Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08/08/2024, 21:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5091382b77d59ace64b0bf7649c753a43963be014306037104c10ac29414d2f3.exe
Resource
win7-20240705-en
6 signatures
150 seconds
General
-
Target
5091382b77d59ace64b0bf7649c753a43963be014306037104c10ac29414d2f3.exe
-
Size
54KB
-
MD5
8f99b1e7e26f208169151e7143ffed70
-
SHA1
467d54f1034c5ceb85fe317374be781a272c96cb
-
SHA256
5091382b77d59ace64b0bf7649c753a43963be014306037104c10ac29414d2f3
-
SHA512
4b95696ee39e6dfd61323ac36dbdbe34415215bc438cd290e1750be647f2eaef7ab03d87b8030f2704170d47568d6d532f13fe2ac02a4b057940d3fbbcd67755
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIY6St9xj:ymb3NkkiQ3mdBjFIY79xj
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/3036-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/796-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-91-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1052-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2096 lfxflrf.exe 2800 xffxrrl.exe 2852 hhbhnt.exe 2420 htntbh.exe 2700 ppjpd.exe 2564 llflxxl.exe 796 nhnbhb.exe 2504 3pdjp.exe 1052 dvddd.exe 2196 xrrlrfl.exe 2232 lfllxxl.exe 2104 hbbbnt.exe 1092 jvvvp.exe 2600 vdvpd.exe 3064 9frrlrx.exe 2628 xxlrffl.exe 1372 nttnbt.exe 536 3dvjj.exe 2152 dvjjp.exe 2188 vvjjv.exe 2484 1xrrflr.exe 1188 xlrlrrl.exe 2360 btnttn.exe 2256 nhtbhh.exe 1688 vppdp.exe 992 pdjjj.exe 1984 xlxrffl.exe 580 xrxllrf.exe 1624 nnbtnh.exe 2120 pjvvd.exe 3032 3jvvj.exe 2764 7rrfllx.exe 2664 fxxlxrr.exe 2852 tnbhnn.exe 2712 jvvpp.exe 1732 xrffrxx.exe 2580 xrfllfl.exe 2548 7thhtn.exe 2704 bbtthh.exe 2976 1pjpp.exe 2520 djppj.exe 2456 lfrrrxf.exe 2312 rlxlrrr.exe 2516 btbhbb.exe 2196 1jddj.exe 2824 vpddj.exe 1320 flxlxlr.exe 2820 xrrrlfx.exe 2728 1thhhb.exe 2432 hbnttb.exe 2172 pdppp.exe 1376 3djjp.exe 1328 9frfrxx.exe 2060 rlrxflr.exe 2332 nnttht.exe 2336 5nthth.exe 2108 ttnnnn.exe 2204 dvjvj.exe 2044 vvjjd.exe 988 7lfxllr.exe 900 1nnthn.exe 2008 3bthnt.exe 2020 pjvpv.exe 2452 pppvj.exe -
resource yara_rule behavioral1/memory/3036-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1052-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2096 3036 5091382b77d59ace64b0bf7649c753a43963be014306037104c10ac29414d2f3.exe 30 PID 3036 wrote to memory of 2096 3036 5091382b77d59ace64b0bf7649c753a43963be014306037104c10ac29414d2f3.exe 30 PID 3036 wrote to memory of 2096 3036 5091382b77d59ace64b0bf7649c753a43963be014306037104c10ac29414d2f3.exe 30 PID 3036 wrote to memory of 2096 3036 5091382b77d59ace64b0bf7649c753a43963be014306037104c10ac29414d2f3.exe 30 PID 2096 wrote to memory of 2800 2096 lfxflrf.exe 31 PID 2096 wrote to memory of 2800 2096 lfxflrf.exe 31 PID 2096 wrote to memory of 2800 2096 lfxflrf.exe 31 PID 2096 wrote to memory of 2800 2096 lfxflrf.exe 31 PID 2800 wrote to memory of 2852 2800 xffxrrl.exe 32 PID 2800 wrote to memory of 2852 2800 xffxrrl.exe 32 PID 2800 wrote to memory of 2852 2800 xffxrrl.exe 32 PID 2800 wrote to memory of 2852 2800 xffxrrl.exe 32 PID 2852 wrote to memory of 2420 2852 hhbhnt.exe 33 PID 2852 wrote to memory of 2420 2852 hhbhnt.exe 33 PID 2852 wrote to memory of 2420 2852 hhbhnt.exe 33 PID 2852 wrote to memory of 2420 2852 hhbhnt.exe 33 PID 2420 wrote to memory of 2700 2420 htntbh.exe 34 PID 