Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 04:05
Static task
static1
Behavioral task
behavioral1
Sample
9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96N.exe
Resource
win7-20240903-en
General
-
Target
9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96N.exe
-
Size
80KB
-
MD5
12246cb1a0faf835fa557a75e9cd2670
-
SHA1
2e1f80f56471931325b0fa9fc833a08cde38dbfa
-
SHA256
9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96
-
SHA512
96f0b66c27216b6ac4c22d390eb2cfae09df316a63a66472c51ba43736c8cbab22acb7b70e01fbbb7af663510c7fddb5b461cb8689edf03401a1573344d26cb5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeha:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4Ka
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2356-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/788-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1456-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/904-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-285-0x0000000076F80000-0x000000007707A000-memory.dmp family_blackmoon behavioral1/memory/2124-284-0x0000000076E60000-0x0000000076F7F000-memory.dmp family_blackmoon behavioral1/memory/2124-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2984 9vppv.exe 2020 rrxfxxr.exe 2244 tttbnb.exe 2224 vvpdd.exe 2724 9fxrlrx.exe 2692 jdvjv.exe 2784 9xrxffl.exe 2860 fxlxxlr.exe 2600 vpdvd.exe 2620 lfflffr.exe 788 ffrlxfr.exe 2832 btbbhh.exe 1860 vpddd.exe 776 ppjjj.exe 1284 xrrflfr.exe 2820 5bthnn.exe 1456 nnhbnb.exe 2752 dvvdj.exe 2264 xlxxlfr.exe 2408 llxxrrl.exe 2952 bbtbnn.exe 1780 jdvvd.exe 2500 rrfrlrr.exe 1340 5rlrxfl.exe 900 hhhtht.exe 696 9jddp.exe 1136 jdpvp.exe 904 rlffrxl.exe 2124 bhtthh.exe 2332 vvvjp.exe 1588 1hhbhn.exe 1752 7dpvj.exe 2008 rlxfrxr.exe 2336 xrfrfxf.exe 2780 5bbntn.exe 2976 tnhhnh.exe 2764 dvpvv.exe 2692 dvdvv.exe 2736 1vpjj.exe 2756 fxllffx.exe 2860 rlrffrr.exe 2276 1nbbhh.exe 348 7ddpj.exe 2636 pvjjv.exe 2472 rfrxfff.exe 1444 rfxfllx.exe 1860 3hnnbn.exe 2316 hhthnn.exe 2324 jpvdj.exe 2184 jdjdd.exe 1412 5xrlxfr.exe 2808 9frlrlr.exe 2148 nhnntn.exe 2448 7tnthh.exe 2664 vpdvd.exe 2944 9vpvj.exe 2088 fxrfxxl.exe 1880 lflrrxf.exe 1496 bbbntb.exe 1748 nhbhtb.exe 768 jjdpj.exe 1724 fllxrfx.exe 1996 1lfflrf.exe 1740 btnbht.exe -
resource yara_rule behavioral1/memory/2356-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/788-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/904-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-283-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2984 2356 9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96N.exe 30 PID 2356 wrote to memory of 2984 2356 9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96N.exe 30 PID 2356 wrote to memory of 2984 2356 9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96N.exe 30 PID 2356 wrote to memory of 2984 2356 9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96N.exe 30 PID 2984 wrote to memory of 2020 2984 9vppv.exe 31 PID 2984 wrote to memory of 2020 2984 9vppv.exe 31 PID 2984 wrote to memory of 2020 2984 9vppv.exe 31 PID 2984 wrote to memory of 2020 2984 9vppv.exe 31 PID 2020 wrote to memory of 2244 2020 rrxfxxr.exe 32 PID 2020 wrote to memory of 2244 2020 rrxfxxr.exe 32 PID 2020 wrote to memory of 2244 2020 rrxfxxr.exe 32 PID 2020 wrote to memory of 2244 2020 rrxfxxr.exe 32 PID 2244 wrote to memory of 