Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 02:01
Static task
static1
Behavioral task
behavioral1
Sample
110fd24f8b5be837137b074536d0f9b7c0dcf6b6f2ca1eb996bfbc1bbb1a09dcN.exe
Resource
win7-20240903-en
General
-
Target
110fd24f8b5be837137b074536d0f9b7c0dcf6b6f2ca1eb996bfbc1bbb1a09dcN.exe
-
Size
83KB
-
MD5
d1d3e9489add38205e2bb5a88cdc7d00
-
SHA1
cd4b6082f7330245c821ea876beeca3891aa488f
-
SHA256
110fd24f8b5be837137b074536d0f9b7c0dcf6b6f2ca1eb996bfbc1bbb1a09dc
-
SHA512
c0fdafa7447b52a17575c0c10a9a6cd3088b498ec7b59f1413ed76b79729b5249bb30d68a72e5b8cbf9b73efaf4b692db2721cad90df301e4d5a41f173b9291a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QD:ymb3NkkiQ3mdBjFIIp9L9QrrA8k
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2436-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/600-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/780-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2284 9pjpj.exe 2792 xlxxfff.exe 2288 nhnbnh.exe 2912 dvjjp.exe 2732 lfrxxxl.exe 2636 nhnntt.exe 1908 3pddd.exe 1628 fxrfflr.exe 2884 1rllrfl.exe 2904 hbtbnt.exe 600 3pjjp.exe 1904 xrflxxl.exe 1060 1xlrfrr.exe 780 btbntt.exe 1668 nbhhnh.exe 2040 jdppp.exe 1692 rlfxxfr.exe 2440 3lxflll.exe 2996 bbnbtt.exe 3036 jjjvj.exe 416 9vjpp.exe 1196 5frrflr.exe 1552 xlrrxff.exe 1460 1bttbh.exe 972 jvpjj.exe 1700 pjppj.exe 2032 llrrxxx.exe 1960 nhtthb.exe 1940 nbhhhn.exe 2712 pjppv.exe 2668 rflllff.exe 1544 lfxfrrl.exe 2724 1nbhtt.exe 2588 vvpdj.exe 2728 pjjjj.exe 2560 rflrfrx.exe 1860 rffrxrx.exe 2276 bbbhnn.exe 1684 bnbhnh.exe 1876 7vjpv.exe 2920 dvjjp.exe 2908 lxrrffr.exe 1420 xrxxxrr.exe 2320 btbhnh.exe 1556 tntttn.exe 764 5dddj.exe 2008 vpvdp.exe 1028 xrrrffr.exe 1936 lfrxxxf.exe 320 3xrflrr.exe 2192 htbbnn.exe 3020 nbhhnh.exe 2380 vpvvd.exe 844 vjpvp.exe 2168 xxllxxl.exe 2400 lxxflrl.exe 996 5hnnnb.exe 1196 thbbhn.exe 1052 5jvvd.exe 1648 jdvvj.exe 920 rlrfxrl.exe 2500 3xrxllr.exe 1928 thtntt.exe 2024 bntthh.exe -
resource yara_rule behavioral1/memory/2436-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/600-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/780-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2284 2436 110fd24f8b5be837137b074536d0f9b7c0dcf6b6f2ca1eb996bfbc1bbb1a09dcN.exe 31 PID 2436 wrote to memory of 2284 2436 110fd24f8b5be837137b074536d0f9b7c0dcf6b6f2ca1eb996bfbc1bbb1a09dcN.exe 31 PID 2436 wrote to memory of 2284 2436 110fd24f8b5be837137b074536d0f9b7c0dcf6b6f2ca1eb996bfbc1bbb1a09dcN.exe 31 PID 2436 wrote to memory of 2284 2436 110fd24f8b5be837137b074536d0f9b7c0dcf6b6f2ca1eb996bfbc1bbb1a09dcN.exe 31 PID 2284 wrote to memory of 2792 2284 9pjpj.exe 32 PID 2284 wrote to