Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 18:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f35280c0baaa0597d4bda1b958411fdf9445ebe6f5598e659bffaa303f9c75fN.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
3f35280c0baaa0597d4bda1b958411fdf9445ebe6f5598e659bffaa303f9c75fN.exe
-
Size
71KB
-
MD5
f2ec001809dd6ebff3abc7fc319a6200
-
SHA1
97973dc1aab233f9f35259238ac5266ad2e11ba5
-
SHA256
3f35280c0baaa0597d4bda1b958411fdf9445ebe6f5598e659bffaa303f9c75f
-
SHA512
5ca10585f628238d709bbd907dde31391113e90552f39f9885219375a612d5ca4df87b2a9ee7ce6892d84ba082d1a4b4ba0da3ce4d9079f0585956d9dd4dc125
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjeG:ymb3NkkiQ3mdBjFI4VOG
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2724-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/944-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1220-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-1453-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-2833-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2724 9dddv.exe 2964 dpvdj.exe 2832 frfflll.exe 2928 thbttt.exe 2752 ppjvv.exe 2616 dvjvp.exe 1604 pdvdj.exe 2092 jjppp.exe 2568 9nbbbh.exe 2472 nhbbbb.exe 2056 9vjdj.exe 944 7jvdj.exe 1328 fxlrffl.exe 1044 hbhbhb.exe 2572 tnhhnb.exe 1572 9dvdd.exe 1968 vpddj.exe 1960 lrrllff.exe 2376 hhnthh.exe 2176 nhbhnh.exe 1468 ppjpj.exe 1220 ddjpd.exe 2124 fxflrfl.exe 1652 thbbhn.exe 1376 jvdjj.exe 1200 pvjjp.exe 988 htnthb.exe 2504 htntbb.exe 1772 dvjjv.exe 2676 vjdjp.exe 2740 xrfllrr.exe 2792 1nhhhn.exe 2964 bnnthb.exe 2592 vpjjj.exe 2624 jdppv.exe 1588 lflfrlr.exe 2620 7lrxfll.exe 2648 7nhttb.exe 3060 vdjvj.exe 308 5pddd.exe 804 5ffxfrr.exe 2136 rfffllr.exe 2976 hhnntb.exe 1792 nbtbnn.exe 2900 jddpp.exe 1944 vjddd.exe 1712 xxrxrxl.exe 2764 1rlrxfl.exe 2020 thtnnb.exe 2760 htntnb.exe 1504 9vjpp.exe 2264 jdpvp.exe 1572 3xlfxxf.exe 1812 lfrlrrx.exe 1108 5btbhb.exe 2400 nhttbb.exe 2388 7vjdj.exe 2428 vpddd.exe 2360 1fxlxfl.exe 924 lxrrrxf.exe 1624 hbhntt.exe 2684 nbnttn.exe 2852 dpdjj.exe 1516 jdvvv.exe -
resource yara_rule behavioral1/memory/2724-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1220-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-1453-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-2833-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2724 2220 3f35280c0baaa0597d4bda1b958411fdf9445ebe6f5598e659bffaa303f9c75fN.exe 31 PID 2220 wrote to memory of 2724 2220 3f35280c0baaa0597d4bda1b958411fdf9445ebe6f5598e659bffaa303f9c75fN.exe 31 PID 2220 wrote to memory of 2724 2220 3f35280c0baaa0597d4bda1b958411fdf9445ebe6f5598e659bffaa303f9c75fN.exe 31 PID 2220 wrote to memory of 2724 2220 3f35280c0baaa0597d4bda1b958411fdf9445ebe6f5598e659bffaa303f9c75fN.exe 31 PID 2724 wrote to memory of 2964 2724 9dddv.exe 32 PID 2724 wrote to memory of 2964 2724 9dddv.exe 32 PID 2724 wrote to memory of 2964 2724 9dddv.exe 32 PID 2724 wrote to memory of 2964 2724 9dddv.exe 32 PID 2964 wrote to memory of 2832 2964 dpvdj.exe 33 PID 2964 wrote to memory of 2832 2964 dpvdj.exe 33 PID 2964 wrote to memory of 2832 2964 dpvdj.exe 33 PID 2964 wrote to memory of 2832 2964 dpvdj.exe 33 PID 2832 wrote to memory of 2928 2832 frfflll.exe 34 PID 2832 wrote to memory of 2928 2832 frfflll.exe 34 PID 2832 wrote to memory of 2928 2832 frfflll.exe 34 PID 2832 wrote to memory of 2928 2832 frfflll.exe 