Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 11:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e3cc6c1c6e5a1773da71cbf8ae7f1d80N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
e3cc6c1c6e5a1773da71cbf8ae7f1d80N.exe
-
Size
58KB
-
MD5
e3cc6c1c6e5a1773da71cbf8ae7f1d80
-
SHA1
0ca91861e41332e275933e1a022c71b3695287fc
-
SHA256
a7ea1e430763235c4745a00535ce5115e12af17be844738f187cf68600bf1b01
-
SHA512
01f307f9c2f1b7ca87d3f10f9fef7a84c99159fb2bb1ec7d5c1a83be1690db92c52c03467d4c9141b54c4d5a4078321b902052b524290e5b6f55daf3d14fa013
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI7ai:ymb3NkkiQ3mdBjFI7ai
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2668-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/576-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1444 xrfrxfl.exe 1740 1fxfllr.exe 3068 9thbtt.exe 2776 tnbnnn.exe 2348 dpvvv.exe 2692 xrfllfl.exe 2052 9hnhbb.exe 2784 pjppv.exe 2900 lfrrrxf.exe 2660 lfrxxrf.exe 2456 bhbtnt.exe 1668 jddvv.exe 2804 3jvdv.exe 576 llrlllr.exe 2824 3bnnhn.exe 2656 hnbbth.exe 1548 7jvjj.exe 1672 xxffrrl.exe 2780 lfxlfll.exe 2684 1htbnb.exe 2092 nhnnbb.exe 2364 vvvdd.exe 844 vjvvj.exe 1692 7lflxff.exe 2252 rrfrxfx.exe 2164 hhtbhn.exe 2484 9hbhhh.exe 2180 7pjjp.exe 1788 rflrrrr.exe 876 9lrxflf.exe 2200 tbtbhh.exe 2564 nttnnh.exe 2000 dvpvv.exe 3068 rrxllfr.exe 1588 rlrfflr.exe 2304 5bbhnt.exe 3008 hbntht.exe 2356 ddvvj.exe 2728 vjjdj.exe 2924 7djdd.exe 2888 lxxfrrx.exe 2876 3ffxrrx.exe 2700 nhbbth.exe 2608 nnbhtt.exe 2144 vjppd.exe 2312 pppvp.exe 2308 vdjjp.exe 264 rfrlffl.exe 1580 1lffrrl.exe 1628 nhtbhn.exe 480 5hbbhb.exe 2824 dvddd.exe 2344 pdjdj.exe 1160 3dddj.exe 2984 fxffrxr.exe 2768 rfrxlxx.exe 2780 dvddj.exe 2684 pppvp.exe 2076 frxrllr.exe 2300 rflrxxf.exe 1924 tntthb.exe 960 3htttn.exe 928 tnbbbb.exe 2252 5jvdp.exe -
resource yara_rule behavioral1/memory/2668-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2668 wrote to memory of 1444 2668 e3cc6c1c6e5a1773da71cbf8ae7f1d80N.exe 30 PID 2668 wrote to memory of 1444 2668 e3cc6c1c6e5a1773da71cbf8ae7f1d80N.exe 30 PID 2668 wrote to memory of 1444 2668 e3cc6c1c6e5a1773da71cbf8ae7f1d80N.exe 30 PID 2668 wrote to memory of 1444 2668 e3cc6c1c6e5a1773da71cbf8ae7f1d80N.exe 30 PID 1444 wrote to memory of 1740 1444 xrfrxfl.exe 31 PID 1444 wrote to memory of 1740 1444 xrfrxfl.exe 31 PID 1444 wrote to memory of 1740 1444 xrfrxfl.exe 31 PID 1444 wrote to memory of 1740 1444 xrfrxfl.exe 31 PID 1740 wrote to memory of 3068 1740 1fxfllr.exe 32 PID 1740 wrote to memory of 3068 1740 1fxfllr.exe 32 PID 1740 wrote to memory of 3068 1740 1fxfllr.exe 32 PID 1740 wrote to memory of 3068 1740 1fxfllr.exe 32 PID 3068 wrote to memory of 2776 3068 9thbtt.exe 33 PID 3068 wrote to memory of 2776 3068 9thbtt.exe 33 PID 3068 wrote to memory of 2776 3068 9thbtt.exe 33 PID 3068 wrote to memory of 2776 3068 9thbtt.exe 33 PID 2776 wrote to memory of 2348 2776 tnbnnn.exe 34 PID 2776 wrote to memory of 2348 2776 tnbnnn.exe 34 PID 2776 wrote to memory of 2348 2776 tnbnnn.exe 34 PID 2776 wrote to memory of 2348 2776 tnbnnn.exe 34 PID 2348 wrote to memory of 2692 2348 dpvvv.exe 35 PID 2348 wrote to memory of 2692 2348 dpvvv.exe 35 PID 