Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 00:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a35864cb42194101f992262cf7498280N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
a35864cb42194101f992262cf7498280N.exe
-
Size
75KB
-
MD5
a35864cb42194101f992262cf7498280
-
SHA1
a35188aaf9c9611fcc441dd3026879f481f78e1a
-
SHA256
3fa71f662646bc7ecc2241af7b44678f9b6fa952e97d6ec5364a0fddf502b5c0
-
SHA512
292be8498e186316095b6feada43d99e5a68de2c4b52eb8f1aed771f52890357ca7caafb6a089abcae6d1fce39c4450403b252cbe60b52f5c901d1e9c57c72ad
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmPaZ:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHL
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/3200-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1924 btbttt.exe 3276 jvddv.exe 4292 xlrffxl.exe 4360 bthbtt.exe 824 fxxrlll.exe 2296 hthnnn.exe 1388 pjpjd.exe 2412 ddvjd.exe 2528 hbhbtb.exe 4844 jvppj.exe 3108 fxxrfxx.exe 1476 7bbtnn.exe 5072 jvdvj.exe 1368 llrlflf.exe 3568 bhnhtn.exe 3212 dpjvv.exe 1216 3lrrxfl.exe 1196 lflfllx.exe 4348 5hnhnn.exe 4816 pjvjd.exe 4596 llxxxlx.exe 4088 7thbhh.exe 2640 pvjdp.exe 3580 rlrrrff.exe 2744 xxxrrrl.exe 4800 9hbbth.exe 4804 dvddd.exe 468 ddvpp.exe 3044 fxrxxlr.exe 1492 tttbbb.exe 1620 9rfffff.exe 4512 xxxrlll.exe 4776 ntbtbh.exe 4080 pvjjv.exe 2908 frrfrfr.exe 960 hhbhbn.exe 812 ddddj.exe 4464 vjddv.exe 4604 lfxrllr.exe 4448 bhnnth.exe 4564 nnbbnn.exe 2548 lrrrlll.exe 3336 frlxlxx.exe 3680 btbhbn.exe 4744 3jvdp.exe 2008 lfflllf.exe 4820 lxlffxx.exe 1132 9bbttt.exe 4764 9ttbtt.exe 3908 jdjdv.exe 924 lffflrr.exe 708 ttbthh.exe 3548 btbbhh.exe 4256 pvdvv.exe 1836 pdjdv.exe 1692 rxxxrxx.exe 1668 flxlrrl.exe 1572 bnhtbh.exe 3532 jpddp.exe 4048 ppjpj.exe 556 xrllflr.exe 3568 lfxxfrx.exe 3172 bhnhhb.exe 644 jvddj.exe -
resource yara_rule behavioral2/memory/3200-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3200 wrote to memory of 1924 3200 a35864cb42194101f992262cf7498280N.exe 83 PID 3200 wrote to memory of 1924 3200 a35864cb42194101f992262cf7498280N.exe 83 PID 3200 wrote to memory of 1924 3200 a35864cb42194101f992262cf7498280N.exe 83 PID 1924 wrote to memory of 3276 1924 btbttt.exe 84 PID 1924 wrote to memory of 3276 1924 btbttt.exe 84 PID 1924 wrote to memory of 3276 1924 btbttt.exe 84 PID 3276 wrote to memory of 4292 3276 jvddv.exe 85 PID 3276 wrote to memory of 4292 3276 jvddv.exe 85 PID 3276 wrote to memory of 4292 3276 jvddv.exe 85 PID 4292 wrote to memory of 4360 4292 xlrffxl.exe 86 PID 4292 wrote to memory of 4360 4292 xlrffxl.exe 86 PID 4292 wrote to memory of 4360 4292 xlrffxl.exe 86 PID 4360 wrote to memory of 824 4360 bthbtt.exe 87 PID 4360 wrote to memory of 824 4360 bthbtt.exe 87 PID 4360 wrote to memory of 824 4360 bthbtt.exe 87 PID 824 wrote to memory of 2296 824 fxxrlll.exe 88 PID 824 wrote to memory of 2296 824 fxxrlll.exe 88 PID 824 wrote to memory of 2296 824 fxxrlll.exe 88 PID 2296 wrote to memory of 1388 2296 hthnnn.exe 89 PID 2296 wrote to memory of 1388 2296 hthnnn.exe 89 PID 2296 wrote to memory of 1388 2296 hthnnn.exe 89 PID 1388 wrote to memory of 2412 1388 pjpjd.exe 90 PID 1388 wrote to memory of 2412 1388 pjpjd.exe 90 PID 1388 wrote to