Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 22:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
434fc72e67530a0fe6da3e63c573b98738a22b5e0bdb74f5c8bfc5a9b2cb7082.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
434fc72e67530a0fe6da3e63c573b98738a22b5e0bdb74f5c8bfc5a9b2cb7082.exe
-
Size
61KB
-
MD5
ef15a5957777dd904d6874c1b55482df
-
SHA1
5d0f450fb54c5e140c209d61f8e690af86b9e8ac
-
SHA256
434fc72e67530a0fe6da3e63c573b98738a22b5e0bdb74f5c8bfc5a9b2cb7082
-
SHA512
6d741a624dfbb77e1959f9f2cae396c50d03d3b931c8bdec227ada432ce24dbc853f799ab135cf8e910d92a9c398fb373ee3f7826d3fab809b3c84d1cf127b6c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFaEubL:ymb3NkkiQ3mdBjFIvIFaE6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral2/memory/1960-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2672-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 540 hbbhhb.exe 3744 jddjj.exe 3044 vppjd.exe 628 lfffxxr.exe 3120 5rxxrrl.exe 5008 5bhhbh.exe 3572 vpddv.exe 1728 jpvpd.exe 2692 lxfxrxx.exe 1548 5rfxrff.exe 2140 5nbbtt.exe 4288 jjppd.exe 4956 rlrllxr.exe 3536 9thbtt.exe 3012 nhtnhh.exe 1000 jjppv.exe 396 jppjv.exe 4800 fffxrrr.exe 3548 3rxrrrl.exe 4372 hhnnhn.exe 5000 jdjdj.exe 828 tbtbbh.exe 2676 btbttt.exe 1828 bbntbb.exe 2160 tnhnnh.exe 3968 dpvvj.exe 4088 dvvpp.exe 2456 lllfrrr.exe 4976 lrrlfff.exe 3268 hnnnhh.exe 2672 jvdvp.exe 1868 pjjdv.exe 2324 5flfxxr.exe 3580 hnnnhh.exe 3116 bttnhh.exe 4724 ppvdj.exe 208 dpvpj.exe 3912 fxrlfff.exe 5040 bbbbbt.exe 824 bbhbnb.exe 4960 9tbbtt.exe 3532 jdvpd.exe 3768 pvjjd.exe 4248 lllfxfx.exe 4988 rxxxrrr.exe 2032 3thbhh.exe 4348 nntnbb.exe 4664 vjpjd.exe 2100 jdjjd.exe 540 1pdvj.exe 3348 7xlfllr.exe 3540 ffxxrxx.exe 2312 nnhhhh.exe 1800 3nttnn.exe 3048 5pvpj.exe 3120 rrfxrrr.exe 560 tntttt.exe 4008 pddpp.exe 4460 jvjvj.exe 2080 rrlxflx.exe 2396 rxffxxr.exe 1708 ttbttt.exe 1636 ddddd.exe 2140 ppjdv.exe -
resource yara_rule behavioral2/memory/1960-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2672-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxlxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1960 wrote to memory of 540 1960 434fc72e67530a0fe6da3e63c573b98738a22b5e0bdb74f5c8bfc5a9b2cb7082.exe 82 PID 1960 wrote to memory of 540 1960 434fc72e67530a0fe6da3e63c573b98738a22b5e0bdb74f5c8bfc5a9b2cb7082.exe 82 PID 1960 wrote to memory of 540 1960 434fc72e67530a0fe6da3e63c573b98738a22b5e0bdb74f5c8bfc5a9b2cb7082.exe 82 PID 540 wrote to memory of 3744 540 hbbhhb.exe 83 PID 540 wrote to memory of 3744 540 hbbhhb.exe 83 PID 540 wrote to memory of 3744 540 hbbhhb.exe 83 PID 3744 wrote to memory of 3044 3744 jddjj.exe 84 PID 3744 wrote to memory of 3044 3744 jddjj.exe 84 PID 3744 wrote to memory of 3044 3744 jddjj.exe 84 PID 3044 wrote to memory of 628 3044 vppjd.exe 85 PID 3044 wrote to memory of 628 3044 vppjd.exe 85 PID 3044 wrote to memory of 628 3044 vppjd.exe 85 PID 628 wrote to memory of 3120 628 lfffxxr.exe 86 PID 628 wrote to memory of 3120 628 lfffxxr.exe 86 PID 628 wrote to memory of 3120 628 lfffxxr.exe 86 PID 3120 wrote to memory of 5008 3120 5rxxrrl.exe 87 PID 3120 wrote to memory of 5008 3120 5rxxrrl.exe 87 PID 3120 wrote to memory of 5008 3120 5rxxrrl.exe 87 PID 5008 wrote to memory of 3572 5008 5bhhbh.exe 88 PID 5008 wrote to