Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 13:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c745b4cadc92d6b0aa111e738baf88b0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
c745b4cadc92d6b0aa111e738baf88b0N.exe
-
Size
59KB
-
MD5
c745b4cadc92d6b0aa111e738baf88b0
-
SHA1
1db2c46004a866c5a5cefa42f93cd5cfdf4c6aa5
-
SHA256
e89ce8a368b30c28ea855e377fe6c037933f1ecf2565c56655e816ced45e4726
-
SHA512
54bafb5e17a6cf5ab9fca00f23309dc9535796d3dbebd40f28ddaa44c96ade1f416b1993d06307f18b20fc68e29957dc54e3c53438b4cde6f7f6c06a2c1ca462
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIm2hRL:ymb3NkkiQ3mdBjFIsIrhRL
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2700-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/788-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1448-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/784-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/620-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/448-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1508 lfrrxxf.exe 2532 nbhntt.exe 2940 jdpdj.exe 2124 jpjdp.exe 2932 3jdvv.exe 2628 lxlflfr.exe 3000 thtbnh.exe 2620 dpddp.exe 2380 7xlxfxf.exe 1788 tnbttb.exe 788 3vjjv.exe 3020 frllxxl.exe 2720 xllfxrx.exe 1448 bttbtn.exe 2964 thtbhh.exe 2012 9jjdd.exe 1620 xrlrxff.exe 2508 fllrlxf.exe 784 bntbhb.exe 620 nhnhnn.exe 1852 9vjpv.exe 376 frxflfl.exe 448 bhtnnn.exe 1536 hbhhnh.exe 712 vpddp.exe 764 3djvd.exe 1664 lxfxrrr.exe 1860 hthnth.exe 2192 tnbbbt.exe 2348 jjjdp.exe 2104 5rxfrrx.exe 2540 rllfxlr.exe 2712 hthhnb.exe 2824 5nhbhh.exe 2124 7vjjj.exe 2084 djjdd.exe 2852 7lfrrrf.exe 2736 frxxxrx.exe 2844 bnnbhh.exe 2732 jdjpv.exe 2692 vpvpj.exe 2052 lfffrrr.exe 1000 flrxxlr.exe 684 btnthh.exe 3040 nhhnbh.exe 2904 tnnttb.exe 2976 pjdpv.exe 2896 lxllrrf.exe 2972 rllrxxf.exe 1428 thbnbb.exe 2024 thbbnt.exe 1220 jdppj.exe 1620 pjvvj.exe 600 7djdd.exe 1172 rlxrxrx.exe 2320 tnbnbb.exe 1876 djvvd.exe 2600 lxxrrll.exe 1100 7lxfxrr.exe 2512 frrrrlr.exe 996 nhnnnh.exe 972 3btbbh.exe 792 jdppj.exe 1940 1jjvv.exe -
resource yara_rule behavioral1/memory/2700-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/788-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1448-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/784-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/620-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/448-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xflflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2700 wrote to memory of 1508 2700 c745b4cadc92d6b0aa111e738baf88b0N.exe 30 PID 2700 wrote to memory of 1508 2700 c745b4cadc92d6b0aa111e738baf88b0N.exe 30 PID 2700 wrote to memory of 1508 2700 c745b4cadc92d6b0aa111e738baf88b0N.exe 30 PID 2700 wrote to memory of 1508 2700 c745b4cadc92d6b0aa111e738baf88b0N.exe 30 PID 1508 wrote to memory of 2532 1508 lfrrxxf.exe 31 PID 1508 wrote to memory of 2532 1508 lfrrxxf.exe 31 PID 1508 wrote to memory of 2532 1508 lfrrxxf.exe 31 PID 1508 wrote to memory of 2532 1508 lfrrxxf.exe 31 PID 2532 wrote to memory of 2940 2532 nbhntt.exe 32 PID 2532 wrote to memory of 2940 2532 nbhntt.exe 32 PID 2532 wrote to memory of 2940 2532 nbhntt.exe 32 PID 2532 wrote to memory of 2940 2532 nbhntt.exe 32 PID 2940 wrote to memory of 2124 2940 jdpdj.exe 33 PID 2940 wrote to memory of 2124 2940 jdpdj.exe 33 