Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/09/2024, 12:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe
-
Size
230KB
-
MD5
d36ab0bd58ada2d5fb9f6560c8d8bf30
-
SHA1
4a5bba862c57082a57dbc212d5ea77bc8052e2c3
-
SHA256
5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed
-
SHA512
7bfa5722700e4d1b02c93d19efdf9b5e7aaa8ca26c89e177fa2bf6dcfe66c5446e584087bd83ae7b5349c7af8d047b702a34dd4a8a5c7fff734529825cbb6d9b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/c1f7:n3C9BRo7MlrWKo+lxKk1f7
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2504-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/280-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1228-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/748-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2032 pjvpj.exe 2880 rlxxflx.exe 2744 dvpvj.exe 2756 pjvvj.exe 2764 9rrflrf.exe 2856 tnbbnh.exe 2776 rfrrrxf.exe 2680 rlxflrx.exe 280 thnntt.exe 1228 7vvdd.exe 2780 fxrxxfx.exe 1744 ttnthn.exe 1948 nhbntt.exe 2884 ddvvj.exe 276 xrfrlxf.exe 2280 9xxxffr.exe 2276 bbnthn.exe 2424 dvjjv.exe 2956 xrfrrrx.exe 2148 tntbtb.exe 1616 5dvjv.exe 1800 jdpvj.exe 2492 fxxxllx.exe 696 hthbbh.exe 2940 1pddv.exe 2092 lfrrrxl.exe 748 btnttt.exe 1032 bttbnt.exe 904 1vpdp.exe 2076 tnhhnn.exe 2876 ddjdp.exe 2916 pdppj.exe 2100 7frrrxf.exe 2792 nnhntb.exe 2744 7ttbnh.exe 2736 jdjpv.exe 2852 lxllrxf.exe 2764 7xrxxxl.exe 2768 7btthh.exe 2856 htbbnn.exe 2772 vpdvj.exe 2232 rlffxxf.exe 1372 5xfflrx.exe 1972 hbtbnh.exe 636 bbtbhh.exe 1912 1dpvv.exe 2328 5jvjd.exe 1108 lfrrllr.exe 3052 nhbbnb.exe 2884 1bnhnn.exe 1996 dpjjv.exe 1752 jddvj.exe 2216 lfxxxxf.exe 532 btnttb.exe 864 nhtbnn.exe 2304 pdjdv.exe 236 3llllrx.exe 1640 9lxflrr.exe 2084 fxxfrxf.exe 1352 5nhntt.exe 1844 dvjjp.exe 1020 ffxlffr.exe 1760 9xlrxfl.exe 1484 nhhthh.exe -
resource yara_rule behavioral1/memory/2504-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1228-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/748-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2032 2504 5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe 30 PID 2504 wrote to memory of 2032 2504 5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe 30 PID 2504 wrote to memory of 2032 2504 5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe 30 PID 2504 wrote to memory of 2032 2504 5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe 30 PID 2032 wrote to memory of 2880 2032 pjvpj.exe 31 PID 2032 wrote to memory of 2880 2032 pjvpj.exe 31 PID 2032 wrote to memory of 2880 2032 pjvpj.exe 31 PID 2032 wrote to memory of 2880 2032 pjvpj.exe 31 PID 2880 wrote to memory of 2744 2880 rlxxflx.exe 32 PID 2880 wrote to memory of 2744 2880 rlxxflx.exe 32 PID 2880 wrote to memory of 2744 2880 rlxxflx.exe 32 PID 2880 wrote to memory of 2744 2880 rlxxflx.exe 32 PID 2744 wrote to memory of 2756 2744 dvpvj.exe 33 PID 2744 wrote to memory of 2756 2744 dvpvj.exe 33 PID 2744 wrote to memory of 2756 2744 dvpvj.exe 33 PID 2744 wrote to memory of 2756 2744 dvpvj.exe 33 PID 2756 wrote to memory of 2764 2756 pjvvj.exe 34 PID 2756 wrote to memory of 2764 2756 pjvvj.exe 34 PID 2756 wrote to memory of 2764 2756 pjvvj.exe 34 PID 2756 wrote to memory of 2764 2756 pjvvj.exe 34 PID 2764 wrote