memory of 2412 1388 pjpjd.exe 90 PID 2412 wrote to memory of 2528 2412 ddvjd.exe 91 PID 2412 wrote to memory of 2528 2412 ddvjd.exe 91 PID 2412 wrote to memory of 2528 2412 ddvjd.exe 91 PID 2528 wrote to memory of 4844 2528 hbhbtb.exe 92 PID 2528 wrote to memory of 4844 2528 hbhbtb.exe 92 PID 2528 wrote to memory of 4844 2528 hbhbtb.exe 92 PID 4844 wrote to memory of 3108 4844 jvppj.exe 93 PID 4844 wrote to memory of 3108 4844 jvppj.exe 93 PID 4844 wrote to memory of 3108 4844 jvppj.exe 93 PID 3108 wrote to memory of 1476 3108 fxxrfxx.exe 94 PID 3108 wrote to memory of 1476 3108 fxxrfxx.exe 94 PID 3108 wrote to memory of 1476 3108 fxxrfxx.exe 94 PID 1476 wrote to memory of 5072 1476 7bbtnn.exe 95 PID 1476 wrote to memory of 5072 1476 7bbtnn.exe 95 PID 1476 wrote to memory of 5072 1476 7bbtnn.exe 95 PID 5072 wrote to memory of 1368 5072 jvdvj.exe 97 PID 5072 wrote to memory of 1368 5072 jvdvj.exe 97 PID 5072 wrote to memory of 1368 5072 jvdvj.exe 97 PID 1368 wrote to memory of 3568 1368 llrlflf.exe 98 PID 1368 wrote to memory of 3568 1368 llrlflf.exe 98 PID 1368 wrote to memory of 3568 1368 llrlflf.exe 98 PID 3568 wrote to memory of 3212 3568 bhnhtn.exe 99 PID 3568 wrote to memory of 3212 3568 bhnhtn.exe 99 PID 3568 wrote to memory of 3212 3568 bhnhtn.exe 99 PID 3212 wrote to memory of 1216 3212 dpjvv.exe 100 PID 3212 wrote to memory of 1216 3212 dpjvv.exe 100 PID 3212 wrote to memory of 1216 3212 dpjvv.exe 100 PID 1216 wrote to memory of 1196 1216 3lrrxfl.exe 101 PID 1216 wrote to memory of 1196 1216 3lrrxfl.exe 101 PID 1216 wrote to memory of 1196 1216 3lrrxfl.exe 101 PID 1196 wrote to memory of 4348 1196 lflfllx.exe 102 PID 1196 wrote to memory of 4348 1196 lflfllx.exe 102 PID 1196 wrote to memory of 4348 1196 lflfllx.exe 102 PID 4348 wrote to memory of 4816 4348 5hnhnn.exe 103 PID 4348 wrote to memory of 4816 4348 5hnhnn.exe 103 PID 4348 wrote to memory of 4816 4348 5hnhnn.exe 103 PID 4816 wrote to memory of 4596 4816 pjvjd.exe 104 PID 4816 wrote to memory of 4596 4816 pjvjd.exe 104 PID 4816 wrote to memory of 4596 4816 pjvjd.exe 104 PID 4596 wrote to memory of 4088 4596 llxxxlx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\a35864cb42194101f992262cf7498280N.exe"C:\Users\Admin\AppData\Local\Temp\a35864cb42194101f992262cf7498280N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\btbttt.exec:\btbttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\jvddv.exec:\jvddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\xlrffxl.exec:\xlrffxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\bthbtt.exec:\bthbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\fxxrlll.exec:\fxxrlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\hthnnn.exec:\hthnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\pjpjd.exec:\pjpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\ddvjd.exec:\ddvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\hbhbtb.exec:\hbhbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\jvppj.exec:\jvppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\fxxrfxx.exec:\fxxrfxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\7bbtnn.exec:\7bbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