Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 05:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe
-
Size
105KB
-
MD5
a4c210bbb97e01caf3f428a3d44172f2
-
SHA1
fc9e2a416cb8a26622e3c668c7c0f4af265498bc
-
SHA256
eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd
-
SHA512
cf790335aa1841a2f216a00ab39d09b034d7bc005e235d324b4179f1ac743f75cea7353e7974c7d0e11614ba1a39d376b92b3b46f5920ef1c77daca9f8dff610
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHq82PC1:n3C9BRo7tvnJ99T/KZE891
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2568-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/680-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2560 jdpvj.exe 2428 vvjjp.exe 2820 7lxxxxf.exe 2776 fxflrxl.exe 2832 3btbnt.exe 2372 bhntbt.exe 2824 dddpp.exe 2380 1xrrffr.exe 2672 btbbnb.exe 3064 vjppp.exe 680 lxllxfl.exe 1912 xlfxrxf.exe 1996 nhttnt.exe 592 hthntb.exe 1836 vjvpd.exe 2116 frxrxrx.exe 1032 3fxfrrf.exe 2668 bnbhhb.exe 2168 nbhnhn.exe 2344 1jjvj.exe 1792 5pppv.exe 448 1xrrxff.exe 1672 thnntn.exe 2492 tntbhn.exe 2688 vjvvv.exe 2520 pjddp.exe 2388 fxllrxl.exe 2200 3hbbhh.exe 284 pjpdv.exe 2576 ddvjv.exe 2560 rfffxfr.exe 2100 rlrrxxl.exe 2940 nnhbbn.exe 2848 bbbhtt.exe 1624 jjvjp.exe 2788 1dppp.exe 2160 xrfxlrf.exe 2880 llxfllr.exe 2372 9htbhh.exe 2176 1nhhnn.exe 2844 vpvjp.exe 2676 ddvpj.exe 2632 9rxfffr.exe 2696 lfrxrxf.exe 844 9ntbhh.exe 1228 7bnnbb.exe 2896 nnbbnt.exe 332 jjvjv.exe 2692 jdvvp.exe 1712 9frflrr.exe 1888 xlxxffx.exe 2884 tnnbnt.exe 3040 nhntbh.exe 2860 1dddp.exe 2156 dvdjv.exe 2168 9frlffl.exe 2608 xrfrflx.exe 1164 tnnbnt.exe 1664 7bntbb.exe 1956 7bntbb.exe 1648 dpjjd.exe 1208 vpdpj.exe 1800 frrfxlf.exe 2252 rlrxxlr.exe -
resource yara_rule behavioral1/memory/2560-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/680-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-272-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2560 2568 eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe 30 PID 2568 wrote to memory of 2560 2568 eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe 30 PID 2568 wrote to memory of 2560 2568 eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe 30 PID 2568 wrote to memory of 2560 2568 eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe 30 PID 2560 wrote to memory of 2428 2560 jdpvj.exe 31 PID 2560 wrote to memory of 2428 2560 jdpvj.exe 31 PID 2560 wrote to memory of 2428 2560 jdpvj.exe 31 PID 2560 wrote to memory of 2428 2560 jdpvj.exe 31 PID 2428 wrote to memory of 2820 2428 vvjjp.exe 32 PID 2428 wrote to memory of 2820 2428 vvjjp.exe 32 PID 2428 wrote to memory of 2820 2428 vvjjp.exe 32 PID 2428 wrote to memory of 2820 2428 vvjjp.exe 32 PID 2820 wrote to memory of 2776 2820 7lxxxxf.exe 33 PID 2820 wrote to memory of 2776 2820 7lxxxxf.exe 33 PID 2820 wrote to memory of 2776 2820 7lxxxxf.exe 33 PID 2820 wrote to memory of 2776 2820 7lxxxxf.exe 33 PID 2776 wrote to memory of 2832 2776 fxflrxl.exe 34 PID 2776 wrote to memory of 2832 2776 fxflrxl.exe 34 PID 2776 wrote to memory of 2832 2776 fxflrxl.exe 34 PID 2776 wrote to memory of 2832 2776 fxflrxl.exe 34 PID 2832 wrote to memory of 2372 2832 3btbnt.exe 35 PID 2832 wrote to memory of 2372 