Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 05:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe
-
Size
67KB
-
MD5
dc1da99ec8ddc07b09536060c824760c
-
SHA1
c279ac114ae52732f48f24ceaa04e385c4487c9b
-
SHA256
db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc
-
SHA512
21a9935477f132441a6438a471dc359266149539dff893512b76b024d1977cc6410eeec69a96765f2ca67294f73e952d213f2fd523ae8d1b78483507539c6427
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxe7:ymb3NkkiQ3mdBjF0y7kbU7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2648-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1380-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/808-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2740 7ttttb.exe 2688 jppvp.exe 2656 7flrllx.exe 2408 3jdjj.exe 2536 5fflxxl.exe 2616 hbhhtt.exe 1764 tnbhnb.exe 2108 7dpdp.exe 2188 xrxflfx.exe 2236 7pdpj.exe 1584 llflxfl.exe 2836 flfllfx.exe 1380 ththtn.exe 2576 jddjp.exe 808 dpjvv.exe 264 fllfrlf.exe 1792 3tnnbn.exe 2412 vvpdd.exe 2088 jjjjj.exe 1660 frlflff.exe 2912 nhbnbn.exe 828 1vjdv.exe 1996 jvdjp.exe 2896 ffxlrfx.exe 1784 9hhtnt.exe 2480 ddjdj.exe 1092 pppdv.exe 1228 fxlflfr.exe 1232 1hnhhb.exe 876 7pjdv.exe 2756 lfrxflf.exe 2752 xrrrxfl.exe 2792 thtttb.exe 1604 pvpdj.exe 2736 jjpdj.exe 2564 7lflxlx.exe 2144 nnnhtb.exe 2552 bbtthb.exe 2960 dddpd.exe 2964 vvvvp.exe 2180 ffxxxlx.exe 1764 bthttt.exe 1868 1nthbb.exe 1500 jjdpd.exe 292 vpjpv.exe 856 lxfrlxr.exe 1652 frxllxf.exe 2948 bthtnt.exe 2128 hhbnnn.exe 2224 3ppvp.exe 400 rrxxrfr.exe 1980 9xrfrxl.exe 264 nbnthh.exe 1656 1btbtt.exe 3012 5jdpj.exe 1820 dvpvj.exe 2220 rxrlrrl.exe 1492 rrfxlrl.exe 2916 bthhbb.exe 1064 bnbbnn.exe 2424 ppdpj.exe 1672 vvvjp.exe 1364 xxlrllx.exe 552 xflfrfr.exe -
resource yara_rule behavioral1/memory/2648-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1380-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-288-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2740 2648 db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe 30 PID 2648 wrote to memory of 2740 2648 db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe 30 PID 2648 wrote to memory of 2740 2648 db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe 30 PID 2648 wrote to memory of 2740 2648 db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe 30 PID 2740 wrote to memory of 2688 2740 7ttttb.exe 31 PID 2740 wrote to memory of 2688 2740 7ttttb.exe 31 PID 2740 wrote to memory of 2688 2740 7ttttb.exe 31 PID 2740 wrote to memory of 2688 2740 7ttttb.exe 31 PID 2688 wrote to memory of 2656 2688 jppvp.exe 32 PID 2688 wrote to memory of 2656 2688 jppvp.exe 32 PID 2688 wrote to memory of 2656 2688 jppvp.exe 32 PID 2688 wrote to memory of 2656 2688 jppvp.exe 32 PID 2656 wrote to memory of 2408 2656 7flrllx.exe 33 PID 2656 wrote to memory of 2408 2656 7flrllx.exe 33 PID 2656 wrote to memory of 2408 2656 7flrllx.exe 33 PID 2656 wrote to memory of 2408 2656 7flrllx.exe 33 PID 2408 wrote to memory of 2536 2408 3jdjj.exe 34 PID 2408 wrote to memory of 2536 2408 3jdjj.exe 34 PID 2408 wrote to memory of 2536 2408 3jdjj.exe 34 PID 2408 wrote to memory of 2536 2408 3jdjj.exe 34 PID 2536 wrote to memory of 2616 2536 5fflxxl.exe 35 PID 2536 wrote to memory