Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 12:03
Static task
static1
Behavioral task
behavioral1
Sample
e504885c56c6ba6a298092c1d058a594960b96133bef4cc8599640679ccf95d1N.exe
Resource
win7-20240903-en
General
-
Target
e504885c56c6ba6a298092c1d058a594960b96133bef4cc8599640679ccf95d1N.exe
-
Size
83KB
-
MD5
cd2fde1720a881eba4eb87e33be52a30
-
SHA1
3304e72b8218b518a3dbf3550ba307da0bb536a6
-
SHA256
e504885c56c6ba6a298092c1d058a594960b96133bef4cc8599640679ccf95d1
-
SHA512
e15c589ab1a88c0b5e8406578bcc168065859c5043d5eb5a4a4e7ab15cd76f5c6d81391002249f7bb8a419cb45da76f9713227b84a5f7edc55ead7942bbebfb1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Qz:ymb3NkkiQ3mdBjFIIp9L9QrrA8C
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2356-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1068-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/376-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2072 ffrxxfr.exe 2992 nhbthh.exe 1788 btbnnh.exe 2032 jjpvd.exe 2796 5ffxxrr.exe 2844 1thnnn.exe 2852 dvdvp.exe 2736 rxxlxrr.exe 2608 thbbtt.exe 3028 tbtttt.exe 1068 jjppp.exe 1976 jdpdp.exe 376 rlflxfr.exe 1940 nbbtbt.exe 1980 dvjpd.exe 2892 7jpjj.exe 3048 xlfxrrf.exe 2804 3ffflrx.exe 2392 nntbbb.exe 2224 jdjvp.exe 1584 vpjvd.exe 2976 lxflrrr.exe 1780 lfxlrrx.exe 1628 5ththh.exe 1316 hnhhnn.exe 744 dppdv.exe 2292 lrllxxl.exe 2120 rlffrrf.exe 2376 tnhnnn.exe 2520 3vddv.exe 3012 jvjjp.exe 2992 5xfrxrf.exe 1788 thttbb.exe 2668 7thhht.exe 2960 7htntn.exe 2800 jdpvj.exe 2688 9lxfllx.exe 2820 lrxrlfr.exe 2852 xllllrx.exe 3056 bthnhn.exe 2648 5jddp.exe 2848 9dvpj.exe 1028 frlrrrx.exe 868 rlxlflr.exe 2816 thtthb.exe 1644 htnnbb.exe 1948 bthhtn.exe 2812 jvddd.exe 1220 pdppp.exe 1312 1lxfllr.exe 3044 rlrxllr.exe 2924 1bnttt.exe 2372 tnthnn.exe 2256 jvpvv.exe 2264 pjjjp.exe 2224 1lxxflr.exe 2616 xlrxflf.exe 448 bnbnbt.exe 1804 tnbbbh.exe 1628 vpjdp.exe 1304 dvpvp.exe 760 fflrxfl.exe 2296 rxxrffl.exe 792 tnbhtt.exe -
resource yara_rule behavioral1/memory/2356-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1068-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/376-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2072 2356 e504885c56c6ba6a298092c1d058a594960b96133bef4cc8599640679ccf95d1N.exe 30 PID 2356 wrote to memory of 2072 2356 e504885c56c6ba6a298092c1d058a594960b96133bef4cc8599640679ccf95d1N.exe 30 PID 2356 wrote to memory of 2072 2356 e504885c56c6ba6a298092c1d058a594960b96133bef4cc8599640679ccf95d1N.exe 30 PID 2356 wrote to memory of 2072 2356 e504885c56c6ba6a298092c1d058a594960b96133bef4cc8599640679ccf95d1N.exe 30 PID 2072 wrote to memory of 2992 2072 ffrxxfr.exe 31 PID 2072 wrote to