Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 05:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077bN.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077bN.exe
-
Size
70KB
-
MD5
c1b30d8ffe3c0b578b19e19e5a677690
-
SHA1
0c9474d6b65b9fbe09d999abc03638cf876d558f
-
SHA256
edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077b
-
SHA512
979ea833491cb1d3d6f3436af3469eb7614191af345bc5a5edf930896f73a5934739191ec6a85efe3d5cdd18d1a189872e95962a6c29428d8dfc66c469eee673
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAcN:ymb3NkkiQ3mdBjFIsIVcN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1792-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1208-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/892-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1876-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2692 rrlrxrx.exe 2952 thttbt.exe 2844 pjjpp.exe 2896 ffrlrxf.exe 2768 nhnnnn.exe 3012 lflfllr.exe 892 1flffrx.exe 1208 bbtbbt.exe 2528 ddppv.exe 2180 rrxxlrl.exe 2336 5tnthh.exe 2840 bbntbh.exe 2616 3jvdj.exe 1520 ddjjv.exe 2284 ffrrlrf.exe 2872 nntthb.exe 580 7tnnnt.exe 2344 jvvpp.exe 2316 llrrrrf.exe 1800 fffxlll.exe 2168 bbhbhh.exe 1876 dpppp.exe 1076 jdjpd.exe 1268 rlllrrx.exe 1776 hhnntb.exe 836 3hbnbh.exe 2404 ddpdj.exe 2496 llrfrrx.exe 2396 rrxrllr.exe 1976 1btbht.exe 2744 jjppv.exe 2688 xrxxxxl.exe 1596 xfflxfl.exe 2664 9bbthn.exe 2812 7hthnt.exe 2800 jjddj.exe 2660 9dppp.exe 2624 ffflrxf.exe 2152 1frlxlx.exe 3024 tbnbnh.exe 2004 nhhntn.exe 1320 vvvvd.exe 1632 ddpjp.exe 2096 3xllxxf.exe 1928 fflrrfl.exe 2140 1hnhhn.exe 2876 7hnnbh.exe 2840 5ddjj.exe 2228 jpvvd.exe 2420 xrllrrr.exe 2324 xrxflfl.exe 768 9ttthh.exe 2872 nntthh.exe 1804 jdpvv.exe 2632 jjjvd.exe 2988 7rflxxf.exe 2216 tnbnhn.exe 1340 9bthhn.exe 2436 pjpdd.exe 912 ppvvj.exe 1752 llrrffl.exe 1268 3xlxlfr.exe 2936 nhhthh.exe 2516 bbnbnh.exe -
resource yara_rule behavioral1/memory/1792-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1208-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-304-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlxx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 2692 1792 edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077bN.exe 30 PID 1792 wrote to memory of 2692 1792 edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077bN.exe 30 PID 1792 wrote to memory of 2692 1792 edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077bN.exe 30 PID 1792 wrote to memory of 2692 1792 edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077bN.exe 30 PID 2692 wrote to memory of 2952 2692 rrlrxrx.exe 31 PID 2692 wrote to memory of 2952 2692 rrlrxrx.exe 31 PID 2692 wrote to memory of 2952 2692 rrlrxrx.exe 31 PID 2692 wrote to memory of 2952 2692 rrlrxrx.exe 31 PID 2952 wrote to memory of 2844 2952 thttbt.exe 32 PID 2952 wrote to memory of 2844 2952 thttbt.exe 32 PID 2952 wrote to memory of 2844 2952 thttbt.exe 32 PID 2952 wrote to memory of 2844 2952 thttbt.exe 32 PID 2844 wrote to memory of 2896 2844 pjjpp.exe 33 PID 2844 wrote to memory of 2896 2844 pjjpp.exe 33 PID 2844 wrote to memory of 2896 2844 pjjpp.exe 33 PID 2844 wrote to memory of 2896 2844 pjjpp.exe 33 PID 2896 wrote to memory of 2768 2896 ffrlrxf.exe 34 PID 2896 wrote