Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 18:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3dd8712bf37557db01f0a64c662d1eb2736f72d71d7649acb974edef7f1f4367N.exe
Resource
win7-20240708-en
6 signatures
150 seconds
General
-
Target
3dd8712bf37557db01f0a64c662d1eb2736f72d71d7649acb974edef7f1f4367N.exe
-
Size
64KB
-
MD5
5b6b03ede6fc7b15cf47c1084dc8b220
-
SHA1
59120a23ebc9182b9fedf82d2b444e05ab24c96b
-
SHA256
3dd8712bf37557db01f0a64c662d1eb2736f72d71d7649acb974edef7f1f4367
-
SHA512
cd6030c220767e49373fd363eb095e584c27ada0b87f005f85a1661a4b771f7f8921bd518d7f5f7acf5e61346841fc3ba19fba5eeb3d8c3d0ac828ccb9d25b72
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxig:ymb3NkkiQ3mdBjF0y7kbN
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/3004-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/576-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/920-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2188 3ppdp.exe 1884 vvpvv.exe 2388 fxlrffr.exe 2760 fxlxllr.exe 2680 hbtthh.exe 2668 vvpdp.exe 2716 pjjvv.exe 2560 rllrffl.exe 2976 hnbbnn.exe 576 1nntbh.exe 920 3ddjp.exe 1444 vjvjp.exe 2028 lrxxfff.exe 2056 btntbn.exe 2440 btbhtb.exe 468 7jvdj.exe 1776 pjpvv.exe 2796 ffxxlrf.exe 2384 fxfxflr.exe 2132 hthntt.exe 2260 9ttnbt.exe 2072 5vjjp.exe 1000 vjvpv.exe 2152 7frrrxf.exe 1960 llxllfl.exe 2476 bbntbh.exe 3064 jddpv.exe 2512 pjpvd.exe 1680 3frrrxl.exe 2336 lllrlrx.exe 2188 htbbhb.exe 2276 hhnbtt.exe 1608 vvjpp.exe 2764 pjpdj.exe 1520 rrflrfr.exe 2760 lfffxxl.exe 2556 9htbnt.exe 1384 hthntt.exe 2688 1thhnn.exe 2596 pjpvd.exe 2716 jjvjv.exe 2672 7lfrrrf.exe 2992 xrxxfxf.exe 1180 tnnnnb.exe 1712 9btbnt.exe 2040 ddpdd.exe 2008 ppdjd.exe 2272 fxxrxxx.exe 1004 xrrrxfx.exe 1120 9ntbbb.exe 1228 htbnbb.exe 1572 pdjpd.exe 2844 7pdjj.exe 2420 fxrrrlx.exe 2084 llxrlrr.exe 2588 bbbhnt.exe 2932 tttbhh.exe 328 vpvpv.exe 2212 5dvjp.exe 1540 frllllr.exe 2160 fxffrrl.exe 1684 frxxxxr.exe 2248 tnthtb.exe 2476 nhhntt.exe -
resource yara_rule behavioral1/memory/3004-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/920-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2188 3004 3dd8712bf37557db01f0a64c662d1eb2736f72d71d7649acb974edef7f1f4367N.exe 31 PID 3004 wrote to memory of 2188 3004 3dd8712bf37557db01f0a64c662d1eb2736f72d71d7649acb974edef7f1f4367N.exe 31 PID 3004 wrote to memory of 2188 3004 3dd8712bf37557db01f0a64c662d1eb2736f72d71d7649acb974edef7f1f4367N.exe 31 PID 3004 wrote to memory of 2188 3004 3dd8712bf37557db01f0a64c662d1eb2736f72d71d7649acb974edef7f1f4367N.exe 31 PID 2188 wrote to memory of 1884 2188 3ppdp.exe 32 PID 2188 wrote to memory of 1884 2188 3ppdp.exe 32 PID 2188 wrote to memory of 1884 2188 3ppdp.exe 32 PID 2188 wrote to memory of 1884 2188 3ppdp.exe 32 PID 1884 wrote to memory of 2388 1884 vvpvv.exe 33 PID 1884 wrote to memory of 2388 1884 vvpvv.exe 33 PID 1884 wrote to memory of 2388 1884 vvpvv.exe 33 PID 1884 wrote to memory of 2388 1884 vvpvv.exe 33 PID 2388 wrote to memory of 2760 2388 fxlrffr.exe 34 PID 2388 wrote to memory of 2760 2388 fxlrffr.exe 34 PID 2388 wrote to memory of 2760 2388 fxlrffr.exe 34 PID 2388 wrote to memory of 2760 2388 fxlrffr.exe 34 PID 2760 wrote to memory of 2680 2760 fxlxllr.exe 35 PID 2760 wrote to memory of 2680 2760 fxlxllr.exe 35 PID 2760 wrote to memory of 2680 2760 