memory of 2992 2072 ffrxxfr.exe 31 PID 2072 wrote to memory of 2992 2072 ffrxxfr.exe 31 PID 2072 wrote to memory of 2992 2072 ffrxxfr.exe 31 PID 2992 wrote to memory of 1788 2992 nhbthh.exe 32 PID 2992 wrote to memory of 1788 2992 nhbthh.exe 32 PID 2992 wrote to memory of 1788 2992 nhbthh.exe 32 PID 2992 wrote to memory of 1788 2992 nhbthh.exe 32 PID 1788 wrote to memory of 2032 1788 btbnnh.exe 33 PID 1788 wrote to memory of 2032 1788 btbnnh.exe 33 PID 1788 wrote to memory of 2032 1788 btbnnh.exe 33 PID 1788 wrote to memory of 2032 1788 btbnnh.exe 33 PID 2032 wrote to memory of 2796 2032 jjpvd.exe 34 PID 2032 wrote to memory of 2796 2032 jjpvd.exe 34 PID 2032 wrote to memory of 2796 2032 jjpvd.exe 34 PID 2032 wrote to memory of 2796 2032 jjpvd.exe 34 PID 2796 wrote to memory of 2844 2796 5ffxxrr.exe 35 PID 2796 wrote to memory of 2844 2796 5ffxxrr.exe 35 PID 2796 wrote to memory of 2844 2796 5ffxxrr.exe 35 PID 2796 wrote to memory of 2844 2796 5ffxxrr.exe 35 PID 2844 wrote to memory of 2852 2844 1thnnn.exe 36 PID 2844 wrote to memory of 2852 2844 1thnnn.exe 36 PID 2844 wrote to memory of 2852 2844 1thnnn.exe 36 PID 2844 wrote to memory of 2852 2844 1thnnn.exe 36 PID 2852 wrote to memory of 2736 2852 dvdvp.exe 37 PID 2852 wrote to memory of 2736 2852 dvdvp.exe 37 PID 2852 wrote to memory of 2736 2852 dvdvp.exe 37 PID 2852 wrote to memory of 2736 2852 dvdvp.exe 37 PID 2736 wrote to memory of 2608 2736 rxxlxrr.exe 38 PID 2736 wrote to memory of 2608 2736 rxxlxrr.exe 38 PID 2736 wrote to memory of 2608 2736 rxxlxrr.exe 38 PID 2736 wrote to memory of 2608 2736 rxxlxrr.exe 38 PID 2608 wrote to memory of 3028 2608 thbbtt.exe 39 PID 2608 wrote to memory of 3028 2608 thbbtt.exe 39 PID 2608 wrote to memory of 3028 2608 thbbtt.exe 39 PID 2608 wrote to memory of 3028 2608 thbbtt.exe 39 PID 3028 wrote to memory of 1068 3028 tbtttt.exe 40 PID 3028 wrote to memory of 1068 3028 tbtttt.exe 40 PID 3028 wrote to memory of 1068 3028 tbtttt.exe 40 PID 3028 wrote to memory of 1068 3028 tbtttt.exe 40 PID 1068 wrote to memory of 1976 1068 jjppp.exe 41 PID 1068 wrote to memory of 1976 1068 jjppp.exe 41 PID 1068 wrote to memory of 1976 1068 jjppp.exe 41 PID 1068 wrote to memory of 1976 1068 jjppp.exe 41 PID 1976 wrote to memory of 376 1976 jdpdp.exe 42 PID 1976 wrote to memory of 376 1976 jdpdp.exe 42 PID 1976 wrote to memory of 376 1976 jdpdp.exe 42 PID 1976 wrote to memory of 376 1976 jdpdp.exe 42 PID 376 wrote to memory of 1940 376 rlflxfr.exe 43 PID 376 wrote to memory of 1940 376 rlflxfr.exe 43 PID 376 wrote to memory of 1940 376 rlflxfr.exe 43 PID 376 wrote to memory of 1940 376 rlflxfr.exe 43 PID 1940 wrote to memory