2420 wrote to memory of 2700 2420 htntbh.exe 34 PID 2420 wrote to memory of 2700 2420 htntbh.exe 34 PID 2420 wrote to memory of 2700 2420 htntbh.exe 34 PID 2700 wrote to memory of 2564 2700 ppjpd.exe 35 PID 2700 wrote to memory of 2564 2700 ppjpd.exe 35 PID 2700 wrote to memory of 2564 2700 ppjpd.exe 35 PID 2700 wrote to memory of 2564 2700 ppjpd.exe 35 PID 2564 wrote to memory of 796 2564 llflxxl.exe 36 PID 2564 wrote to memory of 796 2564 llflxxl.exe 36 PID 2564 wrote to memory of 796 2564 llflxxl.exe 36 PID 2564 wrote to memory of 796 2564 llflxxl.exe 36 PID 796 wrote to memory of 2504 796 nhnbhb.exe 37 PID 796 wrote to memory of 2504 796 nhnbhb.exe 37 PID 796 wrote to memory of 2504 796 nhnbhb.exe 37 PID 796 wrote to memory of 2504 796 nhnbhb.exe 37 PID 2504 wrote to memory of 1052 2504 3pdjp.exe 38 PID 2504 wrote to memory of 1052 2504 3pdjp.exe 38 PID 2504 wrote to memory of 1052 2504 3pdjp.exe 38 PID 2504 wrote to memory of 1052 2504 3pdjp.exe 38 PID 1052 wrote to memory of 2196 1052 dvddd.exe 39 PID 1052 wrote to memory of 2196 1052 dvddd.exe 39 PID 1052 wrote to memory of 2196 1052 dvddd.exe 39 PID 1052 wrote to memory of 2196 1052 dvddd.exe 39 PID 2196 wrote to memory of 2232 2196 xrrlrfl.exe 40 PID 2196 wrote to memory of 2232 2196 xrrlrfl.exe 40 PID 2196 wrote to memory of 2232 2196 xrrlrfl.exe 40 PID 2196 wrote to memory of 2232 2196 xrrlrfl.exe 40 PID 2232 wrote to memory of 2104 2232 lfllxxl.exe 41 PID 2232 wrote to memory of 2104 2232 lfllxxl.exe 41 PID 2232 wrote to memory of 2104 2232 lfllxxl.exe 41 PID 2232 wrote to memory of 2104 2232 lfllxxl.exe 41 PID 2104 wrote to memory of 1092 2104 hbbbnt.exe 42 PID 2104 wrote to memory of 1092 2104 hbbbnt.exe 42 PID 2104 wrote to memory of 1092 2104 hbbbnt.exe 42 PID 2104 wrote to memory of 1092 2104 hbbbnt.exe 42 PID 1092 wrote to memory of 2600 1092 jvvvp.exe 43 PID 1092 wrote to memory of 2600 1092 jvvvp.exe 43 PID 1092 wrote to memory of 2600 1092 jvvvp.exe 43 PID 1092 wrote to memory of 2600 1092 jvvvp.exe 43 PID 2600 wrote to memory of 3064 2600 vdvpd.exe 44 PID 2600 wrote to memory of 3064 2600 vdvpd.exe 44 PID 2600 wrote to memory of 3064 2600 vdvpd.exe 44 PID 2600 wrote to memory of 3064 2600 vdvpd.exe 44 PID 3064 wrote to memory of 2628 3064 9frrlrx.exe 45 PID 3064 wrote to memory of 2628 3064 9frrlrx.exe 45 PID 3064 wrote to memory of 2628 3064 9frrlrx.exe 45 PID 3064 wrote to memory of 2628 3064 9frrlrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5091382b77d59ace64b0bf7649c753a43963be014306037104c10ac29414d2f3.exe"C:\Users\Admin\AppData\Local\Temp\5091382b77d59ace64b0bf7649c753a43963be014306037104c10ac29414d2f3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\lfxflrf.exec:\lfxflrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\xffxrrl.exec:\xffxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\hhbhnt.exec:\hhbhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\htntbh.exec:\htntbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\ppjpd.exec:\ppjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\llflxxl.exec:\llflxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\nhnbhb.exec:\nhnbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\3pdjp.exec:\3pdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\dvddd.exec:\dvddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\xrrlrfl.exec:\xrrlrfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\lfllxxl.exec:\lfllxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\hbbbnt.exec:\hbbbnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\jvvvp.exec:\jvvvp.