memory of 2792 2284 9pjpj.exe 32 PID 2284 wrote to memory of 2792 2284 9pjpj.exe 32 PID 2284 wrote to memory of 2792 2284 9pjpj.exe 32 PID 2792 wrote to memory of 2288 2792 xlxxfff.exe 33 PID 2792 wrote to memory of 2288 2792 xlxxfff.exe 33 PID 2792 wrote to memory of 2288 2792 xlxxfff.exe 33 PID 2792 wrote to memory of 2288 2792 xlxxfff.exe 33 PID 2288 wrote to memory of 2912 2288 nhnbnh.exe 34 PID 2288 wrote to memory of 2912 2288 nhnbnh.exe 34 PID 2288 wrote to memory of 2912 2288 nhnbnh.exe 34 PID 2288 wrote to memory of 2912 2288 nhnbnh.exe 34 PID 2912 wrote to memory of 2732 2912 dvjjp.exe 35 PID 2912 wrote to memory of 2732 2912 dvjjp.exe 35 PID 2912 wrote to memory of 2732 2912 dvjjp.exe 35 PID 2912 wrote to memory of 2732 2912 dvjjp.exe 35 PID 2732 wrote to memory of 2636 2732 lfrxxxl.exe 36 PID 2732 wrote to memory of 2636 2732 lfrxxxl.exe 36 PID 2732 wrote to memory of 2636 2732 lfrxxxl.exe 36 PID 2732 wrote to memory of 2636 2732 lfrxxxl.exe 36 PID 2636 wrote to memory of 1908 2636 nhnntt.exe 37 PID 2636 wrote to memory of 1908 2636 nhnntt.exe 37 PID 2636 wrote to memory of 1908 2636 nhnntt.exe 37 PID 2636 wrote to memory of 1908 2636 nhnntt.exe 37 PID 1908 wrote to memory of 1628 1908 3pddd.exe 38 PID 1908 wrote to memory of 1628 1908 3pddd.exe 38 PID 1908 wrote to memory of 1628 1908 3pddd.exe 38 PID 1908 wrote to memory of 1628 1908 3pddd.exe 38 PID 1628 wrote to memory of 2884 1628 fxrfflr.exe 39 PID 1628 wrote to memory of 2884 1628 fxrfflr.exe 39 PID 1628 wrote to memory of 2884 1628 fxrfflr.exe 39 PID 1628 wrote to memory of 2884 1628 fxrfflr.exe 39 PID 2884 wrote to memory of 2904 2884 1rllrfl.exe 40 PID 2884 wrote to memory of 2904 2884 1rllrfl.exe 40 PID 2884 wrote to memory of 2904 2884 1rllrfl.exe 40 PID 2884 wrote to memory of 2904 2884 1rllrfl.exe 40 PID 2904 wrote to memory of 600 2904 hbtbnt.exe 41 PID 2904 wrote to memory of 600 2904 hbtbnt.exe 41 PID 2904 wrote to memory of 600 2904 hbtbnt.exe 41 PID 2904 wrote to memory of 600 2904 hbtbnt.exe 41 PID 600 wrote to memory of 1904 600 3pjjp.exe 42 PID 600 wrote to memory of 1904 600 3pjjp.exe 42 PID 600 wrote to memory of 1904 600 3pjjp.exe 42 PID 600 wrote to memory of 1904 600 3pjjp.exe 42 PID 1904 wrote to memory of 1060 1904 xrflxxl.exe 43 PID 1904 wrote to memory of 1060 1904 xrflxxl.exe 43 PID 1904 wrote to memory of 1060 1904 xrflxxl.exe 43 PID 1904 wrote to memory of 1060 1904 xrflxxl.exe 43 PID 1060 wrote to memory of 780 1060 1xlrfrr.exe 44 PID 1060 wrote to memory of 780 1060 1xlrfrr.exe 44 PID 1060 wrote to memory of 780 1060 1xlrfrr.exe 44 PID 1060 wrote to memory of 780 1060 1xlrfrr.exe 44 PID 780 wrote