2348 wrote to memory of 2692 2348 dpvvv.exe 35 PID 2348 wrote to memory of 2692 2348 dpvvv.exe 35 PID 2692 wrote to memory of 2052 2692 xrfllfl.exe 36 PID 2692 wrote to memory of 2052 2692 xrfllfl.exe 36 PID 2692 wrote to memory of 2052 2692 xrfllfl.exe 36 PID 2692 wrote to memory of 2052 2692 xrfllfl.exe 36 PID 2052 wrote to memory of 2784 2052 9hnhbb.exe 37 PID 2052 wrote to memory of 2784 2052 9hnhbb.exe 37 PID 2052 wrote to memory of 2784 2052 9hnhbb.exe 37 PID 2052 wrote to memory of 2784 2052 9hnhbb.exe 37 PID 2784 wrote to memory of 2900 2784 pjppv.exe 38 PID 2784 wrote to memory of 2900 2784 pjppv.exe 38 PID 2784 wrote to memory of 2900 2784 pjppv.exe 38 PID 2784 wrote to memory of 2900 2784 pjppv.exe 38 PID 2900 wrote to memory of 2660 2900 lfrrrxf.exe 39 PID 2900 wrote to memory of 2660 2900 lfrrrxf.exe 39 PID 2900 wrote to memory of 2660 2900 lfrrrxf.exe 39 PID 2900 wrote to memory of 2660 2900 lfrrrxf.exe 39 PID 2660 wrote to memory of 2456 2660 lfrxxrf.exe 40 PID 2660 wrote to memory of 2456 2660 lfrxxrf.exe 40 PID 2660 wrote to memory of 2456 2660 lfrxxrf.exe 40 PID 2660 wrote to memory of 2456 2660 lfrxxrf.exe 40 PID 2456 wrote to memory of 1668 2456 bhbtnt.exe 41 PID 2456 wrote to memory of 1668 2456 bhbtnt.exe 41 PID 2456 wrote to memory of 1668 2456 bhbtnt.exe 41 PID 2456 wrote to memory of 1668 2456 bhbtnt.exe 41 PID 1668 wrote to memory of 2804 1668 jddvv.exe 42 PID 1668 wrote to memory of 2804 1668 jddvv.exe 42 PID 1668 wrote to memory of 2804 1668 jddvv.exe 42 PID 1668 wrote to memory of 2804 1668 jddvv.exe 42 PID 2804 wrote to memory of 576 2804 3jvdv.exe 43 PID 2804 wrote to memory of 576 2804 3jvdv.exe 43 PID 2804 wrote to memory of 576 2804 3jvdv.exe 43 PID 2804 wrote to memory of 576 2804 3jvdv.exe 43 PID 576 wrote to memory of 2824 576 llrlllr.exe 44 PID 576 wrote to memory of 2824 576 llrlllr.exe 44 PID 576 wrote to memory of 2824 576 llrlllr.exe 44 PID 576 wrote to memory of 2824 576 llrlllr.exe 44 PID 2824 wrote to memory of 2656 2824 3bnnhn.exe 45 PID 2824 wrote to memory of 2656 2824 3bnnhn.exe 45 PID 2824 wrote to memory of 2656 2824 3bnnhn.exe 45 PID 2824 wrote to memory of 2656 2824 3bnnhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3cc6c1c6e5a1773da71cbf8ae7f1d80N.exe"C:\Users\Admin\AppData\Local\Temp\e3cc6c1c6e5a1773da71cbf8ae7f1d80N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\xrfrxfl.exec:\xrfrxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\1fxfllr.exec:\1fxfllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\9thbtt.exec:\9thbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\tnbnnn.exec:\tnbnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\dpvvv.exec:\dpvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\xrfllfl.exec:\xrfllfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\9hnhbb.exec:\9hnhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\pjppv.exec:\pjppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\lfrxxrf.exec:\lfrxxrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bhbtnt.exec:\bhbtnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\jddvv.exec:\jddvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\3jvdv.exec:\3jvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\llrlllr.exec:\llrlllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\3bnnhn.exec:\3bnnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\hnbbth.exec:\hnbbth.exe17⤵