to memory of 2768 2896 ffrlrxf.exe 34 PID 2896 wrote to memory of 2768 2896 ffrlrxf.exe 34 PID 2896 wrote to memory of 2768 2896 ffrlrxf.exe 34 PID 2768 wrote to memory of 3012 2768 nhnnnn.exe 35 PID 2768 wrote to memory of 3012 2768 nhnnnn.exe 35 PID 2768 wrote to memory of 3012 2768 nhnnnn.exe 35 PID 2768 wrote to memory of 3012 2768 nhnnnn.exe 35 PID 3012 wrote to memory of 892 3012 lflfllr.exe 36 PID 3012 wrote to memory of 892 3012 lflfllr.exe 36 PID 3012 wrote to memory of 892 3012 lflfllr.exe 36 PID 3012 wrote to memory of 892 3012 lflfllr.exe 36 PID 892 wrote to memory of 1208 892 1flffrx.exe 37 PID 892 wrote to memory of 1208 892 1flffrx.exe 37 PID 892 wrote to memory of 1208 892 1flffrx.exe 37 PID 892 wrote to memory of 1208 892 1flffrx.exe 37 PID 1208 wrote to memory of 2528 1208 bbtbbt.exe 38 PID 1208 wrote to memory of 2528 1208 bbtbbt.exe 38 PID 1208 wrote to memory of 2528 1208 bbtbbt.exe 38 PID 1208 wrote to memory of 2528 1208 bbtbbt.exe 38 PID 2528 wrote to memory of 2180 2528 ddppv.exe 39 PID 2528 wrote to memory of 2180 2528 ddppv.exe 39 PID 2528 wrote to memory of 2180 2528 ddppv.exe 39 PID 2528 wrote to memory of 2180 2528 ddppv.exe 39 PID 2180 wrote to memory of 2336 2180 rrxxlrl.exe 40 PID 2180 wrote to memory of 2336 2180 rrxxlrl.exe 40 PID 2180 wrote to memory of 2336 2180 rrxxlrl.exe 40 PID 2180 wrote to memory of 2336 2180 rrxxlrl.exe 40 PID 2336 wrote to memory of 2840 2336 5tnthh.exe 41 PID 2336 wrote to memory of 2840 2336 5tnthh.exe 41 PID 2336 wrote to memory of 2840 2336 5tnthh.exe 41 PID 2336 wrote to memory of 2840 2336 5tnthh.exe 41 PID 2840 wrote to memory of 2616 2840 bbntbh.exe 42 PID 2840 wrote to memory of 2616 2840 bbntbh.exe 42 PID 2840 wrote to memory of 2616 2840 bbntbh.exe 42 PID 2840 wrote to memory of 2616 2840 bbntbh.exe 42 PID 2616 wrote to memory of 1520 2616 3jvdj.exe 43 PID 2616 wrote to memory of 1520 2616 3jvdj.exe 43 PID 2616 wrote to memory of 1520 2616 3jvdj.exe 43 PID 2616 wrote to memory of 1520 2616 3jvdj.exe 43 PID 1520 wrote to memory of 2284 1520 ddjjv.exe 44 PID 1520 wrote to memory of 2284 1520 ddjjv.exe 44 PID 1520 wrote to memory of 2284 1520 ddjjv.exe 44 PID 1520 wrote to memory of 2284 1520 ddjjv.exe 44 PID 2284 wrote to memory of 2872 2284 ffrrlrf.exe 45 PID 2284 wrote to memory of 2872 2284 ffrrlrf.exe 45 PID 2284 wrote to memory of 2872 2284 ffrrlrf.exe 45 PID 2284 wrote to memory of 2872 2284 ffrrlrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077bN.exe"C:\Users\Admin\AppData\Local\Temp\edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\rrlrxrx.exec:\rrlrxrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\thttbt.exec:\thttbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\pjjpp.exec:\pjjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\ffrlrxf.exec:\ffrlrxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\nhnnnn.exec:\nhnnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\lflfllr.exec:\lflfllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\1flffrx.exec:\1flffrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\bbtbbt.exec:\bbtbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\ddppv.exec:\ddppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\rrxxlrl.exec:\rrxxlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\5tnthh.exec:\5tnthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\bbntbh.exec:\bbntbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\3jvdj.exec:\3jvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ddjjv.exec:\ddjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\ffrrlrf.exec:\ffrrlrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\nntthb.exec:\nntthb.exe17⤵
