Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 20:20
Static task
static1
Behavioral task
behavioral1
Sample
674b532a02107996c7bf4c765597d6a7105d99203411026e2f55bfa918c48f3eN.exe
Resource
win7-20240903-en
General
-
Target
674b532a02107996c7bf4c765597d6a7105d99203411026e2f55bfa918c48f3eN.exe
-
Size
96KB
-
MD5
794b87e935c8f13cb7bda43dce397910
-
SHA1
20dfeeba86c5fb509aabd618ab9e7d78e6649076
-
SHA256
674b532a02107996c7bf4c765597d6a7105d99203411026e2f55bfa918c48f3e
-
SHA512
0a3da19732367086c6d7d61d6eecd92662dc1ba8d57e68d1c6a233c607d24a9c6ed3d267fa3e9838b0bc2585193ce47c5a8824cae7911ea2816580375ec5d1d7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7xCkTsIRwnohZkqR4Ra13vYlXO:ymb3NkkiQ3mdBjFo7LAIRUohDmRIL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 17 IoCs
resource yara_rule behavioral1/memory/1920-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1012-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1196-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3036 nhbbnh.exe 3024 ddppd.exe 888 rlrrfxl.exe 2816 rfrrflr.exe 2740 vpvvd.exe 2988 xrllxlx.exe 2904 ttnntt.exe 2620 3bthth.exe 3068 dvjpd.exe 1012 9fxfrrx.exe 692 rlxflrf.exe 1172 5nbhnn.exe 992 9pdjv.exe 2956 vvjpv.exe 2336 fxxfffx.exe 1956 nhtthh.exe 2444 ttbhnn.exe 1692 vjjpv.exe 2920 7rflrfr.exe 1112 xlxxfxl.exe 2296 3hbbbh.exe 1092 tbnbht.exe 2596 7dvdj.exe 1628 fxffrrf.exe 1560 hthhnt.exe 1856 tnnntn.exe 1196 9jvvj.exe 2544 fxffllr.exe 2136 lflrrxf.exe 1920 tnbbnh.exe 2380 3dpvv.exe 2396 vpddj.exe 2876 fxflxxf.exe 2800 frffllr.exe 888 httbtn.exe 2720 ppjjp.exe 3004 vjvpv.exe 2848 rlrrfxl.exe 2788 7lxfllx.exe 2976 hbnntt.exe 1672 tnhhhb.exe 2140 jppvv.exe 2236 1pdjd.exe 676 xxrrllr.exe 2792 xlxrxrr.exe 2968 7ttbhh.exe 1200 btttnn.exe 2704 5pddd.exe 1348 pjpvd.exe 2956 7xrrflf.exe 1540 xffffrx.exe 2368 htbbhh.exe 2656 nbnhhb.exe 1504 dpvvv.exe 2096 rlxrxxf.exe 1940 rlxxxxl.exe 2712 xlrrrxf.exe 2464 bhnbht.exe 1588 jvjpv.exe 2572 rfrlrlr.exe 612 rlxxrrl.exe 1640 nhbhnt.exe 2024 htnbhn.exe 2080 vjddp.exe -
resource yara_rule behavioral1/memory/1920-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1012-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1196-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rllllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1920 wrote to memory of 3036 1920 674b532a02107996c7bf4c765597d6a7105d99203411026e2f55bfa918c48f3eN.exe 30 PID 1920 wrote to memory of 3036 1920 674b532a02107996c7bf4c765597d6a7105d99203411026e2f55bfa918c48f3eN.exe 30 PID 1920 wrote to memory of 3036 1920 674b532a02107996c7bf4c765597d6a7105d99203411026e2f55bfa918c48f3eN.exe 30 PID 1920 wrote to memory of 3036 1920 674b532a02107996c7bf4c765597d6a7105d99203411026e2f55bfa918c48f3eN.exe 30 PID 3036 wrote to memory of 3024 3036 nhbbnh.exe 31 PID 3036 wrote to memory of 3024 3036 nhbbnh.exe 31 PID 3036 wrote to memory of 3024 3036 nhbbnh.exe 31 PID 3036 wrote to memory of 3024 3036 nhbbnh.exe 31 PID 3024 wrote to memory of 888 3024 ddppd.exe 32 PID 3024 wrote to memory of 888 3024 ddppd.exe 32 PID 3024 wrote to memory of 888 3024 ddppd.exe 32 PID 3024 wrote to memory of 888 3024 ddppd.exe 32 PID 888 wrote to memory of 2816 888 rlrrfxl.exe 33 PID 888 wrote to memory of 2816 888 rlrrfxl.exe 33 PID 888 wrote to memory of 2816 888 rlrrfxl.exe 33 PID 888 wrote to memory of 2816 888 rlrrfxl.exe 33 