2832 3btbnt.exe 35 PID 2832 wrote to memory of 2372 2832 3btbnt.exe 35 PID 2832 wrote to memory of 2372 2832 3btbnt.exe 35 PID 2372 wrote to memory of 2824 2372 bhntbt.exe 36 PID 2372 wrote to memory of 2824 2372 bhntbt.exe 36 PID 2372 wrote to memory of 2824 2372 bhntbt.exe 36 PID 2372 wrote to memory of 2824 2372 bhntbt.exe 36 PID 2824 wrote to memory of 2380 2824 dddpp.exe 37 PID 2824 wrote to memory of 2380 2824 dddpp.exe 37 PID 2824 wrote to memory of 2380 2824 dddpp.exe 37 PID 2824 wrote to memory of 2380 2824 dddpp.exe 37 PID 2380 wrote to memory of 2672 2380 1xrrffr.exe 38 PID 2380 wrote to memory of 2672 2380 1xrrffr.exe 38 PID 2380 wrote to memory of 2672 2380 1xrrffr.exe 38 PID 2380 wrote to memory of 2672 2380 1xrrffr.exe 38 PID 2672 wrote to memory of 3064 2672 btbbnb.exe 39 PID 2672 wrote to memory of 3064 2672 btbbnb.exe 39 PID 2672 wrote to memory of 3064 2672 btbbnb.exe 39 PID 2672 wrote to memory of 3064 2672 btbbnb.exe 39 PID 3064 wrote to memory of 680 3064 vjppp.exe 40 PID 3064 wrote to memory of 680 3064 vjppp.exe 40 PID 3064 wrote to memory of 680 3064 vjppp.exe 40 PID 3064 wrote to memory of 680 3064 vjppp.exe 40 PID 680 wrote to memory of 1912 680 lxllxfl.exe 41 PID 680 wrote to memory of 1912 680 lxllxfl.exe 41 PID 680 wrote to memory of 1912 680 lxllxfl.exe 41 PID 680 wrote to memory of 1912 680 lxllxfl.exe 41 PID 1912 wrote to memory of 1996 1912 xlfxrxf.exe 42 PID 1912 wrote to memory of 1996 1912 xlfxrxf.exe 42 PID 1912 wrote to memory of 1996 1912 xlfxrxf.exe 42 PID 1912 wrote to memory of 1996 1912 xlfxrxf.exe 42 PID 1996 wrote to memory of 592 1996 nhttnt.exe 43 PID 1996 wrote to memory of 592 1996 nhttnt.exe 43 PID 1996 wrote to memory of 592 1996 nhttnt.exe 43 PID 1996 wrote to memory of 592 1996 nhttnt.exe 43 PID 592 wrote to memory of 1836 592 hthntb.exe 44 PID 592 wrote to memory of 1836 592 hthntb.exe 44 PID 592 wrote to memory of 1836 592 hthntb.exe 44 PID 592 wrote to memory of 1836 592 hthntb.exe 44 PID 1836 wrote to memory of 2116 1836 vjvpd.exe 45 PID 1836 wrote to memory of 2116 1836 vjvpd.exe 45 PID 1836 wrote to memory of 2116 1836 vjvpd.exe 45 PID 1836 wrote to memory of 2116 1836 vjvpd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe"C:\Users\Admin\AppData\Local\Temp\eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\jdpvj.exec:\jdpvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\vvjjp.exec:\vvjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\7lxxxxf.exec:\7lxxxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\fxflrxl.exec:\fxflrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\3btbnt.exec:\3btbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\bhntbt.exec:\bhntbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\dddpp.exec:\dddpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\1xrrffr.exec:\1xrrffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\btbbnb.exec:\btbbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\vjppp.exec:\vjppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\lxllxfl.exec:\lxllxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\xlfxrxf.exec:\xlfxrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\nhttnt.exec:\nhttnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\hthntb.exec:\hthntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\vjvpd.exec:\vjvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\frxrxrx.exec:\frxrxrx.exe17⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3fxfrrf.exec:\3fxfrrf.exe18⤵
