Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 13:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430.exe
-
Size
79KB
-
MD5
5ca31353af0df933ff43e4068224be68
-
SHA1
67a4c51abfa77f0d9809d5ceaa4f0f96ef707b6a
-
SHA256
b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430
-
SHA512
2c7ff61d758c305cfac5a664f6786a7cca5423704b538bc463ff7ff2009ba01f31dedc1b782c470f3e4d9999c1266201d2faf0e71aa59b420b67cd2f6e0ff2f3
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5bx7DUQeDac7AkE:0cdpeeBSHHMHLf9Rybx7DYec7FE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/3048-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-34-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2796-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-92-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2676-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-128-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/1340-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-148-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1764-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-186-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2940-184-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1016-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/544-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-260-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2272-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/776-318-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2752-337-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/1824-401-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/600-413-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1820-440-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-447-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/644-491-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/1356-504-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-511-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/644-518-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/812-586-0x0000000001B50000-0x0000000001B79000-memory.dmp family_blackmoon behavioral1/memory/2148-701-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-715-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/2092-878-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2676-953-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1640-1008-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1156-1076-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1280-1132-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1660-1210-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2064-1284-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2312 rlrrrlr.exe 2540 tnnhnh.exe 2796 pjvvd.exe 2748 frlfrrx.exe 2908 fxxxfll.exe 2852 vjvjp.exe 2724 1jddv.exe 2952 fxfxllr.exe 2604 nnbhnh.exe 1684 nhbhtb.exe 1340 1vddd.exe 1020 vpdvp.exe 2676 xrrrrxf.exe 588 3frrxxr.exe 2036 5htttt.exe 2808 7pjjv.exe 2000 ppppv.exe 1764 fxrrxxf.exe 2940 9hbbhb.exe 2064 vvpjd.exe 2152 ddddd.exe 1016 5vvpv.exe 3016 rlxfffr.exe 544 5frlxxf.exe 2184 3hbbhb.exe 1828 nnhhnn.exe 2688 5tbhhn.exe 564 9xllxff.exe 392 hhntth.exe 848 tnnhhh.exe 2272 5dpdd.exe 1076 lfrrffl.exe 2520 llflxrx.exe 776 ntntbn.exe 2912 bbtbnn.exe 2260 lfffrxf.exe 2752 lflfflr.exe 2884 bnbthb.exe 2908 jdjjp.exe 2848 vvjjp.exe 2832 ffrrlrx.exe 2776 7xrrrlr.exe 2600 nhthbh.exe 2680 tthbhb.exe 2476 ddpvv.exe 2248 vvjdj.exe 1824 xxffxxl.exe 1908 xrrxxfl.exe 600 tttttt.exe 1496 tnbhnt.exe 588 9bhttn.exe 2508 vpvpp.exe 1820 fffffxr.exe 3068 llxxxfl.exe 2976 hbtbbb.exe 1640 nnttbb.exe 2160 jdjjd.exe 2444 vjpvp.exe 1836 fxffxfr.exe 2360 rrfrrrx.exe 644 htntbb.exe 2292 nnthnn.exe 1356 7dppp.exe 1620 3vjjd.