of 1980 1940 nbbtbt.exe 44 PID 1940 wrote to memory of 1980 1940 nbbtbt.exe 44 PID 1940 wrote to memory of 1980 1940 nbbtbt.exe 44 PID 1940 wrote to memory of 1980 1940 nbbtbt.exe 44 PID 1980 wrote to memory of 2892 1980 dvjpd.exe 45 PID 1980 wrote to memory of 2892 1980 dvjpd.exe 45 PID 1980 wrote to memory of 2892 1980 dvjpd.exe 45 PID 1980 wrote to memory of 2892 1980 dvjpd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e504885c56c6ba6a298092c1d058a594960b96133bef4cc8599640679ccf95d1N.exe"C:\Users\Admin\AppData\Local\Temp\e504885c56c6ba6a298092c1d058a594960b96133bef4cc8599640679ccf95d1N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\ffrxxfr.exec:\ffrxxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\nhbthh.exec:\nhbthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\btbnnh.exec:\btbnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\jjpvd.exec:\jjpvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\5ffxxrr.exec:\5ffxxrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\1thnnn.exec:\1thnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\dvdvp.exec:\dvdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\rxxlxrr.exec:\rxxlxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\thbbtt.exec:\thbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\tbtttt.exec:\tbtttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\jjppp.exec:\jjppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\jdpdp.exec:\jdpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\rlflxfr.exec:\rlflxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\nbbtbt.exec:\nbbtbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\dvjpd.exec:\dvjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\7jpjj.exec:\7jpjj.exe17⤵
- Executes dropped EXE
PID:2892 -
\??\c:\xlfxrrf.exec:\xlfxrrf.exe18⤵
- Executes dropped EXE
PID:3048 -
\??\c:\3ffflrx.exec:\3ffflrx.exe19⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nntbbb.exec:\nntbbb.exe20⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jdjvp.exec:\jdjvp.exe21⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vpjvd.exec:\vpjvd.exe22⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lxflrrr.exec:\lxflrrr.exe23⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lfxlrrx.exec:\lfxlrrx.exe24⤵
- Executes dropped EXE
PID:1780 -
\??\c:\5ththh.exec:\5ththh.exe25⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hnhhnn.exec:\hnhhnn.exe26⤵
- Executes dropped EXE
PID:1316 -
\??\c:\dppdv.exec:\dppdv.exe27⤵
- Executes dropped EXE
PID:744 -
\??\c:\lrllxxl.exec:\lrllxxl.exe28⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rlffrrf.exec:\rlffrrf.exe29⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tnhnnn.exec:\tnhnnn.exe30⤵