2224 2244 tttbnb.exe 33 PID 2244 wrote to memory of 2224 2244 tttbnb.exe 33 PID 2244 wrote to memory of 2224 2244 tttbnb.exe 33 PID 2244 wrote to memory of 2224 2244 tttbnb.exe 33 PID 2224 wrote to memory of 2724 2224 vvpdd.exe 34 PID 2224 wrote to memory of 2724 2224 vvpdd.exe 34 PID 2224 wrote to memory of 2724 2224 vvpdd.exe 34 PID 2224 wrote to memory of 2724 2224 vvpdd.exe 34 PID 2724 wrote to memory of 2692 2724 9fxrlrx.exe 35 PID 2724 wrote to memory of 2692 2724 9fxrlrx.exe 35 PID 2724 wrote to memory of 2692 2724 9fxrlrx.exe 35 PID 2724 wrote to memory of 2692 2724 9fxrlrx.exe 35 PID 2692 wrote to memory of 2784 2692 jdvjv.exe 36 PID 2692 wrote to memory of 2784 2692 jdvjv.exe 36 PID 2692 wrote to memory of 2784 2692 jdvjv.exe 36 PID 2692 wrote to memory of 2784 2692 jdvjv.exe 36 PID 2784 wrote to memory of 2860 2784 9xrxffl.exe 37 PID 2784 wrote to memory of 2860 2784 9xrxffl.exe 37 PID 2784 wrote to memory of 2860 2784 9xrxffl.exe 37 PID 2784 wrote to memory of 2860 2784 9xrxffl.exe 37 PID 2860 wrote to memory of 2600 2860 fxlxxlr.exe 38 PID 2860 wrote to memory of 2600 2860 fxlxxlr.exe 38 PID 2860 wrote to memory of 2600 2860 fxlxxlr.exe 38 PID 2860 wrote to memory of 2600 2860 fxlxxlr.exe 38 PID 2600 wrote to memory of 2620 2600 vpdvd.exe 39 PID 2600 wrote to memory of 2620 2600 vpdvd.exe 39 PID 2600 wrote to memory of 2620 2600 vpdvd.exe 39 PID 2600 wrote to memory of 2620 2600 vpdvd.exe 39 PID 2620 wrote to memory of 788 2620 lfflffr.exe 40 PID 2620 wrote to memory of 788 2620 lfflffr.exe 40 PID 2620 wrote to memory of 788 2620 lfflffr.exe 40 PID 2620 wrote to memory of 788 2620 lfflffr.exe 40 PID 788 wrote to memory of 2832 788 ffrlxfr.exe 41 PID 788 wrote to memory of 2832 788 ffrlxfr.exe 41 PID 788 wrote to memory of 2832 788 ffrlxfr.exe 41 PID 788 wrote to memory of 2832 788 ffrlxfr.exe 41 PID 2832 wrote to memory of 1860 2832 btbbhh.exe 42 PID 2832 wrote to memory of 1860 2832 btbbhh.exe 42 PID 2832 wrote to memory of 1860 2832 btbbhh.exe 42 PID 2832 wrote to memory of 1860 2832 btbbhh.exe 42 PID 1860 wrote to memory of 776 1860 vpddd.exe 43 PID 1860 wrote to memory of 776 1860 vpddd.exe 43 PID 1860 wrote to memory of 776 1860 vpddd.exe 43 PID 1860 wrote to memory of 776 1860 vpddd.exe 43 PID 776 wrote to memory of 1284 776 ppjjj.exe 44 PID 776 wrote to memory of 1284 776 ppjjj.exe 44 PID 776 wrote to memory of 1284 776 ppjjj.exe 44 PID 776 wrote to memory of 1284 776 ppjjj.exe 44 PID 1284 wrote to memory of 2820 1284 xrrflfr.exe 45 PID 1284 wrote to memory of 2820 1284 xrrflfr.exe 45 PID 1284 wrote to memory of 2820 1284 xrrflfr.exe 45 PID 1284 wrote to memory of 2820 1284 xrrflfr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96N.exe"C:\Users\Admin\AppData\Local\Temp\9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\9vppv.exec:\9vppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\rrxfxxr.exec:\rrxfxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\tttbnb.exec:\tttbnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\vvpdd.exec:\vvpdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\9fxrlrx.exec:\9fxrlrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\jdvjv.exec:\jdvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\9xrxffl.exec:\9xrxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\fxlxxlr.exec:\fxlxxlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