Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 14:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
34cd672e54339a4a2c79262c5b0d5f24007c21f182bd9ced0156cf3769aab32aN.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
34cd672e54339a4a2c79262c5b0d5f24007c21f182bd9ced0156cf3769aab32aN.exe
-
Size
71KB
-
MD5
bba6b33503cf622e8ffe8b51811ee5e0
-
SHA1
55fd0c95382bce6c3fd2f8993034639d114a683f
-
SHA256
34cd672e54339a4a2c79262c5b0d5f24007c21f182bd9ced0156cf3769aab32a
-
SHA512
c5c428c02c6a3f29e91e4cff5a414440fa03d44413468a2ef148f25deb4fe1e7ad50bebb086a8f3571775f846cbab8cec93c23c98498d5697ab2acf5d6e2ca14
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjj:ymb3NkkiQ3mdBjFI4Vz
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2376-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/796-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/288-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/448-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1216-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 796 tnhbhh.exe 2264 1dvvv.exe 2284 ddjvp.exe 2848 rfxxxfr.exe 2592 thnnbb.exe 2620 5ppdj.exe 2632 frfffxf.exe 2660 thnntt.exe 3064 pjvvp.exe 320 fxllrlx.exe 788 9nntth.exe 2000 pdjjj.exe 852 dpddj.exe 1708 xlfffll.exe 288 xrlrfxr.exe 2792 tbnnnh.exe 1440 5hnnnb.exe 2084 dpvpv.exe 1108 lfrfrlr.exe 448 rfllxxx.exe 2568 1hbtnh.exe 1204 5pvdd.exe 1528 1jpjp.exe 1216 jvdvd.exe 636 lfxrlll.exe 2532 5nbbhh.exe 1924 bnhtnn.exe 884 vpjvp.exe 2268 frxrfff.exe 2044 rxxxxxr.exe 2264 tbhnnh.exe 2732 vjpdj.exe 2864 9pjpd.exe 1712 lrflfff.exe 2712 frxrrrf.exe 2592 hthhnh.exe 2608 hbnnnh.exe 2196 nbhtnb.exe 2760 jvdvd.exe 3048 5pddp.exe 2604 xlxlrlr.exe 2444 xlxxxxl.exe 3064 1bttbb.exe 320 7bnnhb.exe 1568 vpddd.exe 1732 9dvpp.exe 628 3lxxxxf.exe 1564 frllxxf.exe 1708 nbhthh.exe 2776 nbhnhh.exe 2212 7nnttn.exe 2192 5pddd.exe 2948 vjvjd.exe 2952 xflfffx.exe 1624 5flxffl.exe 2796 nhnhtt.exe 376 thnnhh.exe 2036 dpvvd.exe 2540 jdjjj.exe 1784 7xffllx.exe 860 xlrllfl.exe 952 1tbttn.exe 2148 thnhnn.exe 980 5pvvj.exe -
resource yara_rule behavioral1/memory/2376-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/288-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1108-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/448-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1216-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-279-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrlll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2376 wrote to memory of 796 2376 34cd672e54339a4a2c79262c5b0d5f24007c21f182bd9ced0156cf3769aab32aN.exe 31 PID 2376 wrote to memory of 796 2376 34cd672e54339a4a2c79262c5b0d5f24007c21f182bd9ced0156cf3769aab32aN.exe 31 PID 2376 wrote to memory of 796 2376 34cd672e54339a4a2c79262c5b0d5f24007c21f182bd9ced0156cf3769aab32aN.exe 31 PID 2376 wrote to memory of 796 2376 34cd672e54339a4a2c79262c5b0d5f24007c21f182bd9ced0156cf3769aab32aN.exe 31 PID 796 wrote to memory of 2264 796 tnhbhh.exe 32 PID 796 wrote to memory of 2264 796 tnhbhh.exe 32 PID 796 wrote to memory of 2264 796 tnhbhh.exe 32 PID 796 wrote to memory of 2264 796 tnhbhh.exe 32 PID 2264 wrote to memory of 2284 2264 1dvvv.exe 33 PID 2264 wrote to memory of 2284 2264 1dvvv.exe 33 PID 2264 wrote to memory of 2284 2264 1dvvv.exe 33 PID 2264 wrote to memory of 2284 2264 1dvvv.exe 33 PID 2284 wrote to memory of 