Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 02:49
Static task
static1
Behavioral task
behavioral1
Sample
ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80.exe
Resource
win7-20240903-en
General
-
Target
ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80.exe
-
Size
366KB
-
MD5
552ba3f73a76dbb3e3e76196175c8388
-
SHA1
89c8d2d3e507dde876231f6cbf0b7b24b47e05a2
-
SHA256
ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80
-
SHA512
723b9592b78fc8c67f683a61e72c3e396cad6329651a93a701ea6368a7608576c377be763e58a13d0889b14bafdb76e8c8174c00ed79259f271201836832bef3
-
SSDEEP
6144:n3C9BRo7tvnJ99T/KZEL3RUXownfWQkyCpxwJz9e0pQowLh3EhToK9cT085mnFhz:n3C9ytvnVXFUXoSWlnwJv90aKToFqwfV
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2764-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2908 hbnthh.exe 2724 rfxxrxf.exe 2632 9bhhnh.exe 2612 9vddj.exe 2320 1tbhnt.exe 264 vpdjp.exe 1016 rlxfrff.exe 2000 rlxllfr.exe 2580 1dpjj.exe 2148 llrrlrf.exe 2140 hthbhh.exe 2952 ppppd.exe 2864 ffrrrrx.exe 1740 nnhthh.exe 692 1ddvd.exe 2204 7bhhtt.exe 2572 dppjp.exe 2268 fxlrffr.exe 1596 3pjpv.exe 1660 pjdpd.exe 2300 bthhtt.exe 972 htbbhh.exe 2284 rxllffl.exe 1612 ffxfxfl.exe 876 9thtbh.exe 1892 1xllrrx.exe 2376 btnnbb.exe 2344 5jvdd.exe 1920 3rffflf.exe 1896 3nnntt.exe 2560 9vjjp.exe 1516 jjdjv.exe 2812 bnnhbn.exe 2932 bbtthb.exe 2964 ddvjv.exe 1108 xfllrxf.exe 2608 lfrlrrx.exe 2684 5bbttn.exe 2440 jvvvp.exe 2780 xrffxff.exe 332 lxllrrf.exe 720 bhbnnb.exe 1016 bnhnht.exe 2224 5dvvp.exe 2064 xrxxllx.exe 2868 1httbb.exe 2148 5ddvv.exe 1684 jvddd.exe 2668 fxlfrlx.exe 2972 1nbbhn.exe 3060 nbbbbt.exe 1640 dpvdj.exe 692 xrlxflf.exe 2444 fxlllrx.exe 1476 9tbbth.exe 2472 1pvvp.exe 1424 ppvdj.exe 284 xlxllfr.exe 1952 lxrflll.exe 2016 nbbtbb.exe 824 pjpjj.exe 1712 dppdj.exe 2192 xlxffll.exe 924 hnhtht.exe -
resource yara_rule behavioral1/memory/2764-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/692-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-270-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2908 2764 ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80.exe 30 PID 2764 wrote to memory of 2908 2764 ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80.exe 30 PID 2764 wrote to memory of 2908 2764 ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80.exe 30 PID 2764 wrote to memory of 2908 2764 ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80.exe 30 PID 2908 wrote to memory of 2724 2908 hbnthh.exe 31 PID 2908 wrote to memory of 2724 2908 hbnthh.exe 31 PID 2908 wrote to memory of 2724 2908 hbnthh.exe 31 PID 2908 wrote to memory of 2724 2908 hbnthh.exe 31 PID 2724 wrote to memory of 2632 2724 rfxxrxf.exe 32 PID 2724 wrote to memory of 2632 2724 rfxxrxf.exe 32 PID 2724 wrote to memory of 2632 2724 rfxxrxf.exe 32 PID 2724 wrote to memory of 2632 2724 rfxxrxf.exe 32 PID 2632 wrote to memory of 2612 2632 9bhhnh.exe 33 PID 2632 wrote to memory of 2612 2632 9bhhnh.exe 33 PID 2632 wrote to memory of 2612 2632 9bhhnh.exe 33 PID 2632 wrote to memory of 2612 2632 9bhhnh.exe 33 PID 2612 wrote to memory of 2320 2612 9vddj.exe 34 PID 2612 wrote to memory of 2320 2612 9vddj.exe 34 PID 2612 wrote to memory of 2320 2612 9vddj.exe 34 PID 2612 wrote