PID 2816 wrote to memory of 2740 2816 rfrrflr.exe 34 PID 2816 wrote to memory of 2740 2816 rfrrflr.exe 34 PID 2816 wrote to memory of 2740 2816 rfrrflr.exe 34 PID 2816 wrote to memory of 2740 2816 rfrrflr.exe 34 PID 2740 wrote to memory of 2988 2740 vpvvd.exe 35 PID 2740 wrote to memory of 2988 2740 vpvvd.exe 35 PID 2740 wrote to memory of 2988 2740 vpvvd.exe 35 PID 2740 wrote to memory of 2988 2740 vpvvd.exe 35 PID 2988 wrote to memory of 2904 2988 xrllxlx.exe 36 PID 2988 wrote to memory of 2904 2988 xrllxlx.exe 36 PID 2988 wrote to memory of 2904 2988 xrllxlx.exe 36 PID 2988 wrote to memory of 2904 2988 xrllxlx.exe 36 PID 2904 wrote to memory of 2620 2904 ttnntt.exe 37 PID 2904 wrote to memory of 2620 2904 ttnntt.exe 37 PID 2904 wrote to memory of 2620 2904 ttnntt.exe 37 PID 2904 wrote to memory of 2620 2904 ttnntt.exe 37 PID 2620 wrote to memory of 3068 2620 3bthth.exe 38 PID 2620 wrote to memory of 3068 2620 3bthth.exe 38 PID 2620 wrote to memory of 3068 2620 3bthth.exe 38 PID 2620 wrote to memory of 3068 2620 3bthth.exe 38 PID 3068 wrote to memory of 1012 3068 dvjpd.exe 39 PID 3068 wrote to memory of 1012 3068 dvjpd.exe 39 PID 3068 wrote to memory of 1012 3068 dvjpd.exe 39 PID 3068 wrote to memory of 1012 3068 dvjpd.exe 39 PID 1012 wrote to memory of 692 1012 9fxfrrx.exe 40 PID 1012 wrote to memory of 692 1012 9fxfrrx.exe 40 PID 1012 wrote to memory of 692 1012 9fxfrrx.exe 40 PID 1012 wrote to memory of 692 1012 9fxfrrx.exe 40 PID 692 wrote to memory of 1172 692 rlxflrf.exe 41 PID 692 wrote to memory of 1172 692 rlxflrf.exe 41 PID 692 wrote to memory of 1172 692 rlxflrf.exe 41 PID 692 wrote to memory of 1172 692 rlxflrf.exe 41 PID 1172 wrote to memory of 992 1172 5nbhnn.exe 42 PID 1172 wrote to memory of 992 1172 5nbhnn.exe 42 PID 1172 wrote to memory of 992 1172 5nbhnn.exe 42 PID 1172 wrote to memory of 992 1172 5nbhnn.exe 42 PID 992 wrote to memory of 2956 992 9pdjv.exe 43 PID 992 wrote to memory of 2956 992 9pdjv.exe 43 PID 992 wrote to memory of 2956 992 9pdjv.exe 43 PID 992 wrote to memory of 2956 992 9pdjv.exe 43 PID 2956 wrote to memory of 2336 2956 vvjpv.exe 44 PID 2956 wrote to memory of 2336 2956 vvjpv.exe 44 PID 2956 wrote to memory of 2336 2956 vvjpv.exe 44 PID 2956 wrote to memory of 2336 2956 vvjpv.exe 44 PID 2336 wrote to memory of 1956 2336 fxxfffx.exe 45 PID 2336 wrote to memory of 1956 2336 fxxfffx.exe 45 PID 2336 wrote to memory of 1956 2336 fxxfffx.exe 45 PID 2336 wrote to memory of 1956 2336 fxxfffx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\674b532a02107996c7bf4c765597d6a7105d99203411026e2f55bfa918c48f3eN.exe"C:\Users\Admin\AppData\Local\Temp\674b532a02107996c7bf4c765597d6a7105d99203411026e2f55bfa918c48f3eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\nhbbnh.exec:\nhbbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\ddppd.exec:\ddppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\rlrrfxl.exec:\rlrrfxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\rfrrflr.exec:\rfrrflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\vpvvd.exec:\vpvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\xrllxlx.exec:\xrllxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\ttnntt.exec:\ttnntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\3bthth.exec:\3bthth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\dvjpd.exec:\dvjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\9fxfrrx.exec:\9fxfrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\rlxflrf.exec:\rlxflrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\5nbhnn.exec:\5nbhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\9pdjv.exec:\9pdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\vvjpv.exec:\vvjpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\fxxfffx.exec:\fxxfffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\nhtthh.exec:\nhtthh.exe17⤵
- Executes dropped EXE
PID:1956 -
\??\c:\ttbhnn.exec:\ttbhnn.exe18⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vjjpv.exec:\vjjpv.exe19⤵
- Executes dropped EXE
PID:1692 -
\??\c:\7rflrfr.exec:\7rflrfr.exe20⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xlxxfxl.exec:\xlxxfxl.exe21⤵
- Executes dropped EXE
PID:1112 -
\??\c:\3hbbbh.exec:\3hbbbh.exe22⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tbnbht.exec:\tbnbht.exe23⤵
- Executes dropped EXE
PID:1092 -
\??\c:\7dvdj.exec:\7dvdj.exe24⤵
- Executes dropped EXE
PID:2596 -
\??\c:\fxffrrf.exec:\fxffrrf.exe25⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hthhnt.exec:\hthhnt.exe26⤵
- Executes dropped EXE
PID:1560 -
\??\c:\tnnntn.exec:\tnnntn.exe27⤵
- Executes dropped EXE
PID:1856 -
\??\c:\9jvvj.exec:\9jvvj.exe28⤵
- Executes dropped EXE
PID:1196 -
\??\c:\fxffllr.exec:\fxffllr.exe29⤵
- Executes dropped EXE
PID:2544 -
\??\c:\lflrrxf.exec:\lflrrxf.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2136 -
\??\c:\tnbbnh.exec:\tnbbnh.exe31⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3dpvv.exec:\3dpvv.exe32⤵
- Executes dropped EXE
PID:2380 -
\??\c:\vpddj.exec:\vpddj.exe33⤵
- Executes dropped EXE
PID:2396 -
\??\c:\fxflxxf.exec:\fxflxxf.exe34⤵
- Executes dropped EXE
PID:2876 -
\??\c:\frffllr.exec:\frffllr.exe35⤵
- Executes dropped EXE
PID:2800 -
\??\c:\httbtn.exec:\httbtn.exe36⤵
- Executes dropped EXE
PID:888 -
\??\c:\ppjjp.exec:\ppjjp.exe37⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vjvpv.exec:\vjvpv.exe38⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rlrrfxl.exec:\rlrrfxl.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\7lxfllx.exec:\7lxfllx.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hbnntt.exec:\hbnntt.exe41⤵
- Executes dropped EXE
PID:2976 -
\??\c:\tnhhhb.exec:\tnhhhb.exe42⤵
- Executes dropped EXE
PID:1672 -
\??\c:\jppvv.exec:\jppvv.exe43⤵
- Executes dropped EXE
PID:2140 -
\??\c:\1pdjd.exec:\1pdjd.exe44⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xxrrllr.exec:\xxrrllr.exe45⤵
- Executes dropped EXE
PID:676 -
\??\c:\xlxrxrr.exec:\xlxrxrr.exe46⤵
- Executes dropped EXE
PID:2792 -
\??\c:\7ttbhh.exec:\7ttbhh.exe47⤵
- Executes dropped EXE
PID:2968 -
\??\c:\btttnn.exec:\btttnn.exe48⤵
- Executes dropped EXE
PID:1200 -
\??\c:\5pddd.exec:\5pddd.exe49⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pjpvd.exec:\pjpvd.exe50⤵
- Executes dropped EXE
PID:1348 -
\??\c:\7xrrflf.exec:\7xrrflf.exe51⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xffffrx.exec:\xffffrx.exe52⤵
- Executes dropped EXE
PID:1540 -
\??\c:\htbbhh.exec:\htbbhh.exe53⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nbnhhb.exec:\nbnhhb.exe54⤵
- Executes dropped EXE
PID:2656 -
\??\c:\dpvvv.exec:\dpvvv.exe55⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe56⤵
- Executes dropped EXE
PID:2096 -
