Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 15:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
104b1d7e55616b109de0fcc807e40047b8b10110d1149cd64cb41c3f53f2cd37N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
104b1d7e55616b109de0fcc807e40047b8b10110d1149cd64cb41c3f53f2cd37N.exe
-
Size
64KB
-
MD5
8932a19049f0559d5386b2ef63e9cdd0
-
SHA1
cd45050127d9ec1e809ecfb920612c33ce6e0286
-
SHA256
104b1d7e55616b109de0fcc807e40047b8b10110d1149cd64cb41c3f53f2cd37
-
SHA512
e6359b721b2f707da37b0ee804a77789f813978c345ad20a5517cf556f3aa596a4539dddb50eecb90959f008dd6bb4c54806530cbc3ced765101d6defdb62cb9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxiG:ymb3NkkiQ3mdBjF0y7kbh
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2152-11-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1208-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/756-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1788 rlffrxf.exe 2268 3tbhnt.exe 1808 3dvdj.exe 2896 rlxfrrx.exe 2668 hhnntb.exe 2056 nbhtbh.exe 2640 5dvdp.exe 2496 frxxxxx.exe 2916 ttnbbb.exe 2532 3htbhn.exe 2520 9jvvp.exe 2540 rrrrfrx.exe 1740 xrfxfxr.exe 1860 bthbnt.exe 1964 vvvvd.exe 1944 dpvvd.exe 2036 3fllrfl.exe 1208 1rlrrxl.exe 756 hbtnnh.exe 2476 1hnbbb.exe 2760 ppddv.exe 2220 9pjjj.exe 2340 fxllrrf.exe 836 btthth.exe 2452 hhttbh.exe 768 jvjpp.exe 1620 1dvjd.exe 2296 rflrflr.exe 2188 tbhnnn.exe 2448 ttnbth.exe 1800 jvdvd.exe 2884 pjvdj.exe 2736 xrflrfr.exe 2128 nhnntt.exe 1368 9hbnnn.exe 2892 vdjpd.exe 2952 jvddp.exe 2116 rfxfffr.exe 2668 3llxllf.exe 2996 bbnnht.exe 2192 9nhhnt.exe 1972 3jdpj.exe 2692 fllrffr.exe 2496 xlxxflr.exe 1184 bbtnth.exe 2500 bnnhnt.exe 2928 pppjv.exe 2944 dvvvd.exe 2540 5frrxff.exe 1728 rfllrrx.exe 1872 9nhthh.exe 2248 hhbhtb.exe 1760 dvdjd.exe 1944 jdvdj.exe 1732 5pdjp.exe 744 lllllrf.exe 2824 bnbbtb.exe 2796 bnbhtb.exe 2832 pjdvj.exe 2664 7jpvd.exe 2348 9pjdj.exe 2864 rlrlrrx.exe 1440 9tbhnh.exe 1256 hhbbnn.exe -
resource yara_rule behavioral1/memory/2152-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1208-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/756-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-312-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnnt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2152 wrote to memory of 1788 2152 104b1d7e55616b109de0fcc807e40047b8b10110d1149cd64cb41c3f53f2cd37N.exe 28 PID 2152 wrote to memory of 1788 2152 104b1d7e55616b109de0fcc807e40047b8b10110d1149cd64cb41c3f53f2cd37N.exe 28 PID 2152 wrote to memory of 1788 2152 104b1d7e55616b109de0fcc807e40047b8b10110d1149cd64cb41c3f53f2cd37N.exe 28 PID 2152 wrote to memory of 1788 2152 