- Executes dropped EXE
PID:2376 -
\??\c:\3vddv.exec:\3vddv.exe31⤵
- Executes dropped EXE
PID:2520 -
\??\c:\jvjjp.exec:\jvjjp.exe32⤵
- Executes dropped EXE
PID:3012 -
\??\c:\5xfrxrf.exec:\5xfrxrf.exe33⤵
- Executes dropped EXE
PID:2992 -
\??\c:\thttbb.exec:\thttbb.exe34⤵
- Executes dropped EXE
PID:1788 -
\??\c:\7thhht.exec:\7thhht.exe35⤵
- Executes dropped EXE
PID:2668 -
\??\c:\7htntn.exec:\7htntn.exe36⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jdpvj.exec:\jdpvj.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\9lxfllx.exec:\9lxfllx.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lrxrlfr.exec:\lrxrlfr.exe39⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xllllrx.exec:\xllllrx.exe40⤵
- Executes dropped EXE
PID:2852 -
\??\c:\bthnhn.exec:\bthnhn.exe41⤵
- Executes dropped EXE
PID:3056 -
\??\c:\5jddp.exec:\5jddp.exe42⤵
- Executes dropped EXE
PID:2648 -
\??\c:\9dvpj.exec:\9dvpj.exe43⤵
- Executes dropped EXE
PID:2848 -
\??\c:\frlrrrx.exec:\frlrrrx.exe44⤵
- Executes dropped EXE
PID:1028 -
\??\c:\rlxlflr.exec:\rlxlflr.exe45⤵
- Executes dropped EXE
PID:868 -
\??\c:\thtthb.exec:\thtthb.exe46⤵
- Executes dropped EXE
PID:2816 -
\??\c:\htnnbb.exec:\htnnbb.exe47⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bthhtn.exec:\bthhtn.exe48⤵
- Executes dropped EXE
PID:1948 -
\??\c:\jvddd.exec:\jvddd.exe49⤵
- Executes dropped EXE
PID:2812 -
\??\c:\pdppp.exec:\pdppp.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1220 -
\??\c:\1lxfllr.exec:\1lxfllr.exe51⤵
- Executes dropped EXE
PID:1312 -
\??\c:\rlrxllr.exec:\rlrxllr.exe52⤵
- Executes dropped EXE
PID:3044 -
\??\c:\1bnttt.exec:\1bnttt.exe53⤵
- Executes dropped EXE
PID:2924 -
\??\c:\tnthnn.exec:\tnthnn.exe54⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jvpvv.exec:\jvpvv.exe55⤵
- Executes dropped EXE
PID:2256 -
\??\c:\pjjjp.exec:\pjjjp.exe56⤵
- Executes dropped EXE
PID:2264 -
\??\c:\1lxxflr.exec:\1lxxflr.exe57⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xlrxflf.exec:\xlrxflf.exe58⤵
- Executes dropped EXE
PID:2616 -
\??\c:\bnbnbt.exec:\bnbnbt.exe59⤵
- Executes dropped EXE
PID:448 -
\??\c:\tnbbbh.exec:\tnbbbh.exe60⤵
- Executes dropped EXE
PID:1804 -
\??\c:\vpjdp.exec:\vpjdp.exe61⤵
- Executes dropped EXE
PID:1628 -
\??\c:\dvpvp.exec:\dvpvp.exe62⤵
- Executes dropped EXE
PID:1304 -
\??\c:\fflrxfl.exec:\fflrxfl.exe63⤵
- Executes dropped EXE
PID:760 -
\??\c:\rxxrffl.exec:\rxxrffl.exe64⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tnbhtt.exec:\tnbhtt.exe65⤵
- Executes dropped EXE
PID:792 -
\??\c:\dvjjd.exec:\dvjjd.exe66⤵PID:592
-