\jvdvj.exec:\jvdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\llrlflf.exec:\llrlflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\bhnhtn.exec:\bhnhtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\dpjvv.exec:\dpjvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\3lrrxfl.exec:\3lrrxfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\lflfllx.exec:\lflfllx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\5hnhnn.exec:\5hnhnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\pjvjd.exec:\pjvjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\llxxxlx.exec:\llxxxlx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\7thbhh.exec:\7thbhh.exe23⤵
- Executes dropped EXE
PID:4088 -
\??\c:\pvjdp.exec:\pvjdp.exe24⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rlrrrff.exec:\rlrrrff.exe25⤵
- Executes dropped EXE
PID:3580 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe26⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9hbbth.exec:\9hbbth.exe27⤵
- Executes dropped EXE
PID:4800 -
\??\c:\dvddd.exec:\dvddd.exe28⤵
- Executes dropped EXE
PID:4804 -
\??\c:\ddvpp.exec:\ddvpp.exe29⤵
- Executes dropped EXE
PID:468 -
\??\c:\fxrxxlr.exec:\fxrxxlr.exe30⤵
- Executes dropped EXE
PID:3044 -
\??\c:\tttbbb.exec:\tttbbb.exe31⤵
- Executes dropped EXE
PID:1492 -
\??\c:\9rfffff.exec:\9rfffff.exe32⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xxxrlll.exec:\xxxrlll.exe33⤵
- Executes dropped EXE
PID:4512 -
\??\c:\ntbtbh.exec:\ntbtbh.exe34⤵
- Executes dropped EXE
PID:4776 -
\??\c:\pvjjv.exec:\pvjjv.exe35⤵
- Executes dropped EXE
PID:4080 -
\??\c:\frrfrfr.exec:\frrfrfr.exe36⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hhbhbn.exec:\hhbhbn.exe37⤵
- Executes dropped EXE
PID:960 -
\??\c:\ddddj.exec:\ddddj.exe38⤵
- Executes dropped EXE
PID:812 -
\??\c:\vjddv.exec:\vjddv.exe39⤵
- Executes dropped EXE
PID:4464 -
\??\c:\lfxrllr.exec:\lfxrllr.exe40⤵
- Executes dropped EXE
PID:4604 -
\??\c:\bhnnth.exec:\bhnnth.exe41⤵
- Executes dropped EXE
PID:4448 -
\??\c:\nnbbnn.exec:\nnbbnn.exe42⤵
- Executes dropped EXE
PID:4564 -
\??\c:\lrrrlll.exec:\lrrrlll.exe43⤵
- Executes dropped EXE
PID:2548 -
\??\c:\frlxlxx.exec:\frlxlxx.exe44⤵
- Executes dropped EXE
PID:3336 -
\??\c:\btbhbn.exec:\btbhbn.exe45⤵
- Executes dropped EXE
PID:3680 -
\??\c:\3jvdp.exec:\3jvdp.exe46⤵
- Executes dropped EXE
PID:4744 -
\??\c:\lfflllf.exec:\lfflllf.exe47⤵
- Executes dropped EXE
PID:2008 -
\??\c:\lxlffxx.exec:\lxlffxx.exe48⤵
- Executes dropped EXE
PID:4820 -
\??\c:\9bbttt.exec:\9bbttt.exe49⤵
- Executes dropped EXE
PID:1132 -
\??\c:\9ttbtt.exec:\9ttbtt.exe50⤵
- Executes dropped EXE
PID:4764 -
\??\c:\jdjdv.exec:\jdjdv.exe51⤵
- Executes dropped EXE
PID:3908 -
\??\c:\lffflrr.exec:\lffflrr.exe52⤵
- Executes dropped EXE
PID:924 -
\??\c:\ttbthh.exec:\ttbthh.exe53⤵
- Executes dropped EXE
PID:708 -
\??\c:\btbbhh.exec:\btbbhh.exe54⤵
- Executes dropped EXE
PID:3548 -
\??\c:\pvdvv.exec:\pvdvv.exe55⤵
- Executes dropped EXE
PID:4256 -
\??\c:\pdjdv.exec:\pdjdv.exe56⤵
- Executes dropped EXE
PID:1836 -
\??\c:\rxxxrxx.exec:\rxxxrxx.exe57⤵
- Executes dropped EXE
PID:1692 -
\??\c:\flxlrrl.exec:\flxlrrl.exe58⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bnhtbh.exec:\bnhtbh.exe59⤵