- Executes dropped EXE
PID:2872 -
\??\c:\7tnnnt.exec:\7tnnnt.exe18⤵
- Executes dropped EXE
PID:580 -
\??\c:\jvvpp.exec:\jvvpp.exe19⤵
- Executes dropped EXE
PID:2344 -
\??\c:\llrrrrf.exec:\llrrrrf.exe20⤵
- Executes dropped EXE
PID:2316 -
\??\c:\fffxlll.exec:\fffxlll.exe21⤵
- Executes dropped EXE
PID:1800 -
\??\c:\bbhbhh.exec:\bbhbhh.exe22⤵
- Executes dropped EXE
PID:2168 -
\??\c:\dpppp.exec:\dpppp.exe23⤵
- Executes dropped EXE
PID:1876 -
\??\c:\jdjpd.exec:\jdjpd.exe24⤵
- Executes dropped EXE
PID:1076 -
\??\c:\rlllrrx.exec:\rlllrrx.exe25⤵
- Executes dropped EXE
PID:1268 -
\??\c:\hhnntb.exec:\hhnntb.exe26⤵
- Executes dropped EXE
PID:1776 -
\??\c:\3hbnbh.exec:\3hbnbh.exe27⤵
- Executes dropped EXE
PID:836 -
\??\c:\ddpdj.exec:\ddpdj.exe28⤵
- Executes dropped EXE
PID:2404 -
\??\c:\llrfrrx.exec:\llrfrrx.exe29⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rrxrllr.exec:\rrxrllr.exe30⤵
- Executes dropped EXE
PID:2396 -
\??\c:\1btbht.exec:\1btbht.exe31⤵
- Executes dropped EXE
PID:1976 -
\??\c:\jjppv.exec:\jjppv.exe32⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xrxxxxl.exec:\xrxxxxl.exe33⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xfflxfl.exec:\xfflxfl.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\9bbthn.exec:\9bbthn.exe35⤵
- Executes dropped EXE
PID:2664 -
\??\c:\7hthnt.exec:\7hthnt.exe36⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jjddj.exec:\jjddj.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\9dppp.exec:\9dppp.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\ffflrxf.exec:\ffflrxf.exe39⤵
- Executes dropped EXE
PID:2624 -
\??\c:\1frlxlx.exec:\1frlxlx.exe40⤵
- Executes dropped EXE
PID:2152 -
\??\c:\tbnbnh.exec:\tbnbnh.exe41⤵
- Executes dropped EXE
PID:3024 -
\??\c:\nhhntn.exec:\nhhntn.exe42⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vvvvd.exec:\vvvvd.exe43⤵
- Executes dropped EXE
PID:1320 -
\??\c:\ddpjp.exec:\ddpjp.exe44⤵
- Executes dropped EXE
PID:1632 -
\??\c:\3xllxxf.exec:\3xllxxf.exe45⤵
- Executes dropped EXE
PID:2096 -
\??\c:\fflrrfl.exec:\fflrrfl.exe46⤵
- Executes dropped EXE
PID:1928 -
\??\c:\1hnhhn.exec:\1hnhhn.exe47⤵
- Executes dropped EXE
PID:2140 -
\??\c:\7hnnbh.exec:\7hnnbh.exe48⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5ddjj.exec:\5ddjj.exe49⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jpvvd.exec:\jpvvd.exe50⤵
- Executes dropped EXE
PID:2228 -
\??\c:\xrllrrr.exec:\xrllrrr.exe51⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xrxflfl.exec:\xrxflfl.exe52⤵
- Executes dropped EXE
PID:2324 -
\??\c:\9ttthh.exec:\9ttthh.exe53⤵
- Executes dropped EXE
PID:768 -
\??\c:\nntthh.exec:\nntthh.exe54⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jdpvv.exec:\jdpvv.exe55⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jjjvd.exec:\jjjvd.exe56⤵
- Executes dropped EXE