PID 2940 wrote to memory of 2124 2940 jdpdj.exe 33 PID 2940 wrote to memory of 2124 2940 jdpdj.exe 33 PID 2124 wrote to memory of 2932 2124 jpjdp.exe 34 PID 2124 wrote to memory of 2932 2124 jpjdp.exe 34 PID 2124 wrote to memory of 2932 2124 jpjdp.exe 34 PID 2124 wrote to memory of 2932 2124 jpjdp.exe 34 PID 2932 wrote to memory of 2628 2932 3jdvv.exe 35 PID 2932 wrote to memory of 2628 2932 3jdvv.exe 35 PID 2932 wrote to memory of 2628 2932 3jdvv.exe 35 PID 2932 wrote to memory of 2628 2932 3jdvv.exe 35 PID 2628 wrote to memory of 3000 2628 lxlflfr.exe 36 PID 2628 wrote to memory of 3000 2628 lxlflfr.exe 36 PID 2628 wrote to memory of 3000 2628 lxlflfr.exe 36 PID 2628 wrote to memory of 3000 2628 lxlflfr.exe 36 PID 3000 wrote to memory of 2620 3000 thtbnh.exe 37 PID 3000 wrote to memory of 2620 3000 thtbnh.exe 37 PID 3000 wrote to memory of 2620 3000 thtbnh.exe 37 PID 3000 wrote to memory of 2620 3000 thtbnh.exe 37 PID 2620 wrote to memory of 2380 2620 dpddp.exe 38 PID 2620 wrote to memory of 2380 2620 dpddp.exe 38 PID 2620 wrote to memory of 2380 2620 dpddp.exe 38 PID 2620 wrote to memory of 2380 2620 dpddp.exe 38 PID 2380 wrote to memory of 1788 2380 7xlxfxf.exe 39 PID 2380 wrote to memory of 1788 2380 7xlxfxf.exe 39 PID 2380 wrote to memory of 1788 2380 7xlxfxf.exe 39 PID 2380 wrote to memory of 1788 2380 7xlxfxf.exe 39 PID 1788 wrote to memory of 788 1788 tnbttb.exe 40 PID 1788 wrote to memory of 788 1788 tnbttb.exe 40 PID 1788 wrote to memory of 788 1788 tnbttb.exe 40 PID 1788 wrote to memory of 788 1788 tnbttb.exe 40 PID 788 wrote to memory of 3020 788 3vjjv.exe 41 PID 788 wrote to memory of 3020 788 3vjjv.exe 41 PID 788 wrote to memory of 3020 788 3vjjv.exe 41 PID 788 wrote to memory of 3020 788 3vjjv.exe 41 PID 3020 wrote to memory of 2720 3020 frllxxl.exe 42 PID 3020 wrote to memory of 2720 3020 frllxxl.exe 42 PID 3020 wrote to memory of 2720 3020 frllxxl.exe 42 PID 3020 wrote to memory of 2720 3020 frllxxl.exe 42 PID 2720 wrote to memory of 1448 2720 xllfxrx.exe 43 PID 2720 wrote to memory of 1448 2720 xllfxrx.exe 43 PID 2720 wrote to memory of 1448 2720 xllfxrx.exe 43 PID 2720 wrote to memory of 1448 2720 xllfxrx.exe 43 PID 1448 wrote to memory of 2964 1448 bttbtn.exe 44 PID 1448 wrote to memory of 2964 1448 bttbtn.exe 44 PID 1448 wrote to memory of 2964 1448 bttbtn.exe 44 PID 1448 wrote to memory of 2964 1448 bttbtn.exe 44 PID 2964 wrote to memory of 2012 2964 thtbhh.exe 45 PID 2964 wrote to memory of 2012 2964 thtbhh.exe 45 PID 2964 wrote to memory of 2012 2964 thtbhh.exe 45 PID 2964 wrote to memory of 2012 2964 thtbhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c745b4cadc92d6b0aa111e738baf88b0N.exe"C:\Users\Admin\AppData\Local\Temp\c745b4cadc92d6b0aa111e738baf88b0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\nbhntt.exec:\nbhntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jdpdj.exec:\jdpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\jpjdp.exec:\jpjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\3jdvv.exec:\3jdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\lxlflfr.exec:\lxlflfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\thtbnh.exec:\thtbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\dpddp.exec:\dpddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\7xlxfxf.exec:\7xlxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\tnbttb.exec:\tnbttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\3vjjv.exec:\3vjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\frllxxl.exec:\frllxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\xllfxrx.exec:\xllfxrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\bttbtn.exec:\bttbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\thtbhh.exec:\thtbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\9jjdd.exec:\9jjdd.exe17⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xrlrxff.exec:\xrlrxff.exe18⤵
- Executes dropped EXE
PID:1620 -
\??\c:\fllrlxf.exec:\fllrlxf.exe19⤵
- Executes dropped EXE
PID:2508 -
\??\c:\bntbhb.exec:\bntbhb.exe20⤵
- Executes dropped EXE
PID:784 -
\??\c:\nhnhnn.exec:\nhnhnn.exe21⤵
- Executes dropped EXE
PID:620 -
\??\c:\9vjpv.exec:\9vjpv.exe22⤵
- Executes dropped EXE
PID:1852 -
\??\c:\frxflfl.exec:\frxflfl.exe23⤵
- Executes dropped EXE
PID:376 -
\??\c:\bhtnnn.exec:\bhtnnn.exe24⤵
- Executes dropped EXE
PID:448 -
\??\c:\hbhhnh.exec:\hbhhnh.exe25⤵
- Executes dropped EXE
PID:1536 -
\??\c:\vpddp.exec:\vpddp.exe26⤵
- Executes dropped EXE
PID:712 -
\??\c:\3djvd.exec:\3djvd.exe27⤵
- Executes dropped EXE
PID:764 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe28⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hthnth.exec:\hthnth.exe29⤵
- Executes dropped EXE
PID:1860 -
\??\c:\tnbbbt.exec:\tnbbbt.exe30⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jjjdp.exec:\jjjdp.exe31⤵
- Executes dropped EXE
PID:2348 -
\??\c:\5rxfrrx.exec:\5rxfrrx.exe32⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rllfxlr.exec:\rllfxlr.exe33⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hthhnb.exec:\hthhnb.exe34⤵
- Executes dropped EXE
PID:2712 -
\??\c:\5nhbhh.exec:\5nhbhh.exe35⤵
- Executes dropped EXE
PID:2824 -
\??\c:\7vjjj.exec:\7vjjj.exe36⤵
- Executes dropped EXE
PID:2124 -
\??\c:\djjdd.exec:\djjdd.exe37⤵
- Executes dropped EXE
PID:2084 -
\??\c:\7lfrrrf.exec:\7lfrrrf.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\frxxxrx.exec:\frxxxrx.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\bnnbhh.exec:\bnnbhh.exe40⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jdjpv.exec:\jdjpv.exe41⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vpvpj.exec:\vpvpj.exe42⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lfffrrr.exec:\lfffrrr.exe43⤵
- Executes dropped EXE
PID:2052 -
\??\c:\flrxxlr.exec:\flrxxlr.exe44⤵
- Executes dropped EXE
PID:1000 -
\??\c:\btnthh.exec:\btnthh.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:684 -
\??\c:\nhhnbh.exec:\nhhnbh.exe46⤵
- Executes dropped EXE
PID:3040 -
\??\c:\tnnttb.exec:\tnnttb.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\pjdpv.exec:\pjdpv.exe48⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lxllrrf.exec:\lxllrrf.exe49⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rllrxxf.exec:\rllrxxf.exe50⤵
- Executes dropped EXE
PID:2972 -
\??\c:\thbnbb.exec:\thbnbb.exe51⤵
- Executes dropped EXE
PID:1428 -
\??\c:\thbbnt.exec:\thbbnt.exe52⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jdppj.exec:\jdppj.exe53⤵
- Executes dropped EXE
PID:1220 -
\??\c:\pjvvj.exec:\pjvvj.exe54⤵
- Executes dropped EXE
PID:1620 -
\??\c:\7djdd.exec:\7djdd.exe55⤵
- Executes dropped EXE
PID:600 -
\??\c:\rlxrxrx.exec:\rlxrxrx.exe56⤵