2848 2284 ddjvp.exe 34 PID 2284 wrote to memory of 2848 2284 ddjvp.exe 34 PID 2284 wrote to memory of 2848 2284 ddjvp.exe 34 PID 2284 wrote to memory of 2848 2284 ddjvp.exe 34 PID 2848 wrote to memory of 2592 2848 rfxxxfr.exe 35 PID 2848 wrote to memory of 2592 2848 rfxxxfr.exe 35 PID 2848 wrote to memory of 2592 2848 rfxxxfr.exe 35 PID 2848 wrote to memory of 2592 2848 rfxxxfr.exe 35 PID 2592 wrote to memory of 2620 2592 thnnbb.exe 36 PID 2592 wrote to memory of 2620 2592 thnnbb.exe 36 PID 2592 wrote to memory of 2620 2592 thnnbb.exe 36 PID 2592 wrote to memory of 2620 2592 thnnbb.exe 36 PID 2620 wrote to memory of 2632 2620 5ppdj.exe 37 PID 2620 wrote to memory of 2632 2620 5ppdj.exe 37 PID 2620 wrote to memory of 2632 2620 5ppdj.exe 37 PID 2620 wrote to memory of 2632 2620 5ppdj.exe 37 PID 2632 wrote to memory of 2660 2632 frfffxf.exe 38 PID 2632 wrote to memory of 2660 2632 frfffxf.exe 38 PID 2632 wrote to memory of 2660 2632 frfffxf.exe 38 PID 2632 wrote to memory of 2660 2632 frfffxf.exe 38 PID 2660 wrote to memory of 3064 2660 thnntt.exe 39 PID 2660 wrote to memory of 3064 2660 thnntt.exe 39 PID 2660 wrote to memory of 3064 2660 thnntt.exe 39 PID 2660 wrote to memory of 3064 2660 thnntt.exe 39 PID 3064 wrote to memory of 320 3064 pjvvp.exe 40 PID 3064 wrote to memory of 320 3064 pjvvp.exe 40 PID 3064 wrote to memory of 320 3064 pjvvp.exe 40 PID 3064 wrote to memory of 320 3064 pjvvp.exe 40 PID 320 wrote to memory of 788 320 fxllrlx.exe 41 PID 320 wrote to memory of 788 320 fxllrlx.exe 41 PID 320 wrote to memory of 788 320 fxllrlx.exe 41 PID 320 wrote to memory of 788 320 fxllrlx.exe 41 PID 788 wrote to memory of 2000 788 9nntth.exe 42 PID 788 wrote to memory of 2000 788 9nntth.exe 42 PID 788 wrote to memory of 2000 788 9nntth.exe 42 PID 788 wrote to memory of 2000 788 9nntth.exe 42 PID 2000 wrote to memory of 852 2000 pdjjj.exe 43 PID 2000 wrote to memory of 852 2000 pdjjj.exe 43 PID 2000 wrote to memory of 852 2000 pdjjj.exe 43 PID 2000 wrote to memory of 852 2000 pdjjj.exe 43 PID 852 wrote to memory of 1708 852 dpddj.exe 44 PID 852 wrote to memory of 1708 852 dpddj.exe 44 PID 852 wrote to memory of 1708 852 dpddj.exe 44 PID 852 wrote to memory of 1708 852 dpddj.exe 44 PID 1708 wrote to memory of 288 1708 xlfffll.exe 45 PID 1708 wrote to memory of 288 1708 xlfffll.exe 45 PID 1708 wrote to memory of 288 1708 xlfffll.exe 45 PID 1708 wrote to memory of 288 1708 xlfffll.exe 45 PID 288 wrote to memory of 2792 288 xrlrfxr.exe 46 PID 288 wrote to memory of 2792 288 xrlrfxr.exe 46 PID 288 wrote to memory of 2792 288 xrlrfxr.exe 46 PID 288 wrote to memory of 2792 288 xrlrfxr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\34cd672e54339a4a2c79262c5b0d5f24007c21f182bd9ced0156cf3769aab32aN.exe"C:\Users\Admin\AppData\Local\Temp\34cd672e54339a4a2c79262c5b0d5f24007c21f182bd9ced0156cf3769aab32aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\tnhbhh.exec:\tnhbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\1dvvv.exec:\1dvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\ddjvp.exec:\ddjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\rfxxxfr.exec:\rfxxxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\thnnbb.exec:\thnnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\5ppdj.exec:\5ppdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\frfffxf.exec:\frfffxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\thnntt.exec:\thnntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\pjvvp.exec:\pjvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\fxllrlx.exec:\fxllrlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\9nntth.exec:\9nntth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\pdjjj.exec:\pdjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\dpddj.exec:\dpddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\xlfffll.exec:\xlfffll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\xrlrfxr.exec:\xrlrfxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:288 -
\??\c:\tbnnnh.exec:\tbnnnh.exe17⤵
- Executes dropped EXE
PID:2792 -
\??\c:\5hnnnb.exec:\5hnnnb.exe18⤵
- Executes dropped EXE
PID:1440 -
\??\c:\dpvpv.exec:\dpvpv.exe19⤵
- Executes dropped EXE
PID:2084 -
\??\c:\lfrfrlr.exec:\lfrfrlr.exe20⤵
- Executes dropped EXE
PID:1108 -
\??\c:\rfllxxx.exec:\rfllxxx.exe21⤵
- Executes dropped EXE
PID:448 -
\??\c:\1hbtnh.exec:\1hbtnh.exe22⤵
- Executes dropped EXE
PID:2568 -
\??\c:\5pvdd.exec:\5pvdd.exe23⤵
- Executes dropped EXE
PID:1204 -
\??\c:\1jpjp.exec:\1jpjp.exe24⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jvdvd.exec:\jvdvd.exe25⤵
- Executes dropped EXE
PID:1216 -
\??\c:\lfxrlll.exec:\lfxrlll.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:636 -
\??\c:\5nbbhh.exec:\5nbbhh.exe27⤵
- Executes dropped EXE
PID:2532 -
\??\c:\bnhtnn.exec:\bnhtnn.exe28⤵
- Executes dropped EXE
PID:1924 -
\??\c:\vpjvp.exec:\vpjvp.exe29⤵
- Executes dropped EXE
PID:884 -
\??\c:\frxrfff.exec:\frxrfff.exe30⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rxxxxxr.exec:\rxxxxxr.exe31⤵
- Executes dropped EXE
PID:2044 -
\??\c:\tbhnnh.exec:\tbhnnh.exe32⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vjpdj.exec:\vjpdj.exe33⤵
- Executes dropped EXE
PID:2732 -
\??\c:\9pjpd.exec:\9pjpd.exe34⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lrflfff.exec:\lrflfff.exe35⤵
- Executes dropped EXE
PID:1712 -
\??\c:\frxrrrf.exec:\frxrrrf.exe36⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hthhnh.exec:\hthhnh.exe37⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hbnnnh.exec:\hbnnnh.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nbhtnb.exec:\nbhtnb.exe39⤵
- Executes dropped EXE
PID:2196 -
\??\c:\jvdvd.exec:\jvdvd.exe40⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5pddp.exec:\5pddp.exe41⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xlxlrlr.exec:\xlxlrlr.exe42⤵
- Executes dropped EXE
PID:2604 -
\??\c:\xlxxxxl.exec:\xlxxxxl.exe43⤵
- Executes dropped EXE
PID:2444 -
\??\c:\1bttbb.exec:\1bttbb.exe44⤵
- Executes dropped EXE
PID:3064 -
\??\c:\7bnnhb.exec:\7bnnhb.exe45⤵
- Executes dropped EXE
PID:320 -
\??\c:\vpddd.exec:\vpddd.exe46⤵
- Executes dropped EXE
PID:1568 -
\??\c:\9dvpp.exec:\9dvpp.exe47⤵
- Executes dropped EXE
PID:1732 -
\??\c:\3lxxxxf.exec:\3lxxxxf.exe48⤵
- Executes dropped EXE
PID:628 -
\??\c:\frllxxf.exec:\frllxxf.exe49⤵
- Executes dropped EXE
PID:1564 -
\??\c:\nbhthh.exec:\nbhthh.exe50⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nbhnhh.exec:\nbhnhh.exe51⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7nnttn.exec:\7nnttn.exe52⤵
- Executes dropped EXE
PID:2212 -
\??\c:\5pddd.exec:\5pddd.exe53⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vjvjd.exec:\vjvjd.exe54⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xflfffx.exec:\xflfffx.exe55⤵
