Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 22:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
50ffc3998883d6c4668bf61dbf4ba69a9600947df991802d3f153ac8ba922b40.exe
Resource
win7-20240708-en
6 signatures
150 seconds
General
-
Target
50ffc3998883d6c4668bf61dbf4ba69a9600947df991802d3f153ac8ba922b40.exe
-
Size
139KB
-
MD5
266e571a09d1db9343beb83ef4c52f32
-
SHA1
dd99b22640cee5d33fc25c1785dbe0fd333ce0eb
-
SHA256
50ffc3998883d6c4668bf61dbf4ba69a9600947df991802d3f153ac8ba922b40
-
SHA512
353d865a149096a7503a413b2d55685b2d5b0dfbb6e5ebda176f62349d81f12a16e4a8a057050936447bf382b3d96f086ac36f51878ffee1c7ada562ced8dd27
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGoH/LE:n3C9BRW0j/1px+dGkQ
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2668-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1192-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/740-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/744-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1272-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2776 xrffllr.exe 2688 tnnnnt.exe 2128 7hhnhh.exe 2044 jdjjp.exe 2772 xxllxlx.exe 2616 hhnnbn.exe 2876 pvpdj.exe 816 rlffflr.exe 2944 1fflrfl.exe 1192 tnhhtt.exe 2280 tthnbn.exe 2828 5ppjv.exe 2908 lfrxllx.exe 972 llllffl.exe 740 5bnnth.exe 1244 jdvdj.exe 744 jvjvj.exe 2372 fxfrllx.exe 2384 nhthth.exe 2932 5jddd.exe 2064 dddjv.exe 948 llxflrx.exe 2452 bbtnbb.exe 944 ttbbhh.exe 1728 pddpv.exe 2976 vpdjv.exe 1476 5lflrrx.exe 1272 btbhtt.exe 984 jdpvd.exe 2228 vjvvj.exe 2808 rxllfxr.exe 2564 bbnbnt.exe 2924 7btbhh.exe 1544 dvpdv.exe 2584 pjpvd.exe 2872 jdpdv.exe 2588 1frxxfr.exe 2576 xrfrfrf.exe 2732 nhbhtb.exe 2616 hbttnh.exe 2216 vpdjv.exe 2876 ppjpd.exe 2948 xrxxlll.exe 1656 xrlxlrx.exe 2240 hbnntb.exe 2032 htbbhh.exe 2280 vpvpd.exe 1740 9vddd.exe 572 1vddp.exe 1064 xlrfflf.exe 1896 1xrxffl.exe 2448 9hbntt.exe 1156 nhbbtt.exe 2400 jdpdj.exe 2396 1rfxllr.exe 1768 nbnbnb.exe 2336 7btbbh.exe 1948 vdpvj.exe 2100 pjddv.exe 948 ffrfxfr.exe 2984 lflxlxf.exe 2116 7bthbn.exe 884 7hhthh.exe 2300 ppdpd.exe -
resource yara_rule behavioral1/memory/2668-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1192-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/740-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/744-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1272-272-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2776 2668 50ffc3998883d6c4668bf61dbf4ba69a9600947df991802d3f153ac8ba922b40.exe 30 PID 2668 wrote to memory of 2776 2668 50ffc3998883d6c4668bf61dbf4ba69a9600947df991802d3f153ac8ba922b40.exe 30 PID 2668 wrote to memory of 2776 2668 