34 PID 2928 wrote to memory of 2752 2928 thbttt.exe 35 PID 2928 wrote to memory of 2752 2928 thbttt.exe 35 PID 2928 wrote to memory of 2752 2928 thbttt.exe 35 PID 2928 wrote to memory of 2752 2928 thbttt.exe 35 PID 2752 wrote to memory of 2616 2752 ppjvv.exe 36 PID 2752 wrote to memory of 2616 2752 ppjvv.exe 36 PID 2752 wrote to memory of 2616 2752 ppjvv.exe 36 PID 2752 wrote to memory of 2616 2752 ppjvv.exe 36 PID 2616 wrote to memory of 1604 2616 dvjvp.exe 37 PID 2616 wrote to memory of 1604 2616 dvjvp.exe 37 PID 2616 wrote to memory of 1604 2616 dvjvp.exe 37 PID 2616 wrote to memory of 1604 2616 dvjvp.exe 37 PID 1604 wrote to memory of 2092 1604 pdvdj.exe 38 PID 1604 wrote to memory of 2092 1604 pdvdj.exe 38 PID 1604 wrote to memory of 2092 1604 pdvdj.exe 38 PID 1604 wrote to memory of 2092 1604 pdvdj.exe 38 PID 2092 wrote to memory of 2568 2092 jjppp.exe 39 PID 2092 wrote to memory of 2568 2092 jjppp.exe 39 PID 2092 wrote to memory of 2568 2092 jjppp.exe 39 PID 2092 wrote to memory of 2568 2092 jjppp.exe 39 PID 2568 wrote to memory of 2472 2568 9nbbbh.exe 40 PID 2568 wrote to memory of 2472 2568 9nbbbh.exe 40 PID 2568 wrote to memory of 2472 2568 9nbbbh.exe 40 PID 2568 wrote to memory of 2472 2568 9nbbbh.exe 40 PID 2472 wrote to memory of 2056 2472 nhbbbb.exe 41 PID 2472 wrote to memory of 2056 2472 nhbbbb.exe 41 PID 2472 wrote to memory of 2056 2472 nhbbbb.exe 41 PID 2472 wrote to memory of 2056 2472 nhbbbb.exe 41 PID 2056 wrote to memory of 944 2056 9vjdj.exe 42 PID 2056 wrote to memory of 944 2056 9vjdj.exe 42 PID 2056 wrote to memory of 944 2056 9vjdj.exe 42 PID 2056 wrote to memory of 944 2056 9vjdj.exe 42 PID 944 wrote to memory of 1328 944 7jvdj.exe 43 PID 944 wrote to memory of 1328 944 7jvdj.exe 43 PID 944 wrote to memory of 1328 944 7jvdj.exe 43 PID 944 wrote to memory of 1328 944 7jvdj.exe 43 PID 1328 wrote to memory of 1044 1328 fxlrffl.exe 44 PID 1328 wrote to memory of 1044 1328 fxlrffl.exe 44 PID 1328 wrote to memory of 1044 1328 fxlrffl.exe 44 PID 1328 wrote to memory of 1044 1328 fxlrffl.exe 44 PID 1044 wrote to memory of 2572 1044 hbhbhb.exe 45 PID 1044 wrote to memory of 2572 1044 hbhbhb.exe 45 PID 1044 wrote to memory of 2572 1044 hbhbhb.exe 45 PID 1044 wrote to memory of 2572 1044 hbhbhb.exe 45 PID 2572 wrote to memory of 1572 2572 tnhhnb.exe 46 PID 2572 wrote to memory of 1572 2572 tnhhnb.exe 46 PID 2572 wrote to memory of 1572 2572 tnhhnb.exe 46 PID 2572 wrote to memory of 1572 2572 tnhhnb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f35280c0baaa0597d4bda1b958411fdf9445ebe6f5598e659bffaa303f9c75fN.exe"C:\Users\Admin\AppData\Local\Temp\3f35280c0baaa0597d4bda1b958411fdf9445ebe6f5598e659bffaa303f9c75fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\9dddv.exec:\9dddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\dpvdj.exec:\dpvdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\frfflll.exec:\frfflll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\thbttt.exec:\thbttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\ppjvv.exec:\ppjvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\dvjvp.exec:\dvjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\pdvdj.exec:\pdvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\jjppp.exec:\jjppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\9nbbbh.exec:\9nbbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\nhbbbb.exec:\nhbbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\9vjdj.exec:\9vjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\7jvdj.exec:\7jvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\fxlrffl.exec:\fxlrffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\hbhbhb.exec:\hbhbhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\tnhhnb.exec:\tnhhnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\9dvdd.exec:\9dvdd.exe17⤵
