Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 20:13
Static task
static1
Behavioral task
behavioral1
Sample
e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90N.exe
Resource
win7-20240903-en
General
-
Target
e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90N.exe
-
Size
82KB
-
MD5
d2c1a78877ec264e9183c46e1137b940
-
SHA1
d84e229059378aae4e1e2ea64ecfa91252b13e6c
-
SHA256
e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90
-
SHA512
b394ec72e6f8c59391a5d8b60b7c9d05684a3f487eb06d9c50939f24629643350bd90415b2715923a8c46e8efd71852d891cc38e1e6035f92b1a81adca8ba24b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeqe:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4r2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1928-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-296-0x0000000076C40000-0x0000000076D5F000-memory.dmp family_blackmoon behavioral1/memory/1932-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/756-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/308-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/304-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2256 7bttbn.exe 2540 jvddd.exe 2792 xrxlfxx.exe 2744 hhtntb.exe 2804 vppvd.exe 2712 rlxxffl.exe 2736 xrlxfxl.exe 2616 5hbnnt.exe 2176 9ntbbb.exe 656 pdppp.exe 304 vdvpv.exe 776 lxlllrx.exe 2584 5xxrlll.exe 308 rlrlrlr.exe 1060 nhhhnn.exe 756 hbhntt.exe 1756 jjjpv.exe 2288 djvjj.exe 2344 1vvjv.exe 2140 frrrxxf.exe 1016 lxlrfff.exe 2264 rfllxlr.exe 760 nbntth.exe 952 tnbntn.exe 2580 ttnhtn.exe 2904 vppdj.exe 2536 pvjjd.exe 1660 vvddd.exe 2328 frrxlfl.exe 1932 7fxrxfl.exe 2948 bhnhth.exe 1908 pvvvd.exe 2932 vpddd.exe 2744 1lrlrrf.exe 2080 xrflrlr.exe 2436 lxlllrx.exe 2840 tnbbbt.exe 2868 thnhhb.exe 2660 htbhtt.exe 2628 pjvvp.exe 552 jvjjd.exe 3068 jvppv.exe 2708 xxxlrll.exe 288 fxxfllr.exe 776 9xlfxxx.exe 1680 htnnnn.exe 1044 bthnbb.exe 3012 dpddp.exe 468 3jvvv.exe 2088 dpvdj.exe 2692 xrfrxrf.exe 2288 3jddp.exe 1968 9vpvj.exe 2492 xrlrrrr.exe 544 vvjvv.exe 2968 9dpvp.exe 2208 flrlxlf.exe 2028 ttntbt.exe 1732 bhbbtb.exe 2580 vvjjj.exe 1444 xrxxfxx.exe 2212 bnnnnn.exe 2536 nnbbbt.exe 1644 ppjjp.exe -
resource yara_rule behavioral1/memory/1928-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/756-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-69-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2256 1928 e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90N.exe 30 PID 1928 wrote to memory of 2256 1928 e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90N.exe 30 PID 1928 wrote to memory of 2256 1928 e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90N.exe 30 PID 1928 wrote to memory of 2256 1928 e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90N.exe 30 PID 2256 wrote to memory of 2540 2256 7bttbn.exe 31 PID 2256 wrote to memory of 2540 2256 7bttbn.exe 31 PID 2256 wrote to memory of 2540 2256 7bttbn.exe 31 PID 2256 wrote to memory of 2540 2256 7bttbn.exe 31 PID 2540 wrote to memory of 2792 2540 jvddd.exe 32 PID 2540 wrote to memory of 2792 2540 jvddd.exe 32 PID 2540 wrote to memory of 2792 2540 jvddd.exe 32 PID 2540 wrote to memory of 2792 2540 jvddd.exe 32 PID 2792 wrote to memory of 2744 2792 xrxlfxx.exe 64 PID 2792 wrote to memory of 2744 2792 xrxlfxx.exe 64 PID 2792 wrote to memory of 2744 2792 xrxlfxx.exe 64 PID 