fxlxllr.exe 35 PID 2760 wrote to memory of 2680 2760 fxlxllr.exe 35 PID 2680 wrote to memory of 2668 2680 hbtthh.exe 36 PID 2680 wrote to memory of 2668 2680 hbtthh.exe 36 PID 2680 wrote to memory of 2668 2680 hbtthh.exe 36 PID 2680 wrote to memory of 2668 2680 hbtthh.exe 36 PID 2668 wrote to memory of 2716 2668 vvpdp.exe 37 PID 2668 wrote to memory of 2716 2668 vvpdp.exe 37 PID 2668 wrote to memory of 2716 2668 vvpdp.exe 37 PID 2668 wrote to memory of 2716 2668 vvpdp.exe 37 PID 2716 wrote to memory of 2560 2716 pjjvv.exe 38 PID 2716 wrote to memory of 2560 2716 pjjvv.exe 38 PID 2716 wrote to memory of 2560 2716 pjjvv.exe 38 PID 2716 wrote to memory of 2560 2716 pjjvv.exe 38 PID 2560 wrote to memory of 2976 2560 rllrffl.exe 39 PID 2560 wrote to memory of 2976 2560 rllrffl.exe 39 PID 2560 wrote to memory of 2976 2560 rllrffl.exe 39 PID 2560 wrote to memory of 2976 2560 rllrffl.exe 39 PID 2976 wrote to memory of 576 2976 hnbbnn.exe 40 PID 2976 wrote to memory of 576 2976 hnbbnn.exe 40 PID 2976 wrote to memory of 576 2976 hnbbnn.exe 40 PID 2976 wrote to memory of 576 2976 hnbbnn.exe 40 PID 576 wrote to memory of 920 576 1nntbh.exe 41 PID 576 wrote to memory of 920 576 1nntbh.exe 41 PID 576 wrote to memory of 920 576 1nntbh.exe 41 PID 576 wrote to memory of 920 576 1nntbh.exe 41 PID 920 wrote to memory of 1444 920 3ddjp.exe 42 PID 920 wrote to memory of 1444 920 3ddjp.exe 42 PID 920 wrote to memory of 1444 920 3ddjp.exe 42 PID 920 wrote to memory of 1444 920 3ddjp.exe 42 PID 1444 wrote to memory of 2028 1444 vjvjp.exe 43 PID 1444 wrote to memory of 2028 1444 vjvjp.exe 43 PID 1444 wrote to memory of 2028 1444 vjvjp.exe 43 PID 1444 wrote to memory of 2028 1444 vjvjp.exe 43 PID 2028 wrote to memory of 2056 2028 lrxxfff.exe 44 PID 2028 wrote to memory of 2056 2028 lrxxfff.exe 44 PID 2028 wrote to memory of 2056 2028 lrxxfff.exe 44 PID 2028 wrote to memory of 2056 2028 lrxxfff.exe 44 PID 2056 wrote to memory of 2440 2056 btntbn.exe 45 PID 2056 wrote to memory of 2440 2056 btntbn.exe 45 PID 2056 wrote to memory of 2440 2056 btntbn.exe 45 PID 2056 wrote to memory of 2440 2056 btntbn.exe 45 PID 2440 wrote to memory of 468 2440 btbhtb.exe 46 PID 2440 wrote to memory of 468 2440 btbhtb.exe 46 PID 2440 wrote to memory of 468 2440 btbhtb.exe 46 PID 2440 wrote to memory of 468 2440 btbhtb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dd8712bf37557db01f0a64c662d1eb2736f72d71d7649acb974edef7f1f4367N.exe"C:\Users\Admin\AppData\Local\Temp\3dd8712bf37557db01f0a64c662d1eb2736f72d71d7649acb974edef7f1f4367N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\3ppdp.exec:\3ppdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\vvpvv.exec:\vvpvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\fxlrffr.exec:\fxlrffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\fxlxllr.exec:\fxlxllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\hbtthh.exec:\hbtthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\vvpdp.exec:\vvpdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\pjjvv.exec:\pjjvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\rllrffl.exec:\rllrffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\hnbbnn.exec:\hnbbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\1nntbh.exec:\1nntbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\3ddjp.exec:\3ddjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\vjvjp.exec:\vjvjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\lrxxfff.exec:\lrxxfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\btntbn.exec:\btntbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\btbhtb.exec:\btbhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\7jvdj.exec:\7jvdj.exe17⤵