memory of 3572 5008 5bhhbh.exe 88 PID 5008 wrote to memory of 3572 5008 5bhhbh.exe 88 PID 3572 wrote to memory of 1728 3572 vpddv.exe 89 PID 3572 wrote to memory of 1728 3572 vpddv.exe 89 PID 3572 wrote to memory of 1728 3572 vpddv.exe 89 PID 1728 wrote to memory of 2692 1728 jpvpd.exe 90 PID 1728 wrote to memory of 2692 1728 jpvpd.exe 90 PID 1728 wrote to memory of 2692 1728 jpvpd.exe 90 PID 2692 wrote to memory of 1548 2692 lxfxrxx.exe 91 PID 2692 wrote to memory of 1548 2692 lxfxrxx.exe 91 PID 2692 wrote to memory of 1548 2692 lxfxrxx.exe 91 PID 1548 wrote to memory of 2140 1548 5rfxrff.exe 92 PID 1548 wrote to memory of 2140 1548 5rfxrff.exe 92 PID 1548 wrote to memory of 2140 1548 5rfxrff.exe 92 PID 2140 wrote to memory of 4288 2140 5nbbtt.exe 93 PID 2140 wrote to memory of 4288 2140 5nbbtt.exe 93 PID 2140 wrote to memory of 4288 2140 5nbbtt.exe 93 PID 4288 wrote to memory of 4956 4288 jjppd.exe 94 PID 4288 wrote to memory of 4956 4288 jjppd.exe 94 PID 4288 wrote to memory of 4956 4288 jjppd.exe 94 PID 4956 wrote to memory of 3536 4956 rlrllxr.exe 95 PID 4956 wrote to memory of 3536 4956 rlrllxr.exe 95 PID 4956 wrote to memory of 3536 4956 rlrllxr.exe 95 PID 3536 wrote to memory of 3012 3536 9thbtt.exe 96 PID 3536 wrote to memory of 3012 3536 9thbtt.exe 96 PID 3536 wrote to memory of 3012 3536 9thbtt.exe 96 PID 3012 wrote to memory of 1000 3012 nhtnhh.exe 97 PID 3012 wrote to memory of 1000 3012 nhtnhh.exe 97 PID 3012 wrote to memory of 1000 3012 nhtnhh.exe 97 PID 1000 wrote to memory of 396 1000 jjppv.exe 98 PID 1000 wrote to memory of 396 1000 jjppv.exe 98 PID 1000 wrote to memory of 396 1000 jjppv.exe 98 PID 396 wrote to memory of 4800 396 jppjv.exe 99 PID 396 wrote to memory of 4800 396 jppjv.exe 99 PID 396 wrote to memory of 4800 396 jppjv.exe 99 PID 4800 wrote to memory of 3548 4800 fffxrrr.exe 100 PID 4800 wrote to memory of 3548 4800 fffxrrr.exe 100 PID 4800 wrote to memory of 3548 4800 fffxrrr.exe 100 PID 3548 wrote to memory of 4372 3548 3rxrrrl.exe 101 PID 3548 wrote to memory of 4372 3548 3rxrrrl.exe 101 PID 3548 wrote to memory of 4372 3548 3rxrrrl.exe 101 PID 4372 wrote to memory of 5000 4372 hhnnhn.exe 102 PID 4372 wrote to memory of 5000 4372 hhnnhn.exe 102 PID 4372 wrote to memory of 5000 4372 hhnnhn.exe 102 PID 5000 wrote to memory of 828 5000 jdjdj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\434fc72e67530a0fe6da3e63c573b98738a22b5e0bdb74f5c8bfc5a9b2cb7082.exe"C:\Users\Admin\AppData\Local\Temp\434fc72e67530a0fe6da3e63c573b98738a22b5e0bdb74f5c8bfc5a9b2cb7082.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\hbbhhb.exec:\hbbhhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\jddjj.exec:\jddjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\vppjd.exec:\vppjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\lfffxxr.exec:\lfffxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\5rxxrrl.exec:\5rxxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\5bhhbh.exec:\5bhhbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\vpddv.exec:\vpddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\jpvpd.exec:\jpvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\lxfxrxx.exec:\lxfxrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\5rfxrff.exec:\5rfxrff