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\vdvpd.exec:\vdvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\9frrlrx.exec:\9frrlrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\xxlrffl.exec:\xxlrffl.exe17⤵
- Executes dropped EXE
PID:2628 -
\??\c:\nttnbt.exec:\nttnbt.exe18⤵
- Executes dropped EXE
PID:1372 -
\??\c:\3dvjj.exec:\3dvjj.exe19⤵
- Executes dropped EXE
PID:536 -
\??\c:\dvjjp.exec:\dvjjp.exe20⤵
- Executes dropped EXE
PID:2152 -
\??\c:\vvjjv.exec:\vvjjv.exe21⤵
- Executes dropped EXE
PID:2188 -
\??\c:\1xrrflr.exec:\1xrrflr.exe22⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xlrlrrl.exec:\xlrlrrl.exe23⤵
- Executes dropped EXE
PID:1188 -
\??\c:\btnttn.exec:\btnttn.exe24⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nhtbhh.exec:\nhtbhh.exe25⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vppdp.exec:\vppdp.exe26⤵
- Executes dropped EXE
PID:1688 -
\??\c:\pdjjj.exec:\pdjjj.exe27⤵
- Executes dropped EXE
PID:992 -
\??\c:\xlxrffl.exec:\xlxrffl.exe28⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xrxllrf.exec:\xrxllrf.exe29⤵
- Executes dropped EXE
PID:580 -
\??\c:\nnbtnh.exec:\nnbtnh.exe30⤵
- Executes dropped EXE
PID:1624 -
\??\c:\pjvvd.exec:\pjvvd.exe31⤵
- Executes dropped EXE
PID:2120 -
\??\c:\3jvvj.exec:\3jvvj.exe32⤵
- Executes dropped EXE
PID:3032 -
\??\c:\7rrfllx.exec:\7rrfllx.exe33⤵
- Executes dropped EXE
PID:2764 -
\??\c:\fxxlxrr.exec:\fxxlxrr.exe34⤵
- Executes dropped EXE
PID:2664 -
\??\c:\tnbhnn.exec:\tnbhnn.exe35⤵
- Executes dropped EXE
PID:2852 -
\??\c:\jvvpp.exec:\jvvpp.exe36⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xrffrxx.exec:\xrffrxx.exe37⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xrfllfl.exec:\xrfllfl.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\7thhtn.exec:\7thhtn.exe39⤵
- Executes dropped EXE
PID:2548 -
\??\c:\bbtthh.exec:\bbtthh.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1pjpp.exec:\1pjpp.exe41⤵
- Executes dropped EXE
PID:2976 -
\??\c:\djppj.exec:\djppj.exe42⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe43⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rlxlrrr.exec:\rlxlrrr.exe44⤵
- Executes dropped EXE
PID:2312 -
\??\c:\btbhbb.exec:\btbhbb.exe45⤵
- Executes dropped EXE
PID:2516 -
\??\c:\1jddj.exec:\1jddj.exe46⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vpddj.exec:\vpddj.exe47⤵
- Executes dropped EXE
PID:2824 -
\??\c:\flxlxlr.exec:\flxlxlr.exe48⤵
- Executes dropped EXE
PID:1320 -
\??\c:\xrrrlfx.exec:\xrrrlfx.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2820 -
\??\c:\1thhhb.exec:\1thhhb.exe50⤵
- Executes dropped EXE
PID:2728 -
\??\c:\hbnttb.exec:\hbnttb.exe51⤵
- Executes dropped EXE
PID:2432 -
\??\c:\pdppp.exec:\pdppp.exe52⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3djjp.exec:\3djjp.exe53⤵
- Executes dropped EXE
PID:1376 -
\??\c:\9frfrxx.exec:\9frfrxx.exe54⤵
- Executes dropped EXE
PID:1328 -
\??\c:\rlrxflr.exec:\rlrxflr.exe55⤵
- Executes dropped EXE
PID:2060 -
\??\c:\nnttht.exec:\nnttht.exe56⤵