- Executes dropped EXE
PID:2656 -
\??\c:\7jvjj.exec:\7jvjj.exe18⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xxffrrl.exec:\xxffrrl.exe19⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lfxlfll.exec:\lfxlfll.exe20⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1htbnb.exec:\1htbnb.exe21⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nhnnbb.exec:\nhnnbb.exe22⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vvvdd.exec:\vvvdd.exe23⤵
- Executes dropped EXE
PID:2364 -
\??\c:\vjvvj.exec:\vjvvj.exe24⤵
- Executes dropped EXE
PID:844 -
\??\c:\7lflxff.exec:\7lflxff.exe25⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rrfrxfx.exec:\rrfrxfx.exe26⤵
- Executes dropped EXE
PID:2252 -
\??\c:\hhtbhn.exec:\hhtbhn.exe27⤵
- Executes dropped EXE
PID:2164 -
\??\c:\9hbhhh.exec:\9hbhhh.exe28⤵
- Executes dropped EXE
PID:2484 -
\??\c:\7pjjp.exec:\7pjjp.exe29⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rflrrrr.exec:\rflrrrr.exe30⤵
- Executes dropped EXE
PID:1788 -
\??\c:\9lrxflf.exec:\9lrxflf.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\tbtbhh.exec:\tbtbhh.exe32⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nttnnh.exec:\nttnnh.exe33⤵
- Executes dropped EXE
PID:2564 -
\??\c:\dvpvv.exec:\dvpvv.exe34⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rrxllfr.exec:\rrxllfr.exe35⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rlrfflr.exec:\rlrfflr.exe36⤵
- Executes dropped EXE
PID:1588 -
\??\c:\5bbhnt.exec:\5bbhnt.exe37⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hbntht.exec:\hbntht.exe38⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ddvvj.exec:\ddvvj.exe39⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vjjdj.exec:\vjjdj.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\7djdd.exec:\7djdd.exe41⤵
- Executes dropped EXE
PID:2924 -
\??\c:\lxxfrrx.exec:\lxxfrrx.exe42⤵
- Executes dropped EXE
PID:2888 -
\??\c:\3ffxrrx.exec:\3ffxrrx.exe43⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nhbbth.exec:\nhbbth.exe44⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nnbhtt.exec:\nnbhtt.exe45⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vjppd.exec:\vjppd.exe46⤵
- Executes dropped EXE
PID:2144 -
\??\c:\pppvp.exec:\pppvp.exe47⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vdjjp.exec:\vdjjp.exe48⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rfrlffl.exec:\rfrlffl.exe49⤵
- Executes dropped EXE
PID:264 -
\??\c:\1lffrrl.exec:\1lffrrl.exe50⤵
- Executes dropped EXE
PID:1580 -
\??\c:\nhtbhn.exec:\nhtbhn.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1628 -
\??\c:\5hbbhb.exec:\5hbbhb.exe52⤵
- Executes dropped EXE
PID:480 -
\??\c:\dvddd.exec:\dvddd.exe53⤵
- Executes dropped EXE
PID:2824 -
\??\c:\pdjdj.exec:\pdjdj.exe54⤵
- Executes dropped EXE
PID:2344 -
\??\c:\3dddj.exec:\3dddj.exe55⤵
- Executes dropped EXE
PID:1160 -
\??\c:\fxffrxr.exec:\fxffrxr.exe56⤵
- Executes dropped EXE
PID:2984 -
\??\c:\rfrxlxx.exec:\rfrxlxx.exe57⤵