104b1d7e55616b109de0fcc807e40047b8b10110d1149cd64cb41c3f53f2cd37N.exe 28 PID 1788 wrote to memory of 2268 1788 rlffrxf.exe 29 PID 1788 wrote to memory of 2268 1788 rlffrxf.exe 29 PID 1788 wrote to memory of 2268 1788 rlffrxf.exe 29 PID 1788 wrote to memory of 2268 1788 rlffrxf.exe 29 PID 2268 wrote to memory of 1808 2268 3tbhnt.exe 30 PID 2268 wrote to memory of 1808 2268 3tbhnt.exe 30 PID 2268 wrote to memory of 1808 2268 3tbhnt.exe 30 PID 2268 wrote to memory of 1808 2268 3tbhnt.exe 30 PID 1808 wrote to memory of 2896 1808 3dvdj.exe 31 PID 1808 wrote to memory of 2896 1808 3dvdj.exe 31 PID 1808 wrote to memory of 2896 1808 3dvdj.exe 31 PID 1808 wrote to memory of 2896 1808 3dvdj.exe 31 PID 2896 wrote to memory of 2668 2896 rlxfrrx.exe 32 PID 2896 wrote to memory of 2668 2896 rlxfrrx.exe 32 PID 2896 wrote to memory of 2668 2896 rlxfrrx.exe 32 PID 2896 wrote to memory of 2668 2896 rlxfrrx.exe 32 PID 2668 wrote to memory of 2056 2668 hhnntb.exe 33 PID 2668 wrote to memory of 2056 2668 hhnntb.exe 33 PID 2668 wrote to memory of 2056 2668 hhnntb.exe 33 PID 2668 wrote to memory of 2056 2668 hhnntb.exe 33 PID 2056 wrote to memory of 2640 2056 nbhtbh.exe 34 PID 2056 wrote to memory of 2640 2056 nbhtbh.exe 34 PID 2056 wrote to memory of 2640 2056 nbhtbh.exe 34 PID 2056 wrote to memory of 2640 2056 nbhtbh.exe 34 PID 2640 wrote to memory of 2496 2640 5dvdp.exe 35 PID 2640 wrote to memory of 2496 2640 5dvdp.exe 35 PID 2640 wrote to memory of 2496 2640 5dvdp.exe 35 PID 2640 wrote to memory of 2496 2640 5dvdp.exe 35 PID 2496 wrote to memory of 2916 2496 frxxxxx.exe 36 PID 2496 wrote to memory of 2916 2496 frxxxxx.exe 36 PID 2496 wrote to memory of 2916 2496 frxxxxx.exe 36 PID 2496 wrote to memory of 2916 2496 frxxxxx.exe 36 PID 2916 wrote to memory of 2532 2916 ttnbbb.exe 37 PID 2916 wrote to memory of 2532 2916 ttnbbb.exe 37 PID 2916 wrote to memory of 2532 2916 ttnbbb.exe 37 PID 2916 wrote to memory of 2532 2916 ttnbbb.exe 37 PID 2532 wrote to memory of 2520 2532 3htbhn.exe 38 PID 2532 wrote to memory of 2520 2532 3htbhn.exe 38 PID 2532 wrote to memory of 2520 2532 3htbhn.exe 38 PID 2532 wrote to memory of 2520 2532 3htbhn.exe 38 PID 2520 wrote to memory of 2540 2520 9jvvp.exe 39 PID 2520 wrote to memory of 2540 2520 9jvvp.exe 39 PID 2520 wrote to memory of 2540 2520 9jvvp.exe 39 PID 2520 wrote to memory of 2540 2520 9jvvp.exe 39 PID 2540 wrote to memory of 1740 2540 rrrrfrx.exe 40 PID 2540 wrote to memory of 1740 2540 rrrrfrx.exe 40 PID 2540 wrote to memory of 1740 2540 rrrrfrx.exe 40 PID 2540 wrote to memory of 1740 2540 rrrrfrx.exe 40 PID 1740 wrote to memory of 1860 1740 xrfxfxr.exe 41 PID 1740 wrote to memory