to memory of 2320 2612 9vddj.exe 34 PID 2320 wrote to memory of 264 2320 1tbhnt.exe 35 PID 2320 wrote to memory of 264 2320 1tbhnt.exe 35 PID 2320 wrote to memory of 264 2320 1tbhnt.exe 35 PID 2320 wrote to memory of 264 2320 1tbhnt.exe 35 PID 264 wrote to memory of 1016 264 vpdjp.exe 36 PID 264 wrote to memory of 1016 264 vpdjp.exe 36 PID 264 wrote to memory of 1016 264 vpdjp.exe 36 PID 264 wrote to memory of 1016 264 vpdjp.exe 36 PID 1016 wrote to memory of 2000 1016 rlxfrff.exe 37 PID 1016 wrote to memory of 2000 1016 rlxfrff.exe 37 PID 1016 wrote to memory of 2000 1016 rlxfrff.exe 37 PID 1016 wrote to memory of 2000 1016 rlxfrff.exe 37 PID 2000 wrote to memory of 2580 2000 rlxllfr.exe 38 PID 2000 wrote to memory of 2580 2000 rlxllfr.exe 38 PID 2000 wrote to memory of 2580 2000 rlxllfr.exe 38 PID 2000 wrote to memory of 2580 2000 rlxllfr.exe 38 PID 2580 wrote to memory of 2148 2580 1dpjj.exe 39 PID 2580 wrote to memory of 2148 2580 1dpjj.exe 39 PID 2580 wrote to memory of 2148 2580 1dpjj.exe 39 PID 2580 wrote to memory of 2148 2580 1dpjj.exe 39 PID 2148 wrote to memory of 2140 2148 llrrlrf.exe 40 PID 2148 wrote to memory of 2140 2148 llrrlrf.exe 40 PID 2148 wrote to memory of 2140 2148 llrrlrf.exe 40 PID 2148 wrote to memory of 2140 2148 llrrlrf.exe 40 PID 2140 wrote to memory of 2952 2140 hthbhh.exe 41 PID 2140 wrote to memory of 2952 2140 hthbhh.exe 41 PID 2140 wrote to memory of 2952 2140 hthbhh.exe 41 PID 2140 wrote to memory of 2952 2140 hthbhh.exe 41 PID 2952 wrote to memory of 2864 2952 ppppd.exe 42 PID 2952 wrote to memory of 2864 2952 ppppd.exe 42 PID 2952 wrote to memory of 2864 2952 ppppd.exe 42 PID 2952 wrote to memory of 2864 2952 ppppd.exe 42 PID 2864 wrote to memory of 1740 2864 ffrrrrx.exe 43 PID 2864 wrote to memory of 1740 2864 ffrrrrx.exe 43 PID 2864 wrote to memory of 1740 2864 ffrrrrx.exe 43 PID 2864 wrote to memory of 1740 2864 ffrrrrx.exe 43 PID 1740 wrote to memory of 692 1740 nnhthh.exe 44 PID 1740 wrote to memory of 692 1740 nnhthh.exe 44 PID 1740 wrote to memory of 692 1740 nnhthh.exe 44 PID 1740 wrote to memory of 692 1740 nnhthh.exe 44 PID 692 wrote to memory of 2204 692 1ddvd.exe 45 PID 692 wrote to memory of 2204 692 1ddvd.exe 45 PID 692 wrote to memory of 2204 692 1ddvd.exe 45 PID 692 wrote to memory of 2204 692 1ddvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80.exe"C:\Users\Admin\AppData\Local\Temp\ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\hbnthh.exec:\hbnthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\rfxxrxf.exec:\rfxxrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\9bhhnh.exec:\9bhhnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\9vddj.exec:\9vddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\1tbhnt.exec:\1tbhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\vpdjp.exec:\vpdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\rlxfrff.exec:\rlxfrff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\rlxllfr.exec:\rlxllfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\1dpjj.exec:\1dpjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\llrrlrf.exec:\llrrlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\hthbhh.exec:\hthbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\ppppd.exec:\ppppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ffrrrrx.exec:\ffrrrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\nnhthh.exec:\nnhthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\1ddvd.exec:\1ddvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\7bhhtt.exec:\7bhhtt.exe17⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dppjp.exec:\dppjp.exe18⤵