\??\c:\jdjjp.exec:\jdjjp.exe67⤵PID:2156
-
\??\c:\xrlxxfl.exec:\xrlxxfl.exe68⤵PID:1524
-
\??\c:\1rllllf.exec:\1rllllf.exe69⤵PID:2760
-
\??\c:\rfrxfff.exec:\rfrxfff.exe70⤵PID:2016
-
\??\c:\hbnntt.exec:\hbnntt.exe71⤵PID:2152
-
\??\c:\httntt.exec:\httntt.exe72⤵PID:2700
-
\??\c:\ppdjp.exec:\ppdjp.exe73⤵PID:2144
-
\??\c:\vpjjj.exec:\vpjjj.exe74⤵PID:2856
-
\??\c:\fxlxflf.exec:\fxlxflf.exe75⤵PID:2716
-
\??\c:\rfllxxf.exec:\rfllxxf.exe76⤵PID:2696
-
\??\c:\9dddp.exec:\9dddp.exe77⤵PID:2844
-
\??\c:\rflrrlf.exec:\rflrrlf.exe78⤵PID:2852
-
\??\c:\fxxffxx.exec:\fxxffxx.exe79⤵PID:2792
-
\??\c:\htbbht.exec:\htbbht.exe80⤵PID:2648
-
\??\c:\hhhtbb.exec:\hhhtbb.exe81⤵PID:580
-
\??\c:\3vjpp.exec:\3vjpp.exe82⤵PID:1028
-
\??\c:\vvpvp.exec:\vvpvp.exe83⤵PID:2456
-
\??\c:\xlrxfxl.exec:\xlrxfxl.exe84⤵PID:2816
-
\??\c:\lllrrff.exec:\lllrrff.exe85⤵
- System Location Discovery: System Language Discovery
PID:888 -
\??\c:\bnbnth.exec:\bnbnth.exe86⤵PID:1948
-
\??\c:\btbbhh.exec:\btbbhh.exe87⤵PID:2316
-
\??\c:\9jjjj.exec:\9jjjj.exe88⤵PID:1220
-
\??\c:\dvddd.exec:\dvddd.exe89⤵PID:2900
-
\??\c:\ppvvj.exec:\ppvvj.exe90⤵PID:3044
-
\??\c:\frfllrf.exec:\frfllrf.exe91⤵PID:2252
-
\??\c:\9rxrlll.exec:\9rxrlll.exe92⤵PID:2372
-
\??\c:\bnhhbb.exec:\bnhhbb.exe93⤵PID:2256
-
\??\c:\nhtbnn.exec:\nhtbnn.exe94⤵PID:2264
-
\??\c:\1pdjv.exec:\1pdjv.exe95⤵PID:1824
-
\??\c:\dvdvd.exec:\dvdvd.exe96⤵PID:1996
-
\??\c:\rrlfllx.exec:\rrlfllx.exe97⤵PID:1504
-
\??\c:\9xlrxff.exec:\9xlrxff.exe98⤵PID:956
-
\??\c:\bbnhnn.exec:\bbnhnn.exe99⤵PID:1628
-
\??\c:\hbbbhh.exec:\hbbbhh.exe100⤵PID:1316
-
\??\c:\jvvdp.exec:\jvvdp.exe101⤵PID:760
-
\??\c:\ppvjp.exec:\ppvjp.exe102⤵PID:2136
-
\??\c:\xlfllfr.exec:\xlfllfr.exe103⤵PID:1612
-
\??\c:\lxlrfll.exec:\lxlrfll.exe104⤵PID:592
-
\??\c:\llxfxxx.exec:\llxfxxx.exe105⤵PID:2156
-
\??\c:\1bbbnh.exec:\1bbbnh.exe106⤵PID:1984
-
\??\c:\9ntbbb.exec:\9ntbbb.exe107⤵PID:1060
-
\??\c:\hbntbt.exec:\hbntbt.exe108⤵PID:2380
-
\??\c:\9vvvv.exec:\9vvvv.exe109⤵PID:2152
-
\??\c:\vpdjp.exec:\vpdjp.exe110⤵PID:2548
-
\??\c:\7rxxxfr.exec:\7rxxxfr.exe111⤵PID:2720
-
\??\c:\fxfrflx.exec:\fxfrflx.exe112⤵PID:2676
-
\??\c:\7nhhtt.exec:\7nhhtt.exe113⤵PID:2948
-
\??\c:\dvpvj.exec:\dvpvj.exe114⤵PID:2688
-
\??\c:\3jvjd.exec:\3jvjd.exe115⤵PID:2820
-
\??\c:\7rllrrr.exec:\7rllrrr.exe116⤵PID:2580
-
\??\c:\xlfrlfl.exec:\xlfrlfl.exe117⤵
- System Location Discovery: System Language Discovery
PID:3056 -
\??\c:\tttbtt.exec:\tttbtt.exe118⤵PID:2628
-
\??\c:\bnhnbb.exec:\bnhnbb.exe119⤵PID:2848
-
\??\c:\tnnbhb.exec:\tnnbhb.exe120⤵PID:1640
-
\??\c:\7jvdv.exec:\7jvdv.exe121⤵PID:2456
-
\??\c:\jdvjd.exec:\jdvjd.exe122⤵PID:2636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-