- Executes dropped EXE
PID:468 -
\??\c:\pjpvv.exec:\pjpvv.exe18⤵
- Executes dropped EXE
PID:1776 -
\??\c:\ffxxlrf.exec:\ffxxlrf.exe19⤵
- Executes dropped EXE
PID:2796 -
\??\c:\fxfxflr.exec:\fxfxflr.exe20⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hthntt.exec:\hthntt.exe21⤵
- Executes dropped EXE
PID:2132 -
\??\c:\9ttnbt.exec:\9ttnbt.exe22⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5vjjp.exec:\5vjjp.exe23⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vjvpv.exec:\vjvpv.exe24⤵
- Executes dropped EXE
PID:1000 -
\??\c:\7frrrxf.exec:\7frrrxf.exe25⤵
- Executes dropped EXE
PID:2152 -
\??\c:\llxllfl.exec:\llxllfl.exe26⤵
- Executes dropped EXE
PID:1960 -
\??\c:\bbntbh.exec:\bbntbh.exe27⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jddpv.exec:\jddpv.exe28⤵
- Executes dropped EXE
PID:3064 -
\??\c:\pjpvd.exec:\pjpvd.exe29⤵
- Executes dropped EXE
PID:2512 -
\??\c:\3frrrxl.exec:\3frrrxl.exe30⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lllrlrx.exec:\lllrlrx.exe31⤵
- Executes dropped EXE
PID:2336 -
\??\c:\htbbhb.exec:\htbbhb.exe32⤵
- Executes dropped EXE
PID:2188 -
\??\c:\hhnbtt.exec:\hhnbtt.exe33⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vvjpp.exec:\vvjpp.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\pjpdj.exec:\pjpdj.exe35⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rrflrfr.exec:\rrflrfr.exe36⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lfffxxl.exec:\lfffxxl.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9htbnt.exec:\9htbnt.exe38⤵
- Executes dropped EXE
PID:2556 -
\??\c:\hthntt.exec:\hthntt.exe39⤵
- Executes dropped EXE
PID:1384 -
\??\c:\1thhnn.exec:\1thhnn.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pjpvd.exec:\pjpvd.exe41⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jjvjv.exec:\jjvjv.exe42⤵
- Executes dropped EXE
PID:2716 -
\??\c:\7lfrrrf.exec:\7lfrrrf.exe43⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xrxxfxf.exec:\xrxxfxf.exe44⤵
- Executes dropped EXE
PID:2992 -
\??\c:\tnnnnb.exec:\tnnnnb.exe45⤵
- Executes dropped EXE
PID:1180 -
\??\c:\9btbnt.exec:\9btbnt.exe46⤵
- Executes dropped EXE
PID:1712 -
\??\c:\ddpdd.exec:\ddpdd.exe47⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ppdjd.exec:\ppdjd.exe48⤵
- Executes dropped EXE
PID:2008 -
\??\c:\fxxrxxx.exec:\fxxrxxx.exe49⤵
- Executes dropped EXE
PID:2272 -
\??\c:\xrrrxfx.exec:\xrrrxfx.exe50⤵
- Executes dropped EXE
PID:1004 -
\??\c:\9ntbbb.exec:\9ntbbb.exe51⤵
- Executes dropped EXE
PID:1120 -
\??\c:\htbnbb.exec:\htbnbb.exe52⤵
- Executes dropped EXE
PID:1228 -
\??\c:\pdjpd.exec:\pdjpd.exe53⤵
- Executes dropped EXE
PID:1572 -
\??\c:\7pdjj.exec:\7pdjj.exe54⤵
- Executes dropped EXE
PID:2844 -
\??\c:\fxrrrlx.exec:\fxrrrlx.exe55⤵
- Executes dropped EXE
PID:2420 -
\??\c:\llxrlrr.exec:\llxrlrr.exe56⤵
- Executes dropped EXE
PID:2084 -
\??\c:\bbbhnt.exec:\bbbhnt.exe57⤵
- Executes dropped EXE
PID:2588 -