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2312 3048 b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430.exe 30 PID 3048 wrote to memory of 2312 3048 b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430.exe 30 PID 3048 wrote to memory of 2312 3048 b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430.exe 30 PID 3048 wrote to memory of 2312 3048 b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430.exe 30 PID 2312 wrote to memory of 2540 2312 rlrrrlr.exe 31 PID 2312 wrote to memory of 2540 2312 rlrrrlr.exe 31 PID 2312 wrote to memory of 2540 2312 rlrrrlr.exe 31 PID 2312 wrote to memory of 2540 2312 rlrrrlr.exe 31 PID 2540 wrote to memory of 2796 2540 tnnhnh.exe 32 PID 2540 wrote to memory of 2796 2540 tnnhnh.exe 32 PID 2540 wrote to memory of 2796 2540 tnnhnh.exe 32 PID 2540 wrote to memory of 2796 2540 tnnhnh.exe 32 PID 2796 wrote to memory of 2748 2796 pjvvd.exe 33 PID 2796 wrote to memory of 2748 2796 pjvvd.exe 33 PID 2796 wrote to memory of 2748 2796 pjvvd.exe 33 PID 2796 wrote to memory of 2748 2796 pjvvd.exe 33 PID 2748 wrote to memory of 2908 2748 frlfrrx.exe 34 PID 2748 wrote to memory of 2908 2748 frlfrrx.exe 34 PID 2748 wrote to memory of 2908 2748 frlfrrx.exe 34 PID 2748 wrote to memory of 2908 2748 frlfrrx.exe 34 PID 2908 wrote to memory of 2852 2908 fxxxfll.exe 35 PID 2908 wrote to memory of 2852 2908 fxxxfll.exe 35 PID 2908 wrote to memory of 2852 2908 fxxxfll.exe 35 PID 2908 wrote to memory of 2852 2908 fxxxfll.exe 35 PID 2852 wrote to memory of 2724 2852 vjvjp.exe 36 PID 2852 wrote to memory of 2724 2852 vjvjp.exe 36 PID 2852 wrote to memory of 2724 2852 vjvjp.exe 36 PID 2852 wrote to memory of 2724 2852 vjvjp.exe 36 PID 2724 wrote to memory of 2952 2724 1jddv.exe 37 PID 2724 wrote to memory of 2952 2724 1jddv.exe 37 PID 2724 wrote to memory of 2952 2724 1jddv.exe 37 PID 2724 wrote to memory of 2952 2724 1jddv.exe 37 PID 2952 wrote to memory of 2604 2952 fxfxllr.exe 38 PID 2952 wrote to memory of 2604 2952 fxfxllr.exe 38 PID 2952 wrote to memory of 2604 2952 fxfxllr.exe 38 PID 2952 wrote to memory of 2604 2952 fxfxllr.exe 38 PID 2604 wrote to memory of 1684 2604 nnbhnh.exe 39 PID 2604 wrote to memory of 1684 2604 nnbhnh.exe 39 PID 2604 wrote to memory of 1684 2604 nnbhnh.exe 39 PID 2604 wrote to memory of 1684 2604 nnbhnh.exe 39 PID 1684 wrote to memory of 1340 1684 nhbhtb.exe 40 PID 1684 wrote to memory of 1340 1684 nhbhtb.exe 40 PID 1684 wrote to memory of 1340 1684 nhbhtb.exe 40 PID 1684 wrote to memory of 1340 1684 nhbhtb.exe 40 PID 1340 wrote to memory of 1020 1340 1vddd.exe 41 PID 1340 wrote to memory of 1020 1340 1vddd.exe 41 PID 1340 wrote to memory of 1020 1340 1vddd.exe 41 PID 1340 wrote to memory of 1020 1340 1vddd.exe 41 PID 1020 wrote to memory of 2676 1020 vpdvp.exe 42 PID 1020 wrote to memory of 2676 1020 vpdvp.exe 42 PID 1020 wrote to memory of 2676 1020 vpdvp.exe 42 PID 1020 wrote to memory of 2676 1020 vpdvp.exe 42 PID 2676 wrote to memory of 588 2676 xrrrrxf.exe 43 PID 2676 wrote to memory of 588 2676 xrrrrxf.exe 43 PID 2676 wrote to memory of 588 2676 xrrrrxf.exe 43 PID 2676 wrote to memory of 588 2676 xrrrrxf.exe 43 PID 588 wrote to memory of 2036 588 3frrxxr.exe 44 PID 588 wrote to memory of 2036 588 3frrxxr.exe 44 PID 588 wrote to memory of 2036 588 3frrxxr.exe 44 PID 588 wrote to memory of 2036 588 3frrxxr.exe 44 PID 2036 wrote to memory of 2808 2036 5htttt.exe 45 PID 2036 wrote to memory of 2808 2036 5htttt.exe 45 PID 2036 wrote to memory of 2808 2036 5htttt.exe 45 PID 2036 wrote to memory of 2808 2036 