- Executes dropped EXE
PID:2332 -
\??\c:\5nthth.exec:\5nthth.exe57⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ttnnnn.exec:\ttnnnn.exe58⤵
- Executes dropped EXE
PID:2108 -
\??\c:\dvjvj.exec:\dvjvj.exe59⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vvjjd.exec:\vvjjd.exe60⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7lfxllr.exec:\7lfxllr.exe61⤵
- Executes dropped EXE
PID:988 -
\??\c:\1nnthn.exec:\1nnthn.exe62⤵
- Executes dropped EXE
PID:900 -
\??\c:\3bthnt.exec:\3bthnt.exe63⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pjvpv.exec:\pjvpv.exe64⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pppvj.exec:\pppvj.exe65⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lfrrrrf.exec:\lfrrrrf.exe66⤵PID:1952
-
\??\c:\rfrrxfx.exec:\rfrrxfx.exe67⤵PID:2292
-
\??\c:\bbtbbb.exec:\bbtbbb.exe68⤵PID:792
-
\??\c:\hbntth.exec:\hbntth.exe69⤵PID:888
-
\??\c:\3tntbh.exec:\3tntbh.exe70⤵PID:2384
-
\??\c:\7vvdp.exec:\7vvdp.exe71⤵PID:2788
-
\??\c:\3lfxlrx.exec:\3lfxlrx.exe72⤵PID:2772
-
\??\c:\rlfrxfx.exec:\rlfrxfx.exe73⤵PID:2764
-
\??\c:\hthnth.exec:\hthnth.exe74⤵PID:2696
-
\??\c:\bbbtth.exec:\bbbtth.exe75⤵PID:2808
-
\??\c:\7pppp.exec:\7pppp.exe76⤵PID:3004
-
\??\c:\vjppv.exec:\vjppv.exe77⤵PID:1612
-
\??\c:\llxrflx.exec:\llxrflx.exe78⤵PID:2556
-
\??\c:\tntttt.exec:\tntttt.exe79⤵PID:2964
-
\??\c:\bthhtn.exec:\bthhtn.exe80⤵PID:864
-
\??\c:\7hbbhb.exec:\7hbbhb.exe81⤵PID:2976
-
\??\c:\djvvv.exec:\djvvv.exe82⤵PID:448
-
\??\c:\7jvpp.exec:\7jvpp.exe83⤵PID:2356
-
\??\c:\xlxllfl.exec:\xlxllfl.exe84⤵PID:2912
-
\??\c:\lfllrlr.exec:\lfllrlr.exe85⤵PID:2512
-
\??\c:\3thttt.exec:\3thttt.exe86⤵PID:2220
-
\??\c:\5nhtbt.exec:\5nhtbt.exe87⤵PID:1676
-
\??\c:\5vpjj.exec:\5vpjj.exe88⤵PID:1784
-
\??\c:\vvdpv.exec:\vvdpv.exe89⤵PID:1488
-
\??\c:\llxflll.exec:\llxflll.exe90⤵PID:1956
-
\??\c:\fxflllr.exec:\fxflllr.exe91⤵PID:1520
-
\??\c:\nbnntn.exec:\nbnntn.exe92⤵PID:2320
-
\??\c:\hbbnnn.exec:\hbbnnn.exe93⤵PID:476
-
\??\c:\jdvjj.exec:\jdvjj.exe94⤵PID:2272
-
\??\c:\jvvpd.exec:\jvvpd.exe95⤵PID:2340
-
\??\c:\frllxlr.exec:\frllxlr.exe96⤵PID:3068
-
\??\c:\hbnntt.exec:\hbnntt.exe97⤵PID:2152
-
\??\c:\bnhtnn.exec:\bnhtnn.exe98⤵PID:352
-
\??\c:\nbtnht.exec:\nbtnht.exe99⤵PID:2500
-
\??\c:\dvvpv.exec:\dvvpv.exe100⤵PID:2868
-
\??\c:\vpdjv.exec:\vpdjv.exe101⤵PID:1884
-
\??\c:\dvjpv.exec:\dvjpv.exe102⤵PID:1552
-
\??\c:\3llxffl.exec:\3llxffl.exe103⤵PID:624
-
\??\c:\flrlxrr.exec:\flrlxrr.exe104⤵PID:1700
-
\??\c:\1bbtnt.exec:\1bbtnt.exe105⤵PID:1352
-
\??\c:\nhbhth.exec:\nhbhth.exe106⤵PID:1984
-
\??\c:\jdjpv.exec:\jdjpv.exe107⤵PID:552
-
\??\c:\3djdd.exec:\3djdd.exe108⤵PID:2448
-
\??\c:\ppjdj.exec:\ppjdj.exe109⤵PID:2404
-
\??\c:\3rfrxfx.exec:\3rfrxfx.exe110⤵PID:2660
-
\??\c:\hbnntt.exec:\hbnntt.exe111⤵PID:2684
-
\??\c:\nhnnbb.exec:\nhnnbb.exe112⤵PID:2780
-
\??\c:\7bbnnb.exec:\7bbnnb.exe113⤵PID:2896
-
\??\c:\dpvdd.exec:\dpvdd.exe114⤵PID:2892
-
\??\c:\pdjdd.exec:\pdjdd.exe115⤵PID:1580
-
\??\c:\9jjdj.exec:\9jjdj.exe116⤵PID:2784
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe117⤵PID:1732
-
\??\c:\lfxxfxf.exec:\lfxxfxf.exe118⤵PID:2584
-
\??\c:\hnhhtn.exec:\hnhhtn.exe119⤵PID:2972
-
\??\c:\hbnnnt.exec:\hbnnnt.exe120⤵PID:796
-
\??\c:\jjvjp.exec:\jjvjp.exe121⤵PID:592
-
\??\c:\ddjpj.exec:\ddjpj.exe122⤵PID:1456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-