of 1860 1740 xrfxfxr.exe 41 PID 1740 wrote to memory of 1860 1740 xrfxfxr.exe 41 PID 1740 wrote to memory of 1860 1740 xrfxfxr.exe 41 PID 1860 wrote to memory of 1964 1860 bthbnt.exe 42 PID 1860 wrote to memory of 1964 1860 bthbnt.exe 42 PID 1860 wrote to memory of 1964 1860 bthbnt.exe 42 PID 1860 wrote to memory of 1964 1860 bthbnt.exe 42 PID 1964 wrote to memory of 1944 1964 vvvvd.exe 43 PID 1964 wrote to memory of 1944 1964 vvvvd.exe 43 PID 1964 wrote to memory of 1944 1964 vvvvd.exe 43 PID 1964 wrote to memory of 1944 1964 vvvvd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\104b1d7e55616b109de0fcc807e40047b8b10110d1149cd64cb41c3f53f2cd37N.exe"C:\Users\Admin\AppData\Local\Temp\104b1d7e55616b109de0fcc807e40047b8b10110d1149cd64cb41c3f53f2cd37N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\rlffrxf.exec:\rlffrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\3tbhnt.exec:\3tbhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\3dvdj.exec:\3dvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\hhnntb.exec:\hhnntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\nbhtbh.exec:\nbhtbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\5dvdp.exec:\5dvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\frxxxxx.exec:\frxxxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\ttnbbb.exec:\ttnbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\3htbhn.exec:\3htbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\9jvvp.exec:\9jvvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\rrrrfrx.exec:\rrrrfrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xrfxfxr.exec:\xrfxfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\bthbnt.exec:\bthbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\vvvvd.exec:\vvvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\dpvvd.exec:\dpvvd.exe17⤵
- Executes dropped EXE
PID:1944 -
\??\c:\3fllrfl.exec:\3fllrfl.exe18⤵
- Executes dropped EXE
PID:2036 -
\??\c:\1rlrrxl.exec:\1rlrrxl.exe19⤵
- Executes dropped EXE
PID:1208 -
\??\c:\hbtnnh.exec:\hbtnnh.exe20⤵
- Executes dropped EXE
PID:756 -
\??\c:\1hnbbb.exec:\1hnbbb.exe21⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ppddv.exec:\ppddv.exe22⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9pjjj.exec:\9pjjj.exe23⤵
- Executes dropped EXE
PID:2220 -
\??\c:\fxllrrf.exec:\fxllrrf.exe24⤵
- Executes dropped EXE
PID:2340 -
\??\c:\btthth.exec:\btthth.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:836 -
\??\c:\hhttbh.exec:\hhttbh.exe26⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jvjpp.exec:\jvjpp.exe27⤵
- Executes dropped EXE
PID:768 -
\??\c:\1dvjd.exec:\1dvjd.exe28⤵