- Executes dropped EXE
PID:1032 -
\??\c:\bnbhhb.exec:\bnbhhb.exe19⤵
- Executes dropped EXE
PID:2668 -
\??\c:\nbhnhn.exec:\nbhnhn.exe20⤵
- Executes dropped EXE
PID:2168 -
\??\c:\1jjvj.exec:\1jjvj.exe21⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5pppv.exec:\5pppv.exe22⤵
- Executes dropped EXE
PID:1792 -
\??\c:\1xrrxff.exec:\1xrrxff.exe23⤵
- Executes dropped EXE
PID:448 -
\??\c:\thnntn.exec:\thnntn.exe24⤵
- Executes dropped EXE
PID:1672 -
\??\c:\tntbhn.exec:\tntbhn.exe25⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vjvvv.exec:\vjvvv.exe26⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pjddp.exec:\pjddp.exe27⤵
- Executes dropped EXE
PID:2520 -
\??\c:\fxllrxl.exec:\fxllrxl.exe28⤵
- Executes dropped EXE
PID:2388 -
\??\c:\3hbbhh.exec:\3hbbhh.exe29⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pjpdv.exec:\pjpdv.exe30⤵
- Executes dropped EXE
PID:284 -
\??\c:\ddvjv.exec:\ddvjv.exe31⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rfffxfr.exec:\rfffxfr.exe32⤵
- Executes dropped EXE
PID:2560 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe33⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nnhbbn.exec:\nnhbbn.exe34⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bbbhtt.exec:\bbbhtt.exe35⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jjvjp.exec:\jjvjp.exe36⤵
- Executes dropped EXE
PID:1624 -
\??\c:\1dppp.exec:\1dppp.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xrfxlrf.exec:\xrfxlrf.exe38⤵
- Executes dropped EXE
PID:2160 -
\??\c:\llxfllr.exec:\llxfllr.exe39⤵
- Executes dropped EXE
PID:2880 -
\??\c:\9htbhh.exec:\9htbhh.exe40⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1nhhnn.exec:\1nhhnn.exe41⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vpvjp.exec:\vpvjp.exe42⤵
- Executes dropped EXE
PID:2844 -
\??\c:\ddvpj.exec:\ddvpj.exe43⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9rxfffr.exec:\9rxfffr.exe44⤵
- Executes dropped EXE
PID:2632 -
\??\c:\lfrxrxf.exec:\lfrxrxf.exe45⤵
- Executes dropped EXE
PID:2696 -
\??\c:\9ntbhh.exec:\9ntbhh.exe46⤵
- Executes dropped EXE
PID:844 -
\??\c:\7bnnbb.exec:\7bnnbb.exe47⤵
- Executes dropped EXE
PID:1228 -
\??\c:\nnbbnt.exec:\nnbbnt.exe48⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jjvjv.exec:\jjvjv.exe49⤵
- Executes dropped EXE
PID:332 -
\??\c:\jdvvp.exec:\jdvvp.exe50⤵
- Executes dropped EXE
PID:2692 -
\??\c:\9frflrr.exec:\9frflrr.exe51⤵
- Executes dropped EXE
PID:1712 -
\??\c:\xlxxffx.exec:\xlxxffx.exe52⤵
- Executes dropped EXE
PID:1888 -
\??\c:\tnnbnt.exec:\tnnbnt.exe53⤵
- Executes dropped EXE
PID:2884 -
\??\c:\nhntbh.exec:\nhntbh.exe54⤵
- Executes dropped EXE
PID:3040 -
\??\c:\1dddp.exec:\1dddp.exe55⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dvdjv.exec:\dvdjv.exe56⤵
- Executes dropped EXE
PID:2156 -
\??\c:\9frlffl.exec:\9frlffl.exe57⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xrfrflx.exec:\xrfrflx.exe58⤵
