Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
14-09-2024 15:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d96492f7933435b573680c264d6676e0N.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
d96492f7933435b573680c264d6676e0N.exe
-
Size
74KB
-
MD5
d96492f7933435b573680c264d6676e0
-
SHA1
bf425d2e8b9500741a476b0f0e40f2f8d1e62e5c
-
SHA256
5c054451956f81dedea6d77164709751925e7002e8e7624f1dc202d239e7b3b9
-
SHA512
b01c7b95672ef27be28427696e8a8b51aa1afaea9d32e8865586b8f364d0b0e51d7a7f4502b4d65ec15d18f3fae8653c06c083c2dce2b4d9e62f006656510e97
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmPV:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHw
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2652-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1412-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-290-0x0000000076B20000-0x0000000076C3F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2824 5dpjp.exe 2744 pjdjp.exe 2640 nhtbnb.exe 2548 9nbbhh.exe 2524 ddjpp.exe 2644 frfrxxx.exe 2996 llxxffr.exe 2804 hbhhbb.exe 2864 ddpdd.exe 1432 fxlllrl.exe 1412 1rfflrf.exe 2040 hhhtnb.exe 2260 vvjvv.exe 2732 pvjpv.exe 832 fxrrffl.exe 1828 5nhnbb.exe 2912 1bnnbt.exe 2340 ppjvp.exe 2380 ffxxflr.exe 2172 1xrlllr.exe 2392 tthtnn.exe 2372 jddjv.exe 1532 9vvdd.exe 844 frlrlrx.exe 1264 rrrfxll.exe 2428 nnnnht.exe 2436 9nhntb.exe 2936 pjjvj.exe 1564 9rfxxrr.exe 2196 7rlxlxl.exe 2908 tnhnbn.exe 2532 vvvpj.exe 1516 hhthhh.exe 2688 bbthth.exe 2872 3pdpp.exe 2540 9jdjp.exe 3056 llflxxl.exe 2644 3lfxlxf.exe 576 bbhtnh.exe 2996 bhbbtt.exe 2884 vpjdv.exe 2084 vvvjp.exe 584 lfrfrxl.exe 2008 flflxlx.exe 1632 nhnnnt.exe 2040 7nnttb.exe 1568 ddvdj.exe 532 vpjvp.exe 1596 llxfxfl.exe 832 1flxflr.exe 1828 tthhtb.exe 292 nbbttn.exe 1904 9pjjp.exe 2060 ddvvd.exe 2256 llxrxfl.exe 2360 xrffxxr.exe 1960 nhtbbh.exe 328 5ttbbn.exe 1540 7hbhtt.exe 920 pjjdd.exe 2948 dpjpp.exe 1728 ffffxxl.exe 800 rrflflf.exe 3004 bbhbtb.exe -
resource yara_rule behavioral1/memory/2652-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1412-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bththt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2824 2652 d96492f7933435b573680c264d6676e0N.exe 31 PID 2652 wrote to memory of 2824 2652 d96492f7933435b573680c264d6676e0N.exe 31 PID 2652 wrote to memory of 2824 2652 d96492f7933435b573680c264d6676e0N.exe 31 PID 2652 wrote to memory of 2824 2652 d96492f7933435b573680c264d6676e0N.exe 31 PID 2824 wrote to memory of 2744 2824 5dpjp.exe 32 PID 2824 wrote to memory of 2744 2824 5dpjp.exe 32 PID 2824 wrote to memory of 2744 2824 5dpjp.exe 32 PID 2824 wrote to memory of 2744 2824 5dpjp.exe 32 PID 2744 wrote to memory of 2640 2744 pjdjp.exe 33 PID 2744 wrote to memory of 2640 2744 pjdjp.exe 33 PID 2744 wrote to memory of 2640 2744 pjdjp.exe 33 PID 2744 wrote to memory of 2640 2744 pjdjp.exe 33 PID 2640 wrote to memory of 2548 2640 nhtbnb.exe 34 PID 2640 wrote to memory of 2548 2640 nhtbnb.exe 34 PID 2640 wrote to memory of 2548 2640 nhtbnb.exe 34 PID 2640 wrote to memory of 2548 2640 nhtbnb.exe 34 PID 2548 wrote to memory of 2524 2548 9nbbhh.exe 35 PID 2548 wrote to memory of 2524 2548 9nbbhh.exe 35 PID 2548 wrote to memory of 2524 2548 9nbbhh.exe 35 PID 2548 wrote to memory of 2524 2548 9nbbhh.exe 