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\5nbbtt.exec:\5nbbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\jjppd.exec:\jjppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\rlrllxr.exec:\rlrllxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\9thbtt.exec:\9thbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\nhtnhh.exec:\nhtnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\jjppv.exec:\jjppv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\jppjv.exec:\jppjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\fffxrrr.exec:\fffxrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\3rxrrrl.exec:\3rxrrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\hhnnhn.exec:\hhnnhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\jdjdj.exec:\jdjdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\tbtbbh.exec:\tbtbbh.exe23⤵
- Executes dropped EXE
PID:828 -
\??\c:\btbttt.exec:\btbttt.exe24⤵
- Executes dropped EXE
PID:2676 -
\??\c:\bbntbb.exec:\bbntbb.exe25⤵
- Executes dropped EXE
PID:1828 -
\??\c:\tnhnnh.exec:\tnhnnh.exe26⤵
- Executes dropped EXE
PID:2160 -
\??\c:\dpvvj.exec:\dpvvj.exe27⤵
- Executes dropped EXE
PID:3968 -
\??\c:\dvvpp.exec:\dvvpp.exe28⤵
- Executes dropped EXE
PID:4088 -
\??\c:\lllfrrr.exec:\lllfrrr.exe29⤵
- Executes dropped EXE
PID:2456 -
\??\c:\lrrlfff.exec:\lrrlfff.exe30⤵
- Executes dropped EXE
PID:4976 -
\??\c:\hnnnhh.exec:\hnnnhh.exe31⤵
- Executes dropped EXE
PID:3268 -
\??\c:\jvdvp.exec:\jvdvp.exe32⤵
- Executes dropped EXE
PID:2672 -
\??\c:\pjjdv.exec:\pjjdv.exe33⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5flfxxr.exec:\5flfxxr.exe34⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hnnnhh.exec:\hnnnhh.exe35⤵
- Executes dropped EXE
PID:3580 -
\??\c:\bttnhh.exec:\bttnhh.exe36⤵
- Executes dropped EXE
PID:3116 -
\??\c:\ppvdj.exec:\ppvdj.exe37⤵
- Executes dropped EXE
PID:4724 -
\??\c:\dpvpj.exec:\dpvpj.exe38⤵
- Executes dropped EXE
PID:208 -
\??\c:\fxrlfff.exec:\fxrlfff.exe39⤵
- Executes dropped EXE
PID:3912 -
\??\c:\bbbbbt.exec:\bbbbbt.exe40⤵
- Executes dropped EXE
PID:5040 -
\??\c:\bbhbnb.exec:\bbhbnb.exe41⤵
- Executes dropped EXE
PID:824 -
\??\c:\9tbbtt.exec:\9tbbtt.exe42⤵
- Executes dropped EXE
PID:4960 -
\??\c:\jdvpd.exec:\jdvpd.exe43⤵
- Executes dropped EXE
PID:3532 -
\??\c:\pvjjd.exec:\pvjjd.exe44⤵
- Executes dropped EXE
PID:3768 -
\??\c:\lllfxfx.exec:\lllfxfx.exe45⤵
- Executes dropped EXE
PID:4248 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe46⤵
- Executes dropped EXE
PID:4988 -
\??\c:\3thbhh.exec:\3thbhh.exe47⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nntnbb.exec:\nntnbb.exe48⤵
- Executes dropped EXE
PID:4348 -
\??\c:\vjpjd.exec:\vjpjd.exe49⤵
- Executes dropped EXE
PID:4664 -
\??\c:\jdjjd.exec:\jdjjd.exe50⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1pdvj.exec:\1pdvj.exe51⤵
- Executes dropped EXE
PID:540 -
\??\c:\7xlfllr.exec:\7xlfllr.exe52⤵
- Executes dropped EXE
PID:3348 -
\??\c:\ffxxrxx.exec:\ffxxrxx.exe53⤵
- Executes dropped EXE
PID:3540 -
\??\c:\nnhhhh.exec:\nnhhhh.exe54⤵
- Executes dropped EXE
PID:2312 -
\??\c:\3nttnn.exec:\3nttnn.exe55⤵
- Executes dropped EXE
PID:1800 -
\??\c:\5pvpj.exec:\5pvpj.exe56⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rrfxrrr.exec:\rrfxrrr.exe57⤵
- Executes dropped EXE
