Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 04:44
Static task
static1
Behavioral task
behavioral1
Sample
e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe
Resource
win7-20240903-en
General
-
Target
e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe
-
Size
82KB
-
MD5
48a60f2e9b09bd24a19e7ce6dc415cf3
-
SHA1
60348bdcdf996e8dd035fdf23d459115d81e48f4
-
SHA256
e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e
-
SHA512
321db70d68349bbdeaafa4ad2bc1fa1fb37fc3281bf04256f2fb9b89167ae2926d033727661a10949e2b5c9102a57c89cbbe2bcd85d435f1e93c497c9d3e4112
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmB5Gtb:ymb3NkkiQ3mdBjFo73thgQ/wEk0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1868-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/336-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/756-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2632 9xfrlrl.exe 2812 tnbbbb.exe 2536 bbhhht.exe 2564 vppdj.exe 2692 tnhbhh.exe 2576 ppjvp.exe 3048 3ffrxxl.exe 1900 9ttnbh.exe 336 nttbhb.exe 2096 1rlrlrf.exe 1984 tnhttb.exe 3016 vvppj.exe 2772 vpjdp.exe 2908 xxrxfrx.exe 1556 3nnttn.exe 2128 ppdjd.exe 956 rrlrlrf.exe 2328 1fxlxlx.exe 1568 7nhntn.exe 2220 ddjpd.exe 1996 vpjpd.exe 1276 lfrrffl.exe 2416 ttbntn.exe 1976 jdvvp.exe 3024 pjddp.exe 2996 frlxxlr.exe 756 bnnbbh.exe 2400 jjjvp.exe 1500 xxlrlrl.exe 1432 9nhnhn.exe 2636 bbnnnn.exe 2164 vpjvj.exe 2676 xxrrflx.exe 2800 fflflxx.exe 1656 tnbnth.exe 2868 vddpd.exe 2804 jdvjd.exe 2028 1xxxllx.exe 2560 lfxlrfr.exe 3036 nnhnbb.exe 1820 tthntb.exe 1224 1pjpp.exe 2460 jvppj.exe 1100 fffxrxr.exe 556 lfrrffr.exe 1920 tnbhtt.exe 2896 bthnhh.exe 2764 7jvpp.exe 2872 lfxlfrl.exe 2772 3fflrrr.exe 2920 hnnnbh.exe 2204 hhhnbn.exe 2492 7dppv.exe 1448 dddjd.exe 2100 flrllll.exe 1776 nbnhhh.exe 1408 1nnnnt.exe 2060 dvvdd.exe 272 rrfrrfr.exe 1996 flffrrf.exe 896 7nbtnb.exe 2416 vvpdv.exe 3004 pvjdj.exe 2476 1lrxffr.exe -
resource yara_rule behavioral1/memory/1868-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/336-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/756-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2632 1868 e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe 30 PID 1868 wrote to memory of 2632 1868 e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe 30 PID 1868 wrote to memory of 2632 1868 e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe 30 PID 1868 wrote to memory of 2632 1868 e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe 30 PID 2632 wrote to memory of 2812 2632 9xfrlrl.exe 31 PID 2632 wrote to memory of 2812 2632 9xfrlrl.exe 31 PID 2632 wrote to memory of 2812 2632 9xfrlrl.exe 31 PID 2632 wrote to memory of 2812 2632 9xfrlrl.exe 31 PID 2812 wrote to memory of 2536 2812 tnbbbb.exe 32 PID 2812 wrote to memory of 2536 2812 tnbbbb.exe 32 PID 2812 wrote to memory of 2536 2812 tnbbbb.exe 32 PID 2812 wrote to memory of 2536 2812 tnbbbb.exe 32 PID 2536 wrote to memory of 2564 2536 bbhhht.exe 33 PID 2536 wrote to memory of 2564 2536 bbhhht.exe 33 PID 2536 wrote to memory of 2564 2536 bbhhht.exe 33 PID 2536 wrote to memory of 2564 2536 bbhhht.exe 33 PID 2564 wrote to memory of 2692 2564 vppdj.exe 34 PID 2564 wrote to memory of 2692 2564 vppdj.exe 34 PID 2564 wrote to memory