35 PID 2524 wrote to memory of 2644 2524 ddjpp.exe 36 PID 2524 wrote to memory of 2644 2524 ddjpp.exe 36 PID 2524 wrote to memory of 2644 2524 ddjpp.exe 36 PID 2524 wrote to memory of 2644 2524 ddjpp.exe 36 PID 2644 wrote to memory of 2996 2644 frfrxxx.exe 37 PID 2644 wrote to memory of 2996 2644 frfrxxx.exe 37 PID 2644 wrote to memory of 2996 2644 frfrxxx.exe 37 PID 2644 wrote to memory of 2996 2644 frfrxxx.exe 37 PID 2996 wrote to memory of 2804 2996 llxxffr.exe 38 PID 2996 wrote to memory of 2804 2996 llxxffr.exe 38 PID 2996 wrote to memory of 2804 2996 llxxffr.exe 38 PID 2996 wrote to memory of 2804 2996 llxxffr.exe 38 PID 2804 wrote to memory of 2864 2804 hbhhbb.exe 39 PID 2804 wrote to memory of 2864 2804 hbhhbb.exe 39 PID 2804 wrote to memory of 2864 2804 hbhhbb.exe 39 PID 2804 wrote to memory of 2864 2804 hbhhbb.exe 39 PID 2864 wrote to memory of 1432 2864 ddpdd.exe 40 PID 2864 wrote to memory of 1432 2864 ddpdd.exe 40 PID 2864 wrote to memory of 1432 2864 ddpdd.exe 40 PID 2864 wrote to memory of 1432 2864 ddpdd.exe 40 PID 1432 wrote to memory of 1412 1432 fxlllrl.exe 41 PID 1432 wrote to memory of 1412 1432 fxlllrl.exe 41 PID 1432 wrote to memory of 1412 1432 fxlllrl.exe 41 PID 1432 wrote to memory of 1412 1432 fxlllrl.exe 41 PID 1412 wrote to memory of 2040 1412 1rfflrf.exe 42 PID 1412 wrote to memory of 2040 1412 1rfflrf.exe 42 PID 1412 wrote to memory of 2040 1412 1rfflrf.exe 42 PID 1412 wrote to memory of 2040 1412 1rfflrf.exe 42 PID 2040 wrote to memory of 2260 2040 hhhtnb.exe 43 PID 2040 wrote to memory of 2260 2040 hhhtnb.exe 43 PID 2040 wrote to memory of 2260 2040 hhhtnb.exe 43 PID 2040 wrote to memory of 2260 2040 hhhtnb.exe 43 PID 2260 wrote to memory of 2732 2260 vvjvv.exe 44 PID 2260 wrote to memory of 2732 2260 vvjvv.exe 44 PID 2260 wrote to memory of 2732 2260 vvjvv.exe 44 PID 2260 wrote to memory of 2732 2260 vvjvv.exe 44 PID 2732 wrote to memory of 832 2732 pvjpv.exe 45 PID 2732 wrote to memory of 832 2732 pvjpv.exe 45 PID 2732 wrote to memory of 832 2732 pvjpv.exe 45 PID 2732 wrote to memory of 832 2732 pvjpv.exe 45 PID 832 wrote to memory of 1828 832 fxrrffl.exe 46 PID 832 wrote to memory of 1828 832 fxrrffl.exe 46 PID 832 wrote to memory of 1828 832 fxrrffl.exe 46 PID 832 wrote to memory of 1828 832 fxrrffl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\d96492f7933435b573680c264d6676e0N.exe"C:\Users\Admin\AppData\Local\Temp\d96492f7933435b573680c264d6676e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\5dpjp.exec:\5dpjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\pjdjp.exec:\pjdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\nhtbnb.exec:\nhtbnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\9nbbhh.exec:\9nbbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\ddjpp.exec:\ddjpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\frfrxxx.exec:\frfrxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\llxxffr.exec:\llxxffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\hbhhbb.exec:\hbhhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\ddpdd.exec:\ddpdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\fxlllrl.exec:\fxlllrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\1rfflrf.exec:\1rfflrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\hhhtnb.exec:\hhhtnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\vvjvv.exec:\vvjvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\pvjpv.exec:\pvjpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\fxrrffl.exec:\fxrrffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\5nhnbb.exec:\5nhnbb.exe17⤵