\??\c:\tttbhh.exec:\tttbhh.exe58⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vpvpv.exec:\vpvpv.exe59⤵
- Executes dropped EXE
PID:328 -
\??\c:\5dvjp.exec:\5dvjp.exe60⤵
- Executes dropped EXE
PID:2212 -
\??\c:\frllllr.exec:\frllllr.exe61⤵
- Executes dropped EXE
PID:1540 -
\??\c:\fxffrrl.exec:\fxffrrl.exe62⤵
- Executes dropped EXE
PID:2160 -
\??\c:\frxxxxr.exec:\frxxxxr.exe63⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tnthtb.exec:\tnthtb.exe64⤵
- Executes dropped EXE
PID:2248 -
\??\c:\nhhntt.exec:\nhhntt.exe65⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pjpvj.exec:\pjpvj.exe66⤵PID:1664
-
\??\c:\dpjjv.exec:\dpjjv.exe67⤵PID:552
-
\??\c:\frlrlrf.exec:\frlrlrf.exe68⤵PID:1564
-
\??\c:\lflrffl.exec:\lflrffl.exe69⤵PID:2632
-
\??\c:\bbnbtt.exec:\bbnbtt.exe70⤵PID:3016
-
\??\c:\tbhhth.exec:\tbhhth.exe71⤵PID:896
-
\??\c:\3pjjj.exec:\3pjjj.exe72⤵PID:2892
-
\??\c:\vpvvv.exec:\vpvvv.exe73⤵
- System Location Discovery: System Language Discovery
PID:2484 -
\??\c:\fxrxllr.exec:\fxrxllr.exe74⤵PID:2816
-
\??\c:\lxflxfr.exec:\lxflxfr.exe75⤵PID:2692
-
\??\c:\nhnnnt.exec:\nhnnnt.exe76⤵PID:2756
-
\??\c:\5bbnnt.exec:\5bbnnt.exe77⤵PID:2684
-
\??\c:\vpddj.exec:\vpddj.exe78⤵PID:2584
-
\??\c:\dpvdv.exec:\dpvdv.exe79⤵PID:2728
-
\??\c:\xrlxxfr.exec:\xrlxxfr.exe80⤵PID:2568
-
\??\c:\fxflrfr.exec:\fxflrfr.exe81⤵PID:2624
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe82⤵PID:2432
-
\??\c:\nnhhhh.exec:\nnhhhh.exe83⤵PID:2340
-
\??\c:\nnhbht.exec:\nnhbht.exe84⤵PID:2992
-
\??\c:\dppvd.exec:\dppvd.exe85⤵PID:608
-
\??\c:\dvvjp.exec:\dvvjp.exe86⤵PID:1916
-
\??\c:\xrxxfxl.exec:\xrxxfxl.exe87⤵PID:2016
-
\??\c:\rrrfxfl.exec:\rrrfxfl.exe88⤵PID:1648
-
\??\c:\bnthnh.exec:\bnthnh.exe89⤵PID:2056
-
\??\c:\nhhbtt.exec:\nhhbtt.exe90⤵PID:2536
-
\??\c:\bnbbtt.exec:\bnbbtt.exe91⤵PID:1980
-
\??\c:\5pvdd.exec:\5pvdd.exe92⤵PID:1692
-
\??\c:\1pjjp.exec:\1pjjp.exe93⤵PID:1776
-
\??\c:\llxxfxx.exec:\llxxfxx.exe94⤵PID:2620
-
\??\c:\5rxrffl.exec:\5rxrffl.exe95⤵PID:1420
-
\??\c:\7htbhh.exec:\7htbhh.exe96⤵PID:280
-
\??\c:\hhtnnb.exec:\hhtnnb.exe97⤵PID:448
-
\??\c:\7bnnhn.exec:\7bnnhn.exe98⤵PID:2928
-
\??\c:\jdppp.exec:\jdppp.exe99⤵PID:328
-
\??\c:\vjjdd.exec:\vjjdd.exe100⤵PID:1736
-
\??\c:\3lxfffl.exec:\3lxfffl.exe101⤵PID:1972
-
\??\c:\rlrrflr.exec:\rlrrflr.exe102⤵PID:1988
-
\??\c:\nbntnt.exec:\nbntnt.exe103⤵PID:2868
-
\??\c:\1htbhn.exec:\1htbhn.exe104⤵PID:372
-
\??\c:\jdppj.exec:\jdppj.exe105⤵PID:1016
-
\??\c:\pjppd.exec:\pjppd.exe106⤵PID:2256
-
\??\c:\vpdvj.exec:\vpdvj.exe107⤵PID:2024
-
\??\c:\fxrxllr.exec:\fxrxllr.exe108⤵PID:2068
-
\??\c:\xrxxllx.exec:\xrxxllx.exe109⤵
- System Location Discovery: System Language Discovery
PID:904 -
\??\c:\1fxfrrx.exec:\1fxfrrx.exe110⤵PID:2344
-
\??\c:\tnbhtt.exec:\tnbhtt.exe111⤵PID:896
-
\??\c:\tnhhbb.exec:\tnhhbb.exe112⤵PID:2644
-
\??\c:\jvjvv.exec:\jvjvv.exe113⤵PID:2916
-
\??\c:\pvjdp.exec:\pvjdp.exe114⤵PID:1624
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe115⤵PID:1528
-
\??\c:\lfflffl.exec:\lfflffl.exe116⤵PID:2096
-
\??\c:\1rflrxx.exec:\1rflrxx.exe117⤵PID:2576
-
\??\c:\htbnhh.exec:\htbnhh.exe118⤵PID:2784
-
\??\c:\btnbhn.exec:\btnbhn.exe119⤵PID:2348
-
\??\c:\nhhbhh.exec:\nhhbhh.exe120⤵PID:2616
-
\??\c:\ddvvj.exec:\ddvvj.exe121⤵PID:2980
-
\??\c:\dvjpv.exec:\dvjpv.exe122⤵PID:1940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-