of 2692 2564 vppdj.exe 34 PID 2564 wrote to memory of 2692 2564 vppdj.exe 34 PID 2692 wrote to memory of 2576 2692 tnhbhh.exe 35 PID 2692 wrote to memory of 2576 2692 tnhbhh.exe 35 PID 2692 wrote to memory of 2576 2692 tnhbhh.exe 35 PID 2692 wrote to memory of 2576 2692 tnhbhh.exe 35 PID 2576 wrote to memory of 3048 2576 ppjvp.exe 36 PID 2576 wrote to memory of 3048 2576 ppjvp.exe 36 PID 2576 wrote to memory of 3048 2576 ppjvp.exe 36 PID 2576 wrote to memory of 3048 2576 ppjvp.exe 36 PID 3048 wrote to memory of 1900 3048 3ffrxxl.exe 37 PID 3048 wrote to memory of 1900 3048 3ffrxxl.exe 37 PID 3048 wrote to memory of 1900 3048 3ffrxxl.exe 37 PID 3048 wrote to memory of 1900 3048 3ffrxxl.exe 37 PID 1900 wrote to memory of 336 1900 9ttnbh.exe 38 PID 1900 wrote to memory of 336 1900 9ttnbh.exe 38 PID 1900 wrote to memory of 336 1900 9ttnbh.exe 38 PID 1900 wrote to memory of 336 1900 9ttnbh.exe 38 PID 336 wrote to memory of 2096 336 nttbhb.exe 39 PID 336 wrote to memory of 2096 336 nttbhb.exe 39 PID 336 wrote to memory of 2096 336 nttbhb.exe 39 PID 336 wrote to memory of 2096 336 nttbhb.exe 39 PID 2096 wrote to memory of 1984 2096 1rlrlrf.exe 40 PID 2096 wrote to memory of 1984 2096 1rlrlrf.exe 40 PID 2096 wrote to memory of 1984 2096 1rlrlrf.exe 40 PID 2096 wrote to memory of 1984 2096 1rlrlrf.exe 40 PID 1984 wrote to memory of 3016 1984 tnhttb.exe 41 PID 1984 wrote to memory of 3016 1984 tnhttb.exe 41 PID 1984 wrote to memory of 3016 1984 tnhttb.exe 41 PID 1984 wrote to memory of 3016 1984 tnhttb.exe 41 PID 3016 wrote to memory of 2772 3016 vvppj.exe 42 PID 3016 wrote to memory of 2772 3016 vvppj.exe 42 PID 3016 wrote to memory of 2772 3016 vvppj.exe 42 PID 3016 wrote to memory of 2772 3016 vvppj.exe 42 PID 2772 wrote to memory of 2908 2772 vpjdp.exe 43 PID 2772 wrote to memory of 2908 2772 vpjdp.exe 43 PID 2772 wrote to memory of 2908 2772 vpjdp.exe 43 PID 2772 wrote to memory of 2908 2772 vpjdp.exe 43 PID 2908 wrote to memory of 1556 2908 xxrxfrx.exe 44 PID 2908 wrote to memory of 1556 2908 xxrxfrx.exe 44 PID 2908 wrote to memory of 1556 2908 xxrxfrx.exe 44 PID 2908 wrote to memory of 1556 2908 xxrxfrx.exe 44 PID 1556 wrote to memory of 2128 1556 3nnttn.exe 45 PID 1556 wrote to memory of 2128 1556 3nnttn.exe 45 PID 1556 wrote to memory of 2128 1556 3nnttn.exe 45 PID 1556 wrote to memory of 2128 1556 3nnttn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe"C:\Users\Admin\AppData\Local\Temp\e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\9xfrlrl.exec:\9xfrlrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\tnbbbb.exec:\tnbbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\bbhhht.exec:\bbhhht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\vppdj.exec:\vppdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\tnhbhh.exec:\tnhbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\ppjvp.exec:\ppjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\3ffrxxl.exec:\3ffrxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\9ttnbh.exec:\9ttnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\nttbhb.exec:\nttbhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\1rlrlrf.exec:\1rlrlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\tnhttb.exec:\tnhttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\vvppj.exec:\vvppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\vpjdp.exec:\vpjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\xxrxfrx.exec:\xxrxfrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\3nnttn.exec:\3nnttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\ppdjd.exec:\ppdjd.exe17⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rrlrlrf.exec:\rrlrlrf.exe18⤵