- Executes dropped EXE
PID:1572 -
\??\c:\vpddj.exec:\vpddj.exe18⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lrrllff.exec:\lrrllff.exe19⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hhnthh.exec:\hhnthh.exe20⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nhbhnh.exec:\nhbhnh.exe21⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ppjpj.exec:\ppjpj.exe22⤵
- Executes dropped EXE
PID:1468 -
\??\c:\ddjpd.exec:\ddjpd.exe23⤵
- Executes dropped EXE
PID:1220 -
\??\c:\fxflrfl.exec:\fxflrfl.exe24⤵
- Executes dropped EXE
PID:2124 -
\??\c:\thbbhn.exec:\thbbhn.exe25⤵
- Executes dropped EXE
PID:1652 -
\??\c:\jvdjj.exec:\jvdjj.exe26⤵
- Executes dropped EXE
PID:1376 -
\??\c:\pvjjp.exec:\pvjjp.exe27⤵
- Executes dropped EXE
PID:1200 -
\??\c:\htnthb.exec:\htnthb.exe28⤵
- Executes dropped EXE
PID:988 -
\??\c:\htntbb.exec:\htntbb.exe29⤵
- Executes dropped EXE
PID:2504 -
\??\c:\dvjjv.exec:\dvjjv.exe30⤵
- Executes dropped EXE
PID:1772 -
\??\c:\vjdjp.exec:\vjdjp.exe31⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xrfllrr.exec:\xrfllrr.exe32⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1nhhhn.exec:\1nhhhn.exe33⤵
- Executes dropped EXE
PID:2792 -
\??\c:\bnnthb.exec:\bnnthb.exe34⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vpjjj.exec:\vpjjj.exe35⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jdppv.exec:\jdppv.exe36⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lflfrlr.exec:\lflfrlr.exe37⤵
- Executes dropped EXE
PID:1588 -
\??\c:\7lrxfll.exec:\7lrxfll.exe38⤵
- Executes dropped EXE
PID:2620 -
\??\c:\7nhttb.exec:\7nhttb.exe39⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vdjvj.exec:\vdjvj.exe40⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5pddd.exec:\5pddd.exe41⤵
- Executes dropped EXE
PID:308 -
\??\c:\5ffxfrr.exec:\5ffxfrr.exe42⤵
- Executes dropped EXE
PID:804 -
\??\c:\rfffllr.exec:\rfffllr.exe43⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hhnntb.exec:\hhnntb.exe44⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nbtbnn.exec:\nbtbnn.exe45⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jddpp.exec:\jddpp.exe46⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vjddd.exec:\vjddd.exe47⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xxrxrxl.exec:\xxrxrxl.exe48⤵
- Executes dropped EXE
PID:1712 -
\??\c:\1rlrxfl.exec:\1rlrxfl.exe49⤵
- Executes dropped EXE
PID:2764 -
\??\c:\thtnnb.exec:\thtnnb.exe50⤵
- Executes dropped EXE
PID:2020 -
\??\c:\htntnb.exec:\htntnb.exe51⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9vjpp.exec:\9vjpp.exe52⤵
- Executes dropped EXE
PID:1504 -
\??\c:\jdpvp.exec:\jdpvp.exe53⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3xlfxxf.exec:\3xlfxxf.exe54⤵
- Executes dropped EXE
PID:1572 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe55⤵
- Executes dropped EXE
PID:1812 -
\??\c:\5btbhb.exec:\5btbhb.exe56⤵