\??\c:\rlxxxxl.exec:\rlxxxxl.exe57⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xlrrrxf.exec:\xlrrrxf.exe58⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bhnbht.exec:\bhnbht.exe59⤵
- Executes dropped EXE
PID:2464 -
\??\c:\jvjpv.exec:\jvjpv.exe60⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rfrlrlr.exec:\rfrlrlr.exe61⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rlxxrrl.exec:\rlxxrrl.exe62⤵
- Executes dropped EXE
PID:612 -
\??\c:\nhbhnt.exec:\nhbhnt.exe63⤵
- Executes dropped EXE
PID:1640 -
\??\c:\htnbhn.exec:\htnbhn.exe64⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vjddp.exec:\vjddp.exe65⤵
- Executes dropped EXE
PID:2080 -
\??\c:\ddddj.exec:\ddddj.exe66⤵PID:1996
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe67⤵PID:1224
-
\??\c:\1rrxffl.exec:\1rrxffl.exe68⤵PID:1764
-
\??\c:\5thbbb.exec:\5thbbb.exe69⤵PID:2588
-
\??\c:\nntbhh.exec:\nntbhh.exe70⤵PID:2052
-
\??\c:\dvvvd.exec:\dvvvd.exe71⤵PID:1608
-
\??\c:\jpdvp.exec:\jpdvp.exe72⤵PID:2696
-
\??\c:\vvjpj.exec:\vvjpj.exe73⤵PID:1964
-
\??\c:\9rfxxrx.exec:\9rfxxrx.exe74⤵PID:2944
-
\??\c:\lxlrrrr.exec:\lxlrrrr.exe75⤵PID:2836
-
\??\c:\7bnttb.exec:\7bnttb.exe76⤵PID:2772
-
\??\c:\tnttbh.exec:\tnttbh.exe77⤵PID:2864
-
\??\c:\pdvvv.exec:\pdvvv.exe78⤵PID:2856
-
\??\c:\vpdvv.exec:\vpdvv.exe79⤵PID:2084
-
\??\c:\9lxxffl.exec:\9lxxffl.exe80⤵PID:2760
-
\??\c:\fllrrfr.exec:\fllrrfr.exe81⤵PID:2640
-
\??\c:\tthhtb.exec:\tthhtb.exe82⤵PID:2672
-
\??\c:\nbnntt.exec:\nbnntt.exe83⤵PID:2692
-
\??\c:\5pjjd.exec:\5pjjd.exe84⤵PID:3068
-
\??\c:\pjvdd.exec:\pjvdd.exe85⤵PID:2960
-
\??\c:\djddd.exec:\djddd.exe86⤵PID:792
-
\??\c:\7lffflf.exec:\7lffflf.exe87⤵PID:588
-
\??\c:\xrlxflr.exec:\xrlxflr.exe88⤵PID:1524
-
\??\c:\tnbbhn.exec:\tnbbhn.exe89⤵PID:2972
-
\??\c:\hbbbnh.exec:\hbbbnh.exe90⤵PID:492
-
\??\c:\7vjdj.exec:\7vjdj.exe91⤵PID:324
-
\??\c:\3ppjp.exec:\3ppjp.exe92⤵PID:2212
-
\??\c:\9rxfrrx.exec:\9rxfrrx.exe93⤵PID:1800
-
\??\c:\frxlxrl.exec:\frxlxrl.exe94⤵PID:2536
-
\??\c:\thtntt.exec:\thtntt.exe95⤵PID:2100
-
\??\c:\tnbhtt.exec:\tnbhtt.exe96⤵PID:1632
-
\??\c:\bthntt.exec:\bthntt.exe97⤵PID:1840
-
\??\c:\5dppp.exec:\5dppp.exe98⤵PID:1936
-
\??\c:\vdjjp.exec:\vdjjp.exe99⤵PID:2808
-
\??\c:\fxxxxfl.exec:\fxxxxfl.exe100⤵PID:1868
-
\??\c:\xrflrrx.exec:\xrflrrx.exe101⤵PID:2600
-
\??\c:\htnbbt.exec:\htnbbt.exe102⤵PID:1364
-
\??\c:\hbnhtn.exec:\hbnhtn.exe103⤵PID:1628
-
\??\c:\pdppd.exec:\pdppd.exe104⤵PID:2488
-
\??\c:\pdjdd.exec:\pdjdd.exe105⤵PID:2280
-
\??\c:\ddvjd.exec:\ddvjd.exe106⤵PID:1196
-
\??\c:\frxxflr.exec:\frxxflr.exe107⤵PID:876
-
\??\c:\rfxlllr.exec:\rfxlllr.exe108⤵PID:2996
-
\??\c:\nhnnbh.exec:\nhnnbh.exe109⤵PID:2316
-
\??\c:\hhtbbb.exec:\hhtbbb.exe110⤵PID:3044
-
\??\c:\vjjdj.exec:\vjjdj.exe111⤵PID:2380
-
\??\c:\vpddv.exec:\vpddv.exe112⤵PID:2012
-
\??\c:\9rllllf.exec:\9rllllf.exe113⤵
- System Location Discovery: System Language Discovery
PID:2476 -
\??\c:\9rfflxf.exec:\9rfflxf.exe114⤵PID:2744
-
\??\c:\ththbb.exec:\ththbb.exe115⤵PID:2756
-
\??\c:\nttnnt.exec:\nttnnt.exe116⤵PID:2852
-
\??\c:\pdjdd.exec:\pdjdd.exe117⤵PID:2724
-
\??\c:\jdvvv.exec:\jdvvv.exe118⤵PID:2860
-
\??\c:\pjppv.exec:\pjppv.exe119⤵PID:2332
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe120⤵PID:2492
-
\??\c:\flxrxxl.exec:\flxrxxl.exe121⤵PID:2660
-
\??\c:\7lffffr.exec:\7lffffr.exe122⤵PID:1644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-