2792 wrote to memory of 2744 2792 xrxlfxx.exe 64 PID 2744 wrote to memory of 2804 2744 hhtntb.exe 34 PID 2744 wrote to memory of 2804 2744 hhtntb.exe 34 PID 2744 wrote to memory of 2804 2744 hhtntb.exe 34 PID 2744 wrote to memory of 2804 2744 hhtntb.exe 34 PID 2804 wrote to memory of 2712 2804 vppvd.exe 35 PID 2804 wrote to memory of 2712 2804 vppvd.exe 35 PID 2804 wrote to memory of 2712 2804 vppvd.exe 35 PID 2804 wrote to memory of 2712 2804 vppvd.exe 35 PID 2712 wrote to memory of 2736 2712 rlxxffl.exe 36 PID 2712 wrote to memory of 2736 2712 rlxxffl.exe 36 PID 2712 wrote to memory of 2736 2712 rlxxffl.exe 36 PID 2712 wrote to memory of 2736 2712 rlxxffl.exe 36 PID 2736 wrote to memory of 2616 2736 xrlxfxl.exe 37 PID 2736 wrote to memory of 2616 2736 xrlxfxl.exe 37 PID 2736 wrote to memory of 2616 2736 xrlxfxl.exe 37 PID 2736 wrote to memory of 2616 2736 xrlxfxl.exe 37 PID 2616 wrote to memory of 2176 2616 5hbnnt.exe 38 PID 2616 wrote to memory of 2176 2616 5hbnnt.exe 38 PID 2616 wrote to memory of 2176 2616 5hbnnt.exe 38 PID 2616 wrote to memory of 2176 2616 5hbnnt.exe 38 PID 2176 wrote to memory of 656 2176 9ntbbb.exe 39 PID 2176 wrote to memory of 656 2176 9ntbbb.exe 39 PID 2176 wrote to memory of 656 2176 9ntbbb.exe 39 PID 2176 wrote to memory of 656 2176 9ntbbb.exe 39 PID 656 wrote to memory of 304 656 pdppp.exe 40 PID 656 wrote to memory of 304 656 pdppp.exe 40 PID 656 wrote to memory of 304 656 pdppp.exe 40 PID 656 wrote to memory of 304 656 pdppp.exe 40 PID 304 wrote to memory of 776 304 vdvpv.exe 41 PID 304 wrote to memory of 776 304 vdvpv.exe 41 PID 304 wrote to memory of 776 304 vdvpv.exe 41 PID 304 wrote to memory of 776 304 vdvpv.exe 41 PID 776 wrote to memory of 2584 776 lxlllrx.exe 42 PID 776 wrote to memory of 2584 776 lxlllrx.exe 42 PID 776 wrote to memory of 2584 776 lxlllrx.exe 42 PID 776 wrote to memory of 2584 776 lxlllrx.exe 42 PID 2584 wrote to memory of 308 2584 5xxrlll.exe 43 PID 2584 wrote to memory of 308 2584 5xxrlll.exe 43 PID 2584 wrote to memory of 308 2584 5xxrlll.exe 43 PID 2584 wrote to memory of 308 2584 5xxrlll.exe 43 PID 308 wrote to memory of 1060 308 rlrlrlr.exe 44 PID 308 wrote to memory of 1060 308 rlrlrlr.exe 44 PID 308 wrote to memory of 1060 308 rlrlrlr.exe 44 PID 308 wrote to memory of 1060 308 rlrlrlr.exe 44 PID 1060 wrote to memory of 756 1060 nhhhnn.exe 45 PID 1060 wrote to memory of 756 1060 nhhhnn.exe 45 PID 1060 wrote to memory of 756 1060 nhhhnn.exe 45 PID 1060 wrote to memory of 756 1060 nhhhnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90N.exe"C:\Users\Admin\AppData\Local\Temp\e0be348094407cd4b110be9e8ccf24776eb7c52896ca9ab1b9d2eec2701d8e90N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\7bttbn.exec:\7bttbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\jvddd.exec:\jvddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xrxlfxx.exec:\xrxlfxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\hhtntb.exec:\hhtntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\vppvd.exec:\vppvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\rlxxffl.exec:\rlxxffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\xrlxfxl.exec:\xrlxfxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\5hbnnt.exec:\5hbnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\9ntbbb.exec:\9ntbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\pdppp.exec:\pdppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\vdvpv.exec:\vdvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