of 2616 2536 5fflxxl.exe 35 PID 2536 wrote to memory of 2616 2536 5fflxxl.exe 35 PID 2536 wrote to memory of 2616 2536 5fflxxl.exe 35 PID 2616 wrote to memory of 1764 2616 hbhhtt.exe 36 PID 2616 wrote to memory of 1764 2616 hbhhtt.exe 36 PID 2616 wrote to memory of 1764 2616 hbhhtt.exe 36 PID 2616 wrote to memory of 1764 2616 hbhhtt.exe 36 PID 1764 wrote to memory of 2108 1764 tnbhnb.exe 37 PID 1764 wrote to memory of 2108 1764 tnbhnb.exe 37 PID 1764 wrote to memory of 2108 1764 tnbhnb.exe 37 PID 1764 wrote to memory of 2108 1764 tnbhnb.exe 37 PID 2108 wrote to memory of 2188 2108 7dpdp.exe 38 PID 2108 wrote to memory of 2188 2108 7dpdp.exe 38 PID 2108 wrote to memory of 2188 2108 7dpdp.exe 38 PID 2108 wrote to memory of 2188 2108 7dpdp.exe 38 PID 2188 wrote to memory of 2236 2188 xrxflfx.exe 39 PID 2188 wrote to memory of 2236 2188 xrxflfx.exe 39 PID 2188 wrote to memory of 2236 2188 xrxflfx.exe 39 PID 2188 wrote to memory of 2236 2188 xrxflfx.exe 39 PID 2236 wrote to memory of 1584 2236 7pdpj.exe 40 PID 2236 wrote to memory of 1584 2236 7pdpj.exe 40 PID 2236 wrote to memory of 1584 2236 7pdpj.exe 40 PID 2236 wrote to memory of 1584 2236 7pdpj.exe 40 PID 1584 wrote to memory of 2836 1584 llflxfl.exe 41 PID 1584 wrote to memory of 2836 1584 llflxfl.exe 41 PID 1584 wrote to memory of 2836 1584 llflxfl.exe 41 PID 1584 wrote to memory of 2836 1584 llflxfl.exe 41 PID 2836 wrote to memory of 1380 2836 flfllfx.exe 42 PID 2836 wrote to memory of 1380 2836 flfllfx.exe 42 PID 2836 wrote to memory of 1380 2836 flfllfx.exe 42 PID 2836 wrote to memory of 1380 2836 flfllfx.exe 42 PID 1380 wrote to memory of 2576 1380 ththtn.exe 43 PID 1380 wrote to memory of 2576 1380 ththtn.exe 43 PID 1380 wrote to memory of 2576 1380 ththtn.exe 43 PID 1380 wrote to memory of 2576 1380 ththtn.exe 43 PID 2576 wrote to memory of 808 2576 jddjp.exe 44 PID 2576 wrote to memory of 808 2576 jddjp.exe 44 PID 2576 wrote to memory of 808 2576 jddjp.exe 44 PID 2576 wrote to memory of 808 2576 jddjp.exe 44 PID 808 wrote to memory of 264 808 dpjvv.exe 45 PID 808 wrote to memory of 264 808 dpjvv.exe 45 PID 808 wrote to memory of 264 808 dpjvv.exe 45 PID 808 wrote to memory of 264 808 dpjvv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe"C:\Users\Admin\AppData\Local\Temp\db6a16c461a445cf3bdb6f049ba820f7165d05accf48fb51381f615393abeafc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\7ttttb.exec:\7ttttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\jppvp.exec:\jppvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\7flrllx.exec:\7flrllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\3jdjj.exec:\3jdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\5fflxxl.exec:\5fflxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\hbhhtt.exec:\hbhhtt.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\tnbhnb.exec:\tnbhnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\7dpdp.exec:\7dpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\xrxflfx.exec:\xrxflfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\7pdpj.exec:\7pdpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\llflxfl.exec:\llflxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\flfllfx.exec:\flfllfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\ththtn.exec:\ththtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\jddjp.exec:\jddjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\dpjvv.exec:\dpjvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\fllfrlf.exec:\fllfrlf.exe17⤵