50ffc3998883d6c4668bf61dbf4ba69a9600947df991802d3f153ac8ba922b40.exe 30 PID 2668 wrote to memory of 2776 2668 50ffc3998883d6c4668bf61dbf4ba69a9600947df991802d3f153ac8ba922b40.exe 30 PID 2776 wrote to memory of 2688 2776 xrffllr.exe 31 PID 2776 wrote to memory of 2688 2776 xrffllr.exe 31 PID 2776 wrote to memory of 2688 2776 xrffllr.exe 31 PID 2776 wrote to memory of 2688 2776 xrffllr.exe 31 PID 2688 wrote to memory of 2128 2688 tnnnnt.exe 32 PID 2688 wrote to memory of 2128 2688 tnnnnt.exe 32 PID 2688 wrote to memory of 2128 2688 tnnnnt.exe 32 PID 2688 wrote to memory of 2128 2688 tnnnnt.exe 32 PID 2128 wrote to memory of 2044 2128 7hhnhh.exe 33 PID 2128 wrote to memory of 2044 2128 7hhnhh.exe 33 PID 2128 wrote to memory of 2044 2128 7hhnhh.exe 33 PID 2128 wrote to memory of 2044 2128 7hhnhh.exe 33 PID 2044 wrote to memory of 2772 2044 jdjjp.exe 34 PID 2044 wrote to memory of 2772 2044 jdjjp.exe 34 PID 2044 wrote to memory of 2772 2044 jdjjp.exe 34 PID 2044 wrote to memory of 2772 2044 jdjjp.exe 34 PID 2772 wrote to memory of 2616 2772 xxllxlx.exe 35 PID 2772 wrote to memory of 2616 2772 xxllxlx.exe 35 PID 2772 wrote to memory of 2616 2772 xxllxlx.exe 35 PID 2772 wrote to memory of 2616 2772 xxllxlx.exe 35 PID 2616 wrote to memory of 2876 2616 hhnnbn.exe 36 PID 2616 wrote to memory of 2876 2616 hhnnbn.exe 36 PID 2616 wrote to memory of 2876 2616 hhnnbn.exe 36 PID 2616 wrote to memory of 2876 2616 hhnnbn.exe 36 PID 2876 wrote to memory of 816 2876 pvpdj.exe 37 PID 2876 wrote to memory of 816 2876 pvpdj.exe 37 PID 2876 wrote to memory of 816 2876 pvpdj.exe 37 PID 2876 wrote to memory of 816 2876 pvpdj.exe 37 PID 816 wrote to memory of 2944 816 rlffflr.exe 38 PID 816 wrote to memory of 2944 816 rlffflr.exe 38 PID 816 wrote to memory of 2944 816 rlffflr.exe 38 PID 816 wrote to memory of 2944 816 rlffflr.exe 38 PID 2944 wrote to memory of 1192 2944 1fflrfl.exe 39 PID 2944 wrote to memory of 1192 2944 1fflrfl.exe 39 PID 2944 wrote to memory of 1192 2944 1fflrfl.exe 39 PID 2944 wrote to memory of 1192 2944 1fflrfl.exe 39 PID 1192 wrote to memory of 2280 1192 tnhhtt.exe 40 PID 1192 wrote to memory of 2280 1192 tnhhtt.exe 40 PID 1192 wrote to memory of 2280 1192 tnhhtt.exe 40 PID 1192 wrote to memory of 2280 1192 tnhhtt.exe 40 PID 2280 wrote to memory of 2828 2280 tthnbn.exe 41 PID 2280 wrote to memory of 2828 2280 tthnbn.exe 41 PID 2280 wrote to memory of 2828 2280 tthnbn.exe 41 PID 2280 wrote to memory of 2828 2280 tthnbn.exe 41 PID 2828 wrote to memory of 2908 2828 5ppjv.exe 42 PID 2828 wrote to memory of 2908 2828 5ppjv.exe 42 PID 2828 wrote to memory of 2908 2828 5ppjv.exe 42 PID 2828 wrote to memory of 2908 2828 5ppjv.exe 42 PID 2908 wrote to