to memory of 1668 780 btbntt.exe 45 PID 780 wrote to memory of 1668 780 btbntt.exe 45 PID 780 wrote to memory of 1668 780 btbntt.exe 45 PID 780 wrote to memory of 1668 780 btbntt.exe 45 PID 1668 wrote to memory of 2040 1668 nbhhnh.exe 46 PID 1668 wrote to memory of 2040 1668 nbhhnh.exe 46 PID 1668 wrote to memory of 2040 1668 nbhhnh.exe 46 PID 1668 wrote to memory of 2040 1668 nbhhnh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\110fd24f8b5be837137b074536d0f9b7c0dcf6b6f2ca1eb996bfbc1bbb1a09dcN.exe"C:\Users\Admin\AppData\Local\Temp\110fd24f8b5be837137b074536d0f9b7c0dcf6b6f2ca1eb996bfbc1bbb1a09dcN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\9pjpj.exec:\9pjpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\xlxxfff.exec:\xlxxfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\nhnbnh.exec:\nhnbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\dvjjp.exec:\dvjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\lfrxxxl.exec:\lfrxxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nhnntt.exec:\nhnntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\3pddd.exec:\3pddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\fxrfflr.exec:\fxrfflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\1rllrfl.exec:\1rllrfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\hbtbnt.exec:\hbtbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\3pjjp.exec:\3pjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\xrflxxl.exec:\xrflxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\1xlrfrr.exec:\1xlrfrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\btbntt.exec:\btbntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\nbhhnh.exec:\nbhhnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\jdppp.exec:\jdppp.exe17⤵
- Executes dropped EXE
PID:2040 -
\??\c:\rlfxxfr.exec:\rlfxxfr.exe18⤵
- Executes dropped EXE
PID:1692 -
\??\c:\3lxflll.exec:\3lxflll.exe19⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bbnbtt.exec:\bbnbtt.exe20⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jjjvj.exec:\jjjvj.exe21⤵
- Executes dropped EXE
PID:3036 -
\??\c:\9vjpp.exec:\9vjpp.exe22⤵
- Executes dropped EXE
PID:416 -
\??\c:\5frrflr.exec:\5frrflr.exe23⤵
- Executes dropped EXE
PID:1196 -
\??\c:\xlrrxff.exec:\xlrrxff.exe24⤵
- Executes dropped EXE
PID:1552 -
\??\c:\1bttbh.exec:\1bttbh.exe25⤵
- Executes dropped EXE
PID:1460 -
\??\c:\jvpjj.exec:\jvpjj.exe26⤵
- Executes dropped EXE
PID:972 -
\??\c:\pjppj.exec:\pjppj.exe27⤵
- Executes dropped EXE
PID:1700 -