5htttt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430.exe"C:\Users\Admin\AppData\Local\Temp\b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\rlrrrlr.exec:\rlrrrlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\tnnhnh.exec:\tnnhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\pjvvd.exec:\pjvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\frlfrrx.exec:\frlfrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\fxxxfll.exec:\fxxxfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\vjvjp.exec:\vjvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\1jddv.exec:\1jddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\fxfxllr.exec:\fxfxllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\nnbhnh.exec:\nnbhnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\nhbhtb.exec:\nhbhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\1vddd.exec:\1vddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\vpdvp.exec:\vpdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\xrrrrxf.exec:\xrrrrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\3frrxxr.exec:\3frrxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\5htttt.exec:\5htttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\7pjjv.exec:\7pjjv.exe17⤵
- Executes dropped EXE
PID:2808 -
\??\c:\ppppv.exec:\ppppv.exe18⤵
- Executes dropped EXE
PID:2000 -
\??\c:\fxrrxxf.exec:\fxrrxxf.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\9hbbhb.exec:\9hbbhb.exe20⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vvpjd.exec:\vvpjd.exe21⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ddddd.exec:\ddddd.exe22⤵
- Executes dropped EXE
PID:2152 -
\??\c:\5vvpv.exec:\5vvpv.exe23⤵
- Executes dropped EXE
PID:1016 -
\??\c:\rlxfffr.exec:\rlxfffr.exe24⤵
- Executes dropped EXE
PID:3016 -
\??\c:\5frlxxf.exec:\5frlxxf.exe25⤵
- Executes dropped EXE
PID:544 -
\??\c:\3hbbhb.exec:\3hbbhb.exe26⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nnhhnn.exec:\nnhhnn.exe27⤵
- Executes dropped EXE
PID:1828 -
\??\c:\5tbhhn.exec:\5tbhhn.exe28⤵
- Executes dropped EXE
PID:2688 -
\??\c:\9xllxff.exec:\9xllxff.exe29⤵
- Executes dropped EXE
PID:564 -
\??\c:\hhntth.exec:\hhntth.exe30⤵
- Executes dropped EXE
PID:392 -
\??\c:\tnnhhh.exec:\tnnhhh.exe31⤵
- Executes dropped EXE
PID:848 -
\??\c:\5dpdd.exec:\5dpdd.exe32⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lfrrffl.exec:\lfrrffl.exe33⤵
- Executes dropped EXE
PID:1076 -
\??\c:\llflxrx.exec:\llflxrx.exe34⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ntntbn.exec:\ntntbn.exe35⤵
- Executes dropped EXE
PID:776 -
\??\c:\bbtbnn.exec:\bbtbnn.exe36⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lfffrxf.exec:\lfffrxf.exe37⤵
- Executes dropped EXE
PID:2260 -
\??\c:\lflfflr.exec:\lflfflr.exe38⤵
- Executes dropped EXE
PID:2752 -
\??\c:\bnbthb.exec:\bnbthb.exe39⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jdjjp.exec:\jdjjp.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2908 -
\??\c:\vvjjp.exec:\vvjjp.exe41⤵
- Executes dropped EXE
PID:2848 -
\??\c:\ffrrlrx.exec:\ffrrlrx.exe42⤵
- Executes dropped EXE
PID:2832 -
\??\c:\7xrrrlr.exec:\7xrrrlr.exe43⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nhthbh.exec:\nhthbh.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tthbhb.exec:\tthbhb.exe45⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ddpvv.exec:\ddpvv.exe46⤵
- Executes dropped EXE
PID:2476 -
\??\c:\vvjdj.exec:\vvjdj.exe47⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xxffxxl.exec:\xxffxxl.exe48⤵
- Executes dropped EXE
PID:1824 -
\??\c:\xrrxxfl.exec:\xrrxxfl.exe49⤵
- Executes dropped EXE
PID:1908 -
\??\c:\tttttt.exec:\tttttt.exe50⤵
- Executes dropped EXE
PID:600 -
\??\c:\tnbhnt.exec:\tnbhnt.exe51⤵
- Executes dropped EXE
PID:1496 -