- Executes dropped EXE
PID:1108 -
\??\c:\nhttbb.exec:\nhttbb.exe57⤵
- Executes dropped EXE
PID:2400 -
\??\c:\7vjdj.exec:\7vjdj.exe58⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vpddd.exec:\vpddd.exe59⤵
- Executes dropped EXE
PID:2428 -
\??\c:\1fxlxfl.exec:\1fxlxfl.exe60⤵
- Executes dropped EXE
PID:2360 -
\??\c:\lxrrrxf.exec:\lxrrrxf.exe61⤵
- Executes dropped EXE
PID:924 -
\??\c:\hbhntt.exec:\hbhntt.exe62⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nbnttn.exec:\nbnttn.exe63⤵
- Executes dropped EXE
PID:2684 -
\??\c:\dpdjj.exec:\dpdjj.exe64⤵
- Executes dropped EXE
PID:2852 -
\??\c:\jdvvv.exec:\jdvvv.exe65⤵
- Executes dropped EXE
PID:1516 -
\??\c:\rfrxrrx.exec:\rfrxrrx.exe66⤵PID:2040
-
\??\c:\hnnttt.exec:\hnnttt.exe67⤵PID:1288
-
\??\c:\vpdvv.exec:\vpdvv.exe68⤵PID:992
-
\??\c:\vjjdd.exec:\vjjdd.exe69⤵PID:2504
-
\??\c:\3lrrrrl.exec:\3lrrrrl.exe70⤵PID:1972
-
\??\c:\rfrfrxr.exec:\rfrfrxr.exe71⤵PID:2796
-
\??\c:\nbttbb.exec:\nbttbb.exe72⤵
- System Location Discovery: System Language Discovery
PID:2708 -
\??\c:\3nhnhh.exec:\3nhnhh.exe73⤵PID:2776
-
\??\c:\vjvdd.exec:\vjvdd.exe74⤵PID:2876
-
\??\c:\vvjvv.exec:\vvjvv.exe75⤵PID:2824
-
\??\c:\3rffffr.exec:\3rffffr.exe76⤵PID:2380
-
\??\c:\5rflffl.exec:\5rflffl.exe77⤵PID:2720
-
\??\c:\1nhhnn.exec:\1nhhnn.exe78⤵PID:1580
-
\??\c:\1bbhtn.exec:\1bbhtn.exe79⤵PID:2620
-
\??\c:\pdvdd.exec:\pdvdd.exe80⤵PID:2656
-
\??\c:\jdppp.exec:\jdppp.exe81⤵PID:3060
-
\??\c:\xrxxfrx.exec:\xrxxfrx.exe82⤵PID:2260
-
\??\c:\rfxlxfx.exec:\rfxlxfx.exe83⤵PID:2100
-
\??\c:\7nbbbb.exec:\7nbbbb.exe84⤵PID:1716
-
\??\c:\hthntb.exec:\hthntb.exe85⤵PID:1864
-
\??\c:\ddvdp.exec:\ddvdp.exe86⤵PID:348
-
\??\c:\pjpvv.exec:\pjpvv.exe87⤵PID:2532
-
\??\c:\ffrlrrf.exec:\ffrlrrf.exe88⤵PID:1944
-
\??\c:\5fxfffl.exec:\5fxfffl.exe89⤵PID:584
-
\??\c:\nhhnhh.exec:\nhhnhh.exe90⤵PID:756
-
\??\c:\tnnbhn.exec:\tnnbhn.exe91⤵PID:2020
-
\??\c:\1dppd.exec:\1dppd.exe92⤵PID:1304
-
\??\c:\vvdjj.exec:\vvdjj.exe93⤵PID:1212
-
\??\c:\rlflllx.exec:\rlflllx.exe94⤵PID:264
-
\??\c:\xlxffrl.exec:\xlxffrl.exe95⤵PID:1980
-
\??\c:\bnbhnt.exec:\bnbhnt.exe96⤵PID:1968
-
\??\c:\bbnthb.exec:\bbnthb.exe97⤵PID:1952
-
\??\c:\vjddd.exec:\vjddd.exe98⤵PID:2120
-
\??\c:\jjjpd.exec:\jjjpd.exe99⤵PID:2988
-
\??\c:\fxffrxl.exec:\fxffrxl.exe100⤵PID:2184
-
\??\c:\lfxfxfl.exec:\lfxfxfl.exe101⤵PID:3064
-
\??\c:\ttnntb.exec:\ttnntb.exe102⤵
- System Location Discovery: System Language Discovery
PID:880 -
\??\c:\bnbttb.exec:\bnbttb.exe103⤵PID:2212
-
\??\c:\bnbttb.exec:\bnbttb.exe104⤵PID:2548
-
\??\c:\vpjpv.exec:\vpjpv.exe105⤵PID:2052
-
\??\c:\dpddd.exec:\dpddd.exe106⤵PID:2132
-
\??\c:\xrllxff.exec:\xrllxff.exe107⤵PID:2444
-
\??\c:\lxllrrx.exec:\lxllrrx.exe108⤵PID:2156
-
\??\c:\3lrxfxx.exec:\3lrxfxx.exe109⤵PID:1068
-
\??\c:\tnnbbb.exec:\tnnbbb.exe110⤵PID:3000
-
\??\c:\tntthh.exec:\tntthh.exe111⤵PID:2476
-
\??\c:\jddjj.exec:\jddjj.exe112⤵PID:2800
-
\??\c:\ppdpj.exec:\ppdpj.exe113⤵PID:2788
-
\??\c:\lxxxrxr.exec:\lxxxrxr.exe114⤵PID:2804
-
\??\c:\xxlfllr.exec:\xxlfllr.exe115⤵PID:2844
-
\??\c:\btnhnt.exec:\btnhnt.exe116⤵PID:2812
-
\??\c:\tnnnbh.exec:\tnnnbh.exe117⤵PID:1576
-
\??\c:\5jvdd.exec:\5jvdd.exe118⤵PID:2752
-
\??\c:\jpjjv.exec:\jpjjv.exe119⤵PID:2588
-
\??\c:\rrllrlr.exec:\rrllrlr.exe120⤵PID:2600
-
\??\c:\xrrlrxr.exec:\xrrlrxr.exe121⤵PID:1532
-
\??\c:\htnntb.exec:\htnntb.exe122⤵PID:1000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-