\??\c:\lxlllrx.exec:\lxlllrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\5xxrlll.exec:\5xxrlll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\rlrlrlr.exec:\rlrlrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\nhhhnn.exec:\nhhhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\hbhntt.exec:\hbhntt.exe17⤵
- Executes dropped EXE
PID:756 -
\??\c:\jjjpv.exec:\jjjpv.exe18⤵
- Executes dropped EXE
PID:1756 -
\??\c:\djvjj.exec:\djvjj.exe19⤵
- Executes dropped EXE
PID:2288 -
\??\c:\1vvjv.exec:\1vvjv.exe20⤵
- Executes dropped EXE
PID:2344 -
\??\c:\frrrxxf.exec:\frrrxxf.exe21⤵
- Executes dropped EXE
PID:2140 -
\??\c:\lxlrfff.exec:\lxlrfff.exe22⤵
- Executes dropped EXE
PID:1016 -
\??\c:\rfllxlr.exec:\rfllxlr.exe23⤵
- Executes dropped EXE
PID:2264 -
\??\c:\nbntth.exec:\nbntth.exe24⤵
- Executes dropped EXE
PID:760 -
\??\c:\tnbntn.exec:\tnbntn.exe25⤵
- Executes dropped EXE
PID:952 -
\??\c:\ttnhtn.exec:\ttnhtn.exe26⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vppdj.exec:\vppdj.exe27⤵
- Executes dropped EXE
PID:2904 -
\??\c:\pvjjd.exec:\pvjjd.exe28⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vvddd.exec:\vvddd.exe29⤵
- Executes dropped EXE
PID:1660 -
\??\c:\frrxlfl.exec:\frrxlfl.exe30⤵
- Executes dropped EXE
PID:2328 -
\??\c:\7fxrxfl.exec:\7fxrxfl.exe31⤵
- Executes dropped EXE
PID:1932 -
\??\c:\5thnnt.exec:\5thnnt.exe32⤵PID:2248
-
\??\c:\bhnhth.exec:\bhnhth.exe33⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pvvvd.exec:\pvvvd.exe34⤵
- Executes dropped EXE
PID:1908 -
\??\c:\vpddd.exec:\vpddd.exe35⤵
- Executes dropped EXE
PID:2932 -
\??\c:\1lrlrrf.exec:\1lrlrrf.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xrflrlr.exec:\xrflrlr.exe37⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lxlllrx.exec:\lxlllrx.exe38⤵
- Executes dropped EXE
PID:2436 -
\??\c:\tnbbbt.exec:\tnbbbt.exe39⤵
- Executes dropped EXE
PID:2840 -
\??\c:\thnhhb.exec:\thnhhb.exe40⤵
- Executes dropped EXE
PID:2868 -
\??\c:\htbhtt.exec:\htbhtt.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pjvvp.exec:\pjvvp.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jvjjd.exec:\jvjjd.exe43⤵
- Executes dropped EXE
PID:552 -
\??\c:\jvppv.exec:\jvppv.exe44⤵
- Executes dropped EXE
PID:3068 -
\??\c:\xxxlrll.exec:\xxxlrll.exe45⤵
- Executes dropped EXE
PID:2708 -
\??\c:\fxxfllr.exec:\fxxfllr.exe46⤵
- Executes dropped EXE
PID:288 -
\??\c:\9xlfxxx.exec:\9xlfxxx.exe47⤵
- Executes dropped EXE
PID:776 -
\??\c:\htnnnn.exec:\htnnnn.exe48⤵
- Executes dropped EXE
PID:1680 -
\??\c:\bthnbb.exec:\bthnbb.exe49⤵
- Executes dropped EXE
PID:1044 -
\??\c:\dpddp.exec:\dpddp.exe50⤵
- Executes dropped EXE
PID:3012 -
\??\c:\3jvvv.exec:\3jvvv.exe51⤵
- Executes dropped EXE
PID:468 -
\??\c:\dpvdj.exec:\dpvdj.exe52⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xrfrxrf.exec:\xrfrxrf.exe53⤵
- Executes dropped EXE
PID:2692 -
\??\c:\3jddp.exec:\3jddp.exe54⤵
- Executes dropped EXE
PID:2288 -
\??\c:\9vpvj.exec:\9vpvj.exe55⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xrlrrrr.exec:\xrlrrrr.exe56⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vvjvv.exec:\vvjvv.exe57⤵
- Executes dropped EXE
PID:544 -