\??\c:\llrrxxx.exec:\llrrxxx.exe28⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nhtthb.exec:\nhtthb.exe29⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nbhhhn.exec:\nbhhhn.exe30⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pjppv.exec:\pjppv.exe31⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rflllff.exec:\rflllff.exe32⤵
- Executes dropped EXE
PID:2668 -
\??\c:\lfxfrrl.exec:\lfxfrrl.exe33⤵
- Executes dropped EXE
PID:1544 -
\??\c:\1nbhtt.exec:\1nbhtt.exe34⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vvpdj.exec:\vvpdj.exe35⤵
- Executes dropped EXE
PID:2588 -
\??\c:\pjjjj.exec:\pjjjj.exe36⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rflrfrx.exec:\rflrfrx.exe37⤵
- Executes dropped EXE
PID:2560 -
\??\c:\rffrxrx.exec:\rffrxrx.exe38⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bbbhnn.exec:\bbbhnn.exe39⤵
- Executes dropped EXE
PID:2276 -
\??\c:\bnbhnh.exec:\bnbhnh.exe40⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7vjpv.exec:\7vjpv.exe41⤵
- Executes dropped EXE
PID:1876 -
\??\c:\dvjjp.exec:\dvjjp.exe42⤵
- Executes dropped EXE
PID:2920 -
\??\c:\lxrrffr.exec:\lxrrffr.exe43⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xrxxxrr.exec:\xrxxxrr.exe44⤵
- Executes dropped EXE
PID:1420 -
\??\c:\btbhnh.exec:\btbhnh.exe45⤵
- Executes dropped EXE
PID:2320 -
\??\c:\tntttn.exec:\tntttn.exe46⤵
- Executes dropped EXE
PID:1556 -
\??\c:\5dddj.exec:\5dddj.exe47⤵
- Executes dropped EXE
PID:764 -
\??\c:\vpvdp.exec:\vpvdp.exe48⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xrrrffr.exec:\xrrrffr.exe49⤵
- Executes dropped EXE
PID:1028 -
\??\c:\lfrxxxf.exec:\lfrxxxf.exe50⤵
- Executes dropped EXE
PID:1936 -
\??\c:\3xrflrr.exec:\3xrflrr.exe51⤵
- Executes dropped EXE
PID:320 -
\??\c:\htbbnn.exec:\htbbnn.exe52⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nbhhnh.exec:\nbhhnh.exe53⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vpvvd.exec:\vpvvd.exe54⤵
- Executes dropped EXE
PID:2380 -
\??\c:\vjpvp.exec:\vjpvp.exe55⤵
- Executes dropped EXE
PID:844 -
\??\c:\xxllxxl.exec:\xxllxxl.exe56⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lxxflrl.exec:\lxxflrl.exe57⤵
- Executes dropped EXE
PID:2400 -
\??\c:\5hnnnb.exec:\5hnnnb.exe58⤵
- Executes dropped EXE
PID:996 -
\??\c:\thbbhn.exec:\thbbhn.exe59⤵
- Executes dropped EXE
PID:1196 -
\??\c:\5jvvd.exec:\5jvvd.exe60⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jdvvj.exec:\jdvvj.exe61⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rlrfxrl.exec:\rlrfxrl.exe62⤵
- Executes dropped EXE
PID:920 -
\??\c:\3xrxllr.exec:\3xrxllr.exe63⤵
- Executes dropped EXE
PID:2500 -
\??\c:\thtntt.exec:\thtntt.exe64⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bntthh.exec:\bntthh.exe65⤵
- Executes dropped EXE
PID:2024 -
