\vdpjj.exe60⤵
- Executes dropped EXE
PID:4752 -
\??\c:\vjpjd.exec:\vjpjd.exe61⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xffxrrl.exec:\xffxrrl.exe62⤵
- Executes dropped EXE
PID:760 -
\??\c:\5lrlffx.exec:\5lrlffx.exe63⤵
- Executes dropped EXE
PID:4616 -
\??\c:\hhbthh.exec:\hhbthh.exe64⤵
- Executes dropped EXE
PID:1816 -
\??\c:\3nttnn.exec:\3nttnn.exe65⤵
- Executes dropped EXE
PID:716 -
\??\c:\vpjvj.exec:\vpjvj.exe66⤵PID:2256
-
\??\c:\rxllfxx.exec:\rxllfxx.exe67⤵PID:3756
-
\??\c:\rffxrrl.exec:\rffxrrl.exe68⤵PID:1592
-
\??\c:\7tnbtt.exec:\7tnbtt.exe69⤵PID:4844
-
\??\c:\tnthhb.exec:\tnthhb.exe70⤵PID:1804
-
\??\c:\hhhhbb.exec:\hhhhbb.exe71⤵PID:3524
-
\??\c:\dpppj.exec:\dpppj.exe72⤵PID:4364
-
\??\c:\jpvpj.exec:\jpvpj.exe73⤵PID:3696
-
\??\c:\xrllllr.exec:\xrllllr.exe74⤵PID:3608
-
\??\c:\ffrxrxx.exec:\ffrxrxx.exe75⤵PID:3820
-
\??\c:\ttbbtt.exec:\ttbbtt.exe76⤵PID:2152
-
\??\c:\ppjjd.exec:\ppjjd.exe77⤵PID:3768
-
\??\c:\llrrrrr.exec:\llrrrrr.exe78⤵PID:2296
-
\??\c:\thhtnt.exec:\thhtnt.exe79⤵PID:4556
-
\??\c:\1thbbb.exec:\1thbbb.exe80⤵PID:4328
-
\??\c:\vpjjp.exec:\vpjjp.exe81⤵PID:4760
-
\??\c:\frrlfff.exec:\frrlfff.exe82⤵PID:5000
-
\??\c:\7tbtnn.exec:\7tbtnn.exe83⤵PID:4056
-
\??\c:\vjddd.exec:\vjddd.exe84⤵PID:1396
-
\??\c:\9llrllf.exec:\9llrllf.exe85⤵PID:4368
-
\??\c:\llllfll.exec:\llllfll.exe86⤵PID:4408
-
\??\c:\btnnnn.exec:\btnnnn.exe87⤵PID:4336
-
\??\c:\5bhbhh.exec:\5bhbhh.exe88⤵PID:3752
-
\??\c:\dvjjp.exec:\dvjjp.exe89⤵
- System Location Discovery: System Language Discovery
PID:1444 -
\??\c:\djvpd.exec:\djvpd.exe90⤵PID:3160
-
\??\c:\rrfxrxr.exec:\rrfxrxr.exe91⤵PID:3172
-
\??\c:\xrflllf.exec:\xrflllf.exe92⤵PID:536
-
\??\c:\bbbtnh.exec:\bbbtnh.exe93⤵PID:1400
-
\??\c:\nnttnh.exec:\nnttnh.exe94⤵PID:4124
-
\??\c:\3pjdv.exec:\3pjdv.exe95⤵PID:1308
-
\??\c:\pvjdd.exec:\pvjdd.exe96⤵PID:4048
-
\??\c:\llxrrrx.exec:\llxrrrx.exe97⤵PID:1080
-
\??\c:\llllflf.exec:\llllflf.exe98⤵PID:3048
-
\??\c:\htbtbb.exec:\htbtbb.exe99⤵PID:936
-
\??\c:\1jjjj.exec:\1jjjj.exe100⤵PID:3040
-
\??\c:\ppdjd.exec:\ppdjd.exe101⤵PID:3480
-
\??\c:\lfflllx.exec:\lfflllx.exe102⤵PID:3000
-
\??\c:\xrrxlrl.exec:\xrrxlrl.exe103⤵PID:4192
-
\??\c:\bbthnh.exec:\bbthnh.exe104⤵PID:3008
-
\??\c:\btbbbt.exec:\btbbbt.exe105⤵PID:4680
-
\??\c:\vddvp.exec:\vddvp.exe106⤵PID:1908
-
\??\c:\djppd.exec:\djppd.exe107⤵PID:4196
-
\??\c:\ffrlxfx.exec:\ffrlxfx.exe108⤵PID:3564
-
\??\c:\fxfrlfx.exec:\fxfrlfx.exe109⤵PID:3568
-
\??\c:\3hhbnn.exec:\3hhbnn.exe110⤵PID:2424
-
\??\c:\1ttnhh.exec:\1ttnhh.exe111⤵PID:4480
-
\??\c:\jjjjd.exec:\jjjjd.exe112⤵PID:3484
-
\??\c:\1lfxllf.exec:\1lfxllf.exe113⤵PID:2000
-
\??\c:\nbbttt.exec:\nbbttt.exe114⤵PID:948
-
\??\c:\7bbttt.exec:\7bbttt.exe115⤵PID:4404
-
\??\c:\thnhhb.exec:\thnhhb.exe116⤵PID:3788
-
\??\c:\djjjj.exec:\djjjj.exe117⤵PID:4792
-
\??\c:\vdpvj.exec:\vdpvj.exe118⤵PID:1256
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe119⤵PID:2588
-
\??\c:\fxxllfx.exec:\fxxllfx.exe120⤵PID:3992
-
\??\c:\nntnnh.exec:\nntnnh.exe121⤵PID:4572
-
\??\c:\hhbbnn.exec:\hhbbnn.exe122⤵PID:2948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-