- Executes dropped EXE
PID:956 -
\??\c:\1fxlxlx.exec:\1fxlxlx.exe19⤵
- Executes dropped EXE
PID:2328 -
\??\c:\7nhntn.exec:\7nhntn.exe20⤵
- Executes dropped EXE
PID:1568 -
\??\c:\ddjpd.exec:\ddjpd.exe21⤵
- Executes dropped EXE
PID:2220 -
\??\c:\vpjpd.exec:\vpjpd.exe22⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lfrrffl.exec:\lfrrffl.exe23⤵
- Executes dropped EXE
PID:1276 -
\??\c:\ttbntn.exec:\ttbntn.exe24⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jdvvp.exec:\jdvvp.exe25⤵
- Executes dropped EXE
PID:1976 -
\??\c:\pjddp.exec:\pjddp.exe26⤵
- Executes dropped EXE
PID:3024 -
\??\c:\frlxxlr.exec:\frlxxlr.exe27⤵
- Executes dropped EXE
PID:2996 -
\??\c:\bnnbbh.exec:\bnnbbh.exe28⤵
- Executes dropped EXE
PID:756 -
\??\c:\jjjvp.exec:\jjjvp.exe29⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xxlrlrl.exec:\xxlrlrl.exe30⤵
- Executes dropped EXE
PID:1500 -
\??\c:\9nhnhn.exec:\9nhnhn.exe31⤵
- Executes dropped EXE
PID:1432 -
\??\c:\bbnnnn.exec:\bbnnnn.exe32⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vpjvj.exec:\vpjvj.exe33⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xxrrflx.exec:\xxrrflx.exe34⤵
- Executes dropped EXE
PID:2676 -
\??\c:\fflflxx.exec:\fflflxx.exe35⤵
- Executes dropped EXE
PID:2800 -
\??\c:\tnbnth.exec:\tnbnth.exe36⤵
- Executes dropped EXE
PID:1656 -
\??\c:\vddpd.exec:\vddpd.exe37⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jdvjd.exec:\jdvjd.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\1xxxllx.exec:\1xxxllx.exe39⤵
- Executes dropped EXE
PID:2028 -
\??\c:\lfxlrfr.exec:\lfxlrfr.exe40⤵
- Executes dropped EXE
PID:2560 -
\??\c:\nnhnbb.exec:\nnhnbb.exe41⤵
- Executes dropped EXE
PID:3036 -
\??\c:\tthntb.exec:\tthntb.exe42⤵
- Executes dropped EXE
PID:1820 -
\??\c:\1pjpp.exec:\1pjpp.exe43⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jvppj.exec:\jvppj.exe44⤵
- Executes dropped EXE
PID:2460 -
\??\c:\fffxrxr.exec:\fffxrxr.exe45⤵
- Executes dropped EXE
PID:1100 -
\??\c:\lfrrffr.exec:\lfrrffr.exe46⤵
- Executes dropped EXE
PID:556 -
\??\c:\tnbhtt.exec:\tnbhtt.exe47⤵
- Executes dropped EXE
PID:1920 -
\??\c:\bthnhh.exec:\bthnhh.exe48⤵
- Executes dropped EXE
PID:2896 -
\??\c:\7jvpp.exec:\7jvpp.exe49⤵
- Executes dropped EXE
PID:2764 -
\??\c:\lfxlfrl.exec:\lfxlfrl.exe50⤵
- Executes dropped EXE
PID:2872 -
\??\c:\3fflrrr.exec:\3fflrrr.exe51⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hnnnbh.exec:\hnnnbh.exe52⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hhhnbn.exec:\hhhnbn.exe53⤵
- Executes dropped EXE
PID:2204 -
\??\c:\7dppv.exec:\7dppv.exe54⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dddjd.exec:\dddjd.exe55⤵
- Executes dropped EXE
PID:1448 -
\??\c:\flrllll.exec:\flrllll.exe56⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nbnhhh.exec:\nbnhhh.exe57⤵
- Executes dropped EXE