- Executes dropped EXE
PID:2952 -
\??\c:\5flxffl.exec:\5flxffl.exe56⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nhnhtt.exec:\nhnhtt.exe57⤵
- Executes dropped EXE
PID:2796 -
\??\c:\thnnhh.exec:\thnnhh.exe58⤵
- Executes dropped EXE
PID:376 -
\??\c:\dpvvd.exec:\dpvvd.exe59⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jdjjj.exec:\jdjjj.exe60⤵
- Executes dropped EXE
PID:2540 -
\??\c:\7xffllx.exec:\7xffllx.exe61⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xlrllfl.exec:\xlrllfl.exe62⤵
- Executes dropped EXE
PID:860 -
\??\c:\1tbttn.exec:\1tbttn.exe63⤵
- Executes dropped EXE
PID:952 -
\??\c:\thnhnn.exec:\thnhnn.exe64⤵
- Executes dropped EXE
PID:2148 -
\??\c:\5pvvj.exec:\5pvvj.exe65⤵
- Executes dropped EXE
PID:980 -
\??\c:\pdvvd.exec:\pdvvd.exe66⤵PID:1780
-
\??\c:\dvjjv.exec:\dvjjv.exe67⤵PID:2112
-
\??\c:\lffxlll.exec:\lffxlll.exe68⤵PID:2104
-
\??\c:\jdddd.exec:\jdddd.exe69⤵PID:2900
-
\??\c:\pjddj.exec:\pjddj.exe70⤵PID:2044
-
\??\c:\5pddj.exec:\5pddj.exe71⤵PID:2844
-
\??\c:\5lrrxrx.exec:\5lrrxrx.exe72⤵PID:2348
-
\??\c:\rfxflrf.exec:\rfxflrf.exe73⤵PID:1560
-
\??\c:\nhhbhh.exec:\nhhbhh.exe74⤵PID:2440
-
\??\c:\9bnhnb.exec:\9bnhnb.exe75⤵PID:2892
-
\??\c:\7vjjp.exec:\7vjjp.exe76⤵PID:2704
-
\??\c:\vpddj.exec:\vpddj.exe77⤵PID:2824
-
\??\c:\jvpjj.exec:\jvpjj.exe78⤵PID:2584
-
\??\c:\xrxrfll.exec:\xrxrfll.exe79⤵PID:2596
-
\??\c:\xlxffrx.exec:\xlxffrx.exe80⤵PID:2648
-
\??\c:\tnhhbb.exec:\tnhhbb.exe81⤵PID:2660
-
\??\c:\htttbt.exec:\htttbt.exe82⤵PID:1076
-
\??\c:\pjppp.exec:\pjppp.exe83⤵PID:1892
-
\??\c:\1jpdd.exec:\1jpdd.exe84⤵PID:2392
-
\??\c:\frxffxf.exec:\frxffxf.exe85⤵PID:1160
-
\??\c:\7rxfxrr.exec:\7rxfxrr.exe86⤵PID:1676
-
\??\c:\hbnntb.exec:\hbnntb.exe87⤵PID:1284
-
\??\c:\tthhnh.exec:\tthhnh.exe88⤵PID:1644
-
\??\c:\thhhnn.exec:\thhhnn.exe89⤵PID:1840
-
\??\c:\vpdjp.exec:\vpdjp.exe90⤵PID:2784
-
\??\c:\5dvdj.exec:\5dvdj.exe91⤵PID:2800
-
\??\c:\ffflrrx.exec:\ffflrrx.exe92⤵PID:1440
-
\??\c:\1lfxrxx.exec:\1lfxrxx.exe93⤵PID:1512
-
\??\c:\nbbbbh.exec:\nbbbbh.exe94⤵PID:908
-
\??\c:\5tnbht.exec:\5tnbht.exe95⤵PID:2072
-
\??\c:\pdvvv.exec:\pdvvv.exe96⤵PID:1624
-
\??\c:\jdppp.exec:\jdppp.exe97⤵PID:1328
-
\??\c:\frfxxrx.exec:\frfxxrx.exe98⤵PID:376
-
\??\c:\bnntbh.exec:\bnntbh.exe99⤵PID:1928
-
\??\c:\tnnntt.exec:\tnnntt.exe100⤵PID:1632
-
\??\c:\1jjjj.exec:\1jjjj.exe101⤵PID:1216
-
\??\c:\jdddp.exec:\jdddp.exe102⤵PID:1636
-
\??\c:\7rllllx.exec:\7rllllx.exe103⤵PID:2352
-
\??\c:\5lfxllr.exec:\5lfxllr.exe104⤵PID:1272
-
\??\c:\ntnhnt.exec:\ntnhnt.exe105⤵PID:992
-
\??\c:\htbhbh.exec:\htbhbh.exe106⤵PID:2336
-
\??\c:\jpppd.exec:\jpppd.exe107⤵PID:2964
-
\??\c:\rlxxflr.exec:\rlxxflr.exe108⤵PID:2728
-
\??\c:\hbtttb.exec:\hbtttb.exe109⤵PID:2692
-
\??\c:\7jvdd.exec:\7jvdd.exe110⤵PID:2068
-
\??\c:\5rxxxlx.exec:\5rxxxlx.exe111⤵PID:2968
-
\??\c:\bbbnbn.exec:\bbbnbn.exe112⤵PID:2744
-
\??\c:\1tntnb.exec:\1tntnb.exe113⤵PID:2868
-
\??\c:\3jdjp.exec:\3jdjp.exe114⤵PID:2976
-
\??\c:\rxrlxrr.exec:\rxrlxrr.exe115⤵PID:2884
-
\??\c:\5btthn.exec:\5btthn.exe116⤵PID:2500
-
\??\c:\jpvjd.exec:\jpvjd.exe117⤵PID:2588
-
\??\c:\jdjjj.exec:\jdjjj.exe118⤵PID:2636
-
\??\c:\xrrrlfl.exec:\xrrrlfl.exe119⤵PID:2708
-
\??\c:\hhnbbn.exec:\hhnbbn.exe120⤵PID:1236
-
\??\c:\jjpdd.exec:\jjpdd.exe121⤵PID:1812
-
\??\c:\9rxflrx.exec:\9rxflrx.exe122⤵PID:2412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-