- Executes dropped EXE
PID:2768 -
\??\c:\dvddj.exec:\dvddj.exe58⤵
- Executes dropped EXE
PID:2780 -
\??\c:\pppvp.exec:\pppvp.exe59⤵
- Executes dropped EXE
PID:2684 -
\??\c:\frxrllr.exec:\frxrllr.exe60⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rflrxxf.exec:\rflrxxf.exe61⤵
- Executes dropped EXE
PID:2300 -
\??\c:\tntthb.exec:\tntthb.exe62⤵
- Executes dropped EXE
PID:1924 -
\??\c:\3htttn.exec:\3htttn.exe63⤵
- Executes dropped EXE
PID:960 -
\??\c:\tnbbbb.exec:\tnbbbb.exe64⤵
- Executes dropped EXE
PID:928 -
\??\c:\5jvdp.exec:\5jvdp.exe65⤵
- Executes dropped EXE
PID:2252 -
\??\c:\pjvvv.exec:\pjvvv.exe66⤵PID:2772
-
\??\c:\1frrlfl.exec:\1frrlfl.exe67⤵PID:2272
-
\??\c:\rfllrlx.exec:\rfllrlx.exe68⤵PID:872
-
\??\c:\hbbhnt.exec:\hbbhnt.exe69⤵PID:2540
-
\??\c:\hbttnt.exec:\hbttnt.exe70⤵PID:1696
-
\??\c:\tbnttt.exec:\tbnttt.exe71⤵PID:2672
-
\??\c:\jjvdp.exec:\jjvdp.exe72⤵PID:2512
-
\??\c:\dpjvp.exec:\dpjvp.exe73⤵PID:1524
-
\??\c:\vjvpp.exec:\vjvpp.exe74⤵PID:1740
-
\??\c:\9rxxfff.exec:\9rxxfff.exe75⤵PID:2412
-
\??\c:\frrxfrf.exec:\frrxfrf.exe76⤵PID:1716
-
\??\c:\tbhbnt.exec:\tbhbnt.exe77⤵PID:1848
-
\??\c:\thbhnt.exec:\thbhnt.exe78⤵PID:2224
-
\??\c:\3pvvp.exec:\3pvvp.exe79⤵PID:1248
-
\??\c:\vjpdd.exec:\vjpdd.exe80⤵PID:2356
-
\??\c:\frxxrxf.exec:\frxxrxf.exe81⤵PID:2728
-
\??\c:\rxflrlf.exec:\rxflrlf.exe82⤵PID:2924
-
\??\c:\nbnnnt.exec:\nbnnnt.exe83⤵PID:2888
-
\??\c:\bbthnn.exec:\bbthnn.exe84⤵PID:2592
-
\??\c:\pppdj.exec:\pppdj.exe85⤵PID:2700
-
\??\c:\pvppj.exec:\pvppj.exe86⤵PID:2324
-
\??\c:\rrllxxl.exec:\rrllxxl.exe87⤵PID:2640
-
\??\c:\xrllrrr.exec:\xrllrrr.exe88⤵PID:2832
-
\??\c:\bbbhtb.exec:\bbbhtb.exe89⤵PID:2308
-
\??\c:\hbhhhb.exec:\hbhhhb.exe90⤵PID:664
-
\??\c:\vpddj.exec:\vpddj.exe91⤵PID:2816
-
\??\c:\jpjjv.exec:\jpjjv.exe92⤵PID:980
-
\??\c:\xrlrrrl.exec:\xrlrrrl.exe93⤵PID:480
-
\??\c:\fflflff.exec:\fflflff.exe94⤵PID:1156
-
\??\c:\thttnt.exec:\thttnt.exe95⤵PID:2344
-
\??\c:\hbhbhb.exec:\hbhbhb.exe96⤵PID:1160
-
\??\c:\vvpvp.exec:\vvpvp.exe97⤵PID:2984
-
\??\c:\djjvj.exec:\djjvj.exe98⤵PID:1988
-
\??\c:\xrfllfl.exec:\xrfllfl.exe99⤵PID:2780
-
\??\c:\5frlllr.exec:\5frlllr.exe100⤵PID:2360
-
\??\c:\tntnhb.exec:\tntnhb.exe101⤵PID:2076
-
\??\c:\nhnntn.exec:\nhnntn.exe102⤵PID:1448
-
\??\c:\vdppv.exec:\vdppv.exe103⤵PID:1924
-
\??\c:\vjpjp.exec:\vjpjp.exe104⤵PID:300
-
\??\c:\7pdpp.exec:\7pdpp.exe105⤵PID:1040
-
\??\c:\1lrrrxx.exec:\1lrrrxx.exe106⤵PID:2196
-
\??\c:\rllflrx.exec:\rllflrx.exe107⤵PID:2772
-
\??\c:\bttntn.exec:\bttntn.exe108⤵PID:796
-
\??\c:\nbntbt.exec:\nbntbt.exe109⤵PID:2464
-
\??\c:\pvjjv.exec:\pvjjv.exe110⤵PID:1076
-
\??\c:\jvjdj.exec:\jvjdj.exe111⤵PID:1504
-
\??\c:\3rrrxxl.exec:\3rrrxxl.exe112⤵PID:2064
-
\??\c:\7lfxxxl.exec:\7lfxxxl.exe113⤵PID:2564
-
\??\c:\hhbhbt.exec:\hhbhbt.exe114⤵PID:1996
-
\??\c:\hthnnn.exec:\hthnnn.exe115⤵PID:1740
-
\??\c:\pdjdv.exec:\pdjdv.exe116⤵PID:2412
-
\??\c:\vjvvv.exec:\vjvvv.exe117⤵PID:1716
-
\??\c:\1xrfrxr.exec:\1xrfrxr.exe118⤵PID:2736
-
\??\c:\3rrrffr.exec:\3rrrffr.exe119⤵PID:2224
-
\??\c:\9bnnnh.exec:\9bnnnh.exe120⤵PID:2880
-
\??\c:\3hhbhb.exec:\3hhbhb.exe121⤵PID:2712
-
\??\c:\pppjd.exec:\pppjd.exe122⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-