- Executes dropped EXE
PID:2572 -
\??\c:\fxlrffr.exec:\fxlrffr.exe19⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3pjpv.exec:\3pjpv.exe20⤵
- Executes dropped EXE
PID:1596 -
\??\c:\pjdpd.exec:\pjdpd.exe21⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bthhtt.exec:\bthhtt.exe22⤵
- Executes dropped EXE
PID:2300 -
\??\c:\htbbhh.exec:\htbbhh.exe23⤵
- Executes dropped EXE
PID:972 -
\??\c:\rxllffl.exec:\rxllffl.exe24⤵
- Executes dropped EXE
PID:2284 -
\??\c:\ffxfxfl.exec:\ffxfxfl.exe25⤵
- Executes dropped EXE
PID:1612 -
\??\c:\9thtbh.exec:\9thtbh.exe26⤵
- Executes dropped EXE
PID:876 -
\??\c:\1xllrrx.exec:\1xllrrx.exe27⤵
- Executes dropped EXE
PID:1892 -
\??\c:\btnnbb.exec:\btnnbb.exe28⤵
- Executes dropped EXE
PID:2376 -
\??\c:\5jvdd.exec:\5jvdd.exe29⤵
- Executes dropped EXE
PID:2344 -
\??\c:\3rffflf.exec:\3rffflf.exe30⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3nnntt.exec:\3nnntt.exe31⤵
- Executes dropped EXE
PID:1896 -
\??\c:\9vjjp.exec:\9vjjp.exe32⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jjdjv.exec:\jjdjv.exe33⤵
- Executes dropped EXE
PID:1516 -
\??\c:\bnnhbn.exec:\bnnhbn.exe34⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bbtthb.exec:\bbtthb.exe35⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ddvjv.exec:\ddvjv.exe36⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xfllrxf.exec:\xfllrxf.exe37⤵
- Executes dropped EXE
PID:1108 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\5bbttn.exec:\5bbttn.exe39⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jvvvp.exec:\jvvvp.exe40⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xrffxff.exec:\xrffxff.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lxllrrf.exec:\lxllrrf.exe42⤵
- Executes dropped EXE
PID:332 -
\??\c:\bhbnnb.exec:\bhbnnb.exe43⤵
- Executes dropped EXE
PID:720 -
\??\c:\bnhnht.exec:\bnhnht.exe44⤵
- Executes dropped EXE
PID:1016 -
\??\c:\5dvvp.exec:\5dvvp.exe45⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xrxxllx.exec:\xrxxllx.exe46⤵
- Executes dropped EXE
PID:2064 -
\??\c:\1httbb.exec:\1httbb.exe47⤵
- Executes dropped EXE
PID:2868 -
\??\c:\5ddvv.exec:\5ddvv.exe48⤵
- Executes dropped EXE
PID:2148 -
\??\c:\jvddd.exec:\jvddd.exe49⤵
- Executes dropped EXE
PID:1684 -
\??\c:\fxlfrlx.exec:\fxlfrlx.exe50⤵
- Executes dropped EXE
PID:2668 -
\??\c:\1nbbhn.exec:\1nbbhn.exe51⤵
- Executes dropped EXE
PID:2972 -
\??\c:\nbbbbt.exec:\nbbbbt.exe52⤵
- Executes dropped EXE
PID:3060 -
\??\c:\dpvdj.exec:\dpvdj.exe53⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xrlxflf.exec:\xrlxflf.exe54⤵
- Executes dropped EXE
PID:692 -
\??\c:\fxlllrx.exec:\fxlllrx.exe55⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9tbbth.exec:\9tbbth.exe56⤵
- Executes dropped EXE
PID:1476 -
\??\c:\1pvvp.exec:\1pvvp.exe57⤵
- Executes dropped EXE