- Executes dropped EXE
PID:1172 -
\??\c:\tnbnbb.exec:\tnbnbb.exe57⤵
- Executes dropped EXE
PID:2320 -
\??\c:\djvvd.exec:\djvvd.exe58⤵
- Executes dropped EXE
PID:1876 -
\??\c:\lxxrrll.exec:\lxxrrll.exe59⤵
- Executes dropped EXE
PID:2600 -
\??\c:\7lxfxrr.exec:\7lxfxrr.exe60⤵
- Executes dropped EXE
PID:1100 -
\??\c:\frrrrlr.exec:\frrrrlr.exe61⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nhnnnh.exec:\nhnnnh.exe62⤵
- Executes dropped EXE
PID:996 -
\??\c:\3btbbh.exec:\3btbbh.exe63⤵
- Executes dropped EXE
PID:972 -
\??\c:\jdppj.exec:\jdppj.exe64⤵
- Executes dropped EXE
PID:792 -
\??\c:\1jjvv.exec:\1jjvv.exe65⤵
- Executes dropped EXE
PID:1940 -
\??\c:\9rrlfxr.exec:\9rrlfxr.exe66⤵PID:1588
-
\??\c:\rfxrrlr.exec:\rfxrrlr.exe67⤵PID:2076
-
\??\c:\bhthhb.exec:\bhthhb.exe68⤵PID:2092
-
\??\c:\tnbbhn.exec:\tnbbhn.exe69⤵PID:2088
-
\??\c:\vdjjp.exec:\vdjjp.exe70⤵PID:1552
-
\??\c:\vppjd.exec:\vppjd.exe71⤵PID:2516
-
\??\c:\jjddv.exec:\jjddv.exe72⤵PID:2208
-
\??\c:\fxfxfxx.exec:\fxfxfxx.exe73⤵PID:2828
-
\??\c:\xffffff.exec:\xffffff.exe74⤵PID:2836
-
\??\c:\hthntt.exec:\hthntt.exe75⤵PID:2772
-
\??\c:\9hbttn.exec:\9hbttn.exe76⤵PID:2932
-
\??\c:\vpjdj.exec:\vpjdj.exe77⤵PID:3068
-
\??\c:\1dvvj.exec:\1dvvj.exe78⤵PID:2936
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe79⤵PID:2668
-
\??\c:\flllrll.exec:\flllrll.exe80⤵PID:2640
-
\??\c:\9bbbhb.exec:\9bbbhb.exe81⤵PID:2364
-
\??\c:\hbhbbt.exec:\hbhbbt.exe82⤵PID:1880
-
\??\c:\7ttthb.exec:\7ttthb.exe83⤵PID:640
-
\??\c:\1vdvv.exec:\1vdvv.exe84⤵PID:2584
-
\??\c:\pdpjj.exec:\pdpjj.exe85⤵PID:2888
-
\??\c:\frfxrlr.exec:\frfxrlr.exe86⤵PID:3020
-
\??\c:\9lflrxx.exec:\9lflrxx.exe87⤵PID:1680
-
\??\c:\tnbthb.exec:\tnbthb.exe88⤵PID:2680
-
\??\c:\thhbhb.exec:\thhbhb.exe89⤵PID:1432
-
\??\c:\3pdjj.exec:\3pdjj.exe90⤵PID:2428
-
\??\c:\dvjjj.exec:\dvjjj.exe91⤵PID:2012
-
\??\c:\5frrrlr.exec:\5frrrlr.exe92⤵PID:2352
-
\??\c:\xlfxffl.exec:\xlfxffl.exe93⤵PID:2344
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe94⤵PID:1064
-
\??\c:\hbnhnn.exec:\hbnhnn.exe95⤵PID:848
-
\??\c:\nhntbh.exec:\nhntbh.exe96⤵PID:2320
-
\??\c:\3vddv.exec:\3vddv.exe97⤵PID:2488
-
\??\c:\9dvpj.exec:\9dvpj.exe98⤵PID:2144
-
\??\c:\rfxxfrx.exec:\rfxxfrx.exe99⤵PID:1032
-
\??\c:\fxxlxfr.exec:\fxxlxfr.exe100⤵PID:2708
-
\??\c:\nbbbnt.exec:\nbbbnt.exe101⤵PID:1712
-
\??\c:\bntthh.exec:\bntthh.exe102⤵PID:712
-
\??\c:\hthhtn.exec:\hthhtn.exe103⤵PID:2988
-
\??\c:\pdjjv.exec:\pdjjv.exe104⤵PID:2396
-
\??\c:\ppdjp.exec:\ppdjp.exe105⤵PID:2376
-
\??\c:\7xxxxxl.exec:\7xxxxxl.exe106⤵PID:2456
-
\??\c:\rllxlrx.exec:\rllxlrx.exe107⤵PID:2192
-
\??\c:\3bttbn.exec:\3bttbn.exe108⤵PID:2328
-
\??\c:\btbhtb.exec:\btbhtb.exe109⤵PID:2004
-
\??\c:\jvdvd.exec:\jvdvd.exe110⤵PID:2940
-
\??\c:\pdjdj.exec:\pdjdj.exe111⤵
- System Location Discovery: System Language Discovery
PID:2764 -
\??\c:\lxxxlxx.exec:\lxxxlxx.exe112⤵PID:1640
-
\??\c:\xfllrrf.exec:\xfllrrf.exe113⤵PID:2728
-
\??\c:\3thnnt.exec:\3thnnt.exe114⤵PID:2312
-
\??\c:\btbbnn.exec:\btbbnn.exe115⤵PID:2140
-
\??\c:\pjddp.exec:\pjddp.exe116⤵PID:2752
-
\??\c:\pdvpd.exec:\pdvpd.exe117⤵PID:2784
-
\??\c:\xlxfllx.exec:\xlxfllx.exe118⤵PID:2108
-
\??\c:\9xxlrfx.exec:\9xxlrfx.exe119⤵PID:1896
-
\??\c:\nbbbhh.exec:\nbbbhh.exe120⤵PID:1256
-
\??\c:\5btbht.exec:\5btbht.exe121⤵PID:2000
-
\??\c:\1jvvv.exec:\1jvvv.exe122⤵PID:856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-