- Executes dropped EXE
PID:2608 -
\??\c:\tnnbnt.exec:\tnnbnt.exe59⤵
- Executes dropped EXE
PID:1164 -
\??\c:\7bntbb.exec:\7bntbb.exe60⤵
- Executes dropped EXE
PID:1664 -
\??\c:\7bntbb.exec:\7bntbb.exe61⤵
- Executes dropped EXE
PID:1956 -
\??\c:\dpjjd.exec:\dpjjd.exe62⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vpdpj.exec:\vpdpj.exe63⤵
- Executes dropped EXE
PID:1208 -
\??\c:\frrfxlf.exec:\frrfxlf.exe64⤵
- Executes dropped EXE
PID:1800 -
\??\c:\rlrxxlr.exec:\rlrxxlr.exe65⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe66⤵PID:288
-
\??\c:\hthnbb.exec:\hthnbb.exe67⤵PID:2396
-
\??\c:\5bhhhh.exec:\5bhhhh.exe68⤵PID:2976
-
\??\c:\jdddv.exec:\jdddv.exe69⤵PID:2408
-
\??\c:\3vjdj.exec:\3vjdj.exe70⤵PID:1220
-
\??\c:\5xrrlrf.exec:\5xrrlrf.exe71⤵PID:804
-
\??\c:\flrxrfl.exec:\flrxrfl.exe72⤵PID:1724
-
\??\c:\thtbnt.exec:\thtbnt.exe73⤵PID:1152
-
\??\c:\bnthth.exec:\bnthth.exe74⤵PID:2828
-
\??\c:\hbhnbb.exec:\hbhnbb.exe75⤵PID:2820
-
\??\c:\pjpvd.exec:\pjpvd.exe76⤵PID:1720
-
\??\c:\1jjpv.exec:\1jjpv.exe77⤵PID:2780
-
\??\c:\fxfrrxf.exec:\fxfrrxf.exe78⤵PID:2868
-
\??\c:\rrllrfl.exec:\rrllrfl.exe79⤵PID:2296
-
\??\c:\rfrxxff.exec:\rfrxxff.exe80⤵PID:2720
-
\??\c:\1ntbhh.exec:\1ntbhh.exe81⤵PID:2464
-
\??\c:\5nhnbb.exec:\5nhnbb.exe82⤵PID:2804
-
\??\c:\pjjpd.exec:\pjjpd.exe83⤵PID:2752
-
\??\c:\5jvvv.exec:\5jvvv.exe84⤵PID:3056
-
\??\c:\xffrlxl.exec:\xffrlxl.exe85⤵PID:476
-
\??\c:\1fllllr.exec:\1fllllr.exe86⤵PID:1336
-
\??\c:\hbbhbh.exec:\hbbhbh.exe87⤵PID:2888
-
\??\c:\nhbbhh.exec:\nhbbhh.exe88⤵PID:600
-
\??\c:\5vjpd.exec:\5vjpd.exe89⤵PID:1180
-
\??\c:\3jvpp.exec:\3jvpp.exe90⤵PID:592
-
\??\c:\rlfrxfl.exec:\rlfrxfl.exe91⤵PID:1980
-
\??\c:\5flflxf.exec:\5flflxf.exe92⤵PID:2028
-
\??\c:\1hbnbh.exec:\1hbnbh.exe93⤵PID:1780
-
\??\c:\tbnnnh.exec:\tbnnnh.exe94⤵PID:1264
-
\??\c:\pjpvj.exec:\pjpvj.exe95⤵PID:2668
-
\??\c:\7jdpv.exec:\7jdpv.exe96⤵PID:3004
-
\??\c:\xlxrrxl.exec:\xlxrrxl.exe97⤵PID:2336
-
\??\c:\xrflxll.exec:\xrflxll.exe98⤵PID:1380
-
\??\c:\nhttbb.exec:\nhttbb.exe99⤵PID:772
-
\??\c:\thtntn.exec:\thtntn.exe100⤵PID:1004
-
\??\c:\3dvdj.exec:\3dvdj.exe101⤵PID:1956
-
\??\c:\1dpjj.exec:\1dpjj.exe102⤵
- System Location Discovery: System Language Discovery
PID:1608 -
\??\c:\7lxrxxf.exec:\7lxrxxf.exe103⤵PID:620
-
\??\c:\lrxrllx.exec:\lrxrllx.exe104⤵PID:2480
-
\??\c:\1thhnh.exec:\1thhnh.exe105⤵PID:2520
-
\??\c:\hbnbth.exec:\hbnbth.exe106⤵PID:2484
-
\??\c:\vjvdj.exec:\vjvdj.exe107⤵PID:2328
-
\??\c:\ppjdj.exec:\ppjdj.exe108⤵PID:2216
-
\??\c:\frfrrxf.exec:\frfrrxf.exe109⤵PID:1332
-
\??\c:\rfllxxx.exec:\rfllxxx.exe110⤵PID:1940
-
\??\c:\tnbbtt.exec:\tnbbtt.exe111⤵PID:1704
-
\??\c:\9bnhtt.exec:\9bnhtt.exe112⤵PID:2772
-
\??\c:\5thhhn.exec:\5thhhn.exe113⤵PID:2472
-
\??\c:\vvvvd.exec:\vvvvd.exe114⤵PID:1012
-
\??\c:\9jjjd.exec:\9jjjd.exe115⤵PID:2820
-
\??\c:\lfrrllx.exec:\lfrrllx.exe116⤵PID:2740
-
\??\c:\nbbhbh.exec:\nbbhbh.exe117⤵PID:2756
-
\??\c:\nhnnnh.exec:\nhnnnh.exe118⤵PID:2128
-
\??\c:\dvjpd.exec:\dvjpd.exe119⤵PID:2920
-
\??\c:\vppjv.exec:\vppjv.exe120⤵PID:2800
-
\??\c:\llxflrl.exec:\llxflrl.exe121⤵PID:2824
-
\??\c:\xrrxllf.exec:\xrrxllf.exe122⤵PID:1936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-