to memory of 2856 2764 9rrflrf.exe 35 PID 2764 wrote to memory of 2856 2764 9rrflrf.exe 35 PID 2764 wrote to memory of 2856 2764 9rrflrf.exe 35 PID 2764 wrote to memory of 2856 2764 9rrflrf.exe 35 PID 2856 wrote to memory of 2776 2856 tnbbnh.exe 36 PID 2856 wrote to memory of 2776 2856 tnbbnh.exe 36 PID 2856 wrote to memory of 2776 2856 tnbbnh.exe 36 PID 2856 wrote to memory of 2776 2856 tnbbnh.exe 36 PID 2776 wrote to memory of 2680 2776 rfrrrxf.exe 37 PID 2776 wrote to memory of 2680 2776 rfrrrxf.exe 37 PID 2776 wrote to memory of 2680 2776 rfrrrxf.exe 37 PID 2776 wrote to memory of 2680 2776 rfrrrxf.exe 37 PID 2680 wrote to memory of 280 2680 rlxflrx.exe 38 PID 2680 wrote to memory of 280 2680 rlxflrx.exe 38 PID 2680 wrote to memory of 280 2680 rlxflrx.exe 38 PID 2680 wrote to memory of 280 2680 rlxflrx.exe 38 PID 280 wrote to memory of 1228 280 thnntt.exe 39 PID 280 wrote to memory of 1228 280 thnntt.exe 39 PID 280 wrote to memory of 1228 280 thnntt.exe 39 PID 280 wrote to memory of 1228 280 thnntt.exe 39 PID 1228 wrote to memory of 2780 1228 7vvdd.exe 40 PID 1228 wrote to memory of 2780 1228 7vvdd.exe 40 PID 1228 wrote to memory of 2780 1228 7vvdd.exe 40 PID 1228 wrote to memory of 2780 1228 7vvdd.exe 40 PID 2780 wrote to memory of 1744 2780 fxrxxfx.exe 41 PID 2780 wrote to memory of 1744 2780 fxrxxfx.exe 41 PID 2780 wrote to memory of 1744 2780 fxrxxfx.exe 41 PID 2780 wrote to memory of 1744 2780 fxrxxfx.exe 41 PID 1744 wrote to memory of 1948 1744 ttnthn.exe 42 PID 1744 wrote to memory of 1948 1744 ttnthn.exe 42 PID 1744 wrote to memory of 1948 1744 ttnthn.exe 42 PID 1744 wrote to memory of 1948 1744 ttnthn.exe 42 PID 1948 wrote to memory of 2884 1948 nhbntt.exe 43 PID 1948 wrote to memory of 2884 1948 nhbntt.exe 43 PID 1948 wrote to memory of 2884 1948 nhbntt.exe 43 PID 1948 wrote to memory of 2884 1948 nhbntt.exe 43 PID 2884 wrote to memory of 276 2884 ddvvj.exe 44 PID 2884 wrote to memory of 276 2884 ddvvj.exe 44 PID 2884 wrote to memory of 276 2884 ddvvj.exe 44 PID 2884 wrote to memory of 276 2884 ddvvj.exe 44 PID 276 wrote to memory of 2280 276 xrfrlxf.exe 45 PID 276 wrote to memory of 2280 276 xrfrlxf.exe 45 PID 276 wrote to memory of 2280 276 xrfrlxf.exe 45 PID 276 wrote to memory of 2280 276 xrfrlxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe"C:\Users\Admin\AppData\Local\Temp\5f21ac1f06ad83af166db002e2c7a8cd0bd3473f996599ee20c081f8a781a1ed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\pjvpj.exec:\pjvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\rlxxflx.exec:\rlxxflx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\dvpvj.exec:\dvpvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\pjvvj.exec:\pjvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\9rrflrf.exec:\9rrflrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\tnbbnh.exec:\tnbbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\rfrrrxf.exec:\rfrrrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\rlxflrx.exec:\rlxflrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\thnntt.exec:\thnntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:280 -