- Executes dropped EXE
PID:264 -
\??\c:\3tnnbn.exec:\3tnnbn.exe18⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vvpdd.exec:\vvpdd.exe19⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jjjjj.exec:\jjjjj.exe20⤵
- Executes dropped EXE
PID:2088 -
\??\c:\frlflff.exec:\frlflff.exe21⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nhbnbn.exec:\nhbnbn.exe22⤵
- Executes dropped EXE
PID:2912 -
\??\c:\1vjdv.exec:\1vjdv.exe23⤵
- Executes dropped EXE
PID:828 -
\??\c:\jvdjp.exec:\jvdjp.exe24⤵
- Executes dropped EXE
PID:1996 -
\??\c:\ffxlrfx.exec:\ffxlrfx.exe25⤵
- Executes dropped EXE
PID:2896 -
\??\c:\9hhtnt.exec:\9hhtnt.exe26⤵
- Executes dropped EXE
PID:1784 -
\??\c:\ddjdj.exec:\ddjdj.exe27⤵
- Executes dropped EXE
PID:2480 -
\??\c:\pppdv.exec:\pppdv.exe28⤵
- Executes dropped EXE
PID:1092 -
\??\c:\fxlflfr.exec:\fxlflfr.exe29⤵
- Executes dropped EXE
PID:1228 -
\??\c:\1hnhhb.exec:\1hnhhb.exe30⤵
- Executes dropped EXE
PID:1232 -
\??\c:\7pjdv.exec:\7pjdv.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\lfrxflf.exec:\lfrxflf.exe32⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xrrrxfl.exec:\xrrrxfl.exe33⤵
- Executes dropped EXE
PID:2752 -
\??\c:\thtttb.exec:\thtttb.exe34⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pvpdj.exec:\pvpdj.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\jjpdj.exec:\jjpdj.exe36⤵
- Executes dropped EXE
PID:2736 -
\??\c:\7lflxlx.exec:\7lflxlx.exe37⤵
- Executes dropped EXE
PID:2564 -
\??\c:\nnnhtb.exec:\nnnhtb.exe38⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bbtthb.exec:\bbtthb.exe39⤵
- Executes dropped EXE
PID:2552 -
\??\c:\dddpd.exec:\dddpd.exe40⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vvvvp.exec:\vvvvp.exe41⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ffxxxlx.exec:\ffxxxlx.exe42⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bthttt.exec:\bthttt.exe43⤵
- Executes dropped EXE
PID:1764 -
\??\c:\1nthbb.exec:\1nthbb.exe44⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jjdpd.exec:\jjdpd.exe45⤵
- Executes dropped EXE
PID:1500 -
\??\c:\vpjpv.exec:\vpjpv.exe46⤵
- Executes dropped EXE
PID:292 -
\??\c:\lxfrlxr.exec:\lxfrlxr.exe47⤵
- Executes dropped EXE
PID:856 -
\??\c:\frxllxf.exec:\frxllxf.exe48⤵
- Executes dropped EXE
PID:1652 -
\??\c:\bthtnt.exec:\bthtnt.exe49⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hhbnnn.exec:\hhbnnn.exe50⤵
- Executes dropped EXE
PID:2128 -
\??\c:\3ppvp.exec:\3ppvp.exe51⤵
- Executes dropped EXE
PID:2224 -
\??\c:\rrxxrfr.exec:\rrxxrfr.exe52⤵
- Executes dropped EXE
PID:400 -
\??\c:\9xrfrxl.exec:\9xrfrxl.exe53⤵
- Executes dropped EXE
PID:1980 -
\??\c:\nbnthh.exec:\nbnthh.exe54⤵
- Executes dropped EXE
PID:264 -
\??\c:\1btbtt.exec:\1btbtt.exe55⤵
- Executes dropped EXE
PID:1656 -
\??\c:\5jdpj.exec:\5jdpj.exe56⤵
- Executes dropped EXE
PID:3012 -
\??\c:\dvpvj.exec:\dvpvj.exe57⤵
- Executes dropped EXE
PID:1820 -
\??\c:\rxrlrrl.exec:\rxrlrrl.exe58⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rrfxlrl.exec:\rrfxlrl.exe59⤵