memory of 972 2908 lfrxllx.exe 43 PID 2908 wrote to memory of 972 2908 lfrxllx.exe 43 PID 2908 wrote to memory of 972 2908 lfrxllx.exe 43 PID 2908 wrote to memory of 972 2908 lfrxllx.exe 43 PID 972 wrote to memory of 740 972 llllffl.exe 44 PID 972 wrote to memory of 740 972 llllffl.exe 44 PID 972 wrote to memory of 740 972 llllffl.exe 44 PID 972 wrote to memory of 740 972 llllffl.exe 44 PID 740 wrote to memory of 1244 740 5bnnth.exe 45 PID 740 wrote to memory of 1244 740 5bnnth.exe 45 PID 740 wrote to memory of 1244 740 5bnnth.exe 45 PID 740 wrote to memory of 1244 740 5bnnth.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\50ffc3998883d6c4668bf61dbf4ba69a9600947df991802d3f153ac8ba922b40.exe"C:\Users\Admin\AppData\Local\Temp\50ffc3998883d6c4668bf61dbf4ba69a9600947df991802d3f153ac8ba922b40.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\xrffllr.exec:\xrffllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\tnnnnt.exec:\tnnnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\7hhnhh.exec:\7hhnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\jdjjp.exec:\jdjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\xxllxlx.exec:\xxllxlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\hhnnbn.exec:\hhnnbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\pvpdj.exec:\pvpdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\rlffflr.exec:\rlffflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\1fflrfl.exec:\1fflrfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\tnhhtt.exec:\tnhhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\tthnbn.exec:\tthnbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\5ppjv.exec:\5ppjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\lfrxllx.exec:\lfrxllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\llllffl.exec:\llllffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\5bnnth.exec:\5bnnth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\jdvdj.exec:\jdvdj.exe17⤵
- Executes dropped EXE
PID:1244 -
\??\c:\jvjvj.exec:\jvjvj.exe18⤵
- Executes dropped EXE
PID:744 -
\??\c:\fxfrllx.exec:\fxfrllx.exe19⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nhthth.exec:\nhthth.exe20⤵
- Executes dropped EXE
PID:2384 -
\??\c:\5jddd.exec:\5jddd.exe21⤵
- Executes dropped EXE
PID:2932 -
\??\c:\dddjv.exec:\dddjv.exe22⤵
- Executes dropped EXE
PID:2064 -
\??\c:\llxflrx.exec:\llxflrx.exe23⤵
- Executes dropped EXE
PID:948 -
\??\c:\bbtnbb.exec:\bbtnbb.exe24⤵
- Executes dropped EXE
PID:2452 -
\??\c:\ttbbhh.exec:\ttbbhh.exe25⤵
- Executes dropped EXE
PID:944 -
\??\c:\pddpv.exec:\pddpv.exe26⤵
- Executes dropped EXE
PID:1728 -