\??\c:\7vvdd.exec:\7vvdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\fxrxxfx.exec:\fxrxxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\ttnthn.exec:\ttnthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\nhbntt.exec:\nhbntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\ddvvj.exec:\ddvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\xrfrlxf.exec:\xrfrlxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\9xxxffr.exec:\9xxxffr.exe17⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bbnthn.exec:\bbnthn.exe18⤵
- Executes dropped EXE
PID:2276 -
\??\c:\dvjjv.exec:\dvjjv.exe19⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xrfrrrx.exec:\xrfrrrx.exe20⤵
- Executes dropped EXE
PID:2956 -
\??\c:\tntbtb.exec:\tntbtb.exe21⤵
- Executes dropped EXE
PID:2148 -
\??\c:\5dvjv.exec:\5dvjv.exe22⤵
- Executes dropped EXE
PID:1616 -
\??\c:\jdpvj.exec:\jdpvj.exe23⤵
- Executes dropped EXE
PID:1800 -
\??\c:\fxxxllx.exec:\fxxxllx.exe24⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hthbbh.exec:\hthbbh.exe25⤵
- Executes dropped EXE
PID:696 -
\??\c:\1pddv.exec:\1pddv.exe26⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lfrrrxl.exec:\lfrrrxl.exe27⤵
- Executes dropped EXE
PID:2092 -
\??\c:\btnttt.exec:\btnttt.exe28⤵
- Executes dropped EXE
PID:748 -
\??\c:\bttbnt.exec:\bttbnt.exe29⤵
- Executes dropped EXE
PID:1032 -
\??\c:\1vpdp.exec:\1vpdp.exe30⤵
- Executes dropped EXE
PID:904 -
\??\c:\tnhhnn.exec:\tnhhnn.exe31⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ddjdp.exec:\ddjdp.exe32⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pdppj.exec:\pdppj.exe33⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7frrrxf.exec:\7frrrxf.exe34⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nnhntb.exec:\nnhntb.exe35⤵
- Executes dropped EXE
PID:2792 -
\??\c:\7ttbnh.exec:\7ttbnh.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jdjpv.exec:\jdjpv.exe37⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lxllrxf.exec:\lxllrxf.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\7xrxxxl.exec:\7xrxxxl.exe39⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7btthh.exec:\7btthh.exe40⤵
- Executes dropped EXE
PID:2768 -
\??\c:\htbbnn.exec:\htbbnn.exe41⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vpdvj.exec:\vpdvj.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rlffxxf.exec:\rlffxxf.exe43⤵
- Executes dropped EXE
PID:2232 -
\??\c:\5xfflrx.exec:\5xfflrx.exe44⤵
- Executes dropped EXE
PID:1372 -
\??\c:\hbtbnh.exec:\hbtbnh.exe45⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bbtbhh.exec:\bbtbhh.exe46⤵
- Executes dropped EXE
PID:636 -
\??\c:\1dpvv.exec:\1dpvv.exe47⤵
- Executes dropped EXE
PID:1912 -
\??\c:\5jvjd.exec:\5jvjd.exe48⤵
- Executes dropped EXE
PID:2328 -
\??\c:\lfrrllr.exec:\lfrrllr.exe49⤵
- Executes dropped EXE
PID:1108 -
\??\c:\nhbbnb.exec:\nhbbnb.exe50⤵
- Executes dropped EXE
PID:3052 -
\??\c:\1bnhnn.exec:\1bnhnn.exe51⤵
- Executes dropped EXE
PID:2884 -
\??\c:\dpjjv.exec:\dpjjv.exe52⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jddvj.exec:\jddvj.exe53⤵
- Executes dropped EXE
PID:1752 -
\??\c:\lfxxxxf.exec:\lfxxxxf.exe54⤵
- Executes dropped EXE
PID:2216 -
\??\c:\btnttb.exec:\btnttb.exe55⤵
- Executes dropped EXE
PID:532 -
\??\c:\nhtbnn.exec:\nhtbnn.exe56⤵
- Executes dropped EXE
PID:864 -
\??\c:\pdjdv.exec:\pdjdv.exe57⤵