- Executes dropped EXE
PID:1492 -
\??\c:\bthhbb.exec:\bthhbb.exe60⤵
- Executes dropped EXE
PID:2916 -
\??\c:\bnbbnn.exec:\bnbbnn.exe61⤵
- Executes dropped EXE
PID:1064 -
\??\c:\ppdpj.exec:\ppdpj.exe62⤵
- Executes dropped EXE
PID:2424 -
\??\c:\vvvjp.exec:\vvvjp.exe63⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xxlrllx.exec:\xxlrllx.exe64⤵
- Executes dropped EXE
PID:1364 -
\??\c:\xflfrfr.exec:\xflfrfr.exe65⤵
- Executes dropped EXE
PID:552 -
\??\c:\5hntht.exec:\5hntht.exe66⤵PID:1932
-
\??\c:\nhbhnn.exec:\nhbhnn.exe67⤵PID:2668
-
\??\c:\7ddjd.exec:\7ddjd.exe68⤵PID:2944
-
\??\c:\5vppj.exec:\5vppj.exe69⤵PID:1268
-
\??\c:\llflflx.exec:\llflflx.exe70⤵PID:996
-
\??\c:\rrxlxfr.exec:\rrxlxfr.exe71⤵PID:2684
-
\??\c:\nnhnnt.exec:\nnhnnt.exe72⤵PID:2328
-
\??\c:\tnnttt.exec:\tnnttt.exe73⤵PID:2776
-
\??\c:\jpddv.exec:\jpddv.exe74⤵PID:2812
-
\??\c:\jdpvd.exec:\jdpvd.exe75⤵PID:2824
-
\??\c:\7frxllx.exec:\7frxllx.exe76⤵PID:2704
-
\??\c:\xrlfrlx.exec:\xrlfrlx.exe77⤵PID:2820
-
\??\c:\tthbbt.exec:\tthbbt.exe78⤵PID:1488
-
\??\c:\nthbht.exec:\nthbht.exe79⤵PID:2452
-
\??\c:\jpjvv.exec:\jpjvv.exe80⤵PID:2588
-
\??\c:\ffxrffl.exec:\ffxrffl.exe81⤵
- System Location Discovery: System Language Discovery
PID:1724 -
\??\c:\1xxflrf.exec:\1xxflrf.exe82⤵PID:2208
-
\??\c:\ttthhh.exec:\ttthhh.exe83⤵PID:2360
-
\??\c:\ttnbnb.exec:\ttnbnb.exe84⤵PID:2184
-
\??\c:\vjdjp.exec:\vjdjp.exe85⤵PID:2300
-
\??\c:\ppppd.exec:\ppppd.exe86⤵PID:1552
-
\??\c:\5llxflx.exec:\5llxflx.exe87⤵PID:1864
-
\??\c:\hbntnt.exec:\hbntnt.exe88⤵PID:1744
-
\??\c:\hhhtht.exec:\hhhtht.exe89⤵PID:832
-
\??\c:\pdjpp.exec:\pdjpp.exe90⤵PID:2372
-
\??\c:\jpvvp.exec:\jpvvp.exe91⤵PID:572
-
\??\c:\fxxflxl.exec:\fxxflxl.exe92⤵PID:1096
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe93⤵PID:2196
-
\??\c:\nhthhn.exec:\nhthhn.exe94⤵PID:288
-
\??\c:\9hbnth.exec:\9hbnth.exe95⤵PID:2288
-
\??\c:\ddjpd.exec:\ddjpd.exe96⤵PID:3020
-
\??\c:\ffflrrr.exec:\ffflrrr.exe97⤵PID:2168
-
\??\c:\3rffxfr.exec:\3rffxfr.exe98⤵PID:800
-
\??\c:\nhbtth.exec:\nhbtth.exe99⤵PID:948
-
\??\c:\djjvd.exec:\djjvd.exe100⤵PID:924
-
\??\c:\1vvjv.exec:\1vvjv.exe101⤵PID:904
-
\??\c:\frlxflr.exec:\frlxflr.exe102⤵PID:660
-
\??\c:\ffxrxfl.exec:\ffxrxfl.exe103⤵PID:2872
-
\??\c:\ntthhb.exec:\ntthhb.exe104⤵PID:564
-
\??\c:\nnhnbt.exec:\nnhnbt.exe105⤵PID:2940
-
\??\c:\dvpjj.exec:\dvpjj.exe106⤵PID:1716
-
\??\c:\5frrxxl.exec:\5frrxxl.exe107⤵PID:1260
-
\??\c:\xlflflr.exec:\xlflflr.exe108⤵PID:616
-
\??\c:\bbbhbn.exec:\bbbhbn.exe109⤵PID:1736
-
\??\c:\jvjjv.exec:\jvjjv.exe110⤵PID:872
-
\??\c:\7lrlxfl.exec:\7lrlxfl.exe111⤵PID:2644
-
\??\c:\xrrxrrf.exec:\xrrxrrf.exe112⤵PID:2748
-
\??\c:\bbthnb.exec:\bbthnb.exe113⤵PID:2760
-
\??\c:\hhbtnt.exec:\hhbtnt.exe114⤵PID:1732
-
\??\c:\jjdjj.exec:\jjdjj.exe115⤵PID:2824
-
\??\c:\xxlrxxf.exec:\xxlrxxf.exe116⤵
- System Location Discovery: System Language Discovery
PID:2796 -
\??\c:\xrlxflf.exec:\xrlxflf.exe117⤵PID:2888
-
\??\c:\hbnbtb.exec:\hbnbtb.exe118⤵PID:2532
-
\??\c:\9dpdv.exec:\9dpdv.exe119⤵PID:2536
-
\??\c:\3lflxll.exec:\3lflxll.exe120⤵PID:2152
-
\??\c:\rrlxrll.exec:\rrlxrll.exe121⤵PID:1332
-
\??\c:\3nhnnt.exec:\3nhnnt.exe122⤵PID:2976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-