- Executes dropped EXE
PID:1572 -
\??\c:\jpddp.exec:\jpddp.exe60⤵
- Executes dropped EXE
PID:3532 -
\??\c:\ppjpj.exec:\ppjpj.exe61⤵
- Executes dropped EXE
PID:4048 -
\??\c:\xrllflr.exec:\xrllflr.exe62⤵
- Executes dropped EXE
PID:556 -
\??\c:\lfxxfrx.exec:\lfxxfrx.exe63⤵
- Executes dropped EXE
PID:3568 -
\??\c:\bhnhhb.exec:\bhnhhb.exe64⤵
- Executes dropped EXE
PID:3172 -
\??\c:\jvddj.exec:\jvddj.exe65⤵
- Executes dropped EXE
PID:644 -
\??\c:\ppjpj.exec:\ppjpj.exe66⤵PID:4700
-
\??\c:\xrfllll.exec:\xrfllll.exe67⤵PID:3524
-
\??\c:\tthnbt.exec:\tthnbt.exe68⤵PID:2468
-
\??\c:\ttnhbt.exec:\ttnhbt.exe69⤵PID:4856
-
\??\c:\ppvdp.exec:\ppvdp.exe70⤵PID:4888
-
\??\c:\jjpvp.exec:\jjpvp.exe71⤵PID:4156
-
\??\c:\xxxxxxf.exec:\xxxxxxf.exe72⤵PID:4596
-
\??\c:\rffffff.exec:\rffffff.exe73⤵PID:1948
-
\??\c:\btbttb.exec:\btbttb.exe74⤵PID:3556
-
\??\c:\vvppj.exec:\vvppj.exe75⤵PID:2640
-
\??\c:\9ppjj.exec:\9ppjj.exe76⤵PID:3580
-
\??\c:\fxllfff.exec:\fxllfff.exe77⤵PID:4880
-
\??\c:\fflfrrl.exec:\fflfrrl.exe78⤵
- System Location Discovery: System Language Discovery
PID:2276 -
\??\c:\1ntnnb.exec:\1ntnnb.exe79⤵PID:2760
-
\??\c:\djjjj.exec:\djjjj.exe80⤵PID:2608
-
\??\c:\xlxrlxx.exec:\xlxrlxx.exe81⤵PID:4696
-
\??\c:\3xxlffx.exec:\3xxlffx.exe82⤵PID:3536
-
\??\c:\hhbnth.exec:\hhbnth.exe83⤵PID:1632
-
\??\c:\hnhtht.exec:\hnhtht.exe84⤵PID:8
-
\??\c:\pppjd.exec:\pppjd.exe85⤵PID:2684
-
\??\c:\vvvvp.exec:\vvvvp.exe86⤵PID:3364
-
\??\c:\xxfflff.exec:\xxfflff.exe87⤵PID:4884
-
\??\c:\hhbhbh.exec:\hhbhbh.exe88⤵PID:3140
-
\??\c:\tbtnbh.exec:\tbtnbh.exe89⤵PID:32
-
\??\c:\pdpjj.exec:\pdpjj.exe90⤵PID:3020
-
\??\c:\xrrlllx.exec:\xrrlllx.exe91⤵PID:1480
-
\??\c:\lrxxxxf.exec:\lrxxxxf.exe92⤵PID:732
-
\??\c:\7bnhhn.exec:\7bnhhn.exe93⤵PID:368
-
\??\c:\vjjdv.exec:\vjjdv.exe94⤵PID:3028
-
\??\c:\jdvdv.exec:\jdvdv.exe95⤵PID:4708
-
\??\c:\9rrrfll.exec:\9rrrfll.exe96⤵
- System Location Discovery: System Language Discovery
PID:4588 -
\??\c:\1nhhbt.exec:\1nhhbt.exe97⤵PID:1944
-
\??\c:\bbttnt.exec:\bbttnt.exe98⤵PID:232
-
\??\c:\dpddv.exec:\dpddv.exe99⤵PID:5064
-
\??\c:\9xrlllf.exec:\9xrlllf.exe100⤵PID:2540
-
\??\c:\fffffrx.exec:\fffffrx.exe101⤵PID:4920
-
\??\c:\1hhhbh.exec:\1hhhbh.exe102⤵PID:1584
-
\??\c:\jjvvv.exec:\jjvvv.exe103⤵PID:3880
-
\??\c:\xrlffff.exec:\xrlffff.exe104⤵PID:3380
-
\??\c:\bbhhnn.exec:\bbhhnn.exe105⤵PID:992
-
\??\c:\pdjjv.exec:\pdjjv.exe106⤵PID:1752
-
\??\c:\flffxxx.exec:\flffxxx.exe107⤵PID:2412
-
\??\c:\thnbbh.exec:\thnbbh.exe108⤵PID:1848
-
\??\c:\dvvpj.exec:\dvvpj.exe109⤵PID:3616
-
\??\c:\rfrrxlr.exec:\rfrrxlr.exe110⤵PID:4844
-
\??\c:\nhnhhh.exec:\nhnhhh.exe111⤵PID:2472
-
\??\c:\nnbnnt.exec:\nnbnnt.exe112⤵PID:1648
-
\??\c:\jddvv.exec:\jddvv.exe113⤵PID:3224
-
\??\c:\1pjdv.exec:\1pjdv.exe114⤵PID:3676
-
\??\c:\llffllx.exec:\llffllx.exe115⤵PID:4500
-
\??\c:\hhhbtt.exec:\hhhbtt.exe116⤵PID:2856
-
\??\c:\5tnhhh.exec:\5tnhhh.exe117⤵PID:4328
-
\??\c:\vpjdv.exec:\vpjdv.exe118⤵PID:1216
-
\??\c:\xrxrrxf.exec:\xrxrrxf.exe119⤵PID:4712
-
\??\c:\1rrfffx.exec:\1rrfffx.exe120⤵PID:4980
-
\??\c:\btbttt.exec:\btbttt.exe121⤵PID:4528
-
\??\c:\nhtnhh.exec:\nhtnhh.exe122⤵PID:4836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-