PID:2632 -
\??\c:\7rflxxf.exec:\7rflxxf.exe57⤵
- Executes dropped EXE
PID:2988 -
\??\c:\tnbnhn.exec:\tnbnhn.exe58⤵
- Executes dropped EXE
PID:2216 -
\??\c:\9bthhn.exec:\9bthhn.exe59⤵
- Executes dropped EXE
PID:1340 -
\??\c:\pjpdd.exec:\pjpdd.exe60⤵
- Executes dropped EXE
PID:2436 -
\??\c:\ppvvj.exec:\ppvvj.exe61⤵
- Executes dropped EXE
PID:912 -
\??\c:\llrrffl.exec:\llrrffl.exe62⤵
- Executes dropped EXE
PID:1752 -
\??\c:\3xlxlfr.exec:\3xlxlfr.exe63⤵
- Executes dropped EXE
PID:1268 -
\??\c:\nhhthh.exec:\nhhthh.exe64⤵
- Executes dropped EXE
PID:2936 -
\??\c:\bbnbnh.exec:\bbnbnh.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2516 -
\??\c:\jjpvp.exec:\jjpvp.exe66⤵PID:2444
-
\??\c:\vpdvd.exec:\vpdvd.exe67⤵PID:1528
-
\??\c:\xlflxlf.exec:\xlflxlf.exe68⤵PID:888
-
\??\c:\ffrxfxl.exec:\ffrxfxl.exe69⤵PID:1044
-
\??\c:\nnntht.exec:\nnntht.exe70⤵PID:1948
-
\??\c:\btntnn.exec:\btntnn.exe71⤵PID:1792
-
\??\c:\jpvvj.exec:\jpvvj.exe72⤵PID:2704
-
\??\c:\djdvj.exec:\djdvj.exe73⤵PID:2688
-
\??\c:\1rrrxrl.exec:\1rrrxrl.exe74⤵PID:2556
-
\??\c:\lrxxffl.exec:\lrxxffl.exe75⤵PID:2808
-
\??\c:\hhtbhh.exec:\hhtbhh.exe76⤵PID:3064
-
\??\c:\tthbhn.exec:\tthbhn.exe77⤵PID:2896
-
\??\c:\dddjv.exec:\dddjv.exe78⤵PID:2580
-
\??\c:\dpvvv.exec:\dpvvv.exe79⤵PID:2660
-
\??\c:\rrxxlrr.exec:\rrxxlrr.exe80⤵PID:556
-
\??\c:\5xlfxlr.exec:\5xlfxlr.exe81⤵PID:2916
-
\??\c:\5nntht.exec:\5nntht.exe82⤵PID:3028
-
\??\c:\ttbhtb.exec:\ttbhtb.exe83⤵PID:908
-
\??\c:\3hbhtt.exec:\3hbhtt.exe84⤵PID:1952
-
\??\c:\3vpdp.exec:\3vpdp.exe85⤵PID:2220
-
\??\c:\dddjv.exec:\dddjv.exe86⤵PID:2360
-
\??\c:\xrrrxlr.exec:\xrrrxlr.exe87⤵PID:2336
-
\??\c:\rrlrxxr.exec:\rrlrxxr.exe88⤵PID:2212
-
\??\c:\bbhhtt.exec:\bbhhtt.exe89⤵PID:3032
-
\??\c:\5bnhnt.exec:\5bnhnt.exe90⤵PID:2380
-
\??\c:\ddddj.exec:\ddddj.exe91⤵PID:2348
-
\??\c:\jjpdj.exec:\jjpdj.exe92⤵PID:572
-
\??\c:\djdjv.exec:\djdjv.exe93⤵PID:536
-
\??\c:\ffflxff.exec:\ffflxff.exe94⤵PID:1768
-
\??\c:\rlxflrf.exec:\rlxflrf.exe95⤵PID:2132
-
\??\c:\tbhnbn.exec:\tbhnbn.exe96⤵PID:1256
-
\??\c:\thntbh.exec:\thntbh.exe97⤵PID:2316
-
\??\c:\9dpjj.exec:\9dpjj.exe98⤵PID:1800
-
\??\c:\vjjpv.exec:\vjjpv.exe99⤵PID:1488
-
\??\c:\xfflxfl.exec:\xfflxfl.exe100⤵PID:1020
-
\??\c:\3lxlxlr.exec:\3lxlxlr.exe101⤵PID:696
-
\??\c:\3tbbtb.exec:\3tbbtb.exe102⤵PID:1816
-
\??\c:\9hthnn.exec:\9hthnn.exe103⤵PID:1092
-
\??\c:\9vjpp.exec:\9vjpp.exe104⤵PID:3052
-
\??\c:\ddpvd.exec:\ddpvd.exe105⤵PID:2388
-
\??\c:\5xrrlrf.exec:\5xrrlrf.exe106⤵PID:2512
-
\??\c:\llxlxxf.exec:\llxlxxf.exe107⤵PID:1480
-
\??\c:\lrfflrr.exec:\lrfflrr.exe108⤵PID:2256
-
\??\c:\bbhhnb.exec:\bbhhnb.exe109⤵PID:1492
-
\??\c:\7hhntt.exec:\7hhntt.exe110⤵PID:2292
-
\??\c:\5jjvd.exec:\5jjvd.exe111⤵PID:2776
-
\??\c:\vdpvp.exec:\vdpvp.exe112⤵PID:2680
-
\??\c:\rlrxlxl.exec:\rlrxlxl.exe113⤵PID:2108
-
\??\c:\9fxfrfl.exec:\9fxfrfl.exe114⤵PID:2636
-
\??\c:\9nbhbh.exec:\9nbhbh.exe115⤵PID:2576
-
\??\c:\1bthhh.exec:\1bthhh.exe116⤵PID:2548
-
\??\c:\tntnbh.exec:\tntnbh.exe117⤵PID:2604
-
\??\c:\3vjpd.exec:\3vjpd.exe118⤵PID:2712
-
\??\c:\ddddj.exec:\ddddj.exe119⤵PID:2624
-
\??\c:\fxlfllr.exec:\fxlfllr.exe120⤵PID:1688
-
\??\c:\7rflrfl.exec:\7rflrfl.exe121⤵PID:1012
-
\??\c:\hhttth.exec:\hhttth.exe122⤵PID:2960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-