- Executes dropped EXE
PID:1620 -
\??\c:\rflrflr.exec:\rflrflr.exe29⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tbhnnn.exec:\tbhnnn.exe30⤵
- Executes dropped EXE
PID:2188 -
\??\c:\ttnbth.exec:\ttnbth.exe31⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jvdvd.exec:\jvdvd.exe32⤵
- Executes dropped EXE
PID:1800 -
\??\c:\pjvdj.exec:\pjvdj.exe33⤵
- Executes dropped EXE
PID:2884 -
\??\c:\xrflrfr.exec:\xrflrfr.exe34⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nhnntt.exec:\nhnntt.exe35⤵
- Executes dropped EXE
PID:2128 -
\??\c:\9hbnnn.exec:\9hbnnn.exe36⤵
- Executes dropped EXE
PID:1368 -
\??\c:\vdjpd.exec:\vdjpd.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jvddp.exec:\jvddp.exe38⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rfxfffr.exec:\rfxfffr.exe39⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3llxllf.exec:\3llxllf.exe40⤵
- Executes dropped EXE
PID:2668 -
\??\c:\bbnnht.exec:\bbnnht.exe41⤵
- Executes dropped EXE
PID:2996 -
\??\c:\9nhhnt.exec:\9nhhnt.exe42⤵
- Executes dropped EXE
PID:2192 -
\??\c:\3jdpj.exec:\3jdpj.exe43⤵
- Executes dropped EXE
PID:1972 -
\??\c:\fllrffr.exec:\fllrffr.exe44⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xlxxflr.exec:\xlxxflr.exe45⤵
- Executes dropped EXE
PID:2496 -
\??\c:\bbtnth.exec:\bbtnth.exe46⤵
- Executes dropped EXE
PID:1184 -
\??\c:\bnnhnt.exec:\bnnhnt.exe47⤵
- Executes dropped EXE
PID:2500 -
\??\c:\pppjv.exec:\pppjv.exe48⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dvvvd.exec:\dvvvd.exe49⤵
- Executes dropped EXE
PID:2944 -
\??\c:\5frrxff.exec:\5frrxff.exe50⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rfllrrx.exec:\rfllrrx.exe51⤵
- Executes dropped EXE
PID:1728 -
\??\c:\9nhthh.exec:\9nhthh.exe52⤵
- Executes dropped EXE
PID:1872 -
\??\c:\hhbhtb.exec:\hhbhtb.exe53⤵
- Executes dropped EXE
PID:2248 -
\??\c:\dvdjd.exec:\dvdjd.exe54⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jdvdj.exec:\jdvdj.exe55⤵
- Executes dropped EXE
PID:1944 -
\??\c:\5pdjp.exec:\5pdjp.exe56⤵
- Executes dropped EXE
PID:1732 -
\??\c:\lllllrf.exec:\lllllrf.exe57⤵
- Executes dropped EXE
PID:744 -
\??\c:\bnbbtb.exec:\bnbbtb.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2824 -
\??\c:\bnbhtb.exec:\bnbhtb.exe59⤵
- Executes dropped EXE
PID:2796 -
\??\c:\pjdvj.exec:\pjdvj.exe60⤵
- Executes dropped EXE
PID:2832 -
\??\c:\7jpvd.exec:\7jpvd.exe61⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9pjdj.exec:\9pjdj.exe62⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe63⤵
- Executes dropped EXE
PID:2864 -
\??\c:\9tbhnh.exec:\9tbhnh.exe64⤵
- Executes dropped EXE
PID:1440 -
\??\c:\hhbbnn.exec:\hhbbnn.exe65⤵
- Executes dropped EXE