\??\c:\vpdjv.exec:\vpdjv.exe27⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5lflrrx.exec:\5lflrrx.exe28⤵
- Executes dropped EXE
PID:1476 -
\??\c:\btbhtt.exec:\btbhtt.exe29⤵
- Executes dropped EXE
PID:1272 -
\??\c:\jdpvd.exec:\jdpvd.exe30⤵
- Executes dropped EXE
PID:984 -
\??\c:\vjvvj.exec:\vjvvj.exe31⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rxllfxr.exec:\rxllfxr.exe32⤵
- Executes dropped EXE
PID:2808 -
\??\c:\bbnbnt.exec:\bbnbnt.exe33⤵
- Executes dropped EXE
PID:2564 -
\??\c:\7btbhh.exec:\7btbhh.exe34⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dvpdv.exec:\dvpdv.exe35⤵
- Executes dropped EXE
PID:1544 -
\??\c:\pjpvd.exec:\pjpvd.exe36⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jdpdv.exec:\jdpdv.exe37⤵
- Executes dropped EXE
PID:2872 -
\??\c:\1frxxfr.exec:\1frxxfr.exe38⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xrfrfrf.exec:\xrfrfrf.exe39⤵
- Executes dropped EXE
PID:2576 -
\??\c:\nhbhtb.exec:\nhbhtb.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hbttnh.exec:\hbttnh.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vpdjv.exec:\vpdjv.exe42⤵
- Executes dropped EXE
PID:2216 -
\??\c:\ppjpd.exec:\ppjpd.exe43⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xrxxlll.exec:\xrxxlll.exe44⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xrlxlrx.exec:\xrlxlrx.exe45⤵
- Executes dropped EXE
PID:1656 -
\??\c:\hbnntb.exec:\hbnntb.exe46⤵
- Executes dropped EXE
PID:2240 -
\??\c:\htbbhh.exec:\htbbhh.exe47⤵
- Executes dropped EXE
PID:2032 -
\??\c:\vpvpd.exec:\vpvpd.exe48⤵
- Executes dropped EXE
PID:2280 -
\??\c:\9vddd.exec:\9vddd.exe49⤵
- Executes dropped EXE
PID:1740 -
\??\c:\1vddp.exec:\1vddp.exe50⤵
- Executes dropped EXE
PID:572 -
\??\c:\xlrfflf.exec:\xlrfflf.exe51⤵
- Executes dropped EXE
PID:1064 -
\??\c:\1xrxffl.exec:\1xrxffl.exe52⤵
- Executes dropped EXE
PID:1896 -
\??\c:\9hbntt.exec:\9hbntt.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448 -
\??\c:\nhbbtt.exec:\nhbbtt.exe54⤵
- Executes dropped EXE
PID:1156 -
\??\c:\jdpdj.exec:\jdpdj.exe55⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1rfxllr.exec:\1rfxllr.exe56⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nbnbnb.exec:\nbnbnb.exe57⤵
- Executes dropped EXE
PID:1768 -
\??\c:\7btbbh.exec:\7btbbh.exe58⤵
- Executes dropped EXE
PID:2336 -
\??\c:\vdpvj.exec:\vdpvj.exe59⤵
- Executes dropped EXE
PID:1948 -
\??\c:\pjddv.exec:\pjddv.exe60⤵
- Executes dropped EXE
PID:2100 -
\??\c:\ffrfxfr.exec:\ffrfxfr.exe61⤵
- Executes dropped EXE
PID:948 -
\??\c:\lflxlxf.exec:\lflxlxf.exe62⤵
- Executes dropped EXE
PID:2984 -
\??\c:\7bthbn.exec:\7bthbn.exe63⤵
- Executes dropped EXE
PID:2116 -
\??\c:\7hhthh.exec:\7hhthh.exe64⤵
- Executes dropped EXE
PID:884 -