- Executes dropped EXE
PID:1828 -
\??\c:\1bnnbt.exec:\1bnnbt.exe18⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ppjvp.exec:\ppjvp.exe19⤵
- Executes dropped EXE
PID:2340 -
\??\c:\ffxxflr.exec:\ffxxflr.exe20⤵
- Executes dropped EXE
PID:2380 -
\??\c:\1xrlllr.exec:\1xrlllr.exe21⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tthtnn.exec:\tthtnn.exe22⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jddjv.exec:\jddjv.exe23⤵
- Executes dropped EXE
PID:2372 -
\??\c:\9vvdd.exec:\9vvdd.exe24⤵
- Executes dropped EXE
PID:1532 -
\??\c:\frlrlrx.exec:\frlrlrx.exe25⤵
- Executes dropped EXE
PID:844 -
\??\c:\rrrfxll.exec:\rrrfxll.exe26⤵
- Executes dropped EXE
PID:1264 -
\??\c:\nnnnht.exec:\nnnnht.exe27⤵
- Executes dropped EXE
PID:2428 -
\??\c:\9nhntb.exec:\9nhntb.exe28⤵
- Executes dropped EXE
PID:2436 -
\??\c:\pjjvj.exec:\pjjvj.exe29⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9rfxxrr.exec:\9rfxxrr.exe30⤵
- Executes dropped EXE
PID:1564 -
\??\c:\7rlxlxl.exec:\7rlxlxl.exe31⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tnhnbn.exec:\tnhnbn.exe32⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5vvpv.exec:\5vvpv.exe33⤵PID:2672
-
\??\c:\vvvpj.exec:\vvvpj.exe34⤵
- Executes dropped EXE
PID:2532 -
\??\c:\hhthhh.exec:\hhthhh.exe35⤵
- Executes dropped EXE
PID:1516 -
\??\c:\bbthth.exec:\bbthth.exe36⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3pdpp.exec:\3pdpp.exe37⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9jdjp.exec:\9jdjp.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\llflxxl.exec:\llflxxl.exe39⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3lfxlxf.exec:\3lfxlxf.exe40⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bbhtnh.exec:\bbhtnh.exe41⤵
- Executes dropped EXE
PID:576 -
\??\c:\bhbbtt.exec:\bhbbtt.exe42⤵
- Executes dropped EXE
PID:2996 -
\??\c:\vpjdv.exec:\vpjdv.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vvvjp.exec:\vvvjp.exe44⤵
- Executes dropped EXE
PID:2084 -
\??\c:\lfrfrxl.exec:\lfrfrxl.exe45⤵
- Executes dropped EXE
PID:584 -
\??\c:\flflxlx.exec:\flflxlx.exe46⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nhnnnt.exec:\nhnnnt.exe47⤵
- Executes dropped EXE
PID:1632 -
\??\c:\7nnttb.exec:\7nnttb.exe48⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ddvdj.exec:\ddvdj.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1568 -
\??\c:\vpjvp.exec:\vpjvp.exe50⤵
- Executes dropped EXE
PID:532 -
\??\c:\llxfxfl.exec:\llxfxfl.exe51⤵
- Executes dropped EXE
PID:1596 -
\??\c:\1flxflr.exec:\1flxflr.exe52⤵
- Executes dropped EXE
PID:832 -
\??\c:\tthhtb.exec:\tthhtb.exe53⤵
- Executes dropped EXE
PID:1828 -
\??\c:\nbbttn.exec:\nbbttn.exe54⤵
- Executes dropped EXE
PID:292 -
\??\c:\9pjjp.exec:\9pjjp.exe55⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ddvvd.exec:\ddvvd.exe56⤵
- Executes dropped EXE
PID:2060 -
\??\c:\llxrxfl.exec:\llxrxfl.exe57⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xrffxxr.exec:\xrffxxr.exe58⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nhtbbh.exec:\nhtbbh.exe59⤵