\vpdvd.exec:\vpdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\lfflffr.exec:\lfflffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\ffrlxfr.exec:\ffrlxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\btbbhh.exec:\btbbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\vpddd.exec:\vpddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\ppjjj.exec:\ppjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\xrrflfr.exec:\xrrflfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\5bthnn.exec:\5bthnn.exe17⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nnhbnb.exec:\nnhbnb.exe18⤵
- Executes dropped EXE
PID:1456 -
\??\c:\dvvdj.exec:\dvvdj.exe19⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xlxxlfr.exec:\xlxxlfr.exe20⤵
- Executes dropped EXE
PID:2264 -
\??\c:\llxxrrl.exec:\llxxrrl.exe21⤵
- Executes dropped EXE
PID:2408 -
\??\c:\bbtbnn.exec:\bbtbnn.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2952 -
\??\c:\jdvvd.exec:\jdvvd.exe23⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rrfrlrr.exec:\rrfrlrr.exe24⤵
- Executes dropped EXE
PID:2500 -
\??\c:\5rlrxfl.exec:\5rlrxfl.exe25⤵
- Executes dropped EXE
PID:1340 -
\??\c:\hhhtht.exec:\hhhtht.exe26⤵
- Executes dropped EXE
PID:900 -
\??\c:\9jddp.exec:\9jddp.exe27⤵
- Executes dropped EXE
PID:696 -
\??\c:\jdpvp.exec:\jdpvp.exe28⤵
- Executes dropped EXE
PID:1136 -
\??\c:\rlffrxl.exec:\rlffrxl.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:904 -
\??\c:\bhtthh.exec:\bhtthh.exe30⤵
- Executes dropped EXE
PID:2124 -
\??\c:\5vpdp.exec:\5vpdp.exe31⤵PID:1784
-
\??\c:\vvvjp.exec:\vvvjp.exe32⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1hhbhn.exec:\1hhbhn.exe33⤵
- Executes dropped EXE
PID:1588 -
\??\c:\7dpvj.exec:\7dpvj.exe34⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rlxfrxr.exec:\rlxfrxr.exe35⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xrfrfxf.exec:\xrfrfxf.exe36⤵
- Executes dropped EXE
PID:2336 -
\??\c:\5bbntn.exec:\5bbntn.exe37⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tnhhnh.exec:\tnhhnh.exe38⤵
- Executes dropped EXE
PID:2976 -
\??\c:\dvpvv.exec:\dvpvv.exe39⤵
- Executes dropped EXE
PID:2764 -
\??\c:\dvdvv.exec:\dvdvv.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\1vpjj.exec:\1vpjj.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\fxllffx.exec:\fxllffx.exe42⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rlrffrr.exec:\rlrffrr.exe43⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1nbbhh.exec:\1nbbhh.exe44⤵
- Executes dropped EXE
PID:2276 -
\??\c:\7ddpj.exec:\7ddpj.exe45⤵
- Executes dropped EXE
PID:348 -
\??\c:\pvjjv.exec:\pvjjv.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rfrxfff.exec:\rfrxfff.exe47⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rfxfllx.exec:\rfxfllx.exe48⤵
- Executes dropped EXE
PID:1444 -
\??\c:\3hnnbn.exec:\3hnnbn.exe49⤵
- Executes dropped EXE
PID:1860 -
\??\c:\hhthnn.exec:\hhthnn.exe50⤵
- Executes dropped EXE
PID:2316 -
\??\c:\jpvdj.exec:\jpvdj.exe51⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jdjdd.exec:\jdjdd.exe52⤵
- Executes dropped EXE
PID:2184 -
\??\c:\5xrlxfr.exec:\5xrlxfr.exe53⤵
- Executes dropped EXE
PID:1412 -
\??\c:\9frlrlr.exec:\9frlrlr.exe54⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nhnntn.exec:\nhnntn.exe55⤵
- Executes dropped EXE
PID:2148 -