PID:2472 -
\??\c:\ppvdj.exec:\ppvdj.exe58⤵
- Executes dropped EXE
PID:1424 -
\??\c:\xlxllfr.exec:\xlxllfr.exe59⤵
- Executes dropped EXE
PID:284 -
\??\c:\lxrflll.exec:\lxrflll.exe60⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nbbtbb.exec:\nbbtbb.exe61⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pjpjj.exec:\pjpjj.exe62⤵
- Executes dropped EXE
PID:824 -
\??\c:\dppdj.exec:\dppdj.exe63⤵
- Executes dropped EXE
PID:1712 -
\??\c:\xlxffll.exec:\xlxffll.exe64⤵
- Executes dropped EXE
PID:2192 -
\??\c:\hnhtht.exec:\hnhtht.exe65⤵
- Executes dropped EXE
PID:924 -
\??\c:\bbthth.exec:\bbthth.exe66⤵PID:1588
-
\??\c:\jjpdd.exec:\jjpdd.exe67⤵PID:2108
-
\??\c:\pjvjv.exec:\pjvjv.exe68⤵PID:1628
-
\??\c:\rlxllfr.exec:\rlxllfr.exe69⤵PID:280
-
\??\c:\bnbbbh.exec:\bnbbbh.exe70⤵PID:2344
-
\??\c:\7nnhtt.exec:\7nnhtt.exe71⤵PID:1920
-
\??\c:\9vpdd.exec:\9vpdd.exe72⤵PID:2324
-
\??\c:\fxfffrx.exec:\fxfffrx.exe73⤵PID:2820
-
\??\c:\7xlllff.exec:\7xlllff.exe74⤵PID:3052
-
\??\c:\9thbhh.exec:\9thbhh.exe75⤵PID:2740
-
\??\c:\tnbbhh.exec:\tnbbhh.exe76⤵PID:2852
-
\??\c:\1jppp.exec:\1jppp.exe77⤵PID:1644
-
\??\c:\lxlrxrx.exec:\lxlrxrx.exe78⤵PID:2664
-
\??\c:\rlxlllr.exec:\rlxlllr.exe79⤵PID:2620
-
\??\c:\9hnhhh.exec:\9hnhhh.exe80⤵PID:2728
-
\??\c:\9thbnh.exec:\9thbnh.exe81⤵PID:2172
-
\??\c:\9djdv.exec:\9djdv.exe82⤵
- System Location Discovery: System Language Discovery
PID:1524 -
\??\c:\lfxxfff.exec:\lfxxfff.exe83⤵PID:2780
-
\??\c:\lxlllfr.exec:\lxlllfr.exe84⤵PID:2028
-
\??\c:\btnnbb.exec:\btnnbb.exe85⤵PID:1808
-
\??\c:\pdddj.exec:\pdddj.exe86⤵PID:2164
-
\??\c:\9dvpp.exec:\9dvpp.exe87⤵PID:2580
-
\??\c:\7ffxffl.exec:\7ffxffl.exe88⤵PID:2788
-
\??\c:\btbhhh.exec:\btbhhh.exe89⤵PID:2516
-
\??\c:\bbttnn.exec:\bbttnn.exe90⤵PID:776
-
\??\c:\3dvvj.exec:\3dvvj.exe91⤵PID:2080
-
\??\c:\frffllr.exec:\frffllr.exe92⤵PID:2548
-
\??\c:\rlllffr.exec:\rlllffr.exe93⤵PID:2984
-
\??\c:\htbttn.exec:\htbttn.exe94⤵PID:1584
-
\??\c:\5vdvv.exec:\5vdvv.exe95⤵PID:2184
-
\??\c:\vdjdv.exec:\vdjdv.exe96⤵PID:2480
-
\??\c:\3flxflr.exec:\3flxflr.exe97⤵PID:2572
-
\??\c:\7rfxrll.exec:\7rfxrll.exe98⤵PID:1172
-
\??\c:\nbhntt.exec:\nbhntt.exe99⤵PID:1532
-
\??\c:\ppvdp.exec:\ppvdp.exe100⤵PID:444
-
\??\c:\lfllxxf.exec:\lfllxxf.exe101⤵PID:1660
-
\??\c:\xlflllr.exec:\xlflllr.exe102⤵PID:2212
-
\??\c:\hhtbnt.exec:\hhtbnt.exe103⤵PID:1292
-
\??\c:\9jpvp.exec:\9jpvp.exe104⤵PID:1488
-
\??\c:\9pddj.exec:\9pddj.exe105⤵PID:1280
-
\??\c:\7xrllrx.exec:\7xrllrx.exe106⤵PID:1008
-
\??\c:\5thbbb.exec:\5thbbb.exe107⤵PID:924
-
\??\c:\hbhnbb.exec:\hbhnbb.exe108⤵PID:2004
-
\??\c:\vpjjp.exec:\vpjjp.exe109⤵PID:304
-
\??\c:\lxrflfx.exec:\lxrflfx.exe110⤵PID:3036
-
\??\c:\3nhbnh.exec:\3nhbnh.exe111⤵PID:280
-
\??\c:\hbntbb.exec:\hbntbb.exe112⤵PID:2456
-
\??\c:\9djjp.exec:\9djjp.exe113⤵PID:2304
-
\??\c:\pdpjp.exec:\pdpjp.exe114⤵PID:2560
-
\??\c:\frllllr.exec:\frllllr.exe115⤵PID:2760
-
\??\c:\nnbhtt.exec:\nnbhtt.exe116⤵PID:1988
-
\??\c:\9nhhnh.exec:\9nhhnh.exe117⤵PID:2948
-
\??\c:\jvjjj.exec:\jvjjj.exe118⤵PID:2836
-
\??\c:\1fxxxxx.exec:\1fxxxxx.exe119⤵PID:2632
-
\??\c:\lxfffxx.exec:\lxfffxx.exe120⤵PID:2628
-
\??\c:\1nbbhh.exec:\1nbbhh.exe121⤵PID:2236
-
\??\c:\ppdpd.exec:\ppdpd.exe122⤵PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-