- Executes dropped EXE
PID:1960 -
\??\c:\5ttbbn.exec:\5ttbbn.exe60⤵
- Executes dropped EXE
PID:328 -
\??\c:\7hbhtt.exec:\7hbhtt.exe61⤵
- Executes dropped EXE
PID:1540 -
\??\c:\pjjdd.exec:\pjjdd.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:920 -
\??\c:\dpjpp.exec:\dpjpp.exe63⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ffffxxl.exec:\ffffxxl.exe64⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rrflflf.exec:\rrflflf.exe65⤵
- Executes dropped EXE
PID:800 -
\??\c:\bbhbtb.exec:\bbhbtb.exe66⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pppvp.exec:\pppvp.exe67⤵PID:1784
-
\??\c:\pjdjp.exec:\pjdjp.exe68⤵PID:1424
-
\??\c:\xrllrfr.exec:\xrllrfr.exe69⤵PID:1028
-
\??\c:\1xfxllx.exec:\1xfxllx.exe70⤵PID:336
-
\??\c:\bbbbnt.exec:\bbbbnt.exe71⤵PID:2756
-
\??\c:\3thnbn.exec:\3thnbn.exe72⤵PID:2724
-
\??\c:\ddvdv.exec:\ddvdv.exe73⤵PID:2560
-
\??\c:\ddvjd.exec:\ddvjd.exe74⤵PID:1520
-
\??\c:\llrxffl.exec:\llrxffl.exe75⤵PID:2552
-
\??\c:\xxxrlrf.exec:\xxxrlrf.exe76⤵PID:2792
-
\??\c:\9tthnt.exec:\9tthnt.exe77⤵PID:2576
-
\??\c:\ththnb.exec:\ththnb.exe78⤵PID:2568
-
\??\c:\jjdpp.exec:\jjdpp.exe79⤵PID:1396
-
\??\c:\vpddj.exec:\vpddj.exe80⤵PID:2808
-
\??\c:\rrlfrrf.exec:\rrlfrrf.exe81⤵PID:2068
-
\??\c:\xxxfxfl.exec:\xxxfxfl.exe82⤵PID:2252
-
\??\c:\ffxflxl.exec:\ffxflxl.exe83⤵PID:2412
-
\??\c:\bbtthn.exec:\bbtthn.exe84⤵PID:2880
-
\??\c:\tnhnbh.exec:\tnhnbh.exe85⤵PID:2004
-
\??\c:\jvddj.exec:\jvddj.exe86⤵PID:2344
-
\??\c:\jjpvv.exec:\jjpvv.exe87⤵PID:1900
-
\??\c:\xrffllx.exec:\xrffllx.exe88⤵PID:2260
-
\??\c:\ffxlrfr.exec:\ffxlrfr.exe89⤵PID:480
-
\??\c:\bthbnb.exec:\bthbnb.exe90⤵PID:1244
-
\??\c:\ntnthn.exec:\ntnthn.exe91⤵PID:348
-
\??\c:\dvpdj.exec:\dvpdj.exe92⤵PID:832
-
\??\c:\jpvdj.exec:\jpvdj.exe93⤵PID:2912
-
\??\c:\ffllxfl.exec:\ffllxfl.exe94⤵PID:2368
-
\??\c:\llxfxfx.exec:\llxfxfx.exe95⤵PID:900
-
\??\c:\7bbbnb.exec:\7bbbnb.exe96⤵PID:2076
-
\??\c:\ttthnn.exec:\ttthnn.exe97⤵PID:1076
-
\??\c:\ppjjj.exec:\ppjjj.exe98⤵PID:2392
-
\??\c:\pppdj.exec:\pppdj.exe99⤵PID:1780
-
\??\c:\rrllrrx.exec:\rrllrrx.exe100⤵PID:1056
-
\??\c:\lflrrlf.exec:\lflrrlf.exe101⤵
- System Location Discovery: System Language Discovery
PID:2120 -
\??\c:\9lrrflr.exec:\9lrrflr.exe102⤵PID:740
-
\??\c:\1ttnnt.exec:\1ttnnt.exe103⤵PID:1720
-
\??\c:\bbbhnn.exec:\bbbhnn.exe104⤵PID:2272
-
\??\c:\vjvdp.exec:\vjvdp.exe105⤵PID:2100
-
\??\c:\ppjpj.exec:\ppjpj.exe106⤵PID:2936
-
\??\c:\rrflrfx.exec:\rrflrfx.exe107⤵PID:1840
-
\??\c:\5rrxffr.exec:\5rrxffr.exe108⤵PID:2748
-
\??\c:\nhnbbb.exec:\nhnbbb.exe109⤵PID:2776
-
\??\c:\tnbntt.exec:\tnbntt.exe110⤵PID:2160
-
\??\c:\dvpvj.exec:\dvpvj.exe111⤵PID:2648
-
\??\c:\pjvvd.exec:\pjvvd.exe112⤵PID:2904
-
\??\c:\dddpv.exec:\dddpv.exe113⤵PID:2660
-
\??\c:\ffxfrrf.exec:\ffxfrrf.exe114⤵PID:2572
-
\??\c:\5fxlrxl.exec:\5fxlrxl.exe115⤵PID:2520
-
\??\c:\nnthtb.exec:\nnthtb.exe116⤵PID:2820
-
\??\c:\hhtbnb.exec:\hhtbnb.exe117⤵
- System Location Discovery: System Language Discovery
PID:2316 -
\??\c:\vpddj.exec:\vpddj.exe118⤵PID:564
-
\??\c:\ddpvd.exec:\ddpvd.exe119⤵PID:576
-
\??\c:\rlxflxx.exec:\rlxflxx.exe120⤵PID:2808
-
\??\c:\frxlrrx.exec:\frxlrrx.exe121⤵PID:2796
-
\??\c:\5fxxffr.exec:\5fxxffr.exe122⤵PID:1360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-