- Executes dropped EXE
PID:2304 -
\??\c:\3llllrx.exec:\3llllrx.exe58⤵
- Executes dropped EXE
PID:236 -
\??\c:\9lxflrr.exec:\9lxflrr.exe59⤵
- Executes dropped EXE
PID:1640 -
\??\c:\fxxfrxf.exec:\fxxfrxf.exe60⤵
- Executes dropped EXE
PID:2084 -
\??\c:\5nhntt.exec:\5nhntt.exe61⤵
- Executes dropped EXE
PID:1352 -
\??\c:\dvjjp.exec:\dvjjp.exe62⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ffxlffr.exec:\ffxlffr.exe63⤵
- Executes dropped EXE
PID:1020 -
\??\c:\9xlrxfl.exec:\9xlrxfl.exe64⤵
- Executes dropped EXE
PID:1760 -
\??\c:\nhhthh.exec:\nhhthh.exe65⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nbtthn.exec:\nbtthn.exe66⤵PID:1960
-
\??\c:\dpvjp.exec:\dpvjp.exe67⤵PID:2500
-
\??\c:\jdjjj.exec:\jdjjj.exe68⤵PID:3036
-
\??\c:\xxlllrx.exec:\xxlllrx.exe69⤵PID:1732
-
\??\c:\lxffxxl.exec:\lxffxxl.exe70⤵PID:1348
-
\??\c:\btnbnh.exec:\btnbnh.exe71⤵PID:1596
-
\??\c:\djvdp.exec:\djvdp.exe72⤵PID:2876
-
\??\c:\jjjvd.exec:\jjjvd.exe73⤵PID:2428
-
\??\c:\xrrlllr.exec:\xrrlllr.exe74⤵PID:2000
-
\??\c:\1bttbt.exec:\1bttbt.exe75⤵PID:2812
-
\??\c:\hnbhtt.exec:\hnbhtt.exe76⤵PID:2804
-
\??\c:\3vjjj.exec:\3vjjj.exe77⤵PID:2756
-
\??\c:\7jdvd.exec:\7jdvd.exe78⤵PID:2760
-
\??\c:\lfrfllr.exec:\lfrfllr.exe79⤵PID:1988
-
\??\c:\rrflrrf.exec:\rrflrrf.exe80⤵PID:2612
-
\??\c:\nhnnnn.exec:\nhnnnn.exe81⤵PID:3000
-
\??\c:\tnnhhh.exec:\tnnhhh.exe82⤵PID:1772
-
\??\c:\7vpdd.exec:\7vpdd.exe83⤵PID:2496
-
\??\c:\5xrxrlx.exec:\5xrxrlx.exe84⤵PID:1220
-
\??\c:\5lxrxxx.exec:\5lxrxxx.exe85⤵PID:2432
-
\??\c:\tntttn.exec:\tntttn.exe86⤵PID:1228
-
\??\c:\7hbhnn.exec:\7hbhnn.exe87⤵PID:1252
-
\??\c:\vdppp.exec:\vdppp.exe88⤵
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\jvjjj.exec:\jvjjj.exe89⤵PID:1316
-
\??\c:\5rrllfr.exec:\5rrllfr.exe90⤵PID:2640
-
\??\c:\rlllrlr.exec:\rlllrlr.exe91⤵PID:1036
-
\??\c:\3nhbtt.exec:\3nhbtt.exe92⤵PID:2004
-
\??\c:\5hbhnn.exec:\5hbhnn.exe93⤵PID:2152
-
\??\c:\vjvvd.exec:\vjvvd.exe94⤵PID:2420
-
\??\c:\jdddp.exec:\jdddp.exe95⤵PID:2132
-
\??\c:\frrlrlf.exec:\frrlrlf.exe96⤵PID:940
-
\??\c:\5flrrxf.exec:\5flrrxf.exe97⤵PID:2564
-
\??\c:\tntbhh.exec:\tntbhh.exe98⤵PID:2464
-
\??\c:\bhnbbb.exec:\bhnbbb.exe99⤵PID:2016
-
\??\c:\dvdjv.exec:\dvdjv.exe100⤵PID:1852
-
\??\c:\flrrlff.exec:\flrrlff.exe101⤵PID:1528
-
\??\c:\lxffrxf.exec:\lxffrxf.exe102⤵PID:480
-
\??\c:\nhnthh.exec:\nhnthh.exe103⤵PID:2480
-
\??\c:\thnntb.exec:\thnntb.exe104⤵PID:2376
-
\??\c:\pdjdd.exec:\pdjdd.exe105⤵PID:1776
-
\??\c:\frrlrll.exec:\frrlrll.exe106⤵PID:2972
-
\??\c:\rrxlrrx.exec:\rrxlrrx.exe107⤵PID:3064
-
\??\c:\bthbnn.exec:\bthbnn.exe108⤵PID:2532
-
\??\c:\bnhnnn.exec:\bnhnnn.exe109⤵PID:2336
-
\??\c:\vpppj.exec:\vpppj.exe110⤵PID:1708
-
\??\c:\1lllllr.exec:\1lllllr.exe111⤵PID:808
-
\??\c:\xlrlrlr.exec:\xlrlrlr.exe112⤵PID:2180
-
\??\c:\5bhhhb.exec:\5bhhhb.exe113⤵PID:2808
-
\??\c:\bhhhbb.exec:\bhhhbb.exe114⤵PID:2100
-
\??\c:\jvdjp.exec:\jvdjp.exe115⤵PID:2944
-
\??\c:\7pvjj.exec:\7pvjj.exe116⤵PID:2744
-
\??\c:\9frfrrx.exec:\9frfrrx.exe117⤵PID:2900
-
\??\c:\rfllfxf.exec:\rfllfxf.exe118⤵PID:2764
-
\??\c:\thnttb.exec:\thnttb.exe119⤵PID:2768
-
\??\c:\bnbtbb.exec:\bnbtbb.exe120⤵PID:2828
-
\??\c:\pppvd.exec:\pppvd.exe121⤵PID:2128
-
\??\c:\vvjdd.exec:\vvjdd.exe122⤵PID:2772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-