\??\c:\7tnthh.exec:\7tnthh.exe56⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vpdvd.exec:\vpdvd.exe57⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9vpvj.exec:\9vpvj.exe58⤵
- Executes dropped EXE
PID:2944 -
\??\c:\fxrfxxl.exec:\fxrfxxl.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\lflrrxf.exec:\lflrrxf.exe60⤵
- Executes dropped EXE
PID:1880 -
\??\c:\bbbntb.exec:\bbbntb.exe61⤵
- Executes dropped EXE
PID:1496 -
\??\c:\nhbhtb.exec:\nhbhtb.exe62⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jjdpj.exec:\jjdpj.exe63⤵
- Executes dropped EXE
PID:768 -
\??\c:\fllxrfx.exec:\fllxrfx.exe64⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1lfflrf.exec:\1lfflrf.exe65⤵
- Executes dropped EXE
PID:1996 -
\??\c:\btnbht.exec:\btnbht.exe66⤵
- Executes dropped EXE
PID:1740 -
\??\c:\btnbnn.exec:\btnbnn.exe67⤵PID:2312
-
\??\c:\7vpjj.exec:\7vpjj.exe68⤵PID:904
-
\??\c:\jvvvv.exec:\jvvvv.exe69⤵PID:2984
-
\??\c:\ffrlrrf.exec:\ffrlrrf.exe70⤵PID:2308
-
\??\c:\rxlfrxr.exec:\rxlfrxr.exe71⤵PID:2376
-
\??\c:\nhnttt.exec:\nhnttt.exe72⤵PID:1588
-
\??\c:\dvvpd.exec:\dvvpd.exe73⤵PID:2960
-
\??\c:\jvvpv.exec:\jvvpv.exe74⤵PID:2748
-
\??\c:\lxllxxl.exec:\lxllxxl.exe75⤵PID:2660
-
\??\c:\1htbnt.exec:\1htbnt.exe76⤵PID:2852
-
\??\c:\tntntb.exec:\tntntb.exe77⤵PID:2864
-
\??\c:\pjvjv.exec:\pjvjv.exe78⤵PID:2920
-
\??\c:\5jddd.exec:\5jddd.exe79⤵PID:2868
-
\??\c:\1xxxflx.exec:\1xxxflx.exe80⤵PID:2680
-
\??\c:\rlfrxff.exec:\rlfrxff.exe81⤵PID:2644
-
\??\c:\bbnnbb.exec:\bbnnbb.exe82⤵PID:3056
-
\??\c:\tnbhtb.exec:\tnbhtb.exe83⤵PID:3052
-
\??\c:\pjdjj.exec:\pjdjj.exe84⤵PID:1820
-
\??\c:\9jvdj.exec:\9jvdj.exe85⤵PID:2388
-
\??\c:\llffrlf.exec:\llffrlf.exe86⤵PID:1264
-
\??\c:\9xllrfl.exec:\9xllrfl.exe87⤵PID:588
-
\??\c:\hbbbhn.exec:\hbbbhn.exe88⤵PID:780
-
\??\c:\9jpjj.exec:\9jpjj.exe89⤵PID:1164
-
\??\c:\dvjjp.exec:\dvjjp.exe90⤵PID:1732
-
\??\c:\5xfxlrr.exec:\5xfxlrr.exe91⤵PID:1764
-
\??\c:\hbtbhn.exec:\hbtbhn.exe92⤵PID:1456
-
\??\c:\9hnhhn.exec:\9hnhhn.exe93⤵PID:2260
-
\??\c:\pvjpv.exec:\pvjpv.exe94⤵PID:1640
-
\??\c:\dpvvv.exec:\dpvvv.exe95⤵PID:3068
-
\??\c:\rxfxxff.exec:\rxfxxff.exe96⤵PID:848
-
\??\c:\lfrxflx.exec:\lfrxflx.exe97⤵PID:1664
-
\??\c:\hhthnn.exec:\hhthnn.exe98⤵PID:1484
-
\??\c:\3tntnb.exec:\3tntnb.exe99⤵PID:1096
-
\??\c:\9vppj.exec:\9vppj.exe100⤵PID:2452
-
\??\c:\3ddpv.exec:\3ddpv.exe101⤵PID:2548
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe102⤵PID:900
-
\??\c:\bhthbt.exec:\bhthbt.exe103⤵PID:1064
-
\??\c:\9nbbbb.exec:\9nbbbb.exe104⤵PID:2428
-
\??\c:\vvpjj.exec:\vvpjj.exe105⤵PID:632
-
\??\c:\3djdd.exec:\3djdd.exe106⤵PID:1884
-
\??\c:\rlflxlx.exec:\rlflxlx.exe107⤵PID:3024
-
\??\c:\frxxfxl.exec:\frxxfxl.exe108⤵PID:2488
-
\??\c:\1hbbhn.exec:\1hbbhn.exe109⤵PID:2360
-
\??\c:\nhntbb.exec:\nhntbb.exe110⤵PID:2372
-
\??\c:\vvvjd.exec:\vvvjd.exe111⤵PID:2280
-
\??\c:\jjddj.exec:\jjddj.exe112⤵PID:2024
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe113⤵PID:2768
-
\??\c:\7xxlxxx.exec:\7xxlxxx.exe114⤵PID:2116
-
\??\c:\btbhhh.exec:\btbhhh.exe115⤵PID:2724
-
\??\c:\btbtbh.exec:\btbtbh.exe116⤵PID:2160
-
\??\c:\vjvdj.exec:\vjvdj.exe117⤵PID:2880
-
\??\c:\5rxlrlr.exec:\5rxlrlr.exe118⤵PID:2912
-
\??\c:\llxrrrf.exec:\llxrrrf.exe119⤵PID:2632
-
\??\c:\bthnht.exec:\bthnht.exe120⤵PID:2580
-
\??\c:\bhhnnt.exec:\bhhnnt.exe121⤵PID:2600
-
\??\c:\7dvpj.exec:\7dvpj.exe122⤵PID:2476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-