\??\c:\pjdjp.exec:\pjdjp.exe66⤵PID:2656
-
\??\c:\dpdvv.exec:\dpdvv.exe67⤵PID:2176
-
\??\c:\9rxxfxf.exec:\9rxxfxf.exe68⤵PID:1940
-
\??\c:\5lffrrf.exec:\5lffrrf.exe69⤵PID:2064
-
\??\c:\5bttbn.exec:\5bttbn.exe70⤵PID:1532
-
\??\c:\nbhbbt.exec:\nbhbbt.exe71⤵PID:2688
-
\??\c:\vpddd.exec:\vpddd.exe72⤵PID:1544
-
\??\c:\jjjdd.exec:\jjjdd.exe73⤵PID:2700
-
\??\c:\fxrlrrx.exec:\fxrlrrx.exe74⤵PID:2620
-
\??\c:\1fllrlx.exec:\1fllrlx.exe75⤵PID:2616
-
\??\c:\9tnthn.exec:\9tnthn.exe76⤵PID:2612
-
\??\c:\1bttbh.exec:\1bttbh.exe77⤵PID:1120
-
\??\c:\dvppv.exec:\dvppv.exe78⤵PID:1756
-
\??\c:\5dppp.exec:\5dppp.exe79⤵PID:2740
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe80⤵PID:2868
-
\??\c:\xrfflrx.exec:\xrfflrx.exe81⤵PID:1220
-
\??\c:\tttthh.exec:\tttthh.exe82⤵PID:1056
-
\??\c:\tnbnnn.exec:\tnbnnn.exe83⤵PID:2304
-
\??\c:\5djpp.exec:\5djpp.exe84⤵PID:680
-
\??\c:\vpddp.exec:\vpddp.exe85⤵PID:668
-
\??\c:\vpdvv.exec:\vpdvv.exe86⤵PID:2624
-
\??\c:\xrlrrxf.exec:\xrlrrxf.exe87⤵PID:1632
-
\??\c:\fxlxflf.exec:\fxlxflf.exe88⤵PID:2888
-
\??\c:\7bthnn.exec:\7bthnn.exe89⤵PID:1500
-
\??\c:\nhtnnn.exec:\nhtnnn.exe90⤵PID:1832
-
\??\c:\jvjdj.exec:\jvjdj.exe91⤵PID:1692
-
\??\c:\ppvvv.exec:\ppvvv.exe92⤵PID:2544
-
\??\c:\frflfxl.exec:\frflfxl.exe93⤵PID:1280
-
\??\c:\7xrlrrx.exec:\7xrlrrx.exe94⤵PID:2420
-
\??\c:\xlxxrrx.exec:\xlxxrrx.exe95⤵PID:2080
-
\??\c:\1thnbb.exec:\1thnbb.exe96⤵PID:804
-
\??\c:\btbbbt.exec:\btbbbt.exe97⤵PID:2372
-
\??\c:\ppjvv.exec:\ppjvv.exe98⤵PID:1804
-
\??\c:\jdppv.exec:\jdppv.exe99⤵PID:1688
-
\??\c:\rlfxlfr.exec:\rlfxlfr.exe100⤵PID:1240
-
\??\c:\lflxrff.exec:\lflxrff.exe101⤵PID:1660
-
\??\c:\hbtnnn.exec:\hbtnnn.exe102⤵PID:2020
-
\??\c:\btnthh.exec:\btnthh.exe103⤵
- System Location Discovery: System Language Discovery
PID:892 -
\??\c:\vjppp.exec:\vjppp.exe104⤵PID:2004
-
\??\c:\vvdpj.exec:\vvdpj.exe105⤵PID:2764
-
\??\c:\5frrrfl.exec:\5frrrfl.exe106⤵PID:2760
-
\??\c:\7fxllrx.exec:\7fxllrx.exe107⤵PID:2816
-
\??\c:\1hbtnn.exec:\1hbtnn.exe108⤵PID:2668
-
\??\c:\tthttt.exec:\tthttt.exe109⤵PID:2796
-
\??\c:\thtbnn.exec:\thtbnn.exe110⤵PID:2820
-
\??\c:\dvvjp.exec:\dvvjp.exe111⤵PID:1544
-
\??\c:\5pdpv.exec:\5pdpv.exe112⤵PID:2568
-
\??\c:\rlxlxxr.exec:\rlxlxxr.exe113⤵PID:2576
-
\??\c:\xrlxxfx.exec:\xrlxxfx.exe114⤵PID:3060
-
\??\c:\9htttt.exec:\9htttt.exe115⤵PID:2012
-
\??\c:\jvpjd.exec:\jvpjd.exe116⤵PID:2848
-
\??\c:\jvjpv.exec:\jvjpv.exe117⤵PID:2880
-
\??\c:\7vppv.exec:\7vppv.exe118⤵PID:1892
-
\??\c:\1lffxxl.exec:\1lffxxl.exe119⤵PID:2892
-
\??\c:\rlrrflr.exec:\rlrrflr.exe120⤵PID:1796
-
\??\c:\bnbbht.exec:\bnbbht.exe121⤵PID:2312
-
\??\c:\1hnbth.exec:\1hnbth.exe122⤵PID:476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-