\??\c:\9dpvp.exec:\9dpvp.exe58⤵
- Executes dropped EXE
PID:2968 -
\??\c:\flrlxlf.exec:\flrlxlf.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ttntbt.exec:\ttntbt.exe60⤵
- Executes dropped EXE
PID:2028 -
\??\c:\bhbbtb.exec:\bhbbtb.exe61⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vvjjj.exec:\vvjjj.exe62⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xrxxfxx.exec:\xrxxfxx.exe63⤵
- Executes dropped EXE
PID:1444 -
\??\c:\bnnnnn.exec:\bnnnnn.exe64⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nnbbbt.exec:\nnbbbt.exe65⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ppjjp.exec:\ppjjp.exe66⤵
- Executes dropped EXE
PID:1644 -
\??\c:\ffrxlrf.exec:\ffrxlrf.exe67⤵PID:1920
-
\??\c:\1fxffxx.exec:\1fxffxx.exe68⤵PID:2024
-
\??\c:\tnnttn.exec:\tnnttn.exe69⤵PID:1864
-
\??\c:\vpvdd.exec:\vpvdd.exe70⤵PID:2988
-
\??\c:\7xxxxrr.exec:\7xxxxrr.exe71⤵PID:1608
-
\??\c:\rlrfrlr.exec:\rlrfrlr.exe72⤵PID:2740
-
\??\c:\hbtbtt.exec:\hbtbtt.exe73⤵PID:2972
-
\??\c:\vvpdp.exec:\vvpdp.exe74⤵PID:2836
-
\??\c:\pdjvd.exec:\pdjvd.exe75⤵PID:2316
-
\??\c:\rlfrfrf.exec:\rlfrfrf.exe76⤵PID:1228
-
\??\c:\rfxlxxl.exec:\rfxlxxl.exe77⤵PID:2892
-
\??\c:\tnhthn.exec:\tnhthn.exe78⤵PID:2644
-
\??\c:\bbnhbn.exec:\bbnhbn.exe79⤵PID:2736
-
\??\c:\7jvvj.exec:\7jvvj.exe80⤵PID:3052
-
\??\c:\dvvdp.exec:\dvvdp.exe81⤵PID:2824
-
\??\c:\rfrxxfr.exec:\rfrxxfr.exe82⤵PID:1108
-
\??\c:\rrfflrx.exec:\rrfflrx.exe83⤵PID:2608
-
\??\c:\htbbhh.exec:\htbbhh.exe84⤵PID:3064
-
\??\c:\htntbb.exec:\htntbb.exe85⤵PID:2656
-
\??\c:\dvjdp.exec:\dvjdp.exe86⤵PID:1588
-
\??\c:\rrrxlrx.exec:\rrrxlrx.exe87⤵PID:2668
-
\??\c:\lxxfxrx.exec:\lxxfxrx.exe88⤵PID:2592
-
\??\c:\hbttbb.exec:\hbttbb.exe89⤵PID:1516
-
\??\c:\hthhhh.exec:\hthhhh.exe90⤵PID:2100
-
\??\c:\djjvp.exec:\djjvp.exe91⤵PID:1756
-
\??\c:\dpvpj.exec:\dpvpj.exe92⤵PID:2220
-
\??\c:\3rrrxff.exec:\3rrrxff.exe93⤵PID:1664
-
\??\c:\xlrlrlr.exec:\xlrlrlr.exe94⤵PID:2376
-
\??\c:\bbthbn.exec:\bbthbn.exe95⤵PID:1968
-
\??\c:\nbhbtt.exec:\nbhbtt.exe96⤵PID:408
-
\??\c:\9vppv.exec:\9vppv.exe97⤵PID:544
-
\??\c:\7pdvd.exec:\7pdvd.exe98⤵PID:2264
-
\??\c:\pvddj.exec:\pvddj.exe99⤵PID:2208
-
\??\c:\lrlrlxr.exec:\lrlrlxr.exe100⤵
- System Location Discovery: System Language Discovery
PID:952 -
\??\c:\7bhhnh.exec:\7bhhnh.exe101⤵PID:2552
-
\??\c:\bthtbb.exec:\bthtbb.exe102⤵PID:2064
-
\??\c:\ttbttt.exec:\ttbttt.exe103⤵PID:1640
-
\??\c:\vdvjp.exec:\vdvjp.exe104⤵PID:1944
-
\??\c:\xlffxxf.exec:\xlffxxf.exe105⤵PID:1928
-
\??\c:\5xfxxrx.exec:\5xfxxrx.exe106⤵PID:2368
-
\??\c:\5htbbh.exec:\5htbbh.exe107⤵PID:2112
-
\??\c:\tttbbt.exec:\tttbbt.exe108⤵PID:2256
-
\??\c:\dvjjj.exec:\dvjjj.exe109⤵PID:2060
-
\??\c:\1pvjd.exec:\1pvjd.exe110⤵PID:2284
-
\??\c:\rlrxrxl.exec:\rlrxrxl.exe111⤵PID:1608
-
\??\c:\3rrxrlr.exec:\3rrxrlr.exe112⤵PID:2932
-
\??\c:\bbbbtb.exec:\bbbbtb.exe113⤵PID:2180
-
\??\c:\jjjjp.exec:\jjjjp.exe114⤵PID:2412
-
\??\c:\jdjvv.exec:\jdjvv.exe115⤵PID:2832
-
\??\c:\lfrlxxx.exec:\lfrlxxx.exe116⤵PID:2760
-
\??\c:\5ffrllr.exec:\5ffrllr.exe117⤵
- System Location Discovery: System Language Discovery
PID:2436 -
\??\c:\tntbnh.exec:\tntbnh.exe118⤵PID:2716
-
\??\c:\jdjdv.exec:\jdjdv.exe119⤵PID:2880
-
\??\c:\vvjpd.exec:\vvjpd.exe120⤵PID:1532
-
\??\c:\vdvvv.exec:\vdvvv.exe121⤵PID:2800
-
\??\c:\frrxxrl.exec:\frrxxrl.exe122⤵PID:584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-