PID:1256 -
\??\c:\tthnnh.exec:\tthnnh.exe66⤵PID:580
-
\??\c:\vpjdp.exec:\vpjdp.exe67⤵PID:948
-
\??\c:\1xfxxfr.exec:\1xfxxfr.exe68⤵PID:2228
-
\??\c:\9rflrfl.exec:\9rflrfl.exe69⤵PID:2148
-
\??\c:\frflfll.exec:\frflfll.exe70⤵PID:896
-
\??\c:\bnnhnh.exec:\bnnhnh.exe71⤵PID:1696
-
\??\c:\tnbtnn.exec:\tnbtnn.exe72⤵PID:2184
-
\??\c:\3pjjp.exec:\3pjjp.exe73⤵PID:2300
-
\??\c:\pddpd.exec:\pddpd.exe74⤵PID:2888
-
\??\c:\flxfxll.exec:\flxfxll.exe75⤵PID:2316
-
\??\c:\xrllrfl.exec:\xrllrfl.exe76⤵PID:2404
-
\??\c:\7bttnt.exec:\7bttnt.exe77⤵PID:2424
-
\??\c:\7bhntb.exec:\7bhntb.exe78⤵PID:2432
-
\??\c:\1pjjp.exec:\1pjjp.exe79⤵PID:1996
-
\??\c:\vpjpp.exec:\vpjpp.exe80⤵PID:1464
-
\??\c:\lfxllrx.exec:\lfxllrx.exe81⤵
- System Location Discovery: System Language Discovery
PID:2716 -
\??\c:\lrlrffx.exec:\lrlrffx.exe82⤵PID:2728
-
\??\c:\tnhthh.exec:\tnhthh.exe83⤵PID:2632
-
\??\c:\7bbttt.exec:\7bbttt.exe84⤵PID:2844
-
\??\c:\9vdvv.exec:\9vdvv.exe85⤵PID:2784
-
\??\c:\ddvjv.exec:\ddvjv.exe86⤵PID:2624
-
\??\c:\lfrlxfr.exec:\lfrlxfr.exe87⤵PID:2656
-
\??\c:\xlxxrxf.exec:\xlxxrxf.exe88⤵PID:2600
-
\??\c:\bntttt.exec:\bntttt.exe89⤵PID:2520
-
\??\c:\1btbhn.exec:\1btbhn.exe90⤵PID:2948
-
\??\c:\jdpvp.exec:\jdpvp.exe91⤵PID:464
-
\??\c:\pjddd.exec:\pjddd.exe92⤵PID:2388
-
\??\c:\3rlrxxl.exec:\3rlrxxl.exe93⤵PID:1860
-
\??\c:\7frrxxf.exec:\7frrxxf.exe94⤵PID:1964
-
\??\c:\nhhhhh.exec:\nhhhhh.exe95⤵PID:1752
-
\??\c:\bbtttn.exec:\bbtttn.exe96⤵PID:1616
-
\??\c:\tbbthb.exec:\tbbthb.exe97⤵PID:1048
-
\??\c:\9vvdv.exec:\9vvdv.exe98⤵PID:796
-
\??\c:\vjddj.exec:\vjddj.exe99⤵PID:1640
-
\??\c:\xrrxxxf.exec:\xrrxxxf.exe100⤵PID:2940
-
\??\c:\lrfrrxx.exec:\lrfrrxx.exe101⤵PID:2160
-
\??\c:\tnbnht.exec:\tnbnht.exe102⤵PID:2832
-
\??\c:\hnbthh.exec:\hnbthh.exe103⤵PID:2576
-
\??\c:\vpvvj.exec:\vpvvj.exe104⤵PID:2044
-
\??\c:\pjdvd.exec:\pjdvd.exe105⤵PID:2040
-
\??\c:\3jvdd.exec:\3jvdd.exe106⤵PID:1088
-
\??\c:\xlrflrx.exec:\xlrflrx.exe107⤵PID:1116
-
\??\c:\lxxxxxr.exec:\lxxxxxr.exe108⤵PID:860
-
\??\c:\1htbhn.exec:\1htbhn.exe109⤵PID:1796
-
\??\c:\7bhntb.exec:\7bhntb.exe110⤵PID:1704
-
\??\c:\pjjpj.exec:\pjjpj.exe111⤵PID:2380
-
\??\c:\jdpdv.exec:\jdpdv.exe112⤵PID:548
-
\??\c:\1fxfrxf.exec:\1fxfrxf.exe113⤵PID:1768
-
\??\c:\fxlxllx.exec:\fxlxllx.exe114⤵PID:2572
-
\??\c:\5flxxxx.exec:\5flxxxx.exe115⤵PID:2880
-
\??\c:\nhnbbh.exec:\nhnbbh.exe116⤵PID:2736
-
\??\c:\3nttbb.exec:\3nttbb.exe117⤵PID:2208
-
\??\c:\pvdpv.exec:\pvdpv.exe118⤵PID:2172
-
\??\c:\ppjjv.exec:\ppjjv.exe119⤵PID:2076
-
\??\c:\fflrfxf.exec:\fflrfxf.exe120⤵PID:2136
-
\??\c:\fxfffxf.exec:\fxfffxf.exe121⤵PID:1996
-
\??\c:\btbttn.exec:\btbttn.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-