PID:3120 -
\??\c:\tntttt.exec:\tntttt.exe58⤵
- Executes dropped EXE
PID:560 -
\??\c:\pddpp.exec:\pddpp.exe59⤵
- Executes dropped EXE
PID:4008 -
\??\c:\jvjvj.exec:\jvjvj.exe60⤵
- Executes dropped EXE
PID:4460 -
\??\c:\rrlxflx.exec:\rrlxflx.exe61⤵
- Executes dropped EXE
PID:2080 -
\??\c:\rxffxxr.exec:\rxffxxr.exe62⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ttbttt.exec:\ttbttt.exe63⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ddddd.exec:\ddddd.exe64⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ppjdv.exec:\ppjdv.exe65⤵
- Executes dropped EXE
PID:2140 -
\??\c:\frrlrrr.exec:\frrlrrr.exe66⤵PID:3092
-
\??\c:\rlxlllx.exec:\rlxlllx.exe67⤵PID:1912
-
\??\c:\bnhhhh.exec:\bnhhhh.exe68⤵PID:752
-
\??\c:\5htnnh.exec:\5htnnh.exe69⤵PID:2036
-
\??\c:\vppjd.exec:\vppjd.exe70⤵PID:1780
-
\??\c:\pjvjd.exec:\pjvjd.exe71⤵PID:4408
-
\??\c:\flrlffx.exec:\flrlffx.exe72⤵PID:5036
-
\??\c:\5hnhhh.exec:\5hnhhh.exe73⤵PID:2660
-
\??\c:\9hhtbb.exec:\9hhtbb.exe74⤵PID:2600
-
\??\c:\jjjvp.exec:\jjjvp.exe75⤵PID:952
-
\??\c:\pdppv.exec:\pdppv.exe76⤵PID:3168
-
\??\c:\5xxrlxx.exec:\5xxrlxx.exe77⤵PID:220
-
\??\c:\1bnhtt.exec:\1bnhtt.exe78⤵PID:3360
-
\??\c:\7nnnbh.exec:\7nnnbh.exe79⤵PID:1524
-
\??\c:\pdpjd.exec:\pdpjd.exe80⤵PID:2220
-
\??\c:\jvvpv.exec:\jvvpv.exe81⤵PID:5044
-
\??\c:\5xfxxxf.exec:\5xfxxxf.exe82⤵PID:1004
-
\??\c:\tntntn.exec:\tntntn.exe83⤵PID:2484
-
\??\c:\nhnhtt.exec:\nhnhtt.exe84⤵PID:2004
-
\??\c:\jpdvv.exec:\jpdvv.exe85⤵PID:872
-
\??\c:\xrrlfll.exec:\xrrlfll.exe86⤵PID:2156
-
\??\c:\lffrllx.exec:\lffrllx.exe87⤵PID:4456
-
\??\c:\hthhhh.exec:\hthhhh.exe88⤵PID:4412
-
\??\c:\nhbthb.exec:\nhbthb.exe89⤵PID:3816
-
\??\c:\jpvpp.exec:\jpvpp.exe90⤵PID:3268
-
\??\c:\3ppjd.exec:\3ppjd.exe91⤵PID:2132
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe92⤵PID:2332
-
\??\c:\9xflrrf.exec:\9xflrrf.exe93⤵
- System Location Discovery: System Language Discovery
PID:4716 -
\??\c:\7hhhhh.exec:\7hhhhh.exe94⤵PID:2324
-
\??\c:\9nhbbh.exec:\9nhbbh.exe95⤵PID:4320
-
\??\c:\3xfxlrl.exec:\3xfxlrl.exe96⤵PID:4512
-
\??\c:\5hhbhh.exec:\5hhbhh.exe97⤵PID:5020
-
\??\c:\hbhbbb.exec:\hbhbbb.exe98⤵PID:5068
-
\??\c:\7vpjd.exec:\7vpjd.exe99⤵PID:3952
-
\??\c:\9djdp.exec:\9djdp.exe100⤵PID:2464
-
\??\c:\dppjd.exec:\dppjd.exe101⤵PID:3196
-
\??\c:\fflfrrr.exec:\fflfrrr.exe102⤵PID:4960
-
\??\c:\thnhnn.exec:\thnhnn.exe103⤵PID:4648
-
\??\c:\hnnhbb.exec:\hnnhbb.exe104⤵PID:4224
-
\??\c:\nbthnn.exec:\nbthnn.exe105⤵PID:4392
-
\??\c:\pdpvv.exec:\pdpvv.exe106⤵PID:5112
-
\??\c:\3ddvj.exec:\3ddvj.exe107⤵PID:1756
-
\??\c:\rfrlffx.exec:\rfrlffx.exe108⤵PID:5032
-
\??\c:\btttnn.exec:\btttnn.exe109⤵PID:696
-
\??\c:\3tbbtt.exec:\3tbbtt.exe110⤵PID:2100
-
\??\c:\hnthth.exec:\hnthth.exe111⤵PID:540
-
\??\c:\pjpjd.exec:\pjpjd.exe112⤵PID:3044
-
\??\c:\rxrrffl.exec:\rxrrffl.exe113⤵PID:2104
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe114⤵PID:3804
-
\??\c:\9hnntn.exec:\9hnntn.exe115⤵PID:4772
-
\??\c:\tttbnb.exec:\tttbnb.exe116⤵PID:1632
-
\??\c:\jdjdv.exec:\jdjdv.exe117⤵PID:4696
-
\??\c:\pjddj.exec:\pjddj.exe118⤵PID:3052
-
\??\c:\frlfxxx.exec:\frlfxxx.exe119⤵PID:2928
-
\??\c:\hhhhbh.exec:\hhhhbh.exe120⤵PID:1728
-
\??\c:\nbbhtn.exec:\nbbhtn.exe121⤵PID:3636
-
\??\c:\5jvpp.exec:\5jvpp.exe122⤵PID:3424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-