\??\c:\ppdpd.exec:\ppdpd.exe65⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vvdpv.exec:\vvdpv.exe66⤵PID:708
-
\??\c:\9frlrrf.exec:\9frlrrf.exe67⤵PID:812
-
\??\c:\ttbhtt.exec:\ttbhtt.exe68⤵PID:1132
-
\??\c:\ntntnb.exec:\ntntnb.exe69⤵PID:1732
-
\??\c:\vjvdv.exec:\vjvdv.exe70⤵PID:1056
-
\??\c:\pppdj.exec:\pppdj.exe71⤵PID:2928
-
\??\c:\5lxxfll.exec:\5lxxfll.exe72⤵PID:2248
-
\??\c:\xxxfxfr.exec:\xxxfxfr.exe73⤵PID:2688
-
\??\c:\btbhbh.exec:\btbhbh.exe74⤵PID:2740
-
\??\c:\hhttbb.exec:\hhttbb.exe75⤵PID:2768
-
\??\c:\jdjpd.exec:\jdjpd.exe76⤵PID:2580
-
\??\c:\5vpdp.exec:\5vpdp.exe77⤵PID:2556
-
\??\c:\rlxfffr.exec:\rlxfffr.exe78⤵PID:2636
-
\??\c:\xllrfrl.exec:\xllrfrl.exe79⤵PID:2172
-
\??\c:\tnhhtb.exec:\tnhhtb.exe80⤵PID:3036
-
\??\c:\jdvdd.exec:\jdvdd.exe81⤵PID:1420
-
\??\c:\ppdvj.exec:\ppdvj.exe82⤵PID:1688
-
\??\c:\llxfrfr.exec:\llxfrfr.exe83⤵PID:840
-
\??\c:\lfxlxlr.exec:\lfxlxlr.exe84⤵PID:2736
-
\??\c:\nnhtth.exec:\nnhtth.exe85⤵PID:1316
-
\??\c:\nhntnt.exec:\nhntnt.exe86⤵PID:2188
-
\??\c:\ddvdv.exec:\ddvdv.exe87⤵PID:2032
-
\??\c:\rlxfllr.exec:\rlxfllr.exe88⤵PID:2828
-
\??\c:\llrfxxl.exec:\llrfxxl.exe89⤵PID:3012
-
\??\c:\7httnn.exec:\7httnn.exe90⤵PID:2268
-
\??\c:\5nhtbn.exec:\5nhtbn.exe91⤵PID:2440
-
\??\c:\9xlxfrf.exec:\9xlxfrf.exe92⤵PID:1552
-
\??\c:\7xrxxfr.exec:\7xrxxfr.exe93⤵PID:532
-
\??\c:\hbnhtn.exec:\hbnhtn.exe94⤵PID:2368
-
\??\c:\jjvdj.exec:\jjvdj.exe95⤵PID:2160
-
\??\c:\dvvpp.exec:\dvvpp.exe96⤵PID:1976
-
\??\c:\1rfrflx.exec:\1rfrflx.exe97⤵PID:2968
-
\??\c:\frxflrx.exec:\frxflrx.exe98⤵PID:1880
-
\??\c:\nhhhtb.exec:\nhhhtb.exe99⤵PID:2120
-
\??\c:\thbbhb.exec:\thbbhb.exe100⤵PID:1804
-
\??\c:\jdvvp.exec:\jdvvp.exe101⤵PID:2460
-
\??\c:\jvddd.exec:\jvddd.exe102⤵PID:1032
-
\??\c:\xxrrxxf.exec:\xxrrxxf.exe103⤵PID:2420
-
\??\c:\tnbhtt.exec:\tnbhtt.exe104⤵PID:2988
-
\??\c:\hbhhtb.exec:\hbhhtb.exe105⤵PID:2532
-
\??\c:\pjpdj.exec:\pjpdj.exe106⤵PID:2208
-
\??\c:\pjvvp.exec:\pjvvp.exe107⤵PID:1412
-
\??\c:\rflllxf.exec:\rflllxf.exe108⤵PID:2272
-
\??\c:\tnbbbb.exec:\tnbbbb.exe109⤵PID:2480
-
\??\c:\5bbhhn.exec:\5bbhhn.exe110⤵PID:868
-
\??\c:\jvjpv.exec:\jvjpv.exe111⤵PID:2776
-
\??\c:\3fflllr.exec:\3fflllr.exe112⤵PID:2820
-
\??\c:\7rrflrx.exec:\7rrflrx.exe113⤵PID:2564
-
\??\c:\hbnnbh.exec:\hbnnbh.exe114⤵PID:1576
-
\??\c:\5hhntb.exec:\5hhntb.exe115⤵PID:2800
-
\??\c:\3dppd.exec:\3dppd.exe116⤵PID:2724
-
\??\c:\lfrflfx.exec:\lfrflfx.exe117⤵PID:2608
-
\??\c:\xrlrffr.exec:\xrlrffr.exe118⤵PID:2588
-
\??\c:\3tnthh.exec:\3tnthh.exe119⤵PID:2600
-
\??\c:\pvjjp.exec:\pvjjp.exe120⤵PID:1600
-
\??\c:\pdpjp.exec:\pdpjp.exe121⤵PID:264
-
\??\c:\xlxlrrx.exec:\xlxlrrx.exe122⤵PID:2216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-