\??\c:\9bhttn.exec:\9bhttn.exe52⤵
- Executes dropped EXE
PID:588 -
\??\c:\vpvpp.exec:\vpvpp.exe53⤵
- Executes dropped EXE
PID:2508 -
\??\c:\fffffxr.exec:\fffffxr.exe54⤵
- Executes dropped EXE
PID:1820 -
\??\c:\llxxxfl.exec:\llxxxfl.exe55⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hbtbbb.exec:\hbtbbb.exe56⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nnttbb.exec:\nnttbb.exe57⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jdjjd.exec:\jdjjd.exe58⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vjpvp.exec:\vjpvp.exe59⤵
- Executes dropped EXE
PID:2444 -
\??\c:\fxffxfr.exec:\fxffxfr.exe60⤵
- Executes dropped EXE
PID:1836 -
\??\c:\rrfrrrx.exec:\rrfrrrx.exe61⤵
- Executes dropped EXE
PID:2360 -
\??\c:\htntbb.exec:\htntbb.exe62⤵
- Executes dropped EXE
PID:644 -
\??\c:\nnthnn.exec:\nnthnn.exe63⤵
- Executes dropped EXE
PID:2292 -
\??\c:\7dppp.exec:\7dppp.exe64⤵
- Executes dropped EXE
PID:1356 -
\??\c:\3vjjd.exec:\3vjjd.exe65⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ffrlflr.exec:\ffrlflr.exe66⤵PID:1376
-
\??\c:\1rlllff.exec:\1rlllff.exe67⤵PID:3020
-
\??\c:\hhttbh.exec:\hhttbh.exe68⤵PID:1696
-
\??\c:\dvjdj.exec:\dvjdj.exe69⤵PID:1752
-
\??\c:\vvpjp.exec:\vvpjp.exe70⤵PID:2440
-
\??\c:\1thttb.exec:\1thttb.exe71⤵PID:564
-
\??\c:\hbthtn.exec:\hbthtn.exe72⤵
- System Location Discovery: System Language Discovery
PID:1676 -
\??\c:\pjddj.exec:\pjddj.exe73⤵PID:2008
-
\??\c:\7djdd.exec:\7djdd.exe74⤵PID:3056
-
\??\c:\vvjdj.exec:\vvjdj.exe75⤵PID:2336
-
\??\c:\7ffllrx.exec:\7ffllrx.exe76⤵PID:2348
-
\??\c:\rlxrxfr.exec:\rlxrxfr.exe77⤵PID:812
-
\??\c:\tbntbb.exec:\tbntbb.exe78⤵PID:2984
-
\??\c:\nhtthh.exec:\nhtthh.exe79⤵PID:2092
-
\??\c:\jjdvj.exec:\jjdvj.exe80⤵PID:2856
-
\??\c:\jddjp.exec:\jddjp.exe81⤵PID:2872
-
\??\c:\llffxxf.exec:\llffxxf.exe82⤵PID:2880
-
\??\c:\xrxxffl.exec:\xrxxffl.exe83⤵
- System Location Discovery: System Language Discovery
PID:2612 -
\??\c:\nthntt.exec:\nthntt.exe84⤵PID:2828
-
\??\c:\bbbtbt.exec:\bbbtbt.exe85⤵PID:2848
-
\??\c:\dvppd.exec:\dvppd.exe86⤵PID:2628
-
\??\c:\pvppv.exec:\pvppv.exe87⤵PID:2776
-
\??\c:\1lrrrxf.exec:\1lrrrxf.exe88⤵PID:2128
-
\??\c:\xxxfrlx.exec:\xxxfrlx.exe89⤵PID:2728
-
\??\c:\lfflxfr.exec:\lfflxfr.exe90⤵PID:1108
-
\??\c:\hbtbnt.exec:\hbtbnt.exe91⤵PID:2248
-
\??\c:\5hhhnn.exec:\5hhhnn.exe92⤵PID:2592
-
\??\c:\pjvjj.exec:\pjvjj.exe93⤵PID:1020
-
\??\c:\pvvvv.exec:\pvvvv.exe94⤵PID:1508
-
\??\c:\fxlfllr.exec:\fxlfllr.exe95⤵PID:264
-
\??\c:\7lxxfxf.exec:\7lxxfxf.exe96⤵PID:2148
-
\??\c:\3tbbnn.exec:\3tbbnn.exe97⤵PID:1056
-
\??\c:\nhhhnn.exec:\nhhhnn.exe98⤵PID:2164
-
\??\c:\vjpvd.exec:\vjpvd.exe99⤵PID:2004
-
\??\c:\pjjdd.exec:\pjjdd.exe100⤵PID:1856
-
\??\c:\llfxxrf.exec:\llfxxrf.exe101⤵PID:1764
-
\??\c:\rlffllr.exec:\rlffllr.exe102⤵PID:2124
-
\??\c:\3nhhnt.exec:\3nhhnt.exe103⤵PID:2056
-
\??\c:\nthhnn.exec:\nthhnn.exe104⤵PID:1136
-
\??\c:\btbbbt.exec:\btbbbt.exe105⤵PID:2532
-
\??\c:\vpdjv.exec:\vpdjv.exe106⤵PID:2784
-
\??\c:\pjvvv.exec:\pjvvv.exe107⤵PID:3008
-
\??\c:\7lxllrr.exec:\7lxllrr.exe108⤵PID:1332
-
\??\c:\1xxfffl.exec:\1xxfffl.exe109⤵PID:1872
-
\??\c:\9htnnt.exec:\9htnnt.exe110⤵PID:2380
-
\??\c:\nhnbnn.exec:\nhnbnn.exe111⤵PID:1376
-
\??\c:\ttnnnh.exec:\ttnnnh.exe112⤵PID:660
-
\??\c:\3vjjj.exec:\3vjjj.exe113⤵PID:1560
-
\??\c:\3pvvv.exec:\3pvvv.exe114⤵PID:1732
-
\??\c:\1rxrfxf.exec:\1rxrfxf.exe115⤵PID:2436
-
\??\c:\llxlllx.exec:\llxlllx.exe116⤵PID:564
-
\??\c:\nhntbt.exec:\nhntbt.exe117⤵PID:884
-
\??\c:\nnbhhb.exec:\nnbhhb.exe118⤵PID:3032
-
\??\c:\1pdvd.exec:\1pdvd.exe119⤵PID:1612
-
\??\c:\jvjpv.exec:\jvjpv.exe120⤵PID:2272
-
\??\c:\1vjdj.exec:\1vjdj.exe121⤵PID:1608
-
\??\c:\lxxlrll.exec:\lxxlrll.exe122⤵PID:2408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-