PID:1776 -
\??\c:\1nnnnt.exec:\1nnnnt.exe58⤵
- Executes dropped EXE
PID:1408 -
\??\c:\dvvdd.exec:\dvvdd.exe59⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rrfrrfr.exec:\rrfrrfr.exe60⤵
- Executes dropped EXE
PID:272 -
\??\c:\flffrrf.exec:\flffrrf.exe61⤵
- Executes dropped EXE
PID:1996 -
\??\c:\7nbtnb.exec:\7nbtnb.exe62⤵
- Executes dropped EXE
PID:896 -
\??\c:\vvpdv.exec:\vvpdv.exe63⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pvjdj.exec:\pvjdj.exe64⤵
- Executes dropped EXE
PID:3004 -
\??\c:\1lrxffr.exec:\1lrxffr.exe65⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rrfffxf.exec:\rrfffxf.exe66⤵PID:1096
-
\??\c:\nntbnb.exec:\nntbnb.exe67⤵PID:1212
-
\??\c:\1htbhh.exec:\1htbhh.exe68⤵PID:2056
-
\??\c:\vjvvp.exec:\vjvvp.exe69⤵PID:696
-
\??\c:\xxrxxxl.exec:\xxrxxxl.exe70⤵PID:1060
-
\??\c:\9xfrflx.exec:\9xfrflx.exe71⤵PID:2452
-
\??\c:\btntbh.exec:\btntbh.exe72⤵
- System Location Discovery: System Language Discovery
PID:1784 -
\??\c:\nhhnhh.exec:\nhhnhh.exe73⤵PID:2636
-
\??\c:\jvjpv.exec:\jvjpv.exe74⤵PID:2164
-
\??\c:\9xxfxfr.exec:\9xxfxfr.exe75⤵PID:2688
-
\??\c:\1ffxlxr.exec:\1ffxlxr.exe76⤵PID:2844
-
\??\c:\nnthbh.exec:\nnthbh.exe77⤵PID:2748
-
\??\c:\9bnhth.exec:\9bnhth.exe78⤵PID:2796
-
\??\c:\1vdvd.exec:\1vdvd.exe79⤵PID:1736
-
\??\c:\frlfllr.exec:\frlfllr.exe80⤵PID:2604
-
\??\c:\5rlrxxr.exec:\5rlrxxr.exe81⤵PID:2548
-
\??\c:\ntbhhh.exec:\ntbhhh.exe82⤵PID:2580
-
\??\c:\bththt.exec:\bththt.exe83⤵PID:1916
-
\??\c:\ppdjp.exec:\ppdjp.exe84⤵PID:1816
-
\??\c:\xlxlfxl.exec:\xlxlfxl.exe85⤵PID:1176
-
\??\c:\ffxrfrf.exec:\ffxrfrf.exe86⤵PID:1168
-
\??\c:\bbbhtn.exec:\bbbhtn.exe87⤵PID:2256
-
\??\c:\9dpvv.exec:\9dpvv.exe88⤵PID:1824
-
\??\c:\1pvjp.exec:\1pvjp.exe89⤵PID:2708
-
\??\c:\rxfflff.exec:\rxfflff.exe90⤵PID:2720
-
\??\c:\rrrrflf.exec:\rrrrflf.exe91⤵PID:2932
-
\??\c:\hbttnn.exec:\hbttnn.exe92⤵PID:2064
-
\??\c:\bbbhht.exec:\bbbhht.exe93⤵PID:2244
-
\??\c:\1ppvp.exec:\1ppvp.exe94⤵PID:1556
-
\??\c:\llfrrfr.exec:\llfrrfr.exe95⤵PID:768
-
\??\c:\lrffflx.exec:\lrffflx.exe96⤵PID:480
-
\??\c:\bhbhnh.exec:\bhbhnh.exe97⤵PID:2148
-
\??\c:\pvpjv.exec:\pvpjv.exe98⤵PID:2232
-
\??\c:\rfflllf.exec:\rfflllf.exe99⤵PID:2144
-
\??\c:\xflxlrl.exec:\xflxlrl.exe100⤵PID:912
-
\??\c:\bhbbbb.exec:\bhbbbb.exe101⤵PID:868
-
\??\c:\nnbhnn.exec:\nnbhnn.exe102⤵PID:656
-
\??\c:\vpjjv.exec:\vpjjv.exe103⤵PID:1860
-
\??\c:\frfrrlf.exec:\frfrrlf.exe104⤵PID:680
-
\??\c:\xffxxrf.exec:\xffxxrf.exe105⤵PID:1708
-
\??\c:\tntbnt.exec:\tntbnt.exe106⤵PID:3024
-
\??\c:\nnbhnn.exec:\nnbhnn.exe107⤵PID:2620
-
\??\c:\vvpvp.exec:\vvpvp.exe108⤵PID:756
-
\??\c:\7flxffr.exec:\7flxffr.exe109⤵PID:1008
-
\??\c:\rrlfllx.exec:\rrlfllx.exe110⤵PID:2268
-
\??\c:\bttbhn.exec:\bttbhn.exe111⤵PID:2288
-
\??\c:\3bnhnn.exec:\3bnhnn.exe112⤵PID:2224
-
\??\c:\9vpdj.exec:\9vpdj.exe113⤵PID:2792
-
\??\c:\vpddp.exec:\vpddp.exe114⤵PID:2832
-
\??\c:\xxxfxfx.exec:\xxxfxfx.exe115⤵PID:2676
-
\??\c:\btbbnn.exec:\btbbnn.exe116⤵PID:1516
-
\??\c:\hhbtht.exec:\hhbtht.exe117⤵PID:1656
-
\??\c:\vdvdp.exec:\vdvdp.exe118⤵PID:1632
-
\??\c:\jdpjj.exec:\jdpjj.exe119⤵PID:2804
-
\??\c:\xrlrllx.exec:\xrlrllx.exe120⤵PID:2028
-
\??\c:\rrxflrf.exec:\rrxflrf.exe121⤵PID:3056